Why Full-RBF Makes DoS Attacks on Multiparty Protocols Significantly More Expensive



Summary:

In a bitcoin-dev email from Peter Todd, the benefits of full-RBF are called into question. The confusion, according to Todd, is caused by a quote implying that full-RBF offers no benefits other than breaking zeroconf business practices. Todd argues that without full-RBF people can intentionally and unintentionally DoS attack multi-party protocols by double-spending their inputs with low-fee transactions, holding up progress until that low-fee transaction gets mined. However, another participant in the email chain questions whether this issue could be solved without full-RBF. For example, if Alice, Bob, Carol, and Mallory create a coinjoin transaction, and Mallory either intentionally or unintentionally creates a conflicting transaction that does not opt-in to RBF, Alice, Bob, and Carol can simply create a new coinjoin transaction which does not include any of Mallory's inputs so it doesn't conflict with Mallory's transaction. Additionally, the participant questions Todd's assertion that full-RBF solves the "transaction pinning" attack against coinjoins and dual fundings, arguing that honest participants can create a non-conflicting transaction instead. Todd suggests putting price figures on the attack in terms most people will understand. The conflicting inputs attack Todd describes as being solved by full-RBF costs about $0.05 USD at $17,000/BTC, while the transaction pinning attack Todd implies is unsolved by full-RBF costs about $17.00.


Updated on: 2023-06-16T03:52:39.554316+00:00