Why do we need revocation in both the offered/received HTLC outputs and HTLC timeout/success outputs?

Question

The witness script for the output in the HTLC success/timeout transaction is:

OP_IF
    # Penalty transaction
    <revocationpubkey>
OP_ELSE
    `to_self_delay`
    OP_CHECKSEQUENCEVERIFY
    OP_DROP
    <local_delayedpubkey>
OP_ENDIF
OP_CHECKSIG

Which already exists a penalty transaction. While in the offered HTLC and received HTLC outputs in the commitment transaction, we have,

# To remote node with revocation key
OP_DUP OP_HASH160 <RIPEMD160(SHA256(revocationpubkey))> OP_EQUAL
...

Why don't we put the revocation in the HTLC-Timeout/Success outputs only?

Answer 1

HTLCs have a different timeout (cltv_expiry) than the regular timeout that we use for penalty transactions (to_self_delay). That is the reason why we use a separate transaction stage (HTLC success/HTLC timeout) to allow our counterparty sufficient time to exercise their right to get the entire balance of the channel in case we broadcast the previous state of the channel.

To elaborate further, when your counterparty tells you to add a HTLC, your version of the commitment transaction will have 3 outputs:

1. Paying to your counterparty immediately
2. Paying to self, guarded by the revocation key for to_self_delay time
3. Received HTLC output like below

   # To remote node with revocation key
   OP_DUP OP_HASH160 <RIPEMD160(SHA256(revocationpubkey))> OP_EQUAL
   OP_IF
       OP_CHECKSIG
   OP_ELSE
       <remote_htlcpubkey> OP_SWAP OP_SIZE 32 OP_EQUAL
       OP_IF
           # To local node via HTLC-success transaction.
           OP_HASH160 <RIPEMD160(payment_hash)> OP_EQUALVERIFY
           2 OP_SWAP <local_htlcpubkey> 2 OP_CHECKMULTISIG
       OP_ELSE
           # To remote node after timeout.
           OP_DROP <cltv_expiry> OP_CHECKLOCKTIMEVERIFY OP_DROP
           OP_CHECKSIG
       OP_ENDIF
   OP_ENDIF
   

When you supply the HTLC pre-image to your counterparty the transaction gets resolved. However, even after successful resolution of the HTLC with your counterparty, let us say you decide to cheat them by force closing the earlier state of the commitment transaction containing the HTLC. As soon as you publish this commitment transaction, you publish the HTLC success transaction that consumes the OP_IF part inside the OP_ELSE. Since the HTLC success transaction is consuming an output that is not timelocked, you are not providing enough time for your counterparty to use their right of the revocation key which is in the received HTLC output. That is the reason there is a second stage, where your spending from the offered HTLC output to yourself is locked until to_self_delay which allows your counterparty to use the revocation secret.

Now you might wonder, why the revocation exists in the commitment transaction received HTLC output if it is provided in the HTLC success/timeout transactions. Let us take the above case to explain it. You added the HTLC and signed the commitment transaction. That HTLC was settled by you providing the pre-image to your counterparty and the commitment transaction containing that HTLC was revoked. Despite that, assume you try to broadcast the previous commitment transaction containing the HTLC and refrains from publishing the HTLC success transaction. If revocation did not exist in the commitment transaction, the counterparty might not be able to get their funds back until the cltv_expiry which might extend to hundreds of blocks (couple of days) if there are a number of hops. This is cumbersome since that HTLC was already settled (especially if there are number of previously satisfied HTLCs), and the provision of revocation in the commitment transaction allows the counterparty to settle them immediately.

The revocation part is designed so that your counterparty never suffers because of the actions you decide to take to cheat them. The presence of revocation in commitment transaction and the HTLC success/HTLC timeout transaction help protect the Lightning Network participants from frauds committed their peers.

Answer 2

TL;DR

Because it would create a nasty dependency of the CLTV deltas over the CSV delay or a reduced security for HTLCs.
Having the revocation path in the second-stage transaction allows to be able to timeout an HTLC (ie your peer cannot redeem it via pre-image anymore) while still leaving the revocation period (CSV) intact for you to be punished if you cheated.

Two-stage HTLCs

The Lightning Network protocol makes use of two-stage HTLCs.
Why: allow to use absolute timelock delta shorter than the relative timelock delta used for the fundamental security model (punishment), without degrading the security model for HTLC outputs.
How: make (basically) HTLC outputs pay to either the revocation path, the [timeout/success] transactions only broadcastable after block B, or the receiver with the preimage. Make the [timeout/success] transaction pay only after full expiration of the revocation period (no preimage path anymore here, if the receiver did not cheat they will get paid).

More about two stages HTLCs in this answer.

Why put the revocation path at both stages ?

Because the first stage expires at the end of the absolute timelock period, which is likely to be less than the revocation period.
If the revocation path was not present in the second transaction (which is actually the point of using two stages) then you would either drastically reduce the revocation period for HTLC outputs, or require using insanely high CLTV deltas.

An example

I've a channel with you, and we agreed on a to_self_delay of 144 blocks (1 day to punish the broadcast of a revoked state) and a (reckless) cltv_expiry_delta of 6 blocks.

I just attempted to make a payment through our channel. We appended an offered HTLC output to my commitment transaction and a received HTLC output to yours.
Let's say someone found funny to not take its negligible fees and instead stuck the HTLC to mess with us. After 4 blocks, we fail the HTLC, sign a new pair of commitment transactions and continue operations --I'd later learn that you actually stuck the HTLC just after gathering the preimage.

We don't create new states to our channel and the same night I suffer a power outage, my node comes offline and I don't notice it until I'm awake (5 hours later).
At the exact moment I got offline you took the absolutely irrational decision to broadcast your ancient commitment transaction in which you still have a signed received HTLC output.
Your transaction gets confirmed, and passed the 6 blocks (still 4 hours until I wake up) you can claim the output with your HTLC success transactions.

4 hours later, I wake up, put my continuously backed up node back online and notice the breach.
Before I could even have the time to feel disillusioned, disappointed and frustrated enough to throw swear words to a random internet colored alias, my node stole your coins from your commitment transaction's to_self output, claimed my to_remote output and spent your HTLC success transaction.

Without the revocation path in the second stage my coins would be lost.