Require to claim revoked local output in its own penalty tx post-anchor

[ariard]

If option_anchor_outputs applies, the cheating node can pin spends of its
HTLC-timeout/HTLC-success outputs thanks to SIGHASH_SINGLE malleability.
Using a single penalty transaction for all revoked outputs is thus unsafe as it
could be blocked to propagate long enough for the `local node's main output 's
relative timelock to expire and the cheating party escaping the penalty on this
output.

I think we may just make this an unconditional requirement, indifferently of anchors.

[halseth]

I think we can allow spending them all in a single tx, but perhaps recommend something like "if confirmation doesn't happen within X blocks from expiry, to_local should be swept separately as it might be pinned etc".

[t-bast]

I agree with @halseth, it's worth mentioning this potential attack (good find!) but we should be more permissive with implementers.

[Roasbeef]

IMO it's worth nothing more of the subtly here. If they're pinning, then in order to even get into the mempool, they're likely paying a relatively high fee, which means that if they do confirm, then there's the CSV period on the second level. Also the defender can mix things up themselves, by only sweeping one of the HTLC outputs, which would then invalidate the entire "tree" (possibly needing to pay high enough fees?) of the attacker.

[Roasbeef]

Perhaps this should be "should" instead? As there're other ways to defend against this, for example: sweep every output in its own transaction.

[rustyrussell]

OK, lots of good discussion at meeting about this. The spec says MAY, because if you do make one bit tx, you need to split (as HTLC txs can race you), but you also need to split because your big tx might be pinned.

It's worth noting this, for sure, but I think we can be simpler; also why pick on the to-local output? In theory any output could be largest, and you want that one.

[t-bast]

LGTM

[halseth]

ACK

[halseth]

Feels like SHOULD is more correct here, since the sweeping node is aware of the risk and should be allowed to do as it pleases.

[t-bast]

I agree, @ariard I think this is the last pending point before we merge, what do you think?

[niftynei]

We've got the ACKs on this, should we wait til this is addressed? paging @ariard

[t-bast]

Merging as agreed during the last spec meeting.

[ariard]

If option_anchor_outputs applies, the cheating node can pin spends of its
HTLC-timeout/HTLC-success outputs thanks to SIGHASH_SINGLE malleability.
Using a single penalty transaction for all revoked outputs is thus unsafe as it
could be blocked to propagate long enough for the `local node's main output 's
relative timelock to expire and the cheating party escaping the penalty on this
output.

I think we may just make this an unconditional requirement, indifferently of anchors.

[halseth]

I think we can allow spending them all in a single tx, but perhaps recommend something like "if confirmation doesn't happen within X blocks from expiry, to_local should be swept separately as it might be pinned etc".

[t-bast]

I agree with @halseth, it's worth mentioning this potential attack (good find!) but we should be more permissive with implementers.

[Roasbeef]

IMO it's worth nothing more of the subtly here. If they're pinning, then in order to even get into the mempool, they're likely paying a relatively high fee, which means that if they do confirm, then there's the CSV period on the second level. Also the defender can mix things up themselves, by only sweeping one of the HTLC outputs, which would then invalidate the entire "tree" (possibly needing to pay high enough fees?) of the attacker.

[Roasbeef]

Perhaps this should be "should" instead? As there're other ways to defend against this, for example: sweep every output in its own transaction.

[rustyrussell]

OK, lots of good discussion at meeting about this. The spec says MAY, because if you do make one bit tx, you need to split (as HTLC txs can race you), but you also need to split because your big tx might be pinned.

It's worth noting this, for sure, but I think we can be simpler; also why pick on the to-local output? In theory any output could be largest, and you want that one.

[t-bast]

LGTM

[halseth]

ACK

[halseth]

Feels like SHOULD is more correct here, since the sweeping node is aware of the risk and should be allowed to do as it pleases.

[t-bast]

I agree, @ariard I think this is the last pending point before we merge, what do you think?

[niftynei]

We've got the ACKs on this, should we wait til this is addressed? paging @ariard

[t-bast]

Merging as agreed during the last spec meeting.

[ariard]

If option_anchor_outputs applies, the cheating node can pin spends of its
HTLC-timeout/HTLC-success outputs thanks to SIGHASH_SINGLE malleability.
Using a single penalty transaction for all revoked outputs is thus unsafe as it
could be blocked to propagate long enough for the `local node's main output 's
relative timelock to expire and the cheating party escaping the penalty on this
output.

I think we may just make this an unconditional requirement, indifferently of anchors.

[halseth]

I think we can allow spending them all in a single tx, but perhaps recommend something like "if confirmation doesn't happen within X blocks from expiry, to_local should be swept separately as it might be pinned etc".

[t-bast]

I agree with @halseth, it's worth mentioning this potential attack (good find!) but we should be more permissive with implementers.

[Roasbeef]

IMO it's worth nothing more of the subtly here. If they're pinning, then in order to even get into the mempool, they're likely paying a relatively high fee, which means that if they do confirm, then there's the CSV period on the second level. Also the defender can mix things up themselves, by only sweeping one of the HTLC outputs, which would then invalidate the entire "tree" (possibly needing to pay high enough fees?) of the attacker.

[Roasbeef]

Perhaps this should be "should" instead? As there're other ways to defend against this, for example: sweep every output in its own transaction.

[rustyrussell]

OK, lots of good discussion at meeting about this. The spec says MAY, because if you do make one bit tx, you need to split (as HTLC txs can race you), but you also need to split because your big tx might be pinned.

It's worth noting this, for sure, but I think we can be simpler; also why pick on the to-local output? In theory any output could be largest, and you want that one.

[t-bast]

LGTM

[halseth]

ACK

[halseth]

Feels like SHOULD is more correct here, since the sweeping node is aware of the risk and should be allowed to do as it pleases.

[t-bast]

I agree, @ariard I think this is the last pending point before we merge, what do you think?

[niftynei]

We've got the ACKs on this, should we wait til this is addressed? paging @ariard

[t-bast]

Merging as agreed during the last spec meeting.

[ariard]

If option_anchor_outputs applies, the cheating node can pin spends of its
HTLC-timeout/HTLC-success outputs thanks to SIGHASH_SINGLE malleability.
Using a single penalty transaction for all revoked outputs is thus unsafe as it
could be blocked to propagate long enough for the `local node's main output 's
relative timelock to expire and the cheating party escaping the penalty on this
output.

I think we may just make this an unconditional requirement, indifferently of anchors.

[halseth]

I think we can allow spending them all in a single tx, but perhaps recommend something like "if confirmation doesn't happen within X blocks from expiry, to_local should be swept separately as it might be pinned etc".

[t-bast]

I agree with @halseth, it's worth mentioning this potential attack (good find!) but we should be more permissive with implementers.

[Roasbeef]

IMO it's worth nothing more of the subtly here. If they're pinning, then in order to even get into the mempool, they're likely paying a relatively high fee, which means that if they do confirm, then there's the CSV period on the second level. Also the defender can mix things up themselves, by only sweeping one of the HTLC outputs, which would then invalidate the entire "tree" (possibly needing to pay high enough fees?) of the attacker.

[Roasbeef]

Perhaps this should be "should" instead? As there're other ways to defend against this, for example: sweep every output in its own transaction.

[rustyrussell]

OK, lots of good discussion at meeting about this. The spec says MAY, because if you do make one bit tx, you need to split (as HTLC txs can race you), but you also need to split because your big tx might be pinned.

It's worth noting this, for sure, but I think we can be simpler; also why pick on the to-local output? In theory any output could be largest, and you want that one.

[t-bast]

LGTM

[halseth]

ACK

[halseth]

Feels like SHOULD is more correct here, since the sweeping node is aware of the risk and should be allowed to do as it pleases.

[t-bast]

I agree, @ariard I think this is the last pending point before we merge, what do you think?

[niftynei]

We've got the ACKs on this, should we wait til this is addressed? paging @ariard

[t-bast]

Merging as agreed during the last spec meeting.

[ariard]

If option_anchor_outputs applies, the cheating node can pin spends of its
HTLC-timeout/HTLC-success outputs thanks to SIGHASH_SINGLE malleability.
Using a single penalty transaction for all revoked outputs is thus unsafe as it
could be blocked to propagate long enough for the `local node's main output 's
relative timelock to expire and the cheating party escaping the penalty on this
output.

I think we may just make this an unconditional requirement, indifferently of anchors.

[halseth]

I think we can allow spending them all in a single tx, but perhaps recommend something like "if confirmation doesn't happen within X blocks from expiry, to_local should be swept separately as it might be pinned etc".

[t-bast]

I agree with @halseth, it's worth mentioning this potential attack (good find!) but we should be more permissive with implementers.

[Roasbeef]

IMO it's worth nothing more of the subtly here. If they're pinning, then in order to even get into the mempool, they're likely paying a relatively high fee, which means that if they do confirm, then there's the CSV period on the second level. Also the defender can mix things up themselves, by only sweeping one of the HTLC outputs, which would then invalidate the entire "tree" (possibly needing to pay high enough fees?) of the attacker.

[Roasbeef]

Perhaps this should be "should" instead? As there're other ways to defend against this, for example: sweep every output in its own transaction.

[rustyrussell]

OK, lots of good discussion at meeting about this. The spec says MAY, because if you do make one bit tx, you need to split (as HTLC txs can race you), but you also need to split because your big tx might be pinned.

It's worth noting this, for sure, but I think we can be simpler; also why pick on the to-local output? In theory any output could be largest, and you want that one.

[t-bast]

LGTM

[halseth]

ACK

[halseth]

Feels like SHOULD is more correct here, since the sweeping node is aware of the risk and should be allowed to do as it pleases.

[t-bast]

I agree, @ariard I think this is the last pending point before we merge, what do you think?

[niftynei]

We've got the ACKs on this, should we wait til this is addressed? paging @ariard

[t-bast]

Merging as agreed during the last spec meeting.

[ariard]

If option_anchor_outputs applies, the cheating node can pin spends of its
HTLC-timeout/HTLC-success outputs thanks to SIGHASH_SINGLE malleability.
Using a single penalty transaction for all revoked outputs is thus unsafe as it
could be blocked to propagate long enough for the `local node's main output 's
relative timelock to expire and the cheating party escaping the penalty on this
output.

I think we may just make this an unconditional requirement, indifferently of anchors.

[halseth]

I think we can allow spending them all in a single tx, but perhaps recommend something like "if confirmation doesn't happen within X blocks from expiry, to_local should be swept separately as it might be pinned etc".

[t-bast]

I agree with @halseth, it's worth mentioning this potential attack (good find!) but we should be more permissive with implementers.

[Roasbeef]

IMO it's worth nothing more of the subtly here. If they're pinning, then in order to even get into the mempool, they're likely paying a relatively high fee, which means that if they do confirm, then there's the CSV period on the second level. Also the defender can mix things up themselves, by only sweeping one of the HTLC outputs, which would then invalidate the entire "tree" (possibly needing to pay high enough fees?) of the attacker.

[Roasbeef]

Perhaps this should be "should" instead? As there're other ways to defend against this, for example: sweep every output in its own transaction.

[rustyrussell]

OK, lots of good discussion at meeting about this. The spec says MAY, because if you do make one bit tx, you need to split (as HTLC txs can race you), but you also need to split because your big tx might be pinned.

It's worth noting this, for sure, but I think we can be simpler; also why pick on the to-local output? In theory any output could be largest, and you want that one.

[t-bast]

LGTM

[halseth]

ACK

[halseth]

Feels like SHOULD is more correct here, since the sweeping node is aware of the risk and should be allowed to do as it pleases.

[t-bast]

I agree, @ariard I think this is the last pending point before we merge, what do you think?

[niftynei]

We've got the ACKs on this, should we wait til this is addressed? paging @ariard

[t-bast]

Merging as agreed during the last spec meeting.

[ariard]

If option_anchor_outputs applies, the cheating node can pin spends of its
HTLC-timeout/HTLC-success outputs thanks to SIGHASH_SINGLE malleability.
Using a single penalty transaction for all revoked outputs is thus unsafe as it
could be blocked to propagate long enough for the `local node's main output 's
relative timelock to expire and the cheating party escaping the penalty on this
output.

I think we may just make this an unconditional requirement, indifferently of anchors.

[halseth]

I think we can allow spending them all in a single tx, but perhaps recommend something like "if confirmation doesn't happen within X blocks from expiry, to_local should be swept separately as it might be pinned etc".

[t-bast]

I agree with @halseth, it's worth mentioning this potential attack (good find!) but we should be more permissive with implementers.

[Roasbeef]

IMO it's worth nothing more of the subtly here. If they're pinning, then in order to even get into the mempool, they're likely paying a relatively high fee, which means that if they do confirm, then there's the CSV period on the second level. Also the defender can mix things up themselves, by only sweeping one of the HTLC outputs, which would then invalidate the entire "tree" (possibly needing to pay high enough fees?) of the attacker.

[Roasbeef]

Perhaps this should be "should" instead? As there're other ways to defend against this, for example: sweep every output in its own transaction.

[rustyrussell]

OK, lots of good discussion at meeting about this. The spec says MAY, because if you do make one bit tx, you need to split (as HTLC txs can race you), but you also need to split because your big tx might be pinned.

It's worth noting this, for sure, but I think we can be simpler; also why pick on the to-local output? In theory any output could be largest, and you want that one.

[t-bast]

LGTM

[halseth]

ACK

[halseth]

Feels like SHOULD is more correct here, since the sweeping node is aware of the risk and should be allowed to do as it pleases.

[t-bast]

I agree, @ariard I think this is the last pending point before we merge, what do you think?

[niftynei]

We've got the ACKs on this, should we wait til this is addressed? paging @ariard

[t-bast]

Merging as agreed during the last spec meeting.

[ariard]

If option_anchor_outputs applies, the cheating node can pin spends of its
HTLC-timeout/HTLC-success outputs thanks to SIGHASH_SINGLE malleability.
Using a single penalty transaction for all revoked outputs is thus unsafe as it
could be blocked to propagate long enough for the `local node's main output 's
relative timelock to expire and the cheating party escaping the penalty on this
output.

I think we may just make this an unconditional requirement, indifferently of anchors.

[halseth]

I think we can allow spending them all in a single tx, but perhaps recommend something like "if confirmation doesn't happen within X blocks from expiry, to_local should be swept separately as it might be pinned etc".

[t-bast]

I agree with @halseth, it's worth mentioning this potential attack (good find!) but we should be more permissive with implementers.

[Roasbeef]

IMO it's worth nothing more of the subtly here. If they're pinning, then in order to even get into the mempool, they're likely paying a relatively high fee, which means that if they do confirm, then there's the CSV period on the second level. Also the defender can mix things up themselves, by only sweeping one of the HTLC outputs, which would then invalidate the entire "tree" (possibly needing to pay high enough fees?) of the attacker.

[Roasbeef]

Perhaps this should be "should" instead? As there're other ways to defend against this, for example: sweep every output in its own transaction.

[rustyrussell]

OK, lots of good discussion at meeting about this. The spec says MAY, because if you do make one bit tx, you need to split (as HTLC txs can race you), but you also need to split because your big tx might be pinned.

It's worth noting this, for sure, but I think we can be simpler; also why pick on the to-local output? In theory any output could be largest, and you want that one.

[t-bast]

LGTM

[halseth]

ACK

[halseth]

Feels like SHOULD is more correct here, since the sweeping node is aware of the risk and should be allowed to do as it pleases.

[t-bast]

I agree, @ariard I think this is the last pending point before we merge, what do you think?

[niftynei]

We've got the ACKs on this, should we wait til this is addressed? paging @ariard

[t-bast]

Merging as agreed during the last spec meeting.