1 of 83

Historical perspective on payment channels in Bitcoin and some of the problems that emerge.

Patrick McCorry

paddykcl

PISAResearch

2 of 83

Lots of talks are about lightning.

Let’s consider designing protocols in the context of layer 2.

3 of 83

4 of 83

What is a channel?

Every party collectively authorises a new state of an application locally amongst themselves.

�The blockchain acts as a root of trust to guarantee:

Safety: Each party gets the coins they deserve

Liveness: The application will always progress

paddykcl

5 of 83

1 transaction to turn on channel

200+ transactions authorised off-chain

1 transaction to turn off channel

Ideal case: No latency, no fees, two transactions on the blockchain

Reduces load on the global network,

while retraining similar security guarantees

6 of 83

Spilman Payment Channels

Duplex Micropayment Channels

Lightning Channels

Payment channels

Only re-distribute deposit

2013

2014

2015+

7 of 83

Spilman Payment Channels

Duplex Micropayment Channels

Lightning Channels

Payment channels

Only re-distribute deposit

2013

2014

2015+

What is the big problem new constructions solve?

How to update “the state” locally between parties.

State = balance of Alice&Bob

8 of 83

Spilman One-way Channel

Funding

9 of 83

Spilman One-way Channel

Funding

One of the two spending conditions:

  • Alice gets her coins back after time t
  • Alice and Bob can authorise a transaction before time t

10 of 83

Spilman One-way Channel

Funding

One of the two spending conditions:

  • Alice gets her coins back after time t
  • Alice and Bob can authorise a transaction before time t

Block 1

Block 2

...

...

...

Block t

Funding

Refund

11 of 83

Spilman One-way Channel

Funding

B,

0.1 BTC

A

Input

Output

Payment Transaction 1

A,

0.9 BTC

Transaction History:

Alice sends Bob 0.1 BTC - 10:30pm 02/07/2016

Bob can sign and broadcast

this transaction

before time t to get his 0.1 btc

0.1 BTC

Block 1

Funding

12 of 83

Spilman One-way Channel

Funding

B,

0.6 BTC

A

Input

Output

Payment Transaction 2

A,

0.4 BTC

Bam! Another 0.5 BTC payment.

All payments effectively re-sign a new transaction and passes it to Bob.

0.5 BTC

Transaction History:

Alice sends Bob 0.1 BTC - 10:30pm 02/07/2016

Alice sends Bob 0.5 BTC – 10:32pm 02/07/2016

Block 1

Funding

13 of 83

Spilman One-way Channel

Funding

B,

1 BTC

A

Input

Output

Payment Transaction 3

A,

0 BTC

Eventually..

Alice will send all her coins to Bob.

0.4 BTC

Transaction History:

Alice sends Bob 0.1 BTC - 10:30pm 02/07/2016

Alice sends Bob 0.5 BTC – 10:32pm 02/07/2016

Alice sends Bob 0.4 BTC – 10:33pm 02/07/2016

Block 1

Funding

14 of 83

No more payments!

Bob will sign and broadcast the transaction

that pays *him* the most coins.

This is “replace by incentive”.

15 of 83

Spilman One-way Channel

Funding

B,

1 BTC

A B

Input

Output

Payment Transaction

A,

0 BTC

0.4 BTC

Block 1

Funding

Block 2

16 of 83

Spilman One-way Channel

Funding

Payment

0.4 BTC

Block 1

Funding

Block 2

17 of 83

Spilman One-way Channel

Funding

Payment

0.4 BTC

Block 1

Funding

Block 2

18 of 83

Spilman One-way Channel

Funding

Payment

0.4 BTC

Block 1

Funding

Block 2

19 of 83

Spilman One-way Channel

Funding

Payment

0.4 BTC

Block 1

Funding

Block 2

20 of 83

Spilman One-way Channel

Funding

0.4 BTC

Block 1

Funding

Block 2

Payment

21 of 83

What if we want

a bi-directional channel?

22 of 83

Replace by Timelock

Every time we change payment direction, decrement the time lock.

23 of 83

Replace by Timelock

Every time we change payment direction, decrement the time lock.

The new transaction must have a new expiry time �that is LESS than the previous transaction.

24 of 83

Replace by Timelock

Two spending conditions:

  1. Refund Alice on (or after) block 20
  2. If both Alice and Bob agree, the coins can be spent.

Funding

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

25 of 83

Replace by Timelock

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

Block 1

Block 2

...

Block 18

Block 19

Block 20

Funding

Funding

Refund is valid

26 of 83

Replace by Timelock

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

B,

0.1 BTC

A

Input

Output

Payment Transaction, t=19 days

A,

0.9 BTC

Bob receives 0.1 BTC from Alice

Expiry time is set to 19 days

0.1 BTC

Funding

27 of 83

Replace by Timelock

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

B,

0.1 BTC

A

Input

Output

Payment Transaction, t=19 days

A,

0.9 BTC

0.1 BTC

Block 1

Block 2

...

Block 18

Block 19

Block 20

Funding

Funding

Payment is valid on block 19

(Can be accepted before refund)

28 of 83

Replace by Timelock

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

B,

0.3 BTC

A

Input

Output

Payment Transaction, t=19 days

A,

0.7 BTC

0.3 BTC

Funding

Bob receives another 0.2 BTC (0.3 BTC total) from Alice

Expiry time does not change - replace by incentive!

He must broadcast this transaction after 19 days, but before 20 days.

29 of 83

Replace by Timelock

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

B,

0.3 BTC

A

Input

Output

Payment Transaction, t=19 days

A,

0.7 BTC

0.3 BTC

Block 1

Block 2

...

Block 18

Block 19

Block 20

Funding

Funding

New payment is still valid on block 19

(Can be accepted before refund)

30 of 83

Let’s change payment direction.

Bob pays Alice.

31 of 83

Replace by Timelock

B,

0 BTC

B

Input

Output

Payment Transaction 2, t=18

A,

1 BTC

0.3 BTC

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

Funding

Alice receives 0.1 BTC from Bob.

New expiry time = 18 blocks.

32 of 83

Replace by Timelock

B,

0 BTC

B

Input

Output

Payment Transaction 2, t=18

A,

1 BTC

0.3 BTC

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

Funding

Block 1

Block 2

...

Block 18

Block 19

Block 20

Funding

Payment 2 can be claimed on Block 18

Payment 1 is “replaced/invalidated” as it can only be claimed on Block 19

33 of 83

Replace by Timelock

B,

0 BTC

B

Input

Output

Payment Transaction 2, t=18

A,

1 BTC

0.3 BTC

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

Funding

Block 1

Block 2

...

Block 18

Block 19

Block 20

Funding

“Safety Time Gap” of 1 block

(not safe in practice, may need to be 10 blocks, etc)

34 of 83

Replace by Timelock

B,

0 BTC

B

Input

Output

Payment Transaction 2, t=18

A,

1 BTC

0.3 BTC

Refund Alice on (or after) block 20�OR

Alice and Bob must agree.

Funding

Alice can always claim the 1 BTC before Bob can try to reverse it using an old transaction.

… but she must be ONLINE and READY to broadcast for exactly block 18.

35 of 83

Can we do any better?

DMC tries to alleviate the “reduce expiry time” issue

Spilman Payment Channels

Duplex Micropayment Channels

Lightning Channels

Payment channels

Only re-distribute deposit

36 of 83

Pair of one-way channels

All payments are performed in the one-way channels.

Channels can be destroyed/recreated via invalidation tree

Replace Time Locks to ensure only recent branch can be broadcast.

Two components for DMC

37 of 83

Input

Output

Alice to Bob (A->B)

A,

1 BTC

B,

0 BTC

A

Input

Output

A,

0 BTC

B,

1 BTC

B

Bob to Alice (B->A)

Funding

Pair of Unidirectional Channels

Another approach to bi-directional payments

is to set up two unidirectional channels

A->B and B->A

38 of 83

Input

Output

Alice to Bob (A->B)

A,

0.7 BTC

B,

0.3 BTC

A

Input

Output

A,

0.5 BTC

B,

0.5 BTC

B

Bob to Alice (B->A)

Funding

Pair of Unidirectional Channels

Another approach to bi-directional payments

is to set up two unidirectional channels

A->B and B->A

0.3 BTC Payment

0.5 BTC Payment

39 of 83

Input

Output

Alice to Bob (A->B)

A,

0.5 BTC

B,

0.5 BTC

A

Input

Output

A,

0.8 BTC

B,

0.2 BTC

B

Bob to Alice (B->A)

Funding

Pair of Unidirectional Channels

Another approach to bi-directional payments

is to set up two unidirectional channels

A->B and B->A

0.2 BTC Payment

0.3 BTC Payment

40 of 83

Input

Output

Alice to Bob (A->B)

A,

0 BTC

B,

1 BTC

A

Input

Output

A,

0 BTC

B,

1 BTC

B

Bob to Alice (B->A)

Funding

Pair of Unidirectional Channels

Another approach to bi-directional payments

is to set up two unidirectional channels

A->B and B->A

0.5 BTC Payment

0.2 BTC Payment

41 of 83

No coins left to send!

Let’s destroy the pair of one-way channels (offchain),

And refill them! (offchain)

42 of 83

Replace by Time Lock Structure

Funding

100d

100d

100d

Setup

Invalidation Tree

Signed by both parties

K

Transaction with an Absolute Lock Time

Unidirectional Channel (Payment Transaction)

Unidirectional

Channels

43 of 83

Replace by Time Lock Structure

100d

100d

100d

Setup

Invalidation Tree

Signed by both parties

K

Transaction with an Absolute Lock Time

Unidirectional Channel (Payment Transaction)

Notation Legend

99d

100d

100d

Unidirectional

Channels

Funding

44 of 83

Replace by Time Lock Structure

100d

100d

100d

Setup

Invalidation Tree

Signed by both parties

K

Transaction with an Absolute Lock Time

Unidirectional Channel (Payment Transaction)

Notation Legend

99d

100d

100d

99d

100d

Unidirectional

Channels

Funding

45 of 83

Replace by Time Lock Structure

Signed by both parties

K

Transaction with an Absolute Lock Time

Unidirectional Channel (Payment Transaction)

Notation Legend

100d

100d

100d

Setup

Invalidation Tree

99d

100d

100d

99d

100d

99d

Unidirectional

Channels

Funding

46 of 83

So far… it has all been a bit clunky right?

Hard to get rid of expiry time, limits on throughput of channel, etc.

Lightning Channels fixes that.

47 of 83

Both parties must co-operate for each payment….

State #1: Current Balance

Lightning Channels�Poon & Dryja (2015)

48 of 83

Both parties must co-operate for each payment….

Step 1: Agree a new channel state that represents the new balance

State #2: New Balance

State #1: Current Balance

Lightning Channels�Poon & Dryja (2015)

49 of 83

Both parties must co-operate for each payment….

Step 1: Agree a new channel state that represents the new balance

Step 2: Revoke the previous channel state that represented the old balance

Revoked State #1

State #2: New Balance

Lightning Channels�Poon & Dryja (2015)

50 of 83

Both parties must co-operate for each payment….

Step 1: Agree a new channel state that represents the new balance

Step 2: Revoke the previous channel state that represented the old balance.

Repeat

State #1

State #2

State #3

State #4

Lightning Channels�Poon & Dryja (2015)

State #5: New Balance

51 of 83

State #1

State #2

State #3

State #4

State #5

State #6

State #7

State #8

State #9: New Balance

Lightning Channels�Poon & Dryja (2015)

State #8

State == Pair of Signed Transactions

One transaction for Alice

One transaction for Bob

Disclaimer:

I’m not showing the transactions since its quite complex to get on a slide.

52 of 83

State #1

State #2

State #3

State #4

State #5

State #6

State #7

State #8

BLOCKCHAIN

State #9: New Balance

Lightning Channels�Poon & Dryja (2015)

State #8

What happens if an old state is accepted into the blockchain?

53 of 83

What happens if an old state is accepted into the blockchain?

It triggers a dispute process:

A fixed time period for the non-broadcaster to respond and prove it was a revoked state.

State #1

State #2

State #3

State #4

State #5

State #6

State #7

State #8

State #9: New Balance

Lightning Channels�Poon & Dryja (2015)

State #8

BLOCKCHAIN

State #4

54 of 83

What needs to be broadcast in response?

The non-broadcaster of the old state must publish a justice transaction to claim all coins in the channel!

Replace by Revocation

State #1

State #2

State #3

State #4

State #5

State #6

State #7

State #8

State #9: New Balance

Lightning Channels�Poon & Dryja (2015)

State #8

BLOCKCHAIN

State #4

55 of 83

State #1

State #2

State #3

State #4

State #5

State #6

State #7

State #8

Lightning Channels�Poon & Dryja (2015)

State #9: New Balance

What do we need to create a Justice Transaction?

�“Some information” to later prove the old state was indeed revoked!

56 of 83

State #1

State #2

State #3

State #4

State #5

State #6

State #7

State #8

Lightning Channels�Poon & Dryja (2015)

State #9: New Balance

What do we need to create a Justice Transaction?

�“Some information” to later prove the old state was indeed revoked!

Party:

Preimage (or hash tip)

Watch Tower:

A signed justice transaction.

57 of 83

State #1

State #2

State #3

State #4

State #5

State #6

State #7

State #8

Lightning Channels�Poon & Dryja (2015)

State #9: New Balance

This is why watch towers are impractical TODAY in lightning.

O(N) storage: Tower must keep around a justice transaction for every in-channel update.

58 of 83

Every payment authorises a new “state”

There are several “state replacement” techniques:

  • Replace by Incentive (Spilman Channels)
    • Limited Throughput
  • Replace by Time Lock (Duplex Micropayment Channels)
    • Limited Resets (and lots of transactions in worst-case)
  • Replace by Revocation (Lightning Channels)
    • O(N) storage due to justice transactions

But… problems emerge due to Bitcoin’s scripting facility and UTXO model when we try to remove the expiry time and throughput limitation.

59 of 83

Concretely, what problems emerge?

60 of 83

State and Transaction is intertwined

  • The “state” is restricted:
    • Only considers balances and single-hop conditional transfers. �
  • Watch towers are not yet practical.
    • State == transaction
    • O(N) storage: A pre-signed justice transaction for *every channel update*. �
  • Transaction malleability was a pain in the ass
    • This wasn’t fixed until 2017 (SegWit)
    • If the state was separated to begin with, there would have been no issue�
  • Tx fee is fixed!
    • Awkward to change tx fee
    • (IIRC, replace-by-fee doesn’t work)�As broadcaster’s output is locked.

61 of 83

Single state transitions only

  • We can only design protocols with “one hop or transition” in mind.
    • An input cannot determine how the output is created.
    • Covenants can help here, but not yet supported. �
  • Triggering a dispute commits to one state (even if its invalid).
    • Replace by Revocation (Lightning): We must punish the counterparty for broadcasting an old state.
    • Replace by Time Lock: Honest party must be online *at just the right time* to broadcast a transaction.

No way to update the blockchain within a dispute period to say “wait, there is a later valid state”.

62 of 83

Lightning specific: Make sure your node doesn’t crash.

If the latest state is lost, you will lose all your coins - if the counterparty is not friendly.

Slashing isn’t always great - it hurts reliability as accidental crash = malicious behabviour.

63 of 83

Remember - Satoshi Nakamoto - had no idea how layer 2 would evolve!

Bitcoin isn’t designed with layer 2 (or off-chain protocol design) in mind!

64 of 83

What about Ethereum?

Can we do any better if the platform’s scripting language is more expressive?

65 of 83

Spilman Payment Channels

Duplex Micropayment Channels

Lightning Channels

Raiden Channels

Payment channels

Only re-distribute deposit

66 of 83

Spilman Payment Channels

Duplex Micropayment Channels

Lightning Channels

Raiden Channels

Sprites Channels

(us!)

Perun Channels

Counterfactual

Kitsune�(us!)

State channels

gaming, voting, auctions, etc

Payment channels

Only re-distribute deposit

67 of 83

Kitsune Channels: What is sent to the blockchain?

σA, σB, hstatei , i

Signatures from both parties

Hash of state

H(gamestate,r)

State version �(Monotonic counter)

https://nms.kcl.ac.uk/patrick.mccorry/battleship.pdf

68 of 83

Kitsune Channels: What is sent to the blockchain?

Signatures from both parties

Hash of state

H(gamestate,r)

State version �(Monotonic counter)

The hstate associated with the largest version “i” is considered the most recent authorised off-chain state.

σA, σB, hstatei , i

69 of 83

The Dispute Process (Kitsune) �

Step 1: One party triggers the dispute and there is a fixed time period for all parties to submit the latest agreed off-chain state.

Block 1

Initiate Dispute

Initiate Dispute

One party can initiate the dispute process.

Sets a fixed time period for all parties to respond.

70 of 83

The Dispute Process (Kitsune) �

Step 2: Any party can submit “the latest agreed state” to the blockchain

Submit State (Hash) + Version

All parties can hash of latest state (alongside counter)

Block 1

Block 2

Block ...

Block N-1

Initiate Dispute

hstate,

i

Block 3

hstate, i+1

71 of 83

The Dispute Process (Kitsune) �

Step 3: After the dispute period has expired, the blockchain decides the final state of the app and the dispute is “resolved”.

Block 1

Block 2

Block ...

Block N-1

Block N

Initiate Dispute

hstate,

i

Block 3

hstate, i+1

Resolve Dispute

Resolve Dispute

hstate, i+1 stored as the final commitment

72 of 83

After the dispute is resolved...

The application is re-deployed and

its execution simply continues via the blockchain.

73 of 83

Why are the state channel designs really cool?

No expiry time

No transaction throughput limitation

We don’t sign transactions, but a “commitment to the state”.

Easy to support WatchTower services.

No clunkiness - super straight forward.

74 of 83

This isn’t “new” for the bitcoin community either. �There are real attempts to get this style of dispute process into Bitcoin

75 of 83

76 of 83

Slide from roasbeef’s �2018 BPASE talk.

Replace by Version!

77 of 83

New opcodes!

SIGHASH_NOINPUT to support Replace by Version (similar to state channel)

eltoo supports “temporary state” to let us tell the blockchain which state is really “the latest” during the dispute period.

78 of 83

Even if you don’t like Ethereum for whatever reason

Expressive smart contracts significantly simplify protocol design�

Smart contracts are not “just” about dapps, �but programmable and publicly verifiable third parties

It solves the “coordination” problem, where parties cannot �appoint a single entity to run the protocol for them.

79 of 83

Even if you don’t like Ethereum for whatever reason

Expressive smart contracts significantly simplify protocol design�

Smart contracts are not “just” about dapps, �but programmable and publicly verifiable third parties

It solves the “coordination” problem, where parties cannot �appoint a single entity to run the protocol for them.

Of course, it isn’t all rosey �in the Ethereum world either.

80 of 83

We should do our best to make it as �EASY as possible to design protocols in Bitcoin.

81 of 83

We should do our best to make it as �EASY as possible to design protocols in Bitcoin.

While Bitcoin “script” is simple, �it pushes complexity to the protocol design layer*

*There is a long-running joke that designing a protocol on top of Bitcoin gets you a top-tier academic paper, whereas in Ethereum it gets you a blog post.

82 of 83

We should do our best to make it as �EASY as possible to design protocols in Bitcoin.

While Bitcoin “script” is simple, �it pushes complexity to the protocol design layer*

This needs to be fixed, so let’s advance bitcoin.

*There is a long-running joke that designing a protocol on top of Bitcoin gets you a top-tier academic paper, whereas in Ethereum it gets you a blog post.

83 of 83

Thanks for listening!

Off-chain Summary from 2015:

http://homepages.cs.ncl.ac.uk/patrick.mccorry/paymentnetworks.pdf

Sprites - Speed up routing & state channels

https://arxiv.org/abs/1702.05812

Kitsune (and battleship):�https://nms.kcl.ac.uk/patrick.mccorry/battleship.pdf

PISA:

https://eprint.iacr.org/2018/582.pdf

Painting the landscape for off-chain�https://eprint.iacr.org/2019/360.pdf

paddykcl

PISAResearch