Feedback-ID: i525146e8:Fastmail
Date: Tue, 10 Jan 2023 03:47:48 -0500
From: Peter Todd <pete@petertodd.org>
To: "David A. Harding" <dave@dtrt.org>
Message-ID: <Y70mNHsX4JcKYZyi@petertodd.org>
References: <Y7ySzDjzx5eDjOH9@petertodd.org>
 <aaaeda2950e61127a3218c523927a0d8@dtrt.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="eXFKUwX/XF0SKWEr"
Content-Disposition: inline
In-Reply-To: <aaaeda2950e61127a3218c523927a0d8@dtrt.org>
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Why Full-RBF Makes DoS Attacks on Multiparty
 Protocols Significantly More Expensive
Precedence: list


--eXFKUwX/XF0SKWEr
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jan 09, 2023 at 09:11:46PM -1000, David A. Harding wrote:
> On 2023-01-09 12:18, Peter Todd via bitcoin-dev wrote:
> > [The quote:]
> >=20
> >     "Does fullrbf offer any benefits other than breaking zeroconf
> > business
> >      practices?"
> >=20
> > ...has caused a lot of confusion by implying that there were no
> > benefits. [...]
> >=20
> > tl;dr: without full-rbf people can intentionally and unintentionally DoS
> > attack
> > multi-party protocols by double-spending their inputs with low-fee txs,
> > holding
> > up progress until that low-fee tx gets mined.
>=20
> Hi Peter,
>=20
> I'm confused.  Isn't this an easily solvable issue without full-RBF?
> Let's say Alice, Bob, Carol, and Mallory create a coinjoin transaction.
> Mallory either intentionally or unintentionally creates a conflicting
> transaction that does not opt-in to RBF.
>=20
> You seem to be proposing that the other participants force the coinjoin
> to complete by having the coinjoin transaction replace Mallory's
> conflicting transaction, which requires a full-RBF world.
>=20
> But isn't it also possible in a non-full-RBF world for Alice, Bob, and
> Carol to simply create a new coinjoin transaction which does not include
> any of Mallory's inputs so it doesn't conflict with Mallory's
> transaction?  That way their second coinjoin transaction can confirm
> independently of Mallory's transaction.

How do you propose that the participants learn about the double-spend? With=
out
knowing that it happened, they can't respond as you suggested.

> Likewise, if Alice and Mallory attempt an LN dual funding and Mallory
> creates a conflict, Alice can just create an alternative dual funding
> with Bob rather than try to use full-RBF to force Mallory's earlier dual
> funding to confirm.

Same issue.

And of course, in both cases full-rbf makes Mallory have to actually pay fu=
ll
price for the attack. Either because the intended transaction goes through.=
 Or
because their double-spending DoS attack had to be much more expensive in t=
he
first place.

> > ## Transaction Pinning
> >=20
> > Exploiting either rule is expensive.
>=20
> I think this transaction pinning attack against coinjoins and dual
> fundings is also solved in a non-full-RBF world by the honest
> participants just creating a non-conflicting transaction.
>=20
> That said, if I'm missing something and these attacks do actually apply,
> then it might be worth putting price figures on the attack in terms most
> people will understand.  The conflicting inputs attack you described in
> the beginning as being solved by full-RBF costs about $0.05 USD at
> $17,000/BTC.  The transaction pinning attack you imply is unsolved by
> full-RBF costs about $17.00.  If both attacks apply, any protocol which
> is vulnerable to a $17.00 attack still seems highly vulnerable to me, so
> it doesn't feel like a stretch to say that full-RBF lacks significant
> benefits for those protocols.

Coinjoins are an automated process that happens constantly. As I described =
in
my email, it's totally normal for them to fail constantly - I was told by
Wasabi that only ~25% of coinjoin rounds succeed right now, a figure that
frankly was much higher than I expected. Being forced to spend $17/round ra=
ther
than $0.05/round is a huge improvement that adds up to serious money at the
scale at which Wasabi and similar protocols operate at.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--eXFKUwX/XF0SKWEr
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmO9JiYACgkQLly11TVR
Lzc0iw//dKF+VNqlAIcu8eDI9aVOcMWBrfdka62pjhkCXym4WI1NIdo92seHPjo1
92K+pfEqq5pUHSNVTbayw3JIiDrh48XsIk/N+jTnMgqA3VZ+lMxhzYTSHhMOAs/F
j/YQQIfGqECAsv86z6i/Ow7cHjFfBOpxG2k8XolNBqh6FINrn88Nkw16wO/T2ATO
B71V80JV+tUSjfBZ7CrVqoCpARGE3n+huQ4r+QFnLMd/F9PpbXQySo8T9TEuQwCR
hSrL9OZwhjLpOAPU6aIGLRgiucOjC2UcImwm/W/OVwUWPFAlKZck6p54bcr2TuSV
uwPjmYbtYGVlSr860Tl5pqUSfnf0i0bQGl0F0cAEJRTSwx5ajJnOXITNjGmoHuVo
8CILhK/DpWD6wvV+Xi/C2/hCYxLEMVpHNJCUc1AB01o4HZ7u07RgFYrv6NY4MSK5
Lk4gA/7eVDdfXUVxCSmPjjsVHQ9C2OH53Xxl+WQHDQuKeAX2z7w15W2NLsr5D02T
mn5JbRqNPCIzj5xyq15NsEtpNL7IBj7B+zOl93ZiU9/0GiJi9X35tP+hECqGG+tn
fjc8SIyHHRbHjql0UZ6ywtHWQIysRuWQUIrZocBA0L68B13Dcr51S7eXSD1241L+
yMKS41n/+nk8EYuUPd9V/8jASepTGCIxd5wbvqtIdzROtSVp1hs=
=n7LS
-----END PGP SIGNATURE-----

--eXFKUwX/XF0SKWEr--