Bitcoin (BTC) Lightning Update: A New Vulnerability or Just FUD?

By Michael @ CryptoEQ | CryptoEQ | 29 Aug 2022


e7c579334da5fdc994e6bd4b0c5bb7df36d472a365c31e45dcb72ec91fb5fbc6.png

If you want more cryptocurrency analysis, including full-length research reports, trading signals, and social media sentiment analysis, use the code "Publish0x" when subscribing to CryptoEQ.io to make your first month of CryptoEQ just $10! Or simply click the button above!

 

Lightning Overview

Bitcoin's programming language does not support loops or complex flows, making it incredibly difficult to create fully-expressive smart contracts directly on its base layer. Additionally, because the Bitcoin blockchain can handle so few transactions per second, the more people use and transact on the Bitcoin network, the more expensive it becomes for a user to get their transaction included in a block. This has led many to begin devising ways to scale the capacity of Bitcoin. 

However, Bitcoin's lengthy 10-minute block time is not conducive for many use cases that require fast settlement or several transactions like DeFi. In addition, Bitcoin transaction fees are relatively high; in 2021, the average Bitcoin transaction cost was over $10. The transaction fees of numerous rival networks are as low as fractions of a penny.

Since the security of the overall system is of the utmost importance and adding changes could lead to mistakes or vulnerabilities, one newly created scaling solution involves creating a second layer where transactions are recorded in a separate payment channel and not directly “on-chain.” To address just this, Joseph Poon and Thaddeus Dryja wrote the Lightning Network white paper, 'The Bitcoin Lightning Network: Scalable Off-Chain Instant Payments' in 2015.

Bitcoin’s second layer is called the Lightning Network (LN). The Light­ning Network enables users to open multi-signa­ture payment channels with each other in which they can send fractions of bitcoins back and forth without paying on-chain transaction fees each time. A Lightning channel is a bidirectional payment channel, meaning both parties can send and receive payments across the channel. If at any point one party would like to exit the channel or settle their transactions, they can close the channel and settle back on the base layer. This means users can fit many trans­ac­tions into one fee-driven large settle­ment.

Importantly, as a second layer to Bitcoin, the LN is not its own blockchain or token. It is 100% reliant on Bitcoin for its security. The Bitcoin main chain acts as the final arbiter to any disputes on a second layer.

How It Works

The most frequently cited analogy (and overly simplistic) is the “bar tab” analogy. In this example, when one goes to a bar with a credit card, they open a tab with the bartender if they intend on having multiple drinks. This person and the bar open a payment channel with the credit card. The patron then buys drink after drink all night (responsibly, of course) and, once finished, closes the payment channel and settles up. The only transaction that the bank sees is for the total amount of the drinks, not each individual drink. 

Impor­tantly, an individual doesn't need to have a channel open with the exact person with which they're trying to transact. They only need to have a path from node-to-node-to-node that eventu­ally links to that person. Routing is what enables transactions between two unconnected nodes to occur through pre-existing linked channels. Routing between other-wise unconnected nodes is enabled by Hashed Time Locked Contracts (HTLCs). An HTLC is a unique type of smart contract transaction and is used to allow one party to guarantee payment to another through a shared node connection. Separate individual nodes have the ability to allocate their bitcoin liquidity to help route payments between two parties that are not directly connected.

ca58968dc452a7b1542adc3e59c43e6a44ef2bf2619626a17001e402bc9cc509.png

Lightning Network Routing Depiction. Source: CoinShares

However, there remain several issues surrounding the LN. One issue that exists is the lack of economic incentives for such a router. Solutions are being worked on, like Lightning Pool, which provides a market where LN users can lease liquidity for payment channels. This creates a financial reward/incentive for other Lightning nodes to provide routing and increase liquidity. 

Additionally, while the Lightning Network seeks the cheapest route for transactions, finding consistent channels can be difficult for larger payments. First, transaction size depends on the node initiating it. Second, timelock contracts can have transfer limits. Timelock contracts specify minimum and maximum BTC values for routing nodes. Finding BTC relay nodes might be difficult. Centralized nodes are another network problem. With centralized nodes, the network loses redundancy, and certain users may not discover a linked node.

Other improvements to the LN over the years include the Wumbo upgrade, which removed the original 0.1677 BTC limit on individual LN channels and allowed users to deposit more BTC. The original cap was imposed to limit the user’s exposure to loss should the LN encounter a critical bug in its early stages. Wumbo channels allow large routing nodes to support much higher daily volumes, making the network more practical for all use cases, not just very small transactions.

To open a Bitcoin Lightning channel, two Bitcoin users will deposit bitcoin in a 2-of-2 multi-sig address on the main chain and wait for that transaction to be confirmed on-chain.  Users can only send and receive up to the amount of bitcoin that was originally committed by both parties, no more. When the users are done transacting, the channel is closed with a final on-chain Bitcoin transaction. This final transaction reflects the net change in both users' balances from their time transacting off-chain.

As of Q2 2022, bitcoiners looking to use the LN now have more user-friendly options. Users that wish to run their own Lightning node can choose from companies like Casa, Lightning Labs, or Umbrel, and users looking for LN wallets can take a look at Phoenix, Muun, Breez, or Strike. Strike, possibly the most well-known Lightning service, is an app that enables users to transact on the Lightning Network with a USD bank account. More Lightning Network resources can be found here.

807f48780354c326041d68e8dbf098611f591e34d1504d3d0e86f5ff9095c2e8.png

Source

 

The latest improvement to the LN technology stack is the proposed Taro upgrade. Introduced by Lightning Labs in April 2022, Taro aims to enable Lightning users to send stablecoins and other assets over the LN at virtually zero cost. As of Q3 2022, Taro is still in the process of being implemented. So far, analysis conducted on Taro and LN as a whole has concluded that Taro will effectively serve as a tool to remove taxable events from Lightning Network transactions. By leveraging the fiat-to-bitcoin-to-fiat payment railway, those in developing nations where inflationary pressures are high or banking resources are inefficient could utilize Taro to facilitate global payments with no tax implications.

The European Central Bank (ECB) has even gone as far as to identify Bitcoin and the Lightning Network as legitimate competitors in the global cross-border payments market in its latest Q3 2022 report on the subject. The ability to send stablecoins over the Lightning Network gives the entire network more utility and further cements the fundamental Bitcoin peer-to-peer network as usable on a global scale. As of 2022, the global cross-border payments market is valued above $37 trillion. Cross-border payments have long been inefficient and costly, remaining a largely unsolved issue.

Identified Lightning Network Vulnerability

As of Q3 2022, there has been one significant vulnerability detected. The vulnerability is referred to as channel jamming. Essentially, a malicious actor or series of actors can utilize a denial of service attack (DOS) to prevent the routing nodes from successfully sending along the transaction in an L2 peer-to-peer engagement on LN. Because two nodes do not need to interact directly, this prevents payments from being executed, resulting in a failed payment. As failed payments build up over time, the reliability of the LN is compromised, and the network slows down. A bigger problem with this concept is that the payments don’t technically fail as they cannot time out after the forwarding process has begun between routing nodes, so the network effectively faces congestion until it stops functioning entirely.

This can pose a serious problem in terms of LN adoption and utility. Lightning Network is directly competing with other global cross-border payment solutions, including other blockchain networks. Even in the event of large stablecoin use, if there is a reasonable expectation that a transaction may fail and not execute, this may incentivize consumers to use other payment options.

There have been proposals as to the best way in which to counteract channel jamming attacks. One such proposal is to increase the slot limit to allow more than the current allotted 483 slots in any given channel. This would make it more difficult to successfully execute a channel jamming attack but not impossible. The cost of the attack would linearly scale upwards, but it wouldn’t stop it from being initiated.

dd8fa85c034e5f76c2d2a8813e15cf7420336703e16f0e6abde66df39171f61f.png

Another solution is to monitor individual peer activities and implement transaction limits. Theoretically, this would be able to limit extraordinary and suspicious inbound activity like that of a DOS attack. The problem here is that the privacy technology and pseudonymous nature of the LN makes identifying individual activities purposefully more difficult. As of Q3 2022, there is no consensus as to the best implementations to prevent such attacks from occurring. Many proposals are simply untested at scale and could result in a greater deal of cost or difficulty for minimal impact in slowing or stopping channel jamming attacks.

How do you rate this article?

54


Michael @ CryptoEQ
Michael @ CryptoEQ

I am a Co-Founder and Lead Analyst at CryptoEQ. Gain the market insights you need to grow your cryptocurrency portfolio. Our team's supportive and interactive approach helps you refine your crypto investing and trading strategies.


CryptoEQ
CryptoEQ

Gain the market insights you need to grow your cryptocurrency portfolio. Our team's supportive and interactive approach helps you refine your crypto investing and trading strategies.

Send a $0.01 microtip in crypto to the author, and earn yourself as you read!

20% to author / 80% to me.
We pay the tips from our rewards pool.