MIME-Version: 1.0
Date: Tue, 10 Jan 2023 10:14:47 -1000
From: "David A. Harding" <dave@dtrt.org>
To: Peter Todd <pete@petertodd.org>
In-Reply-To: <Y704non5DD5mtxs1@petertodd.org>
References: <Y7ySzDjzx5eDjOH9@petertodd.org>
 <aaaeda2950e61127a3218c523927a0d8@dtrt.org> <Y70mNHsX4JcKYZyi@petertodd.org>
 <6089e1f0140684435bf5e87b0c13d561@dtrt.org> <Y704non5DD5mtxs1@petertodd.org>
User-Agent: Roundcube Webmail/1.4.10
Message-ID: <6cebd312ca960e634729cc574c2e97b0@dtrt.org>
Content-Type: text/plain; charset=US-ASCII;
 format=flowed
Content-Transfer-Encoding: 7bit
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Why Full-RBF Makes DoS Attacks on Multiparty
 Protocols Significantly More Expensive
Precedence: list

On 2023-01-10 00:06, Peter Todd wrote:
> Remember, we'd like decentralized coinjoin implementations like 
> Joinmarket to
> work. How does a decentralized coinjoin implement "conflict 
> monitoring"?

1. Run a relay node with a conflict-detection patch.  Stock Bitcoin Core
    with -debug=mempoolrej will tell you when it rejects a transaction
    for conflicting with a transaction already in the mempool, e.g.:

       2022-11-01T02:53:17Z 
867b85d68d7a7244c1d65c4797006b56973110ac243ab5ee15a8c4d220060c58 from 
peer=58 was not accepted: txn-mempool-conflict

    I think it would be easy to extend this facility to list the inputs
    which conflicted.  So if Alice sees a conflict created by Mallory,
    she can create a new coinjoin transaction without Mallory.  This
    method has the advantage of being fast and attributing fault,
    although it does require Alice's node be online at the time Mallory's
    conflict is propagated.

2. Simply assume a conflict exists for otherwise unexplainable failures.
    For example, if Alice sees several new blocks whose bottom feerates
    are well below the feerates of an unconfirmed coinjoin transaction
    that Alice helped create and broadcast, she can assume it's a
    conflict that is preventing preventing confirmation of the coinjoin.
    She can find an entirely different set of collaborators and create a
    non-conflicting transaction without ever needing to know which inputs
    from the original transaction conflicted.  This method has the
    disadvantage of being slow (on the order of hours) and not 
attributing
    fault, although it doesn't require Alice has any information beyond 
copies
    of recent blocks.

I didn't list these methods or others before because the specific method 
used to
detect conflicts doesn't matter to the realization that software which
uses conflict detection and evasion to defeat the $17.00 attack also
defeats the $0.05 attack without any need for full-RBF.

-Dave