How do "trustless third-party watchers" work in Lightning Network?

The main point with LN is the need to monitor the blockchain. The reason for this is to detect if the counterparty misbehaves by publishing an old channel state to the blockchain. For a node running on a server, that is not a big problem since it is always online, but mobile nodes might go offline for days, so how do we deal with this issue?

The need to monitor the blockchain actually only exists if the channel is used in both directions: if you are only paying, any outdated commitment transaction will be more in your favor than the current one, so there is really nothing to do!

But in case of two-way payment channels, this seems to be resolved by "trustless third-party watchers". Since I can't find much literature on the internet about them, I was wondering, how do they work and how exactly are they trustless? For that matter, how do you actually trust that anybody is going to publish on your behalf, and why? Are there incentive mechanisms in place for this to be completely trustless?

Luca Matteis

Posted 2017-07-28T12:08:14.473

Reputation: 4 784

Here's something I found online: http://diyhpl.us/wiki/transcripts/scalingbitcoin/milan/unlinkable-outsourced-channel-monitoring/

– Luca Matteis – 2017-07-28T13:03:37.317

Correct me if I'm wrong, but even if the channel is one-directional, doesn't the counterparty also have an incentive to monitor the blockchain for old commitment txs? So watchtowers are also needed in that case. – Paul Razvan Berg – 2018-07-11T09:18:28.077

@PaulRBerg no, for one-directional payment channels this would not be needed.

Imagine a one-directional channel from Alice to Bob. The latest state is always the most lucrative for Bob, so he wouldn't cheat because he's lacking the incentive to do so. I know, you already knew that and you care more about what happens the other way around. So why wouldn't Alice broadcast an old state? Simple: she can't. While Alice is sending tx after tx to Bob, spending their 2-of-2 multisig she would always sign the transactions, while Bob actually neither has to sign nor send the transaction anywhere. – Dalit Sairio – 2018-10-30T18:22:48.243

The first time Bob would need to sign and broadcast the transaction is when he wants to close the channel. – Dalit Sairio – 2018-10-30T18:24:13.320

Answers

I suppose that when you refer to "third-party watchers" you mean watchtowers. I do agree that 'trustless' is probably an ambiguous word in this context. At the time of writing, the only actual proposal with a protocol that I am aware of is PISA, by Andrew Miller et al. PISA allows users to select a custodian that will be incentivised in publishing. Users pay the custodian, and the custodian loses funds if it does not perform (i.e. if the counterparty node manages to publish an old state).

At the moment, seems like Roger Wattenhofer is working on it too. However, They have not proposed a protocol yet. Their idea is to incentivise through rewards when channels are 'saved', instead of through penalisation when a watchtower does not save on time.

Both sides have pros and cons.

The con of Miller's proposal is that one must choose the watchtower, having to trust in it. The counterparty might try to bribe the watchtower, so that they both earn more than the penalisation.
Wattenhofer's proposal does not have this problem, as anyone in the network can retrieve the reward, and thus everyone is the watchtower. The problem of this proposal is that there are incentives for people to attack other people and prevent them from publishing themselves.

This is a work in progress. As for a self-claimed trustless watchtower, there has been some discussion in the ligthing-dev mailing list here and here, but it is yet a work in progress.

ranchalp

Posted 2017-07-28T12:08:14.473

Reputation: 449

Watchtowers are not trustless, you trust them to monitor the blockchain on your behalf and broadcast a justice transaction in the event of your remote party (counterparty) broadcasting a revoked state. If the watchtower fails to do this you could still lose funds. As a result you may choose to use multiple watchtowers to diversify the risk of an individual watchtower failing to recover your funds.

The early implementation of watchtowers in lnd 0.7 differentiates between "altruistic" and "basic reward" watchtowers where the latter receives a fee if they broadcast a justice transaction. The remote party could bribe the watchtowers if they knew which watchtower(s) were monitoring the chain on your behalf. This is not public information nor does it need to be shared with the remote party and so it should be extremely difficult for the remote party to discover this information.

For more information on the current implementation of watchtowers in lnd here is a presentation from Conner Fromknecht (Lightning Labs).

Video: https://www.youtube.com/watch?v=2tyr05tLF4g

Transcript: http://diyhpl.us/wiki/transcripts/boltathon/2019-04-06-conner-fromknecht-watchtowers/

Here is a link to the lnd watchtower GitHub repo: https://github.com/lightningnetwork/lnd/tree/master/watchtower

The other Lightning implementations do not include watchtower functionality as of today's date (August 2019) but c-lightning seems likely to follow a similar approach to lnd.

Michael Folkson

Posted 2017-07-28T12:08:14.473

Reputation: 595