> In the second case, I think Mallory can use an existing pinning
> technique to make it expensive for Bob to fee bump.  The normal
> replacement policies require a replacement to pay an absolute higher fee
> than the original transaction, so Mallory can create a 100,000 vbyte
> transaction with a single-vector sponsor at the end pointing to Bob's
> transaction.  This sponsor transaction pays the same feerate as Bob's
> transaction---let's say 50 nBTC/vbyte, so 5 mBTC total fee.  In order
> for Bob to replace Mallory's sponsor transaction with his own sponsor
> transaction, Bob needs to pay the incremental relay feerate (10
> nBTC/vbyte) more, so 6 mBTC total ($66 at $11k/BTC).

Yup, I was aware of this limitation but I'm not sure how practical it is as an attack because it's quite expensive for the attacker. But there are a few simple policies that can eliminate it:

1) A Sponsoring TX never needs to be more than, say, 2 inputs and 2 outputs. Restricting this via policy would help, or more flexibly limiting the total size of a sponsoring paying transaction to 1000 bytes.

2) Make A Sponsoring TX not need to pay more absolute fee, just needs to increase the feerate (perhaps with a constant relay fee bump to prevent spam).

I think 1) is simpler and should allow full use of the sponsor mechanism while preventing this class of issue mostly.

What do you think?