You are reading an excerpt from our free but shortened abridged report! While still packed with incredible research and data, for just $20/month you can upgrade to our FULL library of 50+ reports (including this one) and complete industry-leading analysis on the top crypto assets. 

Becoming a Premium member means enjoying all the perks of a Basic membership PLUS:

• Full-length CORE Reports: More technical, in-depth research, actionable insights, and potential market alpha for serious crypto users
• Early access to future CORE ratings: Being early is sometimes just as important as being right!
• Premium Member CORE+ Reports: Coverage on the top issues pertaining to crypto users like bridge security, layer two solutions, DeFi plays, and more
• CORE report Audio playback: Don’t want to read? No problem! Listen on the go.

Lightning Network

Announcement

A significant vulnerability in the Lightning Network (LN), Bitcoin's Layer-2 scaling solution, has been uncovered by Antoine Riard, a security researcher and key developer of LN. The discovery has reignited debates about security protocols in blockchain structures that oversee substantial funds.

First, What Is the Lightning Network (LN)?

Contrary to popular belief, Bitcoin is a settlement, not a payment network. The blockchain acts as an immutable ledger, but the sending and receiving of micropayments are unrealistic due to fees. To overcome this scalability blockade, Joseph Poon and Thaddeus Dryja wrote their 2015 white paper, “The Bitcoin Lightning Network: Scalable Off-Chain Instant Payments,” as they aimed to create a second-layer solution without compromising the security of the base layer. In simple terms, the Lightning Network’s goal is to allow for quick and low-cost peer-to-peer microtransactions occurring on a payment channel that’s not a part of Bitcoin’s base layer until settlement. The most commonly used analogy is the idea of a bar tab. When one goes to a bar with a credit card, they open a tab if they intend to have multiple drinks. This customer and the drinking establishment open a payment channel through the credit card. The patron (responsibly) buys drinks throughout the night and closes the payment channel by paying the final check. The bank only sees transactions for the total amount of drinks, not each drink. Lightning works similarly.

The LN lets users open multi-signature payment channels with each other to send fractions of BTC back and forth without paying transaction fees each time. A Lightning channel is bidirectional, meaning both parties can send/receive payments. If one party wants to exit the channel or settle their transactions at any point, they can close the channel and settle back on the base layer. This means users can fit numerous transactions into one large fee-driven settlement. As an L2 to Bitcoin, the Lightning Network is not its own blockchain or token. It maintains its reliance on Bitcoin for its security. The Bitcoin mainchain acts as the final arbiter to any disputes on this secondary layer. 

Moreover, an individual doesn’t need to have an open channel with the exact person with which they’re trying to transact. They only need to have a clear path from node-to-node-to-node that eventu­ally links to said person. Routing is what enables transactions between two unconnected nodes to occur through pre-existing linked channels. Hashed Time Locked Contracts (HTLCs) enable routing between otherwise unconnected nodes. An HTLC is a special type of smart contract transaction and is used to allow one party to guarantee payment to another through a shared node connection. Separate individual nodes have the ability to allocate their Bitcoin liquidity to help route payments between two parties that are otherwise not directly connected.

The first Lightning Network implementation was launched in March 2018 and wasn’t possible until the implementation of another Bitcoin enhancement, SegWit. In August 2017, SegWit introduced a new paradigm for block size calculation in the Bitcoin protocol, transitioning from a simplistic 1MB limit to a more nuanced system of Weight Units (WUs). Under this system, each block is constrained to a maximum of 4 million WUs, a change that allows for more efficient use of block space.

The SegWit-modified Bitcoin transaction incorporates a bifurcated structure:

1. The transactional segment encompasses sender and receiver information, along with input and output specifics. In the WU system, every vByte of this transactional data equates to four WUs, effectively quadrupling its 'weight' relative to the second segment.

2. The 'witness' segment, on the other hand, houses cryptographic signatures and scripts. In this case, each vByte of witness data carries a single WU - a quarter of the 'weight' of transaction data. This differential weighting system was devised to optimize block space utilization while maintaining robust security measures.

Although Poon and Dryja were not the first to discuss and promote off-chain scalability solutions, their white paper inspired multiple development teams (such as Lightning Labs, Blockstream, and ACINQ) to work on the Lightning Network with the goal of making it the most robust payment layer built on top of Bitcoin. 

Back to the Newly Discovered Vulnerability

Riard's disclosure pertains to a vulnerability he labels as “replacement cycling attacks.” This kind of attack targets the Hash Time Lock Contracts (HTLC), which are instrumental in the operational mechanics of the LN. Essentially, these attacks tamper with the HTLC state, potentially impacting the shared funds in channels.

In response to the identified threat, Riard rolled out a set of mitigations on October 16. However, he expressed reservations regarding their efficacy against potential malefactors, noting that while they might deter rudimentary attack attempts, adept attackers could potentially sidestep these safeguards.

Reflections on Protocol Deployment

After shedding light on the vulnerability, Riard declared his intention to disengage from LN development endeavors, particularly those focusing on protocol-level security issues. Riard's apprehensions about the identified vulnerability are profound. He contends that this discovery should prompt introspection about the prevailing development procedures, especially for blockchain architectures responsible for substantial capital.

Several developers have floated potential strategies to mitigate this attack vector. However, the complexity of the issue is underscored by Bitcoin developer Matt Corallo. He emphasized that rectifying this in the Bitcoin Core system would be far from straightforward. The inherent challenge lies in maintaining sufficient history to address the attack without causing the Bitcoin Core to demand unlimited memory.

The Way Forward

Corallo attempted to allay concerns within the Bitcoin community. While he conceded that the LN had challenges to address, he negated the notion that it was inherently compromised. He noted, “Lightning is (currently) for channel counterparties you trust not to do a ton of work to build novel software to attack you.”

In summation, the revelation of this vulnerability in the Lightning Network brings to the fore critical questions about security measures, development protocols, and the evolving nature of blockchain infrastructures. As the discourse unfolds, it will be imperative to strike a balance between innovation and security in this rapidly evolving space.

Taproot

Announcement

Lightning Labs, a leading developer specializing in Bitcoin's layer-2 solutions, has taken a groundbreaking step with the launch of its Taproot Assets protocol on the primary network. This development paves the way for integrating stablecoins and diverse assets into Bitcoin and its Lightning network.

First, What is Taproot?

Taproot, released in November 2021, was Bitcoin’s first soft-fork upgrade in four years. It is ultimately three different BIPs: Schnorr Signatures, Taproot, and Tapscript. In concert, these three proposals will introduce a more private and efficient means of transferring bitcoin. 

Taproot will utilize Schnorr signatures and is considered more secure than Elliptic Curve Digital Signature Algorithm (ECDSA) signatures on which Bitcoin cryptography currently runs.  However, it is important to note that there have been no examples of ECDSA being compromised and remaining secure. However, Schnorr signatures rely on fewer assumptions and eliminate any signature malleability that might have been present in ECDSA signatures. 

Schnorr signatures will bring added privacy, lower fees, and enhanced multi-signature signing to Bitcoin. Taproot integrates Merkelized Alternative Script Types (MAST), which allows users to lock outputs to multiple scripts and is considerably less expensive than current methods.

The privacy benefits from the Taproot upgrade come from the fact that by using Schnorr signatures and key aggregation, multisig contracts/addresses are now indistinguishable from single-signature contracts. This makes onchain analysis much more difficult because all contracts look the same.

Back to the News

According to Ryan Gentry, Lightning Labs' Director of Development, Taproot equips developers with the requisite tools to evolve Bitcoin into a scalable multi-asset network while preserving the foundational principles underpinning Bitcoin. "The release marks the dawn of a new era for Bitcoin," Gentry emphasized.

One of the paramount visions of Lightning Labs centers around the facilitation of foreign exchange transactions via the Lightning network. Reflecting on the feedback from the developer community, the company acknowledged that the integration of stablecoins into applications ranks high among the most fervent requests.

In essence, the introduction of the Taproot Assets protocol signals a pivotal moment in Bitcoin's evolutionary journey, enhancing its versatility and catering to a broader spectrum of financial functionalities.