David A. Harding [ARCHIVE] on Nostr: 📅 Original date posted:2022-11-27 📝 Original message: On 2022-11-25 13:12, ...

📅 Original date posted:2022-11-27
📝 Original message:
On 2022-11-25 13:12, ZmnSCPxj via Lightning-dev wrote:
> If I am an LSP, and I know my competitor LSP distributes their
> credentials, then I can simply apply to be a spoke on my competitor
> and then make several payments to my node, which I then jam up.
> This reduces the reputation of my competitor LSP.

I don't think this how Riard's credentials work. The credential tokens
are blinded, so forwarding nodes can't use them to determine the origin
of the payment---thus they can't assign blame.

As I understand them, credential tokens prevent DoS by each token only
allowing the one-time creation of a single HTLC, so any failed payment
reduces the sender's supply of tokens. That means, if Mallory becomes a
client of Bob's and Bob lets Mallory use some of his tokens, Mallory can
destroy those tokens. Although that's bad for Bob, he can easily limit
the damage by not giving Mallory more tokens after too many failures.
If Bob obtained his tokens at a low cost (e.g. by sending many payments
that were successful and receiving back >100% of the tokens he used to
make those payments) and if Alice has to pay a similar or greater cost
to become a client of Bob's (e.g. onchain channel open costs), then the
attack should not be economically rational.

> This is even worse if my competitor LSP attaches their credentials on
> trampolines, I do not even need to apply to be a spoke on my
> competitor that way.

I think the analysis for trampolines is the same: as long as Bob only
attaches credential tokens to trampoline payments where he knows the
origin has paid a cost (or will need to pay a cost) to abuse his
service, he can prevent any attack from becoming economically rational.

> Thus all reputation still rests with ultimate senders, who have to
> convince LSPs to sell their reputation to them, because they might
> secretly be competitor LSPs who have incentive to drain their
> reputation.
>
> If the price of sold reputation is too high, then it is no different
> from upfront fees.
>
> If the price of sold reputation is too low, then I can drain the
> reputation of competitor LSPs.

I think the statement at the top about reputation resting with ultimate
senders is true but two conditionals below it are not quite right. If
an LSP helps many clients make successful payments, those clients may
(at no additional cost to them beyond the forwarding fees they already
paid) receive more credential tokens than they'll ever need. By
allowing the LSP to instead use those tokens for other clients
("harvesting" them), it's possible for those later clients to avoid
paying for credential tokens---this is equivalent to free upfront fees.
As long as the LSP can prevent a client from using too many tokens, and
requires the client pay other inescapable costs, then it shouldn't be
possible for a competitor to substantially drain the token capital of a
LSP without losing a substantial amount of its own money.

-Dave