Date: Tue, 07 Nov 2023 11:11:59 +0000
To: Antoine Riard <antoine.riard@gmail.com>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <iBopsZOx5TRDjjfxSLo9GLa00c7Jk0uMSae6_EPsPjnd10Aa87-lxVIZnL37GwEM3ppemBAxCwkv7r4w5AfDjLkKo0OhIpdB0jK0_OTRqf4=@protonmail.com>
In-Reply-To: <CALZpt+GXGBbo0JjOyMr3B-3dVY2Q_DuzF6Sn3xE5W24x77PRYg@mail.gmail.com>
References: <CALZpt+GdyfDotdhrrVkjTALg5DbxJyiS8ruO2S7Ggmi9Ra5B9g@mail.gmail.com>
 <ZTMWrJ6DjxtslJBn@petertodd.org>
 <CALZpt+GQ9g-uwAGYogdaJcinVHRxs4=67hML78KbramJg=davA@mail.gmail.com>
 <ZUNBHsw2BldPLvPc@petertodd.org>
 <CALZpt+GBcqquPtf0YB07Rcy2OS0kUhv86s6g=69VrfSE72cYJQ@mail.gmail.com>
 <ZUXyICh45JP6OnDu@petertodd.org>
 <CALZpt+GXGBbo0JjOyMr3B-3dVY2Q_DuzF6Sn3xE5W24x77PRYg@mail.gmail.com>
Feedback-ID: 2872618:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
 "lightning-dev\\\\\\\\@lists.linuxfoundation.org"
 <lightning-dev@lists.linuxfoundation.org>, security@ariard.me
Subject: Re: [bitcoin-dev] [Lightning-dev] OP_Expire and Coinbase-Like
	Behavior: Making HTLCs Safer by Letting Transactions Expire Safely
Precedence: list

Good morning Antoine,


> Once the HTLC is committed on the Bob-Caroll link, Caroll releases the pr=
eimage off-chain to Bob with an `update_fulfill_htlc` message, though Bob d=
oes _not_ send back his signature for the updated channel state.
>=20
> Some blocks before 100, Caroll goes on-chain to claim the inbound HTLC ou=
tput with the preimage. Her commitment transaction propagation in network m=
empools is systematically "replaced cycled out" by Bob.

I think this is impossible?

In this scenario, there is an HTLC offered by Bob to Carol.

Prior to block 100, only Carol can actually create an HTLC-success transact=
ion.
Bob cannot propagate an HTLC-timeout transaction because the HTLC timelock =
says "wait till block 100".

Neither can Bob replace-recycle out the commitment transaction itself, beca=
use the commitment transaction is a single-input transaction, whose sole in=
put requires a signature from Bob and a signature from Carol --- obviously =
Carol will not cooperate on an attack on herself.

So as long as Carol is able to get the HTLC-success transaction confirmed b=
efore block 100, Bob cannot attack.
Of course, once block 100 is reached, `OP_EXPIRE` will then mean that Carol=
 cannot claim the fund anymore.

Regards,
ZmnSCPxj