Lightning and other layer 2 projects with multiple RBF policies [combined summary]



Individual post summaries: Click here to read the original discussion on the lightning-dev mailing list

Published on: 2022-02-14T17:59:37+00:00


Summary:

The security of Lightning Network and other Layer 2 projects is a concern when it comes to the use of different Replace-by-Fee (RBF) policies by nodes. While the base blockchain/network is not impacted by policy rules, these projects can be. However, it is not recommended to abandon current designs without a better security model in place. In a recent email conversation between Prayank and Michael Folkson, it was discussed that while it may take time for the majority of the network to adopt new policy rules in Bitcoin Core, it can ultimately benefit the security of these projects in the long run. Not all full nodes will be running the same policy rules at any given time, as different versions and policies are used. The discussion also raised questions about the vulnerability of Lightning Network and other Layer 2 projects to multiple RBF policies being used, as well as whether recent improvements suggested for RBF policy are solely focused on Lightning Network. Michael mentioned that most of the focus has been on Lightning due to its widespread adoption, but contributors to other Layer 2 projects are free to discuss security considerations. Bitcoin Knots policy is fully configurable, allowing users to choose their desired policy rules. The discussion highlighted concerns about the mempool as an order book for bidding on block space, as potential differences in relay policies used by nodes could impact security. An attacker with 10% hash power could exploit vulnerabilities in projects relying on the default RBF policy in Bitcoin Core.Overall, research into Lightning security is still ongoing, and experiments on signet networks can help identify issues associated with multiple RBF policies. It is important to consider the security of Lightning Network and other Layer 2 projects and determine what default policy rules should be implemented to bolster their security.


Updated on: 2023-08-01T00:05:59.853349+00:00