Feedback-ID: i525146e8:Fastmail
Date: Wed, 20 Dec 2023 19:48:59 +0000
From: Peter Todd <pete@petertodd.org>
To: Gloria Zhao <gloriajzhao@gmail.com>
Message-ID: <ZYNFK5V5e9PnT9eL@petertodd.org>
References: <ZYMhEJ3y11tnDOAx@petertodd.org>
 <CAFXO6=KS05So_5FizLJxCLEPwBxNPV9Wrgi=9sjzmrZ+PLpLOQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="eHvNDj2GtvZ+LdUw"
Content-Disposition: inline
In-Reply-To: <CAFXO6=KS05So_5FizLJxCLEPwBxNPV9Wrgi=9sjzmrZ+PLpLOQ@mail.gmail.com>
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] V3 Transactions are still vulnerable to
 significant tx pinning griefing attacks
Precedence: list


--eHvNDj2GtvZ+LdUw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Dec 20, 2023 at 07:13:22PM +0000, Gloria Zhao wrote:
> The "damage" of the pin can quantified by the extra fees Alice has to pay.
>=20
> For a v3 transaction, Mallory can attach 1000vB at 80sat/vB. This can
> increase the cost of replacement to 80,000sat.
> For a non-v3 transaction, Mallory can attach (101KvB - N) before maxing o=
ut
> the descendant limit.
> Rule #4 is pretty negligible here, but since you've already specified
> Alice's child as 152vB, she'll need to pay Rule #3 + 152sats for a
> replacement.
>=20
> Let's say N is 1000vB. AFAIK commitment transactions aren't usually small=
er
> than this:

You make a good point that the commitment transaction also needs to be incl=
uded
in my calculations. But you are incorrect about the size of them.

With taproot and ephemeral anchors, a typical commitment transaction would =
have
a single-sig input (musig), two taproot outputs, and an ephemeral anchor
output.  Such a transaction is only 162vB, much less than 1000vB.

In my experience, only a minority of commitment transactions that get mined
have HTLCs outstanding; even if there is an HTLC outstanding, that only get=
s us
up to 206vB.

> > Mallory can improve the efficiency of his griefing attack by attacking
> multiple
> > targets at once. Assuming Mallory uses 1 taproot input and 1 taproot
> output for
> > his own funds, he can spend 21 ephemeral anchors in a single 1000vB
> > transaction.
>=20
> Note that v3 does not allow more than 1 unconfirmed parent per tx.

Ah, pity, I had misremembered that restriction as being removed, as that is=
 a
potentially significant improvement in scenarios where you need to do things
like deal with a bunch of force closes at once.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--eHvNDj2GtvZ+LdUw
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmWDRSkACgkQLly11TVR
LzenvBAAlZo/mBduMLIqCcUC0ryGerwPgSVfT6oOWh5La0XVwIjnQTPqxK6pR+x6
WNenlGlWtrPx4Prl+pgsSeCrzL/VNw8bpVjT3AotkQ4yB0ln63yG1sgysLGQ2KdF
3W+fNiQMLijgz06L7MVf72qBtpYa3swt9zWQgdMVTpc8La5CnWXbBIRbe2joRtTK
eO3aakFWMr+2HDC6/CrhmA+SdytRLSC1vhEJoamRMfF8wdnkcGULq1oQhqDEYCcf
DQapf6dYPVVxvmINnrCK+nXeRMcr0amJH0q94H821Njtohp4f2hQbcAKh8/FxZ5d
13clUl2UzChdIp96ACdzO26RpOcv7fTYTdXuLEJmOv4mNWxnfD7AkoEteZ0wy/bX
ZEtzS5r53pTbgvFS5PtGsT1qpzmIqqTwl6LATDB046F4creumV8+l5NWnPJMz3vh
X4o7MnC7SnkRLIyhTcd27GYhukCEvX1MCWeSIVGQopkHld/dWT1LpLpxDVfIWaKM
5ZcA2tL8nHOY5Y2L9Z75xikpR18nv2KTaGTjuk8fudKV0KTPKhgK3LFhd1Ikfkwe
z81Zj10nCWHbJkre+GTCcpdA0w83R0stA/hMXe22LY4/y8d0odvBfhwCtEW+4vpe
/cAFwguQHzQyKER9jXwkZg29lo88Dm++1Zq2KJeGL1J3d7PXUsw=
=WdHc
-----END PGP SIGNATURE-----

--eHvNDj2GtvZ+LdUw--