Author: Nadav Kohen 2019-10-19 06:40:38
Published on: 2019-10-19T06:40:38+00:00
In a recent discussion on the Lightning network, a problem was identified in the protocol for placing bets. The solution proposed involved an oracle that would publish either 'p' or 'q', with Alice and Bob placing bets on what the oracle would publish. However, a one-sided bet could occur if the second transaction is not created. A solution was proposed by Nadav involving a partially trusted escrow party, but another solution was presented that doesn't require an escrow party.Instead, the proposed solution involves atomically exchanging two secrets. The payment from Alice to Bob requires Bob to know 'p' and a secret 'sa', initially only known by Alice. Similarly, the payment from Bob to Alice requires Alice to know 'q' and a secret 'sb', initially only known to Bob. As long as they don't reveal these secrets to anyone, they are bound to time out, making them safe to be locked in any order. After locking in the transactions, Alice and Bob must reveal their secrets to each other to make the locked-in transactions equivalent to an honest, two-sided bet. Bob can choose not to redeem the first transaction, but he receives a penalty that roughly equals the transaction amount if he does so. This penalty can be made sufficiently large to move Bob's incentives towards honest behavior. There are some details regarding time-outs of the three transactions and how to do the elliptic curve magic.In a discussion thread on the Lightning-dev mailing list, a user named CJP suggested an idea regarding generating PP_x1. The user was not sure if a subtract operation exists for elliptic curve points, but if it does, Bob could calculate SA by subtracting P from PP_b0. Otherwise, Alice could just tell Bob SA as metadata included in the first bet transaction. Similarly, to generate PP_x0, Alice needs to know SB. She could calculate SB by subtracting Q from PP_b1 or Bob could tell her SB as metadata included in the second bet transaction. The details of this idea are available in [1] on the mailing list.
Updated on: 2023-06-02T20:59:16.628251+00:00