Okay, Matt explained to me the intended application of CTV vaults off list, so I have a better understanding now.
The CTV vault scheme is designed as an improvement over the traditional management of hot-wallets and cold-wallets. The CTV vault is logically on the "cold-side" and lets funds be sent from the "cold" side to *one's own* the hot wallet after the unvaulting delay. In this case, the hot wallet funds are always at risk, so it isn't unexpected that those funds could be stolen. After all, that is how hot wallets are today. The advantage is that funds can be moved from the "cold" side without needing to dig out the cold keys.
The MES vault scheme applies to a different scenario. In the MES case it is the hot funds are inside the vault, and it is the hot key that unvaults the funds and sends them to *customer's addresses* after a delay. If the hot-key is used in any unauthorised way, then funds can be sent to the address of the cold key (the MES vault actually does something fancy in case of recovery, but it could be adapted to simply send funds to a cold wallet).
The MES vault lie somewhere between "better" and "different" when compared to the CTV vault. If one is unwilling to use the MES vault on the hot side and have every withdrawl vetted, then, while you could use the MES design on the cold side like the CTV vault, it wouldn't really offer you any advantages over a CTV vault. However, if you are interested in managing all your payments through a vault (as I've been imagining) then the CTV vault comes across as ineffective when compared to an MES style vault.
Still trying to make sure I understand this concern, let me know if I get this all wrong.
On 4/22/22 10:25 AM, Russell O'Connor via bitcoin-dev wrote:
> It's not the attackers *only choice to succeed*. If an attacker steals the hot key, then they have
> the option to simply wait for the user to unvault their funds of their own accord and then race /
> outspend the users transaction with their own. Indeed, this is what we expect would happen in the
> dark forest.
Right, a key security assumption of the CTV-based vaults would be that you MUST NOT EVER withdraw
more in one go than your hot wallet risk tolerance, but given that your attack isn't any worse than
simply stealing the hot wallet key immediately after a withdraw.
It does have the drawback that if you ever get a hot wallet key stole you have to rotate all of your
CTV outputs and your CTV outputs must never be any larger than your hot wallet risk tolerance
amount, both of which are somewhat frustrating limitations, but not security limitations, only
practical ones.
> And that's not even mentioning the issues already noted by the document regarding fee management,
> which would likely also benefit from a less constrained design for covenants.
Of course I've always been in favor of a less constrained covenants design from day one for ten
reasons, but that's a whole other rabbit hole :)