1

I am surely not getting some part of this, but it seems to me that the paper and the video (both listed on the official Lightning website) contradict each other. In particular, the paper describes a simple bi-directional payment channel in Section 3 using only one timelock value (1000 blocks). In the video though they claim that in order to reverse the direction of the channel you have to use a shorter timelock (which makes indefinite number of channel updates impossible).

Are decrementing timelocks actually used in simple bi-directional channels? If so, what would go wrong if new commitment transactions were just created with the same timelock value, say, 1000 blocks?

2

The paper Towards Bitcoin Payment Networks (thanks this answer for the link) gave me a clearer understanding of the topic. Here is a very simplified summary of what I've learned.

There are multiple approaches to payment channels, including:

  1. A simple uni-directional channel (replace-by-incentive);
  2. A simple bi-directional channel (with decrementing timelocks, i.e., replace-by-timelock);
  3. Duplex micropayment channels (see also: my related question);
  4. Lightning network.

In Lightning, a single bi-directional channel is constructed using a breach remedy transactions (BRT), the idea being: before updating the channel state, both parties commit that if they broadcast an earlier state, the counterparty will be able to claim all funds. This is achieved with relative timelocks.

Furthermore, Lightning channels are connected into a network, where payments can be routed through non-custodial parties. This construction is based on hash time locked contracts (HTLC). The receiver generates a random value R, sends H(R) to the sender, and the sender specifies in the output script that R is requires to claim it. After the transaction propagates through nodes, the ultimate receiver discloses R and claims their funds; knowledge of R, in turn, allows all parties along the route to claim their funds from the previous node. In order to give each party time to do so, decrementing absolute timelocks are used.

Summary: the Lightning network does not use decrementing timelocks in a single channel, but uses them in multi-hop channel networks.

  • By relativer timelock you mean that if a party broadcasts exit transaction (one-party exits) it must wait some preagreed time to use funds? And this is to allow other party to broadcast anticheat transaction if needed? – croraf Dec 1 '17 at 18:15
  • @croraf Exactly. – Sergei Tikhomirov Dec 1 '17 at 20:38
0

Check this question for intro into lightning: Lightning network smart contract technical explaination (unidirectional payment channel).

Say Alice puts 100 BTC into common address and sends 3 transactions to Bob. First 10 BTC, then 10 BTC then 10 BTC. This means she spends from common address with transactions of 90Alice-10Bob then 80-20 then 70-30 (assume on same day), each with 30 days nLock and with her signature.

Now Bob in 5 days wants to send Alice 10 BTC, this means he must make and send Alice a 80-20 transaction from common address with his signature on. Let's say he also puts nLock 30 days on this transaction. Meaning Alice can put her signature on this 80Alice-20Bob transaction and activate it only after 30 days.

But this means nothing to her, because Bob has hands on previous 3 transactions and can after 25 days (5 days prior to Alice) activate the 70Alice-30Bob transaction. This will cause 80Alice-20Bob transaction to be immediately invalid as the coins from common address are already spent with 70-30 transaction and cannot be respent with another transaction. Effectively Bob would steal 10 BTC from Alice.

Thus Bob's transaction should have <25 days nLock time, so Alice can on day 30 activate this 80Alice-20Bob before Bob can activate transactions in his hands.

  • I see why decrementing timelocks are required here, but the Lightning paper describes a different construction: there, if Alice wants to send 10 BTC to Bob, she first asks Bob to sign an additional transaction that would let Alice get all the money from the channel in case Bob cheats (i.e., broadcasts an older transaction trying to close the channel in the previous state). Only then they co-sign the next pair of transaction reflecting the latest state. So there seems to be two distinct constructions known under the name "payment channel"... – Sergei Tikhomirov Nov 21 '17 at 16:26
  • I think this is the same construction as in my link. There is an initial refund transaction Bob sends to Alice that she can activate in 30 days to get her funds refunded. So further transactions Alice sends to Bob should have lock time up to that date (or not to have lock time at all). – croraf Nov 21 '17 at 17:44
  • I think we use the term "redeem tx" in different meaning. What I actually meant is what they call "Breach Remedy tx" (BRT) in the paper. From what I understand, before signing new "commitment" tx's, the parties sign a new BRT each, letting the counterparty redeem all funds in case of cheating. In your example, if Bob tries to enforce an old state (80-20) on the blockchain, Alice immediately broadcasts her BRT and claims Bob's delayed UTXO of 20. Am I correct that the construction you describe in the answer doesn't have BRTs? – Sergei Tikhomirov Nov 22 '17 at 16:17
  • Yes. I've seen such a construct in an answer. That seems non-trivial. My construct is trivial to achieve and explain. chat.stackexchange.com/rooms/69126/… – croraf Nov 22 '17 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.