Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lightning linked channel forensics #2683

Merged
merged 9 commits into from Nov 30, 2022

Conversation

mononaut
Copy link
Contributor

@mononaut mononaut commented Nov 11, 2022

(builds on PR #2638)

This PR uses on-chain links between channels to deduce ownership of transaction inputs and outputs, together with some other inferences, and surfaces all of this on the channels page.

The resulting data could be useful for tracing how liquidity flows across the network, or simply to highlight this potential privacy leak.

Specifically, we look for the following cases:

  1. where a node funds a new channel with the direct proceeds of previously closed channel - a fairly common behavior for active routing nodes.
  2. a node funds a new channel with the change output of a previous channel open.

If there is a single party in common between these two channels, we can conclude that they owned the connecting txos.

From there, we can fully or partially deduce closing balances of each node in any closed channels, as well as funding contributions to the new channel. In the case of a force close, we can sometimes also infer which node initiated the close.

complete-output-attribution

Implementation

Implemented as another step in the regular lightning network sync tasks, when using an esplora backend (like the existing runClosedChannelsForensics task).

The analysis consists of checking each input of the channel open transaction to see if it spends a known channel close output (or spends the result of sweeping such an output, where that step is required by the protocol).

When a matching channel close is found, we deduce what we can using the heuristics described above, and save the data to a new channels_forensics db table.

The first run will take several hours, since it involves fetching and examining transactions one or two steps back from every input of every channel open. However, we only analyse each channel once, so subsequent runs should be fast. To avoid stalling other network sync tasks, we break after GRAPH_REFRESH_INTERVAL and resume on the next sync.

Limitations

Complete liquidity flows are only revealed when nodes fully recycle funds on both the opening and closing side of a channel. In other cases, we may only be able to deduce the funding contributions, or the closing balances, or nothing at all.

Dual-funded channels

For a channel known to be funded by a single party, discovering the owner of any input to the channel open transaction tells us who contributed all of the capacity.

However, if a channel open uses multiple inputs, (as far as I'm aware) we can't rule out the possiblity that it's actually dual-funded. In that case, the amount contributed by each party is ambiguous, (especially if the transaction generates a lot of change).

partial-attribution

@cla-bot cla-bot bot added the cla-signed label Nov 11, 2022
@softsimon softsimon self-requested a review November 11, 2022 11:01
@softsimon
Copy link
Member

FYI here is an example of dual funded channels

https://twitter.com/alexbosworth/status/1591896718756708352

@mononaut
Copy link
Contributor Author

interesting!

I saw this one from CLN, but didn't realize there were tools for multi-funded channels on LND already.

https://mempool.space/tx/91538cbc4aca767cb77aa0690c2a6e710e095c8eb6d8f73d53a3a29682cb7581

@mononaut mononaut force-pushed the ln-forensics-output-attribution branch 2 times, most recently from d181a4f to 22fa63f Compare November 20, 2022 10:21
@mononaut mononaut marked this pull request as ready for review November 20, 2022 10:29
@softsimon softsimon marked this pull request as draft November 22, 2022 02:04
@mononaut mononaut force-pushed the ln-forensics-output-attribution branch from 99abf59 to d95ce5e Compare November 24, 2022 06:39
@mononaut mononaut marked this pull request as ready for review November 24, 2022 06:39
@mononaut mononaut force-pushed the ln-forensics-output-attribution branch 2 times, most recently from 88b61bf to 1733894 Compare November 24, 2022 07:08
Copy link
Member

@softsimon softsimon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

channels_forensics columns can be merged into the channels table

@mononaut mononaut force-pushed the ln-forensics-output-attribution branch from 8a9488e to b5a16c5 Compare November 25, 2022 11:03
@mononaut
Copy link
Contributor Author

mononaut commented Nov 25, 2022

merged channel_forensics into channels table and rebased on current master (f73dc59)

@wiz
Copy link
Member

wiz commented Nov 30, 2022

please rebase and fix DB migration conflict

@softsimon softsimon force-pushed the ln-forensics-output-attribution branch from 4abccb2 to ba10df6 Compare November 30, 2022 09:24
Copy link
Member

@softsimon softsimon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tested ACK @ ba10df6

Copy link
Member

@wiz wiz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested ACK @ v2.5.0-dev [ba10df69]

@wiz wiz merged commit 5f1a71c into mempool:master Nov 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants