Feedback-ID: i525146e8:Fastmail
Date: Tue, 30 Jan 2024 04:38:26 +0000
From: Peter Todd <pete@petertodd.org>
To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <Zbh9Qqk2jK0tqKgp@petertodd.org>
References: <ZbFle6n0Zu3yUV8o@petertodd.org>
 <4619vs2aZBsW1lr3ihqjM6TdRgx8CuA_wRwXetu7jZZcL8r3oWUy7xOPkT-qJ0xxT79_Ss6it2chOWAAWPJuU8YSCzjaNOd6JvnMvWTBc-c=@protonmail.com>
 <9tVZA3A4x-GZB5wQ1kMUoyyYXqvGS4MP4iDrLx1FCFHly-MU--II8evpgdcf2Xb9JZWDsY0kEB8r9dClzPrOk_V8EiWtHms8fvlunZQNGrA=@protonmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="bmdDGprMOYGQ9Ewu"
Content-Disposition: inline
In-Reply-To: <9tVZA3A4x-GZB5wQ1kMUoyyYXqvGS4MP4iDrLx1FCFHly-MU--II8evpgdcf2Xb9JZWDsY0kEB8r9dClzPrOk_V8EiWtHms8fvlunZQNGrA=@protonmail.com>
Cc: bitcoin-dev@lists.linuxfoundation.org,
 Lightning Dev <lightning-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] [Lightning-dev] CheckTemplateVerify Does Not
 Scale Due to UTXO's Required For Fee Payment
Precedence: list


--bmdDGprMOYGQ9Ewu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 30, 2024 at 04:12:07AM +0000, ZmnSCPxj wrote:
> Peter Todd proposes to sign multiple versions of offchain transactions at=
 varying feerates.
> However, this proposal has the issue that if you are not the counterparty=
 paying for onchain fees (e.g. the original acceptor of the channel, as per=
 "initiator pays" principle), then you have no disincentive to just use the=
 highest-feerate version always, and have a tiny incentive to only store th=
e signature for the highest-feerate version to reduce your own storage cost=
s slightly.

You are incorrect. Lightning commitments actually come in two different
versions, for the local and remote sides. Obviously, I'm proposing that fee=
s be
taken from the side choosing to sign and broadcast the transaction. Which is
essentially no different from CPFP anchors, where the side choosing to get =
the
transaction mined pays the fee (though with anchors, it is easy for both si=
des
to choose to contribute, but in practice this almost never seems to happen =
in
my experience running LN nodes).

> In addition, it is also incentive-incompatible for the party that pays on=
chain fees to withhold signatures for the higher-fee versions, because if y=
ou are the party who does not pay fees and all you hold are the complete si=
gnatures for the lowest-fee version (because the counterparty does not want=
 to trust you with signatures for higher-fee versions because you will just=
 abuse it), then you will need anchor outputs again to bump up the fee.

That is also incorrect. If the protocol demands multiple fee variants exist,
the state of the lightning channel simply doesn't advance until all required
fee-variants are provided. Withholding can't happen any more than someone c=
ould
"withhold" a state by failing to provide the last byte of a commitment
transaction: until the protocol state requirements have been fufilled in fu=
ll,
the previous state remains in effect.

> However, there may be issues with hosting HTLCs; technically HTLCs are ne=
sted inside a larger contract (the channel) and if so, do you need a separa=
te transaction to resolve them (Poon-Dryja does!) and do you also have to m=
ulti-feerate *in addition to* multi-feerate the outer transaction (e.g. com=
mitment transaction in Poon-Dryja) resulting in a O(N * N) transactions for=
 N feerates?

I covered HTLCs in my blog post on the subject; I would suggest you read it=
 in
full. There are multiple potential options to deal with HTLC feerates to av=
oid
the obvious N^2 problem:

https://petertodd.org/2023/v3-transactions-review#htlcs-and-replace-by-fee

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--bmdDGprMOYGQ9Ewu
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmW4fUAACgkQLly11TVR
LzeTtg//WcISs4FshLbBh9dv2ypHpVqRUtPbkxdJHX/xfEZ8vdhaZSt13KS9rYoN
E359/g0xDiQVOGg/ZxXUIgHPU+hE7Zd/iRtAGoQ6O9VDkpHeSlT3UhLYcXMsUOuj
AqzfstvJj7MWtMLxlqgPG790Mh+/bO6HN+pxsNIFHBKjpxpHnDtmylJk+kpymkFR
hIJG1cnyBs7E6kTJDPipOEH8Br30dFoOe8/r26Oat6EcWyI9KFzCpolGUzNy06Re
n6VxqzlAeAxqhxQkIOxNFkBelYo9zrlQaQTpX154gFlaC5rvZNHCaxpNQfShRK9C
MqF5m3zmdbsrLRndyspYGgVsUpwCxU2+mQ+3uaVJrop8xOflmh3jX8LG0Ew0Euye
9HQbLvPHX9nk4ciEJM8OmOB5m7OZ7zb8LezVOa1EQEv9I/2N5bB8DS0Hvds1xtHW
YL2Lvft5oz2Tb3SqciSv/wQjHK77fPsJT3pzFeAt+X2T8ojTe0dTz30xMiYXaDDy
jvV76QzD+2ZwvMaujaEG+GEmEzU1Fr4FovULxRYq0eLOf+cl1pJYqHyTRZltO0Ia
UvwUheRTGlXwToeaJftzEboHB6jy2+A8Y0LtxDg6Y8ECr40aDQAETUIJ9/eLXDgY
W2aKAjbf9udoHI9Oi/fl7cUe4QOWfKsBgWGbGU0uuBMTPdAvN/E=
=lNr0
-----END PGP SIGNATURE-----

--bmdDGprMOYGQ9Ewu--