Thunderdome: Timelock-Free Rationally-Secure Virtual Channels

Thunderdome: Timelock-Free Rationally-Secure Virtual Channels

Speakers: Yuong Wang, PhD Student, TU Vienna; Zeta Avarikioti, Supervisor, TU Vienna & Common Prefix; Y1, CRSC Institute & Tencent Intelligence Institute

Conference: USENIX Security

YouTube: https://www.youtube.com/watch?v=BLDb3d8JSz4

Overview

This talk introduces Thunderdome, a novel virtual channel protocol designed to enhance the scalability of blockchain platforms, specifically addressing the limitations of existing Layer 2 protocols like payment channel networks. Presented by Yuong Wang, a PhD student from TU Vienna, this work, a collaboration with Zeta Avarikioti and Y1, tackles the fundamental problem of blockchain scalability, exemplified by Ethereum's transaction throughput being significantly lower than centralized systems like Visa. While many solutions propose changes to the underlying Layer 1 blockchain, Thunderdome focuses on a Layer 2 approach, aiming to improve efficiency without requiring a hard fork.

The core innovation of Thunderdome lies in its departure from traditional time lock schemes, which are prevalent in most existing Layer 2 payment channels and virtual channels. Time locks introduce complexities and rely on participants acting honestly and timely, a reliance that can be exploited in adversarial scenarios. Thunderdome proposes a time-lock-free design, achieving security through the introduction of a decentralized committee of wardens (also known as watchtowers) and a robust rational security model based on game theory. This shift represents a significant step towards more resilient and economically rational Layer 2 solutions for off-chain transactions.

The significance of Thunderdome extends beyond mere efficiency gains. By eliminating the reliance on time-based assumptions, the protocol enhances the robustness and predictability of off-chain interactions. This is particularly crucial in a decentralized environment where participants may be rational actors motivated by maximizing their own utility. The research not only presents a detailed protocol design but also provides rigorous security analyses under both Byzantine and rational security models, offering a comprehensive framework for building the next generation of scalable and secure blockchain applications.

Background

▶ Watch: Introduction: Thunderdome and blockchain scalability problem (0:00)

The inherent scalability limitations of Layer 1 blockchains, such as Ethereum, have long been a bottleneck for widespread adoption. With transaction throughput orders of magnitude lower than traditional financial systems, off-chain solutions, collectively known as Layer 2 protocols, have emerged as a critical area of research and development. Among these, payment channel networks offer a promising avenue for high-frequency, low-cost transactions by allowing parties to conduct multiple transactions off-chain, only settling the final state on the main blockchain.

The fundamental building block of a payment channel network is the payment channel itself. In a typical two-party payment channel, Alice and Bob first lock funds into a joint smart contract on the Layer 1 blockchain, effectively "opening" the channel. They then exchange signed updates to the channel's state off-chain, reflecting new transactions. When they are finished, they "close" the channel by submitting the latest agreed-upon state to the smart contract, which then distributes funds accordingly. The security of these channels traditionally relies on a time lock scheme. This mechanism typically dictates a challenge period during which parties must publish the latest state. If a party attempts to publish an old state, the counterparty has a window to submit the correct, more recent state, failing which they would be punished, often by forfeiture of funds. While effective, time locks introduce a dependency on timely action and can lead to complex protocol designs to prevent griefing attacks or ensure liveness.

The complexity further increases when parties are not directly connected. The two-hop payment problem illustrates this: Alice and Bob want to transact, but they are only connected to a third party, Charlie, each via their own payment channel. Previous solutions to this problem include multi-hop payment schemes and virtual channels. Multi-hop schemes, often relying on cryptographic primitives like hashed timelock contracts (HTLCs) and verifiable signatures, require the intermediate party (Charlie) to actively participate in every transaction. This introduces latency and a single point of failure for liveness. Furthermore, these schemes are heavily reliant on time-related assumptions due to the nature of HTLCs.

Virtual channels, on the other hand, aim to reduce Charlie's involvement. In this model, Charlie helps Alice and Bob to open and close a "virtual" channel between themselves. Once opened, Alice and Bob can transact directly, much like in a regular payment channel, but without a dedicated Layer 1 smart contract for the virtual channel itself. All virtual channel state changes are eventually reflected on the underlying Layer 1 smart contracts of Alice-Charlie and Charlie-Bob payment channels. While this reduces Charlie's per-transaction overhead, previous virtual channel protocols still inherited the time lock dependencies from their underlying payment channels. The central question Thunderdome addresses is whether these payment channel networks, and specifically virtual channels, can be designed without any reliance on time locks, thereby improving their robustness and simplifying their security model.

Key Findings

▶ Watch: Defining the two-hop payment problem in networks (2:50)

The primary contribution of Thunderdome is the design and rigorous analysis of a novel virtual channel protocol that entirely eliminates the reliance on time lock schemes. This represents a significant advancement in the field of Layer 2 protocols, offering a more robust and predictable mechanism for off-chain transactions within payment channel networks. Instead of time-based security, Thunderdome leverages a decentralized committee of trusted third parties, referred to as wardens or watchtowers, to ensure the integrity and liveness of the channels.

The protocol's security model is built upon two critical pillars:

1. Honest Majority of Wardens: Thunderdome assumes the existence of an honest majority within each warden committee. Specifically, it requires 2f+1 honest wardens out of 3f+1 total wardens, where f is the maximum number of Byzantine wardens. These wardens are required to deposit collateral, be responsive, and constantly monitor the blockchain.
2. Rational Security: Beyond traditional Byzantine security, Thunderdome also rigorously analyzes its security under a rational security model. This assumes all participants are rational economic agents who will deviate from the protocol if doing so maximizes their personal utility. Through an extensive form game analysis, the protocol proves that following the specified procedures is the only rational strategy for all participants to maximize their benefits, thereby ensuring protocol adherence even in the absence of strict time-based enforcement.

By integrating these two security paradigms, Thunderdome provides a solution to the two-hop payment problem that is not only efficient but also inherently more resilient to timing attacks and potential misbehavior from participants. The protocol's design offers a clear pathway to building scalable off-chain transaction systems that are less susceptible to the complexities and vulnerabilities associated with time-dependent security guarantees.

Technical Deep Dive

▶ Watch: Introducing Thunderdome: a time-lock free virtual channel (5:08)

Thunderdome's design is predicated on the concept of time-lock-free payment channels, which fundamentally alter how security is guaranteed compared to traditional designs. Instead of relying on a time window for dispute resolution, these channels delegate security enforcement to a committee of wardens. These wardens are crucial to the protocol's integrity and are characterized by several assumptions:

• Honest Majority: Each warden committee is assumed to have an honest majority, meaning at least 2f+1 wardens are honest and follow the protocol, out of a total 3f+1 wardens.
• Collateral Deposit: Each warden must deposit a certain amount of collateral before joining the protocol, providing a financial incentive for honest behavior and a deterrent against malicious actions.
• Responsiveness and Monitoring: Honest wardens are assumed to be responsive and actively monitor the blockchain and channel activities at all times.

The Thunderdome protocol operates through three main procedures: opening, updating, and closing a virtual channel.

Opening a Thunderdome Virtual Channel

To initiate a virtual channel between Alice and Bob, mediated by Charlie:

1. Collaborative Signing: Alice, Bob, and Charlie collaboratively sign an opening request that includes the initial state of the virtual channel (e.g., initial fund distribution).
2. Warden Notification: This signed request and initial state are then sent to all wardens in both of the underlying payment channel committees (i.e., Alice-Charlie's wardens and Charlie-Bob's wardens).
3. Agreement Threshold: A party (Alice, Bob, or Charlie) considers the virtual channel "open" only after receiving 2f+1 agreements (confirmations) from each of the two warden committees. This 2f+1 threshold ensures that even if f wardens are malicious in each committee, the honest majority's consensus prevails.

Channel Updates

Once the Thunderdome virtual channel is open, Charlie's active participation is no longer required for state updates. Alice and Bob can directly communicate off-chain:

1. Direct Communication: Alice and Bob agree on a new state for the Thunderdome channel (e.g., reflecting a payment from Alice to Bob).
2. State Signing: Both Alice and Bob sign this new state, indicating their agreement.
3. Warden Notification: The signed new state is then sent to all wardens in both warden committees.
4. Commitment Threshold: A party considers the new state "committed" only after receiving 2f+1 agreements from each of the two warden committees. This ensures that the new state is securely recorded by a sufficient number of honest wardens.

Closing a Thunderdome Virtual Channel

Thunderdome offers two distinct methods for closing the virtual channel, accommodating both optimistic and pessimistic scenarios:

1. Collaborative Close (Optimistic)

This method is used when Alice, Bob, and Charlie are all responsive and cooperative.

1. Alice & Bob Agreement: Alice and Bob first agree on the final state with which to close the Thunderdome channel. They both sign this agreement.
2. Charlie's Role: They send this signed agreement to Charlie. Charlie then assists in updating the two underlying payment channels (Alice-Charlie and Charlie-Bob) to reflect the virtual channel's final state.
3. Underlying Channel Updates: For each underlying payment channel (e.g., Alice-Charlie), Alice and Charlie sign an update request and send it to their own respective warden committee.
4. Warden Agreement: Once 2f+1 agreements are received from each of the two individual warden committees (Alice-Charlie's committee and Charlie-Bob's committee), both underlying payment channels are considered updated, and the entire Thunderdome virtual channel is collaboratively closed.

2. Unilateral Close (Pessimistic)

This method is designed for situations where one party, for instance, Bob, becomes unresponsive or malicious.

1. Initiation by Alice: Alice, wanting to close the channel, sends a request to her own warden committee (the Alice-Charlie committee).
2. Warden Publication: Upon receiving Alice's request, the wardens in her committee publish the latest Thunderdome state they have stored (from previous channel updates) to the smart contract.
3. Smart Contract Resolution: After receiving 2f+1 publications from the wardens, the smart contract identifies the state with the highest sequence number, which indicates the most recent valid state.
4. Cross-Verification: The smart contract then uses this latest state to cross-check with the smart contract of the other underlying payment channel (Charlie-Bob). This cross-verification is critical to ensure that when both parts of the payment channel are eventually closed, they do so with a consistent state, preventing any party from losing funds due to discrepancies.

Security Analysis

The security of Thunderdome is analyzed under two distinct models:

1. Byzantine Security Model: This model assumes that up to f wardens in each committee can be malicious (Byzantine), while the remaining 2f+1 are honest. It also assumes at least one honest party among Alice, Bob, and Charlie. Under these assumptions, Thunderdome is proven to achieve balance security, meaning no honest party will lose coins during the protocol's execution. It also guarantees liveness, ensuring that requests from an honest party will eventually be executed or invalidated due to misbehavior.

1. Rational Security Model: This model is crucial for understanding real-world participant behavior. It assumes that all participants (Alice, Bob, Charlie, and wardens) are rational and will deviate from the protocol if doing so yields them greater utility. The protocol's closing procedure, in particular, is modeled as an extensive form game (a game tree) where each participant's possible strategies and their corresponding utilities are analyzed. The key finding here is the proof of rational security: following the Thunderdome protocol is the only way for rational parties to maximize their utility. This means that even without strict cryptographic enforcement of timely action (as with time locks), rational self-interest incentivizes correct protocol execution.

By combining the robustness of warden-based security with the economic incentives of rational behavior, Thunderdome offers a compelling solution to the long-standing challenge of time-lock reliance in Layer 2 scaling solutions.

Demo / Proof of Concept

▶ Watch: How time-lock free channels work using wardens (5:40)

The talk mentions that a prototype implementation of the Thunderdome protocol has been developed. While a live demonstration was not explicitly detailed in the transcript, the existence of this implementation is crucial for validating the protocol's feasibility and evaluating its practical performance. The implementation allowed the researchers to conduct a gas cost evaluation, comparing Thunderdome's operational expenses on a blockchain to a previous, widely recognized virtual channel protocol called Perun, which is built upon the traditional time lock scheme.

The evaluation revealed that Thunderdome's gas fee is, on average, approximately 1.5 times higher compared to Perun's. This increased cost is presented as an acceptable trade-off, considering the significant advantage of removing all time-related assumptions from the protocol's security model. The researchers argue that the enhanced robustness and simplified security reasoning achieved by eliminating time locks justify the moderate increase in transactional costs. The code for the prototype implementation is publicly available, with a link provided in the associated paper on GitHub, allowing other researchers and developers to review, test, and build upon their work.

Defensive Implications

▶ Watch: Thunderdome protocol: closing a virtual channel (7:41)

The Thunderdome protocol introduces a paradigm shift in the security model of Layer 2 virtual channels, moving away from time lock schemes towards a reliance on warden committees. This shift has several critical implications for defenders, including users, developers, and blockchain operators:

1. Understanding the New Trust Model: Defenders must fully grasp that the security guarantee is no longer solely cryptographic and time-bound but now hinges on the honest majority assumption of the warden committees. This means that the integrity and responsiveness of these third-party entities are paramount.
2. Warden Selection and Oversight: For any deployment of Thunderdome or similar protocols, the selection, reputation, and ongoing monitoring of wardens become critical. Mechanisms for wardens to deposit collateral are a good start, but ensuring their continuous responsiveness and preventing collusion among a malicious minority are ongoing challenges. Defenders should consider the governance models for these warden committees.
3. Cost-Benefit Analysis of Time Lock Elimination: While Thunderdome offers the benefit of eliminating time locks, it comes with a higher gas cost (approximately 1.5 times that of Perun). Developers designing Layer 2 solutions must weigh this increased cost against the benefits of simplified security reasoning and reduced reliance on timely user action. For applications where liveness and predictability are absolute priorities, the increased cost might be justified.
4. Game Theory as a Defensive Tool: The emphasis on the rational security model and extensive form game analysis highlights the importance of understanding economic incentives in blockchain security. Defenders should adopt a game-theoretic perspective when designing or evaluating protocols, ensuring that honest behavior is always the most rational and utility-maximizing strategy for all participants.
5. Monitoring and Alerting for Warden Misbehavior: Although wardens are assumed to have an honest majority, the protocol still accounts for potential f malicious wardens. Robust monitoring systems would be necessary to detect any deviations or unresponsiveness from wardens, allowing for potential penalties or replacement mechanisms to maintain the integrity of the committee.
6. Future Challenges (Privacy, Scalability, State Channels): The talk itself points to future research directions that have defensive implications:

• Privacy against Wardens: The current design means wardens have visibility into channel states. Future work on privacy-preserving Thunderdome protocols (e.g., using zero-knowledge proofs) would be essential to protect user privacy from these third parties.
• Multi-Hop Scalability: While the current design can apply to multi-hop scenarios, the message complexity is high. Scaling this efficiently is a defensive challenge to prevent network congestion or slow transaction finality in larger networks.
• State Channel Extension: Extending virtual channels from simple transaction execution to more complex state channel designs (for smart contract execution) would introduce new attack surfaces and require careful defensive considerations for state integrity and computation correctness.

In essence, adopting Thunderdome implies a shift from defending against timing vulnerabilities to ensuring the robustness and economic alignment of a distributed set of trusted third parties. This requires a holistic security strategy that combines cryptographic principles with economic incentives and robust governance.

Key Takeaways

• Virtual Channels as Layer 3 for Enhanced Efficiency: Virtual channels can act as a "Layer 3" on top of existing Layer 2 protocols like payment channel networks, significantly improving the efficiency and scalability of off-chain transactions by allowing direct communication between non-directly connected parties.
• Eliminating Time Locks through Trusted Third Parties: To move away from the complexities and dependencies of time lock schemes in blockchain protocols, leveraging trusted third parties, specifically wardens or watchtowers, can be an effective strategy. This requires careful consideration of their security guarantees, such as an honest majority and deposited collateral.
• Importance of Rational Security and Game Theory: Designing robust Layer 2 protocols and other blockchain systems benefits significantly from rational security model analysis and game theory, particularly the extensive form game. This ensures that following the protocol is the most rational and utility-maximizing strategy for all participants, even in the presence of potential adversaries.
• Trade-offs for Enhanced Security: While Thunderdome successfully eliminates time locks, it incurs a higher gas cost (approximately 1.5 times more than the Perun protocol). This highlights the inherent trade-offs in blockchain design, where enhanced security properties or simplified assumptions may come with increased operational expenses.
• Future Research Avenues: Key areas for future development include enhancing the privacy of virtual channels against wardens, improving the scalability of multi-hop virtual channels, and extending the design to full state channels capable of executing complex smart contracts beyond simple transactions.

About the Speaker(s)

The primary presenter for "Thunderdome: Timelock-Free Rationally-Secure Virtual Channels" was Yuong Wang, a PhD student affiliated with TU Vienna. This work was a collaborative effort, with significant contributions from Y1, associated with both the CRSC Institute and Tencent Intelligence Institute, and Zeta Avarikioti, who served as Yuong Wang's supervisor at TU Vienna and is also associated with Common Prefix. Their combined expertise in blockchain technology, security protocols, and distributed systems formed the foundation for this innovative research into scalable and secure virtual channel designs.