Feedback-ID: i525146e8:Fastmail
Date: Fri, 20 Oct 2023 10:47:38 +0000
From: Peter Todd <pete@petertodd.org>
To: Antoine Riard <antoine.riard@gmail.com>
Message-ID: <ZTJays5mDFvDqkkB@petertodd.org>
References: <CALZpt+GdyfDotdhrrVkjTALg5DbxJyiS8ruO2S7Ggmi9Ra5B9g@mail.gmail.com>
 <7ED2BCD8-BAE3-48E3-9749-A396F3724B6E@petertodd.org>
 <CALZpt+GsRfHvABjhkX=eN_1viVw8Jos4=+sBd7vWQJ_VxNta8g@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="OeoqGIql4O7ZPeiE"
Content-Disposition: inline
In-Reply-To: <CALZpt+GsRfHvABjhkX=eN_1viVw8Jos4=+sBd7vWQJ_VxNta8g@mail.gmail.com>
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Full Disclosure: CVE-2023-40231 / CVE-2023-40232
 / CVE-2023-40233 / CVE-2023-40234 "All your mempool are belong to us"
Precedence: list


--OeoqGIql4O7ZPeiE
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Oct 17, 2023 at 02:11:20AM +0100, Antoine Riard wrote:
> > I think if you want people to understand this exploit, you need to
> explain in more detail how we have a situation where two different parties
> can spend the same HTLC txout, without the first party having the right to
> spend it via their knowledge of the HTLC-preimage.
>=20
> If I'm correctly understanding your question, you're asking why we have a
> situation where the spend of a HTLC output can be in competition between 2
> channel counterparties.

No, you are not correctly understanding it.

It's obvious that an HTLC output can be in competition between 2 different
parties. Obviously, the HTLC-preimage doesn't expire. The problem is you
haven't explained why the party with the HTLC pre-image should not *remain*=
 the
party with the *right* to spend that output, even after the timeout branch
becomes another possible way to spend it.

> LN commitment transactions have offered HTLC outputs where a counterparty
> Alice is pledging to her other counterparty Caroll the HTLC amount in
> exchange of a preimage (and Caroll signature).
>=20
> After the expiration of the HTLC timelock, if the HTLC has not been claim=
ed
> on-chain by Caroll, Alice can claim it back with her signature (and the
> pre-exchanged Caroll signature).
>=20
> The exploit works actually in Caroll leveraging her HTLC-preimage
> transaction as a replace-by-fee of Alice's HTLC-timeout _after_ the
> expiration of the timelock, the HTLC-preimage transaction staying consens=
us
> valid.

That's precisely my point re: you not properly explaining the problem. If
Caroll has the HTLC-preimage, she has the right to spend it. You need to
explain why her right to spend that HTLC-preimage output should expire.

If anything, the way you've explained it sounds like Bob has stolen the out=
put
=66rom Caroll by virtue of the fact that Caroll wasn't able to spend the
HTLC-preimage output in time.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--OeoqGIql4O7ZPeiE
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmUyWsgACgkQLly11TVR
LzeTig//RWsawPzHRXmJnHmQxY2T9zj7TBpWjvys7E8Si0N62gWhLgwCeeRX4Acq
N9zkhyVDJulrbVIcD20gKM9PqetswtmdtkD15w6zeptok3A9VrQWIMnLvEpDtfk+
1jdII6IdbvuGSpMz0O2aSFSK4rDZlv39XXma3yPPnJWEAZFXvHQL1MPmtU9BjEHd
vQS0R/wjmu+3v+3z122L4h76jfoj5ebZPJklzqEcUX8lORIROxrU3HYGsIDAnpa9
P1ytmJO5/h+Wmrhgo1pdAv5IAipwKcyCQZwnfaWoCDN2anAzsOnEECCEfhMMjUyB
ktQRe89ZtCM8ZICEOC7xiBZ1L/a4PVJ/V0FHlXskme30eIJwQUYeP4sutAqZchnk
+HCu163JWE5XXWd3+bkkzgRqlcISpdGHiu2+Za4pC8QOaDxRuG13dIOJypi/LyK7
hTxTTqmX/drNqOYO/b35qZUYC+/PTXW47zz19SdtQL9KX8RCaVlBFnw+/uHPbYFF
yY5Ao2D+iebgWvjzc8BPFQjCuutsohn0Iu/0OTIuKa5O+mHXDfS26kT/1F5Ghiwk
sVn7CQ2cY0k/cxKz1+H80sFJZtauuY0V9h/8viE9MMkcvO/zoCjDZIsKJM2AntVw
P1kRQAAz7Jin8xknajNHjCQlQOkcJHNhRoLUyX8xBgCl2ZjL4H0=
=Hb9N
-----END PGP SIGNATURE-----

--OeoqGIql4O7ZPeiE--