Re: [bitcoin-dev] V3 Transactions are still vulnerable to significant tx pinning griefing attacks

[Peter Todd <pete@petertodd.org>]

[-- Attachment #1: Type: text/plain, Size: 2679 bytes --]

On Tue, Jan 02, 2024 at 11:12:05AM +0000, Gloria Zhao wrote:
> Hi Peter,
> 
> > You make a good point that the commitment transaction also needs to be
> included
> > in my calculations. But you are incorrect about the size of them.
> 
> > With taproot and ephemeral anchors, a typical commitment transaction
> would have
> > a single-sig input (musig), two taproot outputs, and an ephemeral anchor
> > output.  Such a transaction is only 162vB, much less than 1000vB.
> 
> Note that these scenarios are much less interesting for commitment
> transactions with no HTLC outputs, so 162 isn't what I would use for the
> minimum.

<snip, replied to in another email>

> So, I apologize for not using a more accurate minimum, though I think this
> helps illustrate the 100x reduction of v3 a lot better.
> While I think the true minimum is higher, let's go ahead and use your
> number N=162vB.
> - Alice is happy to pay 162sat/vB * (162 + 152vB) = 50,868sat
> - In a v3 world, Mallory can make the cost to replace 80sat/vB * (1000vB) +
> 152 = 80,152sat
>     - Mallory succeeds, forcing Alice to pay 80,152 - 50,868 = *29,284sat*
> more
> - In a non-v3 world, Mallory can make the cost to replace 80sat/vB *
> (100,000vB) + 152 = 8,000,152sat
>     - Mallory succeeds, forcing Alice to pay 8,000,152 - 50,868 = *7,949,284sat
> *more (maxed out by the HTLC amount)
> 
> As framed above, what we've done here is quantify the severity of the
> pinning damage in the v3 and non-v3 world by calculating the additional
> fees Mallory can force Alice to pay using Rule 3. To summarize this
> discussion, at the lower end of possible commitment transaction sizes,
> pinning is possible but is restricted by 100x, as claimed.

Also, you're writeup is still missing a very important point: existing
Lightning anchor channels solved pinning by having a CHECKSIG. Only the parties
with the right to spend the anchor channel can do that, and all other outputs
are unspendable until the commitment transaction confirms.

So the question is not whether or not V3 transactions can improve pinning
compared to a hypothetical protocol with vulnerabilities. The question, for
Lightning, is how much better or worse V3 transactions would be than the status
quo. So far, they look like the difference is marginal at best, quite possibly
worse.

Now, with other protocols, maybe we could make an argument that V3 transactions
is worthwhile and for those protocols no other solution is possible. But you
have not attempted to make that argument in the documentation provided in your
pull-req(s).

-- 
https://petertodd.org 'peter'[:-1]@petertodd.org

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]