2

The witness script for the output in the HTLC success/timeout transaction is:

OP_IF
    # Penalty transaction
    <revocationpubkey>
OP_ELSE
    `to_self_delay`
    OP_CHECKSEQUENCEVERIFY
    OP_DROP
    <local_delayedpubkey>
OP_ENDIF
OP_CHECKSIG

Which already exists a penalty transaction. While in the offered HTLC and received HTLC outputs in the commitment transaction, we have,

# To remote node with revocation key
OP_DUP OP_HASH160 <RIPEMD160(SHA256(revocationpubkey))> OP_EQUAL
...

Why don't we put the revocation in the HTLC-Timeout/Success outputs only?

0

HTLCs have a different timeout (cltv_expiry) than the regular timeout that we use for penalty transactions (to_self_delay). That is the reason why we use a separate transaction stage (HTLC success/HTLC timeout) to allow our counterparty sufficient time to exercise their right to get the entire balance of the channel in case we broadcast the previous state of the channel.

To elaborate further, when your counterparty tells you to add a HTLC, your version of the commitment transaction will have 3 outputs:

  1. Paying to your counterparty immediately
  2. Paying to self, guarded by the revocation key for to_self_delay time
  3. Received HTLC output like below
    # To remote node with revocation key
    OP_DUP OP_HASH160 <RIPEMD160(SHA256(revocationpubkey))> OP_EQUAL
    OP_IF
        OP_CHECKSIG
    OP_ELSE
        <remote_htlcpubkey> OP_SWAP OP_SIZE 32 OP_EQUAL
        OP_IF
            # To local node via HTLC-success transaction.
            OP_HASH160 <RIPEMD160(payment_hash)> OP_EQUALVERIFY
            2 OP_SWAP <local_htlcpubkey> 2 OP_CHECKMULTISIG
        OP_ELSE
            # To remote node after timeout.
            OP_DROP <cltv_expiry> OP_CHECKLOCKTIMEVERIFY OP_DROP
            OP_CHECKSIG
        OP_ENDIF
    OP_ENDIF
    

When you supply the HTLC pre-image to your counterparty the transaction gets resolved. However, even after successful resolution of the HTLC with your counterparty, let us say you decide to cheat them by force closing the earlier state of the commitment transaction containing the HTLC. As soon as you publish this commitment transaction, you publish the HTLC success transaction that consumes the OP_IF part inside the OP_ELSE. Since the HTLC success transaction is consuming an output that is not timelocked, you are not providing enough time for your counterparty to use their right of the revocation key which is in the received HTLC output. That is the reason there is a second stage, where your spending from the offered HTLC output to yourself is locked until to_self_delay which allows your counterparty to use the revocation secret.

Now you might wonder, why the revocation exists in the commitment transaction received HTLC output if it is provided in the HTLC success/timeout transactions. Let us take the above case to explain it. You added the HTLC and signed the commitment transaction. That HTLC was settled by you providing the pre-image to your counterparty and the commitment transaction containing that HTLC was revoked. Despite that, assume you try to broadcast the previous commitment transaction containing the HTLC and refrains from publishing the HTLC success transaction. If revocation did not exist in the commitment transaction, the counterparty might not be able to get their funds back until the cltv_expiry which might extend to hundreds of blocks (couple of days) if there are a number of hops. This is cumbersome since that HTLC was already settled (especially if there are number of previously satisfied HTLCs), and the provision of revocation in the commitment transaction allows the counterparty to settle them immediately.

The revocation part is designed so that your counterparty never suffers because of the actions you decide to take to cheat them. The presence of revocation in commitment transaction and the HTLC success/HTLC timeout transaction help protect the Lightning Network participants from frauds committed their peers.

| improve this answer | |
  • If you publish an old commitment tx with 1 received HTLC, the counterparty can enter the timeout process as specified in cltv_expiry and then collect the money via HTLC-timeout anyway? So your point is that we don't want the counterparty to wait that long if you cheat? You don't seem to have a good reason to publish this tx though pure harm may be wanted. – yyforyongyu Oct 29 '19 at 10:10
  • @yyforyongyu (1) Yes, you are correct that the counterparty can collect after the time-out process, but the local node (who is cheating) can spend it immediately using the HTLC success transaction (since it has the pre-image). (2) it is not just pure harm but you are definitely economically incentivized to publish it. You got the funds from your counterparty by providing the pre-image for the HTLC. Suppose after that you provided some funds to your counterparty for some good you bought from them. The previous state that included the HTLC is more beneficial to you so you publish that,. – Ugam Kamat Oct 29 '19 at 10:14
  • Let's say I'm the local node who is cheating. I have to spend it via a HTLC-success tx, which has a revocation inside it. Once I spend the commitment tx, I have to wait to_self_delay time before I can spend the HTLC-success tx, meanwhile, the counterparty can take the money via the revocation? – yyforyongyu Oct 29 '19 at 10:32
  • @yyforyongyu Yes. Since you can spend the commitment transaction HTLC output immediately (for HTLC success) you will not be providing any time for your counterparty to react. As a result the to_self_delay within the HTLC success output allows the counterparty to use the revocation and then spend the money. – Ugam Kamat Oct 29 '19 at 10:34
  • interesting. This goes back to the original question, if the counterparty can take the money via revocation inside the HTLC-success tx, what's the point of having a revocation inside the commitment tx? – yyforyongyu Oct 29 '19 at 10:43
0

TL;DR

Because it would create a nasty dependency of the CLTV deltas over the CSV delay or a reduced security for HTLCs.
Having the revocation path in the second-stage transaction allows to be able to timeout an HTLC (ie your peer cannot redeem it via pre-image anymore) while still leaving the revocation period (CSV) intact for you to be punished if you cheated.

Two-stage HTLCs

The Lightning Network protocol makes use of two-stage HTLCs.
Why: allow to use absolute timelock delta shorter than the relative timelock delta used for the fundamental security model (punishment), without degrading the security model for HTLC outputs.
How: make (basically) HTLC outputs pay to either the revocation path, the [timeout/success] transactions only broadcastable after block B, or the receiver with the preimage. Make the [timeout/success] transaction pay only after full expiration of the revocation period (no preimage path anymore here, if the receiver did not cheat they will get paid).

More about two stages HTLCs in this answer.

Why put the revocation path at both stages ?

Because the first stage expires at the end of the absolute timelock period, which is likely to be less than the revocation period.
If the revocation path was not present in the second transaction (which is actually the point of using two stages) then you would either drastically reduce the revocation period for HTLC outputs, or require using insanely high CLTV deltas.

An example

I've a channel with you, and we agreed on a to_self_delay of 144 blocks (1 day to punish the broadcast of a revoked state) and a (reckless) cltv_expiry_delta of 6 blocks.

I just attempted to make a payment through our channel. We appended an offered HTLC output to my commitment transaction and a received HTLC output to yours.
Let's say someone found funny to not take its negligible fees and instead stuck the HTLC to mess with us. After 4 blocks, we fail the HTLC, sign a new pair of commitment transactions and continue operations --I'll lean later on that you actually stuck the HTLC just after gathering the preimage.

We don't create new states to our channel and the same night I suffer a power outage, my node comes offline and I don't notice it until I'm awake (5 hours later).
At the exact moment I got offline you took the absolutely irrational decision to broadcast your ancient commitment transaction in which you still have a signed received HTLC output.
Your transaction gets confirmed, and passed the 6 blocks (still 4 hours until I wake up) you can claim the output with your HTLC success transactions.

4 hours later, I wake up, put my continuously backed up node back online and notice the breach.
Before I could even have the time to feel disillusioned, disappointed and frustrated enough to throw swear words to a random internet colored alias, my node can stealed your coins from your commitment transaction's to_self output, claim my to_remote output and spend your HTLC success transaction.

Without the revocation path in the second stage my coins would be lost.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.