On Wed, Apr 22, 2020 at 03:53:37PM -0700, Matt Corallo wrote: > if you focus on sending the pinning transaction to miner nodes > directly (which isn't trivial, but also not nearly as hard as it > sounds), you could still pull off the attack. If the problem is that miners might have information not available to the network in general, you could just bribe them for that knowledge. E.g. as Bob's refund deadline approaches and he begins to suspect that mempool shenanigans are preventing his refund transaction from confirming, he takes a confirmed P2WPKH UTXO he's been saving for use in CPFP fee bumps and spends part of its value (say 1 mBTC) to the following scriptPubKey[1], OP_SHA256 OP_EQUAL Assuming the feerate and the bribe amount are reasonable, any miner who knows the preimage is incentivized to include Bob's transaction and a child transation spending from it in their next block. That child transaction will include the preimage, which Bob will see when he processes the block. If any non-miner knows the preimage, they can also create that child transaction. The non-miner probably can't profit from this---miners can just rewrite the child transaction to pay themselves since there's no key-based security---but the non-miner can at least pat themselves on the back for being a good Summaritan. Again Bob will learn the preimage once the child transaction is included in a block, or earlier if his wallet is monitoring for relays of spends from his parent transaction. Moreover, Bob can first create a bribe via LN and, in that case, things are even better. As Bob's deadline approaches, he uses one of his still-working channels to send a bunch of max-length (20 hops?) probes that reuse the earlier HTLC's . If any hop along the path knows the preimage, they can immediately claim the probe amount (and any routing fees that were allocated to subsequent hops). This not only gives smaller miners with LN nodes an equal chance of claiming the probe-bribe as larger miners, but it also allows non-miners to profit from learning the preimage from miners. That last part is useful because even if, as in your example, the adversary is able to send one version of the transaction just to miners (with the preimage) and another conflicting version to all relay nodes (without the preimage), miners will naturally attempt to relay the preimage version of the transaction to other users; if some of those users run modified nodes that write all 32-byte witness data blobs to a database---even if the transaction is ultimately rejected as a conflict---then targetted relay to miners may not be effective at preventing Bob from learning the preimage. Obviously all of the above requires people run additional software to keep track of potential preimages[2] and then compare them to hash candidates, plus it requires additional complexity in LN clients, so I can easily understand why it might be less desirable than the protocol changes under discussion in other parts of this thread. Still, with lots of effort already being put into watchtowers and other enforcement-assistance services, I wonder if this problem can be largely addressed in the same general way. -Dave [1] Requires a change to standard relay and mining policy. [2] Pretty easy, e.g. bitcoin-cli getrawmempool \ | jq -r .[] \ | while read txid ; do bitcoin-cli getrawtransaction $txid true | jq .vout[].scriptPubKey.asm done \ | grep -o '\<[0-9a-f]\{64\}\>'