From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 355B5C016E for ; Sun, 28 Jun 2020 16:42:34 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 24A2185B0D for ; Sun, 28 Jun 2020 16:42:34 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 09dHmLLIe7yg for ; Sun, 28 Jun 2020 16:42:33 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from newmail.dtrt.org (li1228-87.members.linode.com [45.79.129.87]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 4604385913 for ; Sun, 28 Jun 2020 16:42:32 +0000 (UTC) Received: from harding by newmail.dtrt.org with local (Exim 4.92) (envelope-from ) id 1jpaNz-0002tk-3G; Sun, 28 Jun 2020 12:42:31 -0400 Date: Sun, 28 Jun 2020 12:41:32 -0400 From: "David A. Harding" To: Stanga , Bitcoin Protocol Discussion Message-ID: <20200628164132.mmpimgcrxpai2gnb@ganymede> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="n55ktn3ibnwjlido" Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20180716 Cc: Matan Yehieli , Itay Tsabary Subject: Re: [bitcoin-dev] MAD-HTLC X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jun 2020 16:42:34 -0000 --n55ktn3ibnwjlido Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Jun 23, 2020 at 03:47:56PM +0300, Stanga via bitcoin-dev wrote: > On Tue, Jun 23, 2020 at 12:48 PM ZmnSCPxj wrote: > > * Inputs: > > * Bob 1 BTC - HTLC amount > > * Bob 1 BTC - Bob fidelity bond > > > > * Cases: > > * Alice reveals hashlock at any time: > > * 1 BTC goes to Alice > > * 1 BTC goes to Bob (fidelity bond refund) > > * Bob reveals bob-hashlock after time L: > > * 2 BTC goes to Bob (HTLC refund + fidelity bond refund) > > * Bob cheated, anybody reveals both hashlock and bob-hashlock: > > * 2 BTC goes to miner > > > > [...] >=20 > The cases you present are exactly how MAD-HTLC works. It comprises two > contracts (UTXOs): > * Deposit (holding the intended HTLC tokens), with three redeem paths: > - Alice (signature), with preimage "A", no timeout > - Bob (signature), with preimage "B", timeout T > - Any entity (miner), with both preimages "A" and "B", no timeout > * Collateral (the fidelity bond, doesn't have to be of the same amount) > - Bob (signature), no preimage, timeout T > - Any entity (miner), with both preimages "A" and "B", timeout T I'm not these are safe if your counterparty is a miner. Imagine Bob offers Alice a MAD-HTLC. Alice knows the payment preimage ("preimage A"). Bob knows the bond preimage ("preimage B") and he's the one making the payment and offering the bond. After receiving the HTLC, Alice takes no action on it, so the timelock expires. Bob publicly broadcasts the refund transaction with the bond preimage. Unbeknownst to Bob, Alice is actually a miner and she uses her pre-existing knowledge of the payment preimage plus her received knowledge of the bond preimage to privately attempt mining a transaction that pays her both the payment ("deposit") and the bond ("collateral"). Assuming Alice is a non-majority miner, she isn't guaranteed to succeed---her chance of success depends on her percentage of the network hashrate and how much fee Bob paid to incentivize other miners to confirm his refund transaction quickly. However, as long as Alice has a non-trivial amount of hashrate, she will succeed some percentage of the time in executing this type of attack. Any of her theft attempts that fail will leave no public trace, perhaps lulling users into a false sense of security. -Dave --n55ktn3ibnwjlido Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEgxUkqkMp0LnoXjCr2dtBqWwiadMFAl74yDwACgkQ2dtBqWwi adN8cRAAo+nHBLGlEW3oXZt7RN1VquM+e626brF4XLxFZyJyaSn7FHDY18HMPI2a 3LCTLeCXB/VEc3dtWZJBeJndIOg1UgEWPtbJqXsuw6e7j6XOzlOQSdNHOhncLf+V pbwT/6wP0ACNF/RwBLpXuug05XUKQm2kxqU3CHHCTq/0DVCy3ROU5nqkBLL9iFf9 tpz6yk3xlh/cThnz9qU7J3ACaRGbGr32bso/Pz1EuggZ35S5cAR4q7yFmyVg3y+D C+iZPYWL+iyNDi8ZAe4cwJoRkzOT6J/5XuDUsmJuWJEo+7uD8vRHxHq3OQZWt//L Wq7hGlBEw6O0Y10FaFvSD9fc9exyr2G7iqUQ+4ZOl0SUw3FltcZ3+I9ZKZaUpBtY nG7WKbEKo2p+QnIMrSTbUAOa32SR7eX1NIwGbjPjWwBPsBI2yXligmtVyBaywK5u 6FSBeaysSql9e14AKzfFUn5OhEz2lzf5ysM9aBvMoYWM7Zpp6vhQKNgSD4KaXZ1o axxxXn/Wqd/8GNMeCqo2arHtTpe99RLpQWF/6t4021XIO8eby2qdEdPq/72aP/CA vwMQAqtNq5zMlx/EOGdrQFLjYh7SGPDtZkBQewyjp10y1gyCQ0jzGBEKfQUKt06H Eop14xzVdh5oo95H5a1qUF3K1G7BT44Ypt95jOKwZitBk4cXeQ4= =7MjD -----END PGP SIGNATURE----- --n55ktn3ibnwjlido--