3

If someone breaches a Lightning channel (aka tries to spend more than he is allowed to), the other party has to intervene and prove that the coins actually belong to them. This process happens on-chain. How large would such a transaction be? Is it proportional to the number of transactions that happened while the channel was open?

Improve this question

1 Answer 1

Reset to default
2

The cost is proportional to the number of committed HTLCs on the channel at the time of closure. Each HTLC has an output in the commitment transaction which pays into either a HTLC-success transaction script or a HTLC-timeout transaction script, depending on whether the HTLC was incoming our outgoing. The commitment also usually has an output to the spender (timelocked) and a regular P2WSH output to the other party of the channel.

Due to both parties needing to agree up-front about the transaction fees involved (in order to sign matching transactions), the protocol works on an "estimated weight", which assumes worst-case sizes for signatures etc.

The estimated weights are broken down in full in BOLT#3, but the key values are

Commitment weight:   724 + 172 * num-untrimmed-htlc-outputs
HTLC-timeout weight: 663
HTLC-success weight: 703

The transaction fee is then the agreed upon feerate in satoshi/kweight * expected_weight / 1000 (rounding down).

Clearly it is undesirable to have a large number of htlcs in flight in case of unilateral closure. There is a technical limit of 453 due to the 10k script limit in Bitcoin, but ideally you will want to use a much smaller number.

With other developments like Taproot, it should be possible to bring these costs down significantly for the most likely outcomes.

Improve this answer
12
  • So the smart contracts are structured in a way, that the cheater has to pay all the transaction fees? What if the fees have singificantly risen since we both agreed on the contract?
    – Grunzwanzling
    Mar 3, 2019 at 17:31
  • The transaction fees are paid out of the channel funds, which are initially provided by the channel funder when the channel is created. On a unilateral close, the cost of the commitment transaction is above regardless of whether it was cheating or not, the only difference being that the claimant of a penalty transaction uses signature||revocation_key versus signature||payment_hash as the witness for their to_local output, and their witness for the htlc transactions is signature||1.
    – Mark H
    Mar 3, 2019 at 18:00
  • 1
    The fee is paid regardless of whether you prove him wrong or not. You will never lose all of the money in the channel, but at worst, you may lose the to_remote amount or the amounts of any timed out htlcs of the revoked commitment the cheater broadcasts if you don't issue the penalty. The fee is paid by the channel funder. The fundee has no obligation to cooperate with you except the funds on their side of the channel which they might be able to gain if they do cooperate. There is a channel_reserve for this purpose, which ensures that there is a minimum amount kept by the fundee
    – Mark H
    Mar 3, 2019 at 18:16
  • 1
    There is also a push_amount on channel open, which establishes that the fundee at least has some funds if they cooperate. There is an incentive for them to accept channels because they stand to gain from it. Also, if they don't keep enough funds on their side of the channel, their output will be truncated and they will gain nothing, unless they successfully cheat. Since the fundee cheating is always possible, the funder needs to account for the possibility and set a sufficiently low max_htcls_in_flight that they can afford to pay if the other party is uncooperative.
    – Mark H
    Mar 3, 2019 at 18:19
  • 1
    I'm not aware of what each client sets their channel_reserve to by default. It should be user configurable. The purpose of the push_msat in the channel opening is to provide the other side with some money. The won't attempt to cheat unless that have had at least some money at some point in the past (ie, there is a revoked commitment which would award them some of the channel funds). If they have never had funds, they stand to gain nothing by closing the channel anyway.
    – Mark H
    Mar 3, 2019 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.