익명 00:14

What are the advantages to attackers of different styles of replacement cycle at...

What are the advantages to attackers of different styles of replacement cycle attacks?

In Antoine Riard's original description of replacement cycle attacks against HTLCs, a replacement cycle looks like this:

  • Bob broadcasts an HTLC-timeout (input A, input B for fees, output X)
  • Mallory replaces the HTLC-timeout with an HTLC-preimage (input A, input C for fees, output Y)
  • Mallory replaces the transaction that created input C, removing the HTLC-preimage from the mempool

However, an alternative approach is:

  • (Same) Bob broadcasts an HTLC-timeout (input A, input B for fees, output X)
  • (Same) Mallory replaces the HTLC-timeout with an HTLC-preimage (input A, input C for fees, output Y)
  • (Different) Mallory uses input C to replace the HTLC-preimage with a transaction that does not include input A, removing the preimage from the mempool

The alternative approach has three clear advantages:

  • It's simpler. The original approach works by replacing input C's parent, removing from the mempool the data necessary to confirm the HTLC-preimage; the alternative approach simply replaces the HTLC-preimage, removing it from the mempool directly.
  • It requires less setup. The original approach requires input C's parent to be an unconfirmed transaction already in the mempool of targeted nodes; the alternative approach can use any of those outputs or any confirmed output.
  • It's more robust. If the original approach's unconfirmed output gets confirmed, the attacker needs to create another unconfirmed output.

Are there additional advantages to the alternative approach? Are there advantages to the original approach?



Top Answer/Comment:

Yes, your three advantages hold, but check that: Think of the mempool as a waiting room. The attack keeps yanking Bob's payout transaction out of it so it never confirms in time. The two versions differ in how Mallory yanks it. The original kills a different transaction that Bob's depends on, so his falls out on its own. The alternative just directly overwrites Bob's transaction. The alternative wins mainly on cost: to kick a transaction out you must pay a higher fee than what you're replacing, and in the alternative Mallory is overwriting her own cheap transaction — so it's cheap every time. In the original she's stuck beating a fee she doesn't control.

Since she repeats this cycle many times, cheap-per-repeat matters a lot. It also needs less setup and is more reliable, since everything belongs to her. The original's only real upside: it can make the bad transaction look juicy to miners while it sits there, without costing more to remove later. Bottom line: the alternative is better in practice; the original is just the clearest way to explain the attack.

상단 광고의 [X] 버튼을 누르면 내용이 보입니다