bitcoin-dev

A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

A "Free" Relay Attack Taking Advantage of The Lack of Full-RBF In Core

Original Postby Antoine Riard

Posted on: August 16, 2024 04:20 UTC

Peter Todd's email to Dave provides an in-depth analysis and critique of the current state and potential future directions of Bitcoin protocol development, especially concerning the relationship between the core protocol and second-layer solutions like the Lightning Network (LN).

He starts by addressing the categorization of miners and volunteer relay node operators, stating their distinct roles and capabilities within the network, particularly highlighting miners' unique ability to include non-standard transactions in their blocks. This distinction is crucial for understanding various attack vectors, such as those related to dust HTLCs, which miners could exploit due to their privileged position in transaction selection.

Todd then shifts focus to discuss the broader implications of game theory incentives in LN and the importance of considering these when designing protocol extensions. He warns about the potential for unintended consequences on the base layer due to these second-layer protocols, referencing his own experience with a halted project due to concerns over creating new avenues for spam attacks.

The email deepens into a critique of how Bitcoin Core developers approach the design and implementation of mechanisms affecting downstream projects. Drawing from recent security vulnerabilities found in anchor outputs and other features, Todd argues that these issues stem from a lack of understanding of operational inter-dependencies between the protocol's components. He cites the IETF's documentation on TCP/IP development to underscore the principle that increased complexity and interdependence in large systems can lead to unforeseen interactions and vulnerabilities.

Todd advocates for a change in culture regarding the design and deployment of peer-to-peer or mempool policy mechanisms that support downstream protocols like LN. He calls for Bitcoin Core developers, especially those working on subsystems interfacing with downstream protocols, to have a thorough understanding of those protocols’ inner workings. He criticizes the initial proposals and implementations of TRUC for not achieving technical consensus and potentially causing more harm than good in the long term.

Furthermore, Todd discusses the challenges of predicting mempool congestion and its impact on attack strategies within the context of LN. He emphasizes the practical aspects for attackers, pointing out the need for more detailed analysis on one-shot Replace-By-Fee (RBFR) and suggests a shift towards more modular transaction acceptance policies in Bitcoin Core to better accommodate alternative policies like RBFR.

Lastly, he expresses concerns about the long-term viability of TRUC as a solution to minimize lightning pinning risks. He highlights the false security guarantees it might provide due to the non-uniformity of transaction acceptance policies among miners, suggesting that reliance on uniform policy mechanisms like TRUC may not effectively ground downstream protocols' safety.

Overall, Todd's email emphasizes the need for a more coordinated and informed approach to Bitcoin protocol development, advocating for systemic changes to ensure the safety and reliability of Bitcoin and its layered solutions.