He-HTLC: Revisiting Incentives in HTLC with Kartik Nayak | a16z crypto research talks

Transcript

welcome everyone to today's a16z crypto research seminar very happy to introduce cartex Nayak from uh he's a professor at Duke University and he'll be telling us about something that blends together different parts of the web 3 space instead and hashtag that contracts talks about my introduction so I'm very happy to be here by the way I'm here for today and tomorrow so I'm very happy to chat with all of you so in general in in the entire web3 or blockchain ecosystem uh so I'm generally interested in the entire space but my focus primarily has been with respect to L1 or consensus design and and that has been with respect to achieving very various properties for example trying to get good latency good communication

complexity getting fairness getting incentive compatibility and so on so today I'm going to be talking about something a little different I'm going to be touching up on L2 and incentives in L2 in particular I'll be focusing on hdlc or hash time locked contracts which is a primitive that is used in various L2 protocols like lightning networks Atomic swaps and so on and so forth so since this has been one of those widely deployed Primitives there has been quite some work in trying to analyze the incentives involved in this system and it's been an interesting cat and mouse in the past few years so the last system claimed that they are incentive compatible and what we show is

that you know they are not and and in fact there are still attacks and we come up with a better medication system so with that let me try to get into what hdlcs are so htlc stands for hash time block contracts and it's actually implementing a very simple functionality so it allows a conditional transfer of tokens from a payer to a PE so the payer over here is Bob and payee's Alice and the amount of tokens that are being transferred is vdap okay so it's a conditional transfer which means that there are two conditions that the payee or Alice has to present before she can retrieve These funds

so the first condition is that she has to present a hash pre-image of some hash that is available and second she has to do this within some time of t okay so where does she need to present this this would be in on some blockchain on some L1 layer that that is underneath okay so the time of T over here is with respect to some block number in that sense so because she's presenting this hash pre-image we call it a hashlock and this time tease is called a time lock so that's why we call this contract or hash time not contract so the specification is is actually very simple there are so let's say Bob puts

in some readoff tokens uh to begin with there are two ways in which money can be retrieved the first way is through path way where Alice presents a signed transaction with the pre-image create and and she can retrieve tokens from here okay so Alice can spend vdep tokens if you can provide pre-a if not for example if Alice is inactive the contract also provides an opportunity for Bob to actually refund money back to himself and this he can do after some time t okay so after time T if he sends the signed transaction TX B at that point he

can get this money back so let's see how uh how this plays out in in this graphical manner so so this graphic is something that you're going to see in a lot of my slides so let me explain to you what's going on over here so to the right you're seeing a utility versus players or utility versus parties uh uh figure so on the x axis you have different parties Alice Bob and three miners in this example okay another Y axis it's the utility corresponding to these parties at the end of the game with respect to hdlc on the left you're seeing a blockchain and I have marked you know which Miner is going to mine which block uh over here or on top of the block

so the time of T over here refers to the hdlc timeout so in a normal execution when Alice is redeeming this money you will have Alice broadcasting this TX depay this purple transaction that you see it will be put on the Chain by let's say the next minor M3 and at the end of this Alice would obtain vdap tokens and M3 would obtain some small transaction fees okay very simple the other situation is where Bob obtains a refund in Institute in a situation where let's say Alice is inactive in that case at this time of T Bob will put up a transaction TX Deb B this

orange transaction which would be taken up by the next minor let us say M2 and at the end of it Bob would get back or all of the tokens and minor M2 would get a transaction fee okay so you're saying this is it everything happens yes this is where everyone is honest okay so the point to note over here is that no matter what happens it's the miners who are doing who are deciding what the source software of this okay so if Alice and Bob are honest they will we will always take one of these two paths but but they may not be honest okay and if we assume that miners are honest even then I think we are okay but if you think of

then perhaps actually cheat to earn more than what the spec suggests two questions one in your description here you talk a timeout yes so I'm I'm assuming so yeah I think it's just a number of blocks after the start that's right so that's just the colorification the other thing that I'm to see here is what prevents in in this example in this demonstration I realize it's just for explanation but what would prevent Bob from posting the transaction that is beneficial for Bob before tea so the spec says that you you can only obtain this after T so you will not get back your money which spec

ific hdlc implementation underneath so the contract says you can get back your money only after t so Alice still has enough time to to present TX depth to get back our money so I guess that was missing I'm nitpicking here and bothering you because it was missing from your description that there is also the other side it said Alice needs to post before T but he didn't say there was any limitation of posting something else before team sure sure it's just that Bob will get back to this money if there is after tea so he gets a refund after t all right so if parties are honest life is good right

but if Bob is rational and if minus are rational perhaps something else can happen so perhaps you know Bob can get back all of these tokens even when Alice is presenting create the chain so if you're thinking of this from the miners perspective they are they are receiving some sort of a transaction fee for putting in txt if some Bob can incentivize the miners if Bob can bribe them to not put Alice's transaction to sensor analysis transaction at at that point you know he can get all of the refund so he needs to censor until this time t so there have been mechanisms that uh people have spoken about with respect to

you know what what Bob needs to pay to actually make this happen you know one such idea is uh this was presented by Ben therator they said we're going to pay every Miner in the world you know some amount of money that's good enough for them to actually make this choice and and censor analysis transaction a different way a better way which was presented by sabari atal in this paper from s P20 was to incentivize every Miner in such a way that in expectation they would prefer to actually censor analysis transaction so the way to think about it is perhaps Bob would put out a transaction txdeb B ahead of time with a very high transaction fee in so that everyone would say okay I

have Alexis transaction paying me lower Bob's transaction paying me higher at a later point perhaps I should pick Bob's transaction so if there is only one Miner the transaction fee just needs to be a little higher than analysis transaction and that that in itself you know will incentivize the minor if there are many such Miners and let's say Lambda is is my computation power then with probability Lambda I will mine that block and I need to take this this probability into account to compute the expected gain after time so this is what I call a probabilistic paper minus strategy a a third way of doing this again proposed by Windsor Airtel poster paper block for every block that is being produced Bob will bribe them some amount

of money Okay this may be slightly higher than the transaction fee and you'll keep doing this until 20. so let's see how this paper block strategy you know fits in over here let's say let's broadcast transaction txfa and Bob at this point would be incentivized to bribe this Miner some amount that is slightly higher than the transaction fee and Bob would keep doing this for every Miner from there on okay by the way on the graphic to the right that you see anything above the x axis is your gain and anything below the x-axis is something that you pay or your loss so your net gain in this figure is whatever is about the x axis minus

whatever is below the x axis and eventually Bob would put in txt b uh minor M2 will accept it and the miner would Bob would get beat up okay so both so in this situation both Bob and the miners are better off at the expense of Alice even if Alice did everything correctly so this is an attack so mad htlc which was this work from SNP 20 they said we will disincentivize this bribery okay and and they essentially use this lack of trust between Bob and minus to

actually desensitivize it they basically said that they basically introduced two key ideas where first they introduced some sort of a path for miners to actually confiscate all of the tokens if Bob items to try okay and and then they said well this by itself would reduce Bob's utility but you know what he would get at the end of it is perhaps zero so they said we'll introduce a new contract called as a collateral contract and with this contract you know Bob would get into a negative utility regime and at that point you know his and his totally disincent device to even attempt

to cry so the contracts uh that they proposed uh were the following so I mean this looks like a lot of lines but it's actually very simple so txt over here is as earlier and she can get back uh the tokens for Debbie it's similar to earlier Bob can get a refund but in this case you know spending uh this amount that requires Bob to submit another secret another free image called preview okay so in the honest world both of these parts you know will work as earlier so if pries is available also would get back her money if Priya is not

available Bob would get back his money after time t but if both of these are available that is a situation where you know Bob is attempting to bribe at that point they introduce the third path where miners or for that matter anyone can retrieve all of these tokens and confiscate it for themselves okay so he also they also introduced this collateral contract and over here again for for whatever money you put in as collateral Bob would get it back without submitting any pre-image after uh some time T Bob can can retrieve it but uh you would lose it if both 3 and 3B are available on the chip

okay so what would a bribing situation in marriage TLC looks like look like so let's say Bob is still bribing different miners some amount of money and when you get to the stage where you are at the timeout and Bob announces txdb and release pre-b at that point from minor m2's perspective will pre-a from transaction type A is available 3B from transaction type B is available so instead of taking Deb B they would prefer to take the path depram and they would earn they would take that time as well as column and confirm those transactions and you and have a good utility based on the confiscated amount okay and both Bob and Alice would lose in the

process in this model is very notion that the miners knowing about these publishing yeah I'm just thinking like yes what if I had transactions the first two types and just kept them private and then I just copied this to three images to trigger the third condition right so Alice Alice tries to sort of collapse right but I suppress so I think you can do that but the

question is you know what is the utility for Alice or mob to do that so for example if all right okay but I think if I are putting it out on the mempool right if the miners can control the mempool then sure but assuming they cannot then if I have it everyone has it because Alice put it out for everyone to see because Alice wants this transaction to be taken right yeah yeah or at least one more minor no no set and and everyone will receive it yeah um what it to like what if Bob is himself a minor can you know like as soon as Alice puts the pre-image out there then like Bob instead of you know including that transaction Bob

can just generate the cheating transaction for 10 T is a minor and not Bob and sure so I think so if Bob is a miner himself then he has some more power than what we are making out to be over here that is correct so in that case you know he would not lose all of the money with some probability but that probability is has ought to be less than 0.5 right because no minor we are assuming is is controlled more than 51 of the competition part sure maybe a worse one then is like if writing it through with Alice okay so you're saying that if Bob is the miner but they can't control exactly when Alice posts yes that you know if

if but if Alice happens to post it when Bob is the next Miner then they could just steal all the money anyway so Bob being the next Miner by itself does not help you know you still have to bribe these intermediate miners because you're putting a transaction only after time t right so but over here if you end up mining that block at that point you you are you're at an advantage sorry I was thinking about the so say that like Bob is the third Miner okay Bob is the first Miner so B doesn't have three then they see Alice's pre-image and then can you know they can also just generate like you have the third case the deposit for m

like Bob can just pretend he was gonna achieve and then let M3 collect everything sure I think that is possible so the deposit value and collateral value come from Bob's account rate yes so shouldn't Bob start with the negative utility you can you can you can as well where you you think of so I'm thinking of you know Bob getting a certain utility after the fact but you can say you know he gets to zero and starts with negative utility as well because I feel like if Bob just stops the entire like htlc then it's almost like this oh that she'll see really will happen for him because he wants to get something from Alice's pre-image and unlock something so so the reason why it comes so all of

this comes into picture is because you know this htlc is used in a higher level application so let's imagine you're using this in some sort of an atomic swap where two htlcs would be used in in conjunction and and over there you would be using the same Secret in in voltage tlcs actually and over there you know I'm paying you some money on bitcoin and I'm receiving some money from you on ether because it's the same secret I will receive that money from you over here but while sending this money the secret is is out there you know I can try to bribe and make sure that I get back the money as well so that it becomes a one-way transfer instead of a two-way transfer okay After Time [Music] so so that's true I think it it depends

on you know how you're trying to model this so from Ace perspective so the highest amount of money she can get is vdap right so if she had pre-image I think she could just use the honest path and undo it right in the beginning right so I mean her if if she wants to fight Bob then sure I think she can do something like that but we are assuming that Alice is not spiteful over here good all right so An Elegant solution seems like it works so where do we come into picture so I think we looked at this and we said okay there are still some concerns with with this protocol okay and and then so in in our work we you know got some more attacks on on this particular protocol and then we

went into it figured out what these attacks looked like and then we came up with uh a new mitigation so our attacks so so the fact that we have attacks does not mean that you know marriage TLC whatever they presented is incorrect you know their their paper their work everything works for the model that they present it's just that they do not consider a set of actions that we believe are a reasonable for miners when we think of minus as being some actively rational parties so I'll get to you know what activity rational means in the next slide and devise a new class of attacks called reverse primary attacks and in our work we actually present three different attacks called success independent reverse bribery success dependent reverse library and a hybrid attack so in this talk I will focus on talking

about success dependent reverse library and I'll touch upon what hybrid attacks are and then we come up with this mitigation system called HH TLC or as we like to call it helium hdlc so it is a simple practical incentive compatible hdlc scheme Okay the reason why we call it helium stlc is because we believe it is lightweight and it is inert to any incentive manipulation so what what is the distinction between an active rational Miner and a passive rational minor in general when you're thinking of miners we think of them as focused on the mempool where they're looking at all the transactions available to them and they would confirm the most profitable transactions

but minus in general can be active in the sense that they can participate in external protocols to actually maximize their gains okay for example they can add some Mev software on top of uh what they have to to actually engage in a protocol to to improve their gains uh this is kind of General so we can just talk about the beginning that's better if a can also buy um HP likely to win the bride fight because the way I'm thinking like B has to drive like n blocks all of them and a has to win the bride in one block right so yeah anyone look in that direction no so so we thought about uh you know solving it along that direction but in an Ideal World you know you want no one

to bribe right so why do you have to so we are using this because this conditional transfer needs to happen if you're relying on both of these parties to bribe the miners to to achieve the internet action that's not ideal so ideally you want no bribe and yet everything functions yeah [Music] but I think it would be even better if a can get a 10 without driving anything right so the question is you know why do we care about this modeling and in general you we would say you know you would want to consider such active miners because

if there is profit available to be taken at some point you know miners will actually uh will take it you know the rise of flash Bots and so on is is kind of an example of this and all right what our attacks show is that you know the state of the art is no longer safe if this attacks can be pulled off and finally there's this interesting question of you know can we have a secure protocol in the stronger adversarial model so let's try to understand you know what are the concerns with uh this new contract can you still do some bribery over here and for Simplicity let's say you know I'm going to ignore the collateral

contact and just focus on the deposit contract so the highest level idea is still similar so if at the end of the day if Alice is cheated against then both minus and Bob are still better off okay so in an honest execution when Alice is presenting TX step a she would have received v-depth tokens back Bob through this collateral contact would have received we call tokens back and miners would receive some transaction fees if we can get into this situation where Alice gets nothing back and let's say Bob gets something more than what he did in the honest execution so we call this Epsilon and let's say miners get B depth minus we call plus

Epsilon then it may be advantages for both Bob and the miners I and note that in the bottom line over here I'm ignoring the collateral contact although I have I have you know kept it in in the honest execution so even in in such a situation uh Bob and minus can potentially earn more so it in fact couldn't the miners do it even without really Bob chilling they can just uh prevent you know stop Alice's uh so as soon as Alice posts her um transaction uh you know her pre-image they will hold on to it then they wait until the time out teeth then Bob

honestly you know posts uh the uh Redemption and now they have both and they can but Bob has nothing to gain by giving out pre-b so let's say Alice and Bob are honest and and if this happens you know I think I think first you will lose trust in in in in the entire world because my miners are just you know censoring Alice and Bob can do nothing at this point you know given the spec if he releases freely he does not get back anything because the miners are getting money out of it so wouldn't that be automated if the timeout expires is the timeout no no I think that the money is still there in that contract at that point because even if the like the miners are

competing right so they have the pollute to achieve that outcome because everyone has an intentional straight a transaction fees also that's true yeah that's true well I I okay I don't want to grab this hole it's too much into this but I believe in practice when the timeout T reaches there are automated mechanisms that uh essentially close the channel and and disperse through transactions the the uh funds that that would be the honest mechanism and then um is there something for and then uh conversely even if the miners are super

honest Alice's uh transaction at this point has expired it doesn't help them if they they firstly so I think in in the current implementation as far as I know Madison is not being used right now and that's why perhaps you know this automatic closing can happen so if you have freebie you cannot do that anymore because without that secret Bob cannot this money cannot be refunded back about it sort of strange to reason that if Alice and Bob locked some funds on a channel and uh nobody really knew the channel there are mechanisms out there that will uh not leave money you know locked dead but will automatically so so I'd argue that you know over here we are in control of this designing this

mechanism and over here this mechanism or this specification or this implementation sense well the money is locked right right so okay so just to follow up on this thread again it still could be that say say like I'm M3 I have nothing to do with Bob I could as soon as I see pre-a I could be the one to bribe at all the other Miners and I could write all the other Miners And I say please don't include Alice's transaction because I want to be the one who whenever it's my turn to mine later I'm going to you know get my agreement for Bob and do these things like I could start driving too so that's a great segue for what I'm going to speak about okay sorry

all right so I think back to what I was saying over here what I was telling over here so in this potential attack you know Bob and miners can both potentially earn a higher amount of money so the approach over here would be one where minor would obtain VTEC from the contract through this path depam and drive Bob some amount higher than what he would receive otherwise so this is where we call it a reverse Library attack because until now we were seeing you know Bob mining Bob driving miners but over here minus up driving Bob to actually achieve this action the challenge though over here is that Bob and miners do not trust each other so the question is you know who makes

the first move to make this happen if Bob does note that miners need freebie to actually mind FM if Bob shares pre-b then at that point The Miner is not incentivized to actually pay the money pay him a break on the other hand if the miner makes the first move where minor pays Bob a bribe at that point Bob is not incentivized to release pre-b so we need some sort of an exchange mechanism where both of these can happen together there may be multiple different ways of actually doing this what we share what I'm sharing over here is you know one such way where this can happen so we're discussing of an exchange using our trusted execution environment so in the previous thing if minus the above the

price doesn't Bob doesn't do anything what happens too is deposit it's just gone sure but but but remember Bob all he wanted to get was recall that is the honest execution right and he already got recall plus Epsilon so he got more than what he started off with in the first place right so he's better off no matter what so how is vehicle given back doesn't Bob have to give a free image to get a vehicle so this is a bribe that the miner is giving to Bob oh the right is we call perception yes yes I'm sorry uh like does Paul have to proactively do something to get recall so yeah he has to get so he has to in in

the normal execution he has to get this uh send the signed transaction TX call B to get back this money all right so I'm going to sketch one way in which this this exchange can happen using a trusted execution environment like like an Intel sdx and we're going to rely on two key facts to achieve this so the first is that mining a block actually does not need all of the transaction details so if you just have the hash of a transaction that is sufficient for you to actually mind so if Bob can create this transaction TX depend in such a way that the miner gets the money and send the hash and and it also contains pre and pre-b and send the hash

of this transaction to The Miner then Miner can actually start mining on it okay the question is how does minor trust how does the miner trust the fact that whenever uh it receives this hash it is actually formed correctly so for that you can rely on a trusted execution environment or some sort of a zero knowledge proof to perform some sort of Integrity checks okay so so how will this proceed in practice they would first set up uh set up a program on a trusted execution environment which instantiates the stee with the hdlc parameters this would be shared with the miner subsequently they would construct

Bob would construct txt m and compute its hash and send this hash along with an attestation from this de saying that he has done it correctly and the miner can verify the fact that this hash has been constructed correctly and start producing or working on the Block okay so let us say the miner is successful and mindset Block B at that point The Miner can share this Block B uh with Bob and Bob can verify the fact that this this block includes a payment to him in some sort of a bribe that happens on the same channel and at the same time he can share TX Japan along with the block with everyone in

the world so this block is is a singular proof that minus receive TX step M and at the same time Bob receives this bribe as well let's see how this progresses on the chain thank you Alice broadcasts TX step a and at that point PA is available Bob has 3B let's say M3 and Bob engage in this communication where they actually perform this Exchange okay at that point Bob receives V call plus Epsilon M3 receives txt M this transaction happens and those are the corresponding utilities for both of

these parties and then the game would just proceed eventually you know some minor would mine TX column because pre and PB are now available on the chain and minor M2 would obtain a recall note that this is like something specific about marriage TLC which says you know thdfm can be retrieved earlier but TX column can only be retrieved at time T at or after time t so because of which uh M3 and M2 are can be two different entities uh in this figure so stuck so the first part is so I already explained uh that this is this is why it is called a

reverse primary attack we call this a success dependent reverse Library attack because only if the miner is successful in in actually mining this block that is when this exchange would happen if not you know nothing gained nothing lost if it happens at that point both Bob gets uh Bob gets the bribe and minor gets TX FM second note that at least the way I have presented it this works when depth read app is greater than V call right so winning minus gain the way I have shown it is V diff minus V call

plus Epsilon Bob gets V call plus Epsilon and some other minor may get recall you know you may actually want to work uh and be a little more tight over here because the sum of the minor can be the same minor as as the one who engaged in this bribery as well so this condition can be a little tighter which we do in you know if you think about it the key reason why we have this constraint on vdap and V call is because the deposit and collateral contracts are redeemed at different times and finally if I were to defend then well Bob can just pay a very high collateral okay something like 2x V deck

but as you know if I'm paying you a thousand dollars putting down a collateral of two thousand dollars is not ideal so if anything the collateral should be as small as possible so in fact what we show is that you know while such a difference would work against what is the winning minor here oh the winning Miner is the one who did the success dependent reverse bribery so I think in this example it's M3 over here who did this exchange and that minor received v-depth from txm debt but also paid we call plus Epsilon to Bob so you receive B depth minus V call precepts okay so both um sure I think it's it's just uh maybe

four wordings over there yeah but it's not winning the puzzle okay okay I mean they did win the Bitcoin puzzle for for those yeah for those instances so over here it is the one who actually did the success dependent reverse primary so you can use this defense to defend against this attack but well uh you know we can it turns out that we can improve this attack so that this relationship between Meetup and recall does not hold and and the key thing that you need over here is that you need to somehow ensure that both of these contracts are Redeemed by a single Miner Okay so

if that happens then we'll not have these constraints and that would be ideal and we actually show a way of achieving this where if somehow Bob can do this bribery that I spoke about earlier and And Delay redeeming this delay redeeming of of TX depam until that later point then both of those transactions would be would be retrieved at once so we would fund these bribery attacks using some future reverse bribery income so I'm not going to get into the details of exactly this but graphically this is what it looks like where Bob is bribing each of these minus until the timeout

and then engaging in some sort of a success dependent reverse bribery attack where the minor the winning Miner M2 over here gets beta plus we call perhaps Plus in addition to some bribes from earlier and for that The Miner is paying Bob we call it silent Okay so let's talk about how we would mitigate these attacks you know in general if I were to design a a scheme what should what what do I need so the first and foremost uh the most important quality I need is incentive compatibility so you want something that is secure even the presence of actively rational miners second if there is a collateral you

would want this collateral to be as low as possible you would want Simplicity as well as you would want it to be practical you know you can you can Implement any contract on ethereum but you would ideally want it to be implementable on bitcoin as well and that is exactly what we achieve so so again we call it helium hdlc because it's lightweight and inert to incentive manipulation so before designing our mechanism design let's again look at you know what are the key aspects or key things that we actually exploit uh that we use in our attacks so first part is you know these attacks

are possible because some party earns too much money if other parties cooperate so in the case of bribery it was Bob who was earning B depth plus we call if if minus cooperated and note that there is there exists a path in the hdlc spec which says you know Bob should get back all of this money so this is something that we cannot avoid so that has to exist a path where Bob gets back all of his money in the case of reverse bribery where the miner was paying Bob note that marriage TLC was overly compensating the miner Majesty was saying okay if you confiscate you confiscate the entire amount and that gives the miners some excess

money that it can use to actually bribe of our attack was atomicity so somehow this Redemption happened in in one go you just put out a transaction and you get back all of the money and and this is something that we used in sdrba where you put in this TX step M and miners get back all of the money or Bob puts in txtb and he gets back all of the money in one transaction so let's start with with the easier goal of you know if I were to disincent device reverse bribery what would I do so the idea is if the miner as the

enforcer of the contract is paid a lower confiscation amount then perhaps The Miner cannot afford to bribe Bob okay so how much lower should I go now that Bob gets we call in an honest execution so the if the minor gets less than equal to we call at that point you know reverse bribery will not happen The Miner does not have enough funds to break up okay so that is one constraint we'll place in in our eventual uh in the eventual protocol uh that we'll come up with second the harder question is you know how we

would dissent disincentivize bribery over here note that you know that it has to exist a path where Bob can still obtain V depth plus v call as a refund this is required by the htlc spec moreover based on the last slide we know that a miner cannot earn more than we call so Bob can always bribe the minor a higher amount of higher value right so this this gap between the two will always exist so over here though we utilize the fact that you know there does not exist just one minor but there exists multiple such miners so if somehow we can enforce that Bob drives multiple such miners

before he can get back his money then he cannot afford to actually bribe all of these minus how would this actually happen so let's say in this graphic over here now the timeout T is is right over here and and let's say Bob is attempting to bribe this Miner if we can enforce that this bribe is large enough let's say it's greater than we call then the miner gets a lot of money but Bob loses the same amount as well and if he keeps doing this at some point he may get his refund transaction and he may get VW plus v call back but the amount of money he has paid to the miners is so high that

the entire game is not worth it for Bob so how can we enforce this first you know if miners need to be paid greater than we call it's because they have an action available to them where they can confiscate recall okay when will the conference get recall if pre-b is available on the chain so we can enforce that you know Bob should release freebie at a certain time and after that he needs to wait for some amount of blocks over here L blocks so that he has to bribe approximately L minus so if he does not bribe a minor they

would immediately take the step where they would confiscate the money and and everything is lost if not he has to bribe them and as soon as you reach this stage where you know you're at this time t plus L where Bob can get back his money by then I think it's not profitable enough for him okay there is some constraint that needs to hold with respect to B depth we call and L in particular in this example you need V dep plus we call minus three we call or minus l b call to be less than we call or something like that so so far as we can satisfy that constraint we are good we can set L appropriately questions

[Music] that's a good question so I think since I'm designing a mitigation system over here I'm going to give you know Bob an ideal way to my to bribe so let's say Bob has that and despite that I want to design a mechanism where you know it's not profitable for Bob but I think we can discuss you know how these these bribes can happen in more detail uh maybe after the talk okay if there are no more questions then let's quickly look at what the what our implementation assess again it's very simple I'm going to just step through for how this protocol would behave under different

situations okay the first situation is where Alice reveals PA in that case pre a is available and uh the you can take this path depe where Alice gets back this money vdap and Bob gets back we call okay if Alice is inactive at that point pries is not available in the main pool and at that point Bob can attempt to get a refund when Alice is still when Alice is inactive so at that point you take these parts Deb B followed by call B so in path Deb B Bob would actually release this free image B which will increase

uh the amount of bribe he would need to pay okay at that point he does not get back anything all of these funds would be transferred to a different contract and then he needs to wait for at least L blocks after this contract has been created to actually get back his money so if at any point you know Bob attempts to cheat where he tries to get a refund when Priya is available at that point miners can take this path call them and they would get back we call and everything else would uh would be burned so give me a sense again probably both scale would be depth at

some level yes yes so let's assume that so so we call and L is something that Bob can choose over here so let's assume for Simplicity that you know all of these blocks are mined by distinct miners so I mean this is something that we discussed in the paper I'm not bringing it up here but in that situation you would want a v depth to be L times V call or L minus 1 times V call because Bob would get back so basically you get to choose so yeah I think that was the first thing

that I was about to bring up so there is a Time collateral trade-off for Bob so larger collateral means lesser weight for a refund and vice versa so if you think about it closely there is a relationship between the contract that we have over here and the kind of attacks that we spoke about so so let's take bribery attacks for Simplicity over there note that Bob was bribing these miners as well but the bribe amount was small it was only transaction fees over here by bringing in this collateral contract and making Bob pay a higher amount we are ensuring that always Bob does not have uh enough money to actually make this brand happen so in that sense there is a deeper connection between what we

have in hhtlc and the original primary attacks or for that matter hybrid attacks so we do have an implementation I'm not going to discuss about the implementation over here but it turns out that it is more efficient than what matters TLC had so with that uh I'll conclude so in this talk I spoke about the notion of active irrational minus uh we spoke about some reverse bribery attacks against state-of-the-art stlc implementation and we discussed helium htlc which is a simple practical lightweight incentive compatible hdlc protocol so our paper is online so what you see right now is an outdated version we will put up a new version by tonight

thank you foreign so just to confirm so the idea is that um honest Behavior would mean um as soon as Alice reveals pre-a Bob knows that it's been revealed because Bob can see the mempool and from that point on if Bob is on this Bob or Bob knows that Bob's in trouble if he reveals freebie and so he will just wait for create to be eventually included in the chain yes even though he already

knows it yeah what if the miners see pre-a and they withhold it and they reveal it after like between that so is something that's available to everyone so we cannot get so once you put it on it's not like you're not sending it directly to the minus point to point you're just putting it in this peer-to-peer Network and everyone can access it yeah but what if every Miner wants to collect that call um uh the last the showing so all of them decide to keep decide not to send in our services transaction on purpose without any primary they just want to collect the call and this is the Trinity of comments

because sort of you who are betting on you getting it right and if you have a short thing of like getting a chance yeah so at that point you're not getting your transaction fees which is what which is the small incentive that that you you're about to get earlier and you know and an honest Bob would not reveal pre-b or for that matter any Bob will not reveal preview at that point because if because at that point Bob does not gain anything right if it is in the mempool even if the miners are not including it in the transaction Bob would not hear it so if Bob doesn't fund he call like what would happen is everyone loses everything right if Bob does not fund uh that she comes so over here yeah yes

Bob has lost his deposit and his collateral for nothing but maybe he sees the field so so note that I think in the bigger scheme of things right so I think the example that I was giving earlier was it was an atomic swap where you are paying Bob uh some money through Bitcoin so yeah you're paying Bob some money through Bitcoin and you're getting back money from from some of the mechanisms so I think when you're when you're funding it over here you're actually not trying to get it back so although you have put in that money because you're receiving that money on the other side so so far as that happens from Bob's perspective he does not care about the fact that you lost beta so he was not supposed to get it in the first place Alice was supposed to so Alice cares about Vita Bob does

care about recall which he would lose in this case where you know the miners are just behaving in in a way that you know we are not going to do anything on unless so all we are going to do is take call them at that point you know that is not the rational thing for miners to do as well yeah I mean if we call this much bigger than the transaction fee then maybe it would be they could take a part in every minor asset 10 chance of getting it uh that might is there like no so so again I can wait long enough if I know that I'm going to get preview but Bob would give me pre-b only if he stands to gain something out of it right so for that you know you can do something like reverse bribery where I

bribe Bob something and and he gives me uh pre-b in in exchange but otherwise you know Bob has no incentive to actually give a preemie because he knows Praise on the Chain so he's not going to get anything okay so he just accepts that recall is lost yes all of my early questions it's like there's like a dog experiment it's only like 10 blocks until tea right and then you just do the math on a bright war between Like A and B right I really think about it like B breaks even if B rise at most like the deposit amount divided by 10 right and so a can win as long as they pay to ten usually I think as you increase the number of blocks until the unlock the amount 80s to drive to win is quite a small fraction because of the fact that these days when the

clock is not included next if they advertised they only has the main option so it usually in the Bible a is a huge Advantage because a only a is when you get some money B has to pay every block until the money is unlocked so it feels like it's truly either one is the simpler a never has to pay but quantitative people if you have a long time until the unlock it feels like it has a huge advantage and thus the market clearing prices so I think what you're saying is fair so over here Alice does not need to pay anything but something that I I skipped on is is the fact that you know there is a constraint with respect to how high we call can be as well because if recall is too high at that point you know Alice and minus can

get together and actually you know steal B call from Bob you can have a reverse Primary in in that angle as well so that is potentially possible but if you set V call to be less than equal to vdap I did not discuss it here we discussed it in the paper if you set it to be less than equal to V depth at that point you're fine I guess my question is less about your solution here than the question in general being very outside of the field just that it feels like one approach you could take to this question is the size of the rides when there's a lot of blocks into query is like it's very hard for me to win this fight I wonder if anyone may die so I think the way I think of it is why would you ever want to get into a

situation where I think I'm getting into a bright bar as a solution because it's a very small um bright War call if you just set the device so that would be my argument if I wanted to defend that like you just lowered on a bike speeds you you have a much simpler thing and it works okay with the dynamism it also doesn't need to be a bride board that can just be a transaction fee [Music] in an Ideal World I would not want to have this transaction fee be dependent on vdap at least the way I think of it

because it should be an independent thing but but I'm not sure like sure but it's not it doesn't lose it up to that so it's more quantitative I totally agree with you qualitatively but is it quantitatively does this end up being a bit so that's the direction maybe let's talk more about it because uh so so you're mentioning you know this can be a simpler solution than doing something like this so I I want to understand you know why you think it is simpler because to me this seems simple and I think I I know the question is the complexity foreign statement in the paper because it feels

like you're trying to say that like honestly ignorance is soaking Perfect People every other suitably defined kind of multi-stage game so yeah yeah so we try to define the game for for every block or what happens I mean it's a ultimately to ACT results can maybe refresh like she's saying are you feel like maybe the bride isn't needed at all on the equilibrium path just the thread yeah so so ultimately this boils down to like an interior guarantee that says like awesome hey there's a suddenly equilibrium and at the end of this point you might be like oh well if that's ultimately the statement maybe actually this earlier protocol would actually have that came through as soon and then that would throw the responsibility back on you and it kind of said no no but like this is a

stronger empiric statement which might be true I can still see that being true this is that actually seems like a quite delicate right it's merely just pushing complexity between some proof and some paper and a protocol you also exactly so is that fair yeah I think that's better than my face so so I also wanted to take a step back and ask um uh all this starts with hdlc but not a protocol that uses the hdlc so what is the uh context in which Alice would even need to post something with a time lock I is it part of the

lightning uh so it can be like it can be Atomic swaps so that is exactly the question that we are looking at right now to see you know what happens when hdlc is used at higher layers you know over there you're composing many htlcs as well and there are some external incentives that that may come into picture for example from layer one and we are trying to understand you know does everything hold water when you actually use it at the higher layer okay so I mean you're starting with we already solved and produced a mechanism but I'm also uh kind of questioning why did we in in which realistic context did we end up in a position where Alice wanted to post something that didn't

have in a higher level protocol already some punishment to Bob if it's you know if he was trying to fraud her or something so again I think so what you're referring to is you know what are the external incentives so if I cheat over here it is a detectable cheating right so this reverse Library happens so it is detectable so what you're saying is if at a higher layer if I could punish them at that point uh you know perhaps you would not cheat in the first place existing use cases might already have some mechanisms sure so I think so I think the Watchers that you were referring to earlier yeah all right thanks a lot