> "fully" punitive channels also make large value channels more dangerous from the perspective of bugs causing old states to be published

Wouldn't it be ideal to have the penalty be to pay for a single extra transaction fee? That way there is a penalty so cheating attempts aren't free (for someone who wants to close a channel anyway) and yet a single fee isn't going to be much of a concern in the accidental publishing case. It still perplexes me why eltoo chose no penalty at all vs a small penalty like that.

On Fri, Feb 18, 2022, 19:46 Greg Sanders via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
> One point of discomfort I have with Eltoo that I think is not universal, but is shared by some others, is that non-punitive channels may not be good for high-value channels as you do want, especially in a congested blockspace world, punishments to incentivize correct behavior (otherwise cheating may look like a free option).

Without derailing the conversation too far, "fully" punitive channels also make large value channels more dangerous from the perspective of bugs causing old states to be published. High value channels you'll need to have very high uptime. If you're available, your counterparty is incentivized to do a mutual close to reduce fees and remove timelocks on outputs. I think these tradeoffs will result in both types existing for N==2.

On Sat, Feb 19, 2022 at 8:56 AM Jeremy Rubin via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
This is a fascinating post and I'm still chewing on it.

Chiming in with two points:

Point 1, note with respect to evictions, revivals, CTV, TLUV:

CTV enables 1 person to be evicted in O(log N) or one person to leave in O(log N). TLUV enables 1 person to leave in O(1) O(log N) transactions, but evictions take (AFAICT?) O(N) O(log N) transactions because the un-live party stays in the pool. Hence OP_EVICT helps also make it so you can kick someone out, rather than all having to leave, which is an improvement.

CTV rejoins work as follows:

suppose you have a pool with 1 failure, you need to do log N txns to evict the failure, which creates R * log_R(N) outputs, which can then do a transaction to rejoin.

For example, suppose I had 64 people in a radix 4 tree. you'd have at the top level 4 groups of 16, then 4 groups of 4 people, and then 1 to 4 txns. Kicking 1 person out would make you do 3 txns, and create 12 outputs total. A transaction spending the 11 outputs that are live would capture 63 people back into the tree, and with CISA would not be terribly expensive. To be a bit more economical, you might prefer to just join the 3 outputs with 16 people in it, and yield 48 people in one pool. Alternatively, you can lazily re-join if fees make it worth it/piggybacking another transaction, or operate independently or try to find new, better, peers.

Overall this is the type of application that necessitates *exact* byte counting. Oftentimes things with CTV seem inefficient, but when you crunch the numbers it turns out not to be so terrible. OP_EVICT seems promising in this regard compared to TLUV or accumulators.

Another option is to randomize the CTV trees with multiple outputs per party (radix Q), then you need to do Q times the evictions, but you end up with sub-pools that contain more people/fractional liquidity (this might happen naturally if CTV Pools have channels in them, so it's good to model).


Point 2, on Eltoo:

One point of discomfort I have with Eltoo that I think is not universal, but is shared by some others, is that non-punitive channels may not be good for high-value channels as you do want, especially in a congested blockspace world, punishments to incentivize correct behavior (otherwise cheating may look like a free option).

Thus I'm reluctant to fully embrace designs which do not permit nested traditional punitive channels in favor of Eltoo, when Eltoo might not have product-market-fit for higher valued channels.

If someone had a punitive-eltoo variant that would ameliorate this concern almost entirely.

Cheers,

Jeremy




On Fri, Feb 18, 2022 at 3:40 PM ZmnSCPxj via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
Good morning ariard,


> > A statechain is really just a CoinPool hosted inside a
> >  Decker-Wattenhofer or Decker-Russell-Osuntokun construction.
>
> Note, to the best of my knowledge, how to use LN-Penalty in the context of multi-party construction is still an unsolved issue. If an invalidated state is published on-chain, how do you guarantee that the punished output value is distributed "fairly" among the "honest" set of users ? At least
> where fairness is defined as a reasonable proportion of the balances they owned in the latest state.

LN-Penalty I believe is what I call Poon-Dryja?

Both Decker-Wattenhofer (has no common colloquial name) and Decker-Russell-Osuntokun ("eltoo") are safe with N > 2.
The former has bad locktime tradeoffs in the unilateral close case, and the latter requires `SIGHASH_NOINPUT`/`SIGHASH_ANYPREVOUT`.


> > In principle, a set of promised outputs, if the owners of those
> > outputs are peers, does not have *any* inherent order.
> > Thus, I started to think about a commitment scheme that does not
> > impose any ordering during commitment.
>
> I think we should dissociate a) *outputs publication ordering* from the b) *spends paths ordering* itself. Even if to each spend path a output publication is attached, the ordering constraint might not present the same complexity.
>
> Under this distinction, are you sure that TLUV imposes an ordering on the output publication ?

Yes, because TLUV is based on tapleaf revelation.
Each participant gets its own unique tapleaf that lets that participant get evicted.

In Taproot, the recommendation is to sort the hashes of each tapleaf before arranging them into a MAST that the Taproot address then commits to.
This sort-by-hash *is* the arbitrary ordering I refer to when I say that TLUV imposes an arbitrary ordering.
(actually the only requirement is that pairs of scripts are sorted-by-hash, but it is just easier to sort the whole array by hash.)

To reveal a single participant in a TLUV-based CoinPool, you need to reveal O(log N) hashes.
It is the O(log N) space consumption I want to avoid with `OP_EVICT`, and I believe the reason for that O(log N) revelation is due precisely to the arbitrary but necessary ordering.

> > With `OP_TLUV`, however, it is possible to create an "N-of-N With
> > Eviction" construction.
> > When a participant in the N-of-N is offline, but the remaining
> > participants want to advance the state of the construction, they
> > instead evict the offline participant, creating a smaller N-of-N
> > where *all* participants are online, and continue operating.
>
> I think we should dissociate two types of pool spends : a) eviction by the pool unanimity in case of irresponsive participants and b) unilateral withdrawal by a participant because of the liquidity allocation policy. I think the distinction is worthy, as the pool participant should be stable and the eviction not abused.
>
> I'm not sure if TLUV enables b), at least without transforming the unilateral withdrawal into an eviction. To ensure the TLUV operation is correct  (spent leaf is removed, withdrawing participant point removed, etc), the script content must be inspected by *all* the participant. However, I believe
> knowledge of this content effectively allows you to play it out against the pool at any time ? It's likely solvable at the price of a CHECKSIG.

Indeed, that distinction is important.
`OP_TLUV` (and `OP_EVICT`, which is just a redesigned `OP_TLUV`) supports (a) but not (b).

> `OP_EVICT`
> ----------
>
> >  * If it is `1` that simply means "use the Taproot internal
> >    pubkey", as is usual for `OP_CHECKSIG`.
>
> IIUC, this assumes the deployment of BIP118, where if the  public key is a single byte 0x01, the internal pubkey is used
> for verification.

I thought it was part of Taproot?

>
> >  * Output indices must not be duplicated, and indicated
> >    outputs must be SegWit v1 ("Taproot") outputs.
>
> I think public key duplication must not be verified. If a duplicated public key is present, the point is subtracted twice from the internal pubkey and therefore the aggregated
> key remains unknown ? So it sounds to me safe against replay attacks.

Ah, right.

> >  * The public key is the input point (i.e. stack top)
> >    **MINUS** all the public keys of the indicated outputs.
>
> Can you prevent eviction abuse where one counterparty threatens to evict everyone as all the output signatures are known among participants and free to sum ? (at least not considering fees)

No, I considered onchain fees as the only mechanism to avoid eviction abuse.
The individual-evict signatures commit to fixed quantities.
The remaining change is then the only fund that can pay for onchain fees, so a single party evicting everyone else has to pay for the eviction of everyone else.


> > Suppose however that B is offline.
> > Then A, C, and D then decide to evict B.
> > To do so, they create a transaction that has an output
> > with "B := 6", and they reveal the `OP_EVICT` Tapscript
> > as well as sign(b, "B := 6").
> > This lets them change state and spend their funds without
> > B being online.
> > And B remains secure, as they cannot evict B except using
> > the pre-signed output, which B certifies as their expected
> > promised output.
>
> I think in the context of (off-chain) payment pool, OP_EVICT requires participant cooperation *after* the state update to allow a single participant to withdraw her funds.

How so?

A single participant withdrawing their funds unilaterally can do so by evicting everyone else (and paying for those evictions, as sort of a "nuisance fee").
The signatures for each per-participant-eviction can be exchanged before the signature exchange for the Decker-Wattenhofer or Decker-Russell-Osuntokun.


> > The combined fund cannot be spent except if all participants
> > agree.
>
> If all participants agree minus the evicted ones, correct ? The output promises signatures are shared at state setup, therefore no additional contribution from the evicted participant (I think).

Yes.

>
> > To prevent signature replay, each update of an updateable
> > scheme like CoinPool et al should use a different pubkey
> > for each participant for each state.
>
> I'm not even sure if it's required with OP_EVICT, as the publication of the promised output are ultimately restrained by a signature of the updated internal pubkey, this set of signers verify that promised output N does bind to the published state N ?

If the internal pubkey is reused (for example, if all participants are online and want to change state cooperatively) then the component keys need to be re-tweaked each time.

The tweaking can be done with non-hardened derivation.


> > Its advantage is reduced number of eviction transactions,
> > as multiple evictions, plus the revival of the CoinPool,
> > can be put in a single transaction.
> > It has the disadvantage relative to `OP_TLUV` of requiring
> > point operations.
> > I have not explored completely, but my instinct suggests
> > that `OP_TLUV` use may require at least one signature
> > validation anyway.
>
> I believe you can slightly modify TLUV to make it functional for CoinPool revival, where you want to prevent equivocation among the remaining set of signers. Though, I'm leaning to agree that you may require at least one signature validation  (first to restrain spend authorization inside the pool participants, second to attach fees at broadcast-time).

Yes, TLUV does have that advantage relative to CTV, and `OP_EVICT` is "just" a redesigned `OP_TLUV`.

In particular, I first developed my thoughts on revivable constructs with eviction of participants here: https://lists.linuxfoundation.org/pipermail/lightning-dev/2022-February/003479.html


Regards,
ZmnSCPxj
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev