{"type":"rich","version":"1.0","author_name":"npub17rld56k4365lfphyd8u8kwuejey5xcazdxptserx03wc4jc9g24stx9l2h","author_url":"https://nostr.ae/npub17rld56k4365lfphyd8u8kwuejey5xcazdxptserx03wc4jc9g24stx9l2h","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2021-07-12\n📝 Original message:\nHello world,\n\nSuppose you have some payments going from Alice to Bob to Carol with\neltoo channels. Bob's lightning node crashes, and he recovers from an\nold backup, and Alice and Carol end up dropping newer channel states\nonto the blockchain.\n\nSuppose the timeout for the payments is a few hours away, while the\nchannels have specified a week long CSV delay to rectify any problems\non-chain.\n\nThen I think that that means that:\n\n 1) Carol will reveal the point preimages on-chain via adaptor\n    signatures, but Bob won't be able to decode those adaptor signatures\n    because those signatures will need to change for each state\n\n 2) Even if Bob knows the point preimages, he won't be able to\n    claim the PTLC payments on-chain, for the same reason: he needs\n    newer adaptor signatures that he'll have lost with the state update\n\n 3) For any payments that timeout, Carol doesn't have any particular\n    incentive to make it easy for Bob to claim the refund, and Bob won't\n    have the adaptor signatures for the latest state to do so\n\n 4) But Alice will be able to claim refunds easily. This is working how\n    it's meant to, at least!\n\nI think you could fix (3) by giving Carol (who does have all the adaptor\nsignatures for the latest state) the ability to steal funds that are\nmeant to have been refunded, provided she gives Bob the option of claiming\nthem first.\n\nHowever fixing (1) and (2) aren't really going against Alice or Carol's\ninterests, so maybe you can just ask: Carol loses nothing by allowing\nBob to claim funds from Alice; and Alice has already indicated that\nknowing P is worth more to her than the PTLC's funds -- otherwise she\nwouldn't have forwarded the PTLC to Bob in the first place.\n\nLikewise, everyone's probably incentivised to negotiate cooperative\ncloses instead of going on-chain -- better privacy, less fees, and less\ndelay before the funds can be used elsewhere.\n\nFWIW, I think a similar flaw exists even in the original eltoo spec --\nAlice could simply decline to publish the settlement transaction until\nthe timeout has been reached, preventing Bob from revealing the HTLC\npreimage before Alice can claim the refund.\n\nSo I think that adds up to:\n\n a) Nodes should share state on reconnection; if you find a node that\n    doesn't do this, close the channel and put the node on your enemies\n    list. If you disagree on what the current state is, share your most\n    recent state, and if the other guy's state is more recent, and all\n    the signatures verify, update your state to match theirs.\n\n b) Always negotiate a mutual/cooperative close if possible, to avoid\n    actually using the eltoo protocol on-chain.\n\n c) If you want to allow continuing the channel after restoring an old\n    state from backup, set the channel state index based on the real time,\n    eg (real_time-start_time)*(max_updates_per_second). That way your\n    first update after a restore from backup will ensure that any old\n    states that your channel partner may not have told you about are\n    invalidated.\n\n d) Accept that if you lose connectivity to a channel partner, you will\n    have to pay any PTLCs that were going to them, and won't be able\n    to claim the PTLCs that were funding them. Perhaps limit the total\n    value of inbound PTLCs for forwarding that you're willing to accept\n    at any one itme?\n\nAlso, layered commitments seem like they make channel factories\ncomplicated too. Nobody came up with a way to avoid layered commitments\nwhile I wasn't watching did they?\n\nCheers,\naj"}