đź“… Original date posted:2020-02-26
đź“ť Original message:
In this email, myself (gleb) and ariard want to discuss some aspects of the LN implementations when it comes to massive channel closing.
LN security model relies on the unilateral capability to timely confirm on-chain commitment transaction. Currently, fee rates of both commitment transaction and HTLC-timeout/HTLC-Success are pre-committed at signatures and can be interactively updated with a `update_fee` message. In case of mempool fee rates surge and a counterparty being adversarial or irresponsive (by being offline by occasion or under attack), this mechanism isn’t reliable because a low-fee rate commitment transaction may never make it into network mempools. Switching to automatic single-party dynamic fee-bumping of *their* commitment transaction via CPFP/package relay would solve this issue, while potentially opening new attack vectors.
If dynamic fee-bumping is used by a significant fraction of LN nodes, this security measure may be exploited by a miner, a massive LN channels closing would choke the mempool, dynamic fee-bumpers would react in consequence and fee rates raise to the roof. Miners would harvest abnormal high-fees for multiple blocks.
A massive channel closing may be provoked by feeding an invalid block to light clients (in the BIP157 paradigm), as they don’t have utxo access, they can’t verify input signatures (note: the only utxo spend they can check is the funding_output and they should do so) and lead to think than their channel is closed. This may provoke a spurious broadcast of their local commitment transaction, this one being valid and propagating on the base layer. Even if an invalid block isn’t fetched, the secure strategy on what to do when your chain view is messed up by an attacker is still an open question. Note that one invalid block may be used to force-close multiple channels, making this attack more economically feasible.
Another attack building block could be to exploit any LN protocol/implementation vulnerability like a malicious HTLC-of-death which would provoke honest parties to close their mutual channel when routed through [0]
LN light clients should disable HTLC routing and avoid any aggressive fee-bumping for a broadcast of local commitment transactions as time-sensitivity doesn’t matter in this case beyond UX and funds stuck in-flight.
Bounding dynamic-fees engine may be viewed as a game-theoretic aspect between LN parties (burn the maximum in fee rate to avoid an attacker to make any profit) and macro-considerations (prevent miner to exploit the whole LN network, conservative mempool/resources usage).
Considering that most of the block reward is currently subsidized, the incentives for miners to launch this attack are questionable. However, this might change when the fraction of fees in the reward becomes higher.
As LN becomes an important part of the Bitcoin ecosystem, it’s important to acknowledge the mining-related incentives and risks, as these may at the end be used to influence protocol development.
Since the LN infrastructure seems to be moving towards the heavy use of light clients, and the attacks we mentioned are expected to appear again (at least in some of the implementations), we believe it’s important to understand the mechanics of these attacks and countermeasures.
It would be interesting to have an empirical study (based on the historical data) and a simulation of the fee spikes, with parameterized:
- how many channels are vulnerable to force-closing (based on the particular LN implementations)
- what are the properties of those channels (amount, timelocks)
- what is the distribution of those channels across nodes
- how many nodes implement dynamic bumping
- mining reward allocation
What are your opinions on these issues?
– gleb
[0] One example with this RL issue:
(https://github.com/rust-bitcoin/rust-lightning/pull/513)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20200226/d529ce9f/attachment-0001.html>;
Gleb Naumenko [ARCHIVE] /
npub1fl…94tkz
2023-06-09 12:59:06
in reply to nevent1q…q65f
Author Public Key
npub1fldyzvpmt2yx6a4tu8asjpkrrn0xy3daht37549g7yzlrm65l7dsq94tkzPublished at
2023-06-09 12:59:06Event JSON
{
"id": "e1687db0ac016b825266a2837419becada152909bdf4da8c46a23ea93bede01e",
"pubkey": "4fda41303b5a886d76abe1fb0906c31cde6245bdbae3ea54a8f105f1ef54ff9b",
"created_at": 1686315546,
"kind": 1,
"tags": [
[
"e",
"1dc729ebdcaca10db31663ae188fd4bf64d4b2b3a7ef07270b14fbb4b606233f",
"",
"reply"
],
[
"p",
"9456f7acb763eaab2e02bd8e60cf17df74f352c2ae579dce1f1dd25c95dd611c"
]
],
"content": "📅 Original date posted:2020-02-26\n📝 Original message:\nIn this email, myself (gleb) and ariard want to discuss some aspects of the LN implementations when it comes to massive channel closing.\n\nLN security model relies on the unilateral capability to timely confirm on-chain commitment transaction. Currently, fee rates of both commitment transaction and HTLC-timeout/HTLC-Success are pre-committed at signatures and can be interactively updated with a `update_fee` message. In case of mempool fee rates surge and a counterparty being adversarial or irresponsive (by being offline by occasion or under attack), this mechanism isn’t reliable because a low-fee rate commitment transaction may never make it into network mempools. Switching to automatic single-party dynamic fee-bumping of *their* commitment transaction via CPFP/package relay would solve this issue, while potentially opening new attack vectors.\n\nIf dynamic fee-bumping is used by a significant fraction of LN nodes, this security measure may be exploited by a miner, a massive LN channels closing would choke the mempool, dynamic fee-bumpers would react in consequence and fee rates raise to the roof. Miners would harvest abnormal high-fees for multiple blocks.\n\nA massive channel closing may be provoked by feeding an invalid block to light clients (in the BIP157 paradigm), as they don’t have utxo access, they can’t verify input signatures (note: the only utxo spend they can check is the funding_output and they should do so) and lead to think than their channel is closed. This may provoke a spurious broadcast of their local commitment transaction, this one being valid and propagating on the base layer. Even if an invalid block isn’t fetched, the secure strategy on what to do when your chain view is messed up by an attacker is still an open question. Note that one invalid block may be used to force-close multiple channels, making this attack more economically feasible.\n\nAnother attack building block could be to exploit any LN protocol/implementation vulnerability like a malicious HTLC-of-death which would provoke honest parties to close their mutual channel when routed through [0]\n\nLN light clients should disable HTLC routing and avoid any aggressive fee-bumping for a broadcast of local commitment transactions as time-sensitivity doesn’t matter in this case beyond UX and funds stuck in-flight.\n\nBounding dynamic-fees engine may be viewed as a game-theoretic aspect between LN parties (burn the maximum in fee rate to avoid an attacker to make any profit) and macro-considerations (prevent miner to exploit the whole LN network, conservative mempool/resources usage).\n\nConsidering that most of the block reward is currently subsidized, the incentives for miners to launch this attack are questionable. However, this might change when the fraction of fees in the reward becomes higher.\nAs LN becomes an important part of the Bitcoin ecosystem, it’s important to acknowledge the mining-related incentives and risks, as these may at the end be used to influence protocol development.\n\nSince the LN infrastructure seems to be moving towards the heavy use of light clients, and the attacks we mentioned are expected to appear again (at least in some of the implementations), we believe it’s important to understand the mechanics of these attacks and countermeasures.\n\nIt would be interesting to have an empirical study (based on the historical data) and a simulation of the fee spikes, with parameterized:\n- how many channels are vulnerable to force-closing (based on the particular LN implementations)\n- what are the properties of those channels (amount, timelocks)\n- what is the distribution of those channels across nodes\n- how many nodes implement dynamic bumping\n- mining reward allocation\n\nWhat are your opinions on these issues?\n\n– gleb\n\n\n[0] One example with this RL issue:\n(https://github.com/rust-bitcoin/rust-lightning/pull/513)\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20200226/d529ce9f/attachment-0001.html\u003e",
"sig": "8b1c53023a75038e00ac5e49901a5b3c52d0b20a9acab6efe48bf7399e30ab656acb41639d5c9ad01ae7bb72d598521f168727a1238b612ddac5c32a5d8f9a74"
}