5

For regular on-chain payments, a txid can prove at least a transferring of value indeedly happened, at a specific time, despite that it may be totally irrelevant. For example, a malicious user can send his own money to himself, to pretend that he purchased some goods from an innocent merchant.

For LN off-chain payments, is it possible for a payer to prove to 3rd party that he had indeedly made a payment to the payee?

Improve this question

1 Answer 1

Reset to default
5

In lightning the receiver of the money comes up with a random secret and comits to it via the payment hash. Once all the hashed time lock contracts (htlcs) are set up along a path through the network from the sender to the receiver the recipient will release the secret preimage for the chain of htlcs to settle. The preimage can be seen as a proof of payment. However as with the onchain case there is some doubt. Every node along the route who participated in the payment will know the primage of the payment hash and could thus argue that they initiate the payment

Improve this answer
7
  • Should the preimage be signed by the payer/payee?
    – Chris Chen
    Commented Dec 9, 2019 at 10:10
  • 1
    the invoice which transports the payment hash is signed by the payee. The payee cannot really sign the preimage to gain something as every routing node could do that. There are currently proposals like stuckless and cancable payments as well as payment decorrelation. In that world the payer could actually proof (s)he was the the payer
    – Rene Pickhardt
    Commented Dec 9, 2019 at 10:20
  • I still doubt how could a signed invoice (which contains the payment hash) together with the preimage could prove anything. How could the 3rd party be convinced, or be able to spot fake proofs?
    – Chris Chen
    Commented Dec 9, 2019 at 10:39
  • The proof consists because we assume that the inverse of the hash function is unknown. Being able to provide the preimage is proof that the recipient was paid otherwise (s)he would not have released the secret
    – Rene Pickhardt
    Commented Dec 9, 2019 at 14:38
  • But invoices can be generated with zero cost, right? How could the 3rd party distinguish between an actually paid invoice and an never-paid invoice which is used to pretend to be a paid one?
    – Chris Chen
    Commented Dec 9, 2019 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.