user may lose funds in a submarine swap, if their channel is force closed.

[ecdsa]

Scenario:

• Alice has a channel with Bob
• Alice initiates a normal swap with Carol.
• Alice receives a HTLC from Carol, through Bob
• Alice sends on-chain funds to the swap funding address
• Alice goes offline.
• The swap funding transaction gets confirmed.
• Carol publishes the claim transaction, with the preimage.
• Time passes, and the HTLC between Alice and Bob expires. Bob force closes the channel.
• More time passes, and the CSV delay expires, Bob now redeems the HTLC.

I do not think this is fixable; this is a consequence of the new protocol. (note: In the old protocol, Alice sends on-chain funds before she receives the HTLC. She has the preimage and settles the HTLC instantly).

Note that the GUI currently shows a dialog instructing the user to stay online until the funding transaction is confirmed.
However, that dialog is shown when the user initiates the swap, and the risk might not be understood.
I think we should also show a dialog when the GUI is closed.

If Alice shuts down her client while a swap is ongoing, the GUI could show a dialog offering several choices:

• cancel the swap (using a double spend)
• run the risk (promise to come back online soon)

edit: cancelling the swap does not guarantee that the swap funding transaction will not be mined

[SomberNight]

• Time passes, and the HTLC between Alice and Bob expires. Bob force closes the channel.
• More time passes, and the CSV delay expires, Bob now redeems the HTLC.

There is no CSV delay (unless Bob broadcasts a revoked ctx). Timing out an offered HTLC in a ctx works by broadcasting an "HTLC-Timeout" tx - the only timelock involved works by the "HTLC-Timeout" tx being presigned with a specific nLocktime (which is set to the expiration time of the HTLC).

---

• Time passes, and the HTLC between Alice and Bob expires. Bob force closes the channel.

We could increase the cltv_delta in the invoice created by Alice:

electrum/electrum/lnworker.py

Line 2177 in ff50487

('c', MIN_FINAL_CLTV_DELTA_FOR_INVOICE),

This value is currently ~1 day (147 blocks). We could increase it to 3-5 days.
(increase it just for this specific use-case of normal swaps though, so it needs some refactoring)

[SomberNight]

note: there is already this text, though only in the desktop qt gui:

electrum/electrum/gui/qt/main_window.py

Line 2693 in ff50487

msg += _("Please remain online until the funding transaction is confirmed.")

[ecdsa]

note: there is already this text, though only in the desktop qt gui:

yes, this is what I was referring to above

[SomberNight]

I think we should adjust this text in qml - which was applicable to the old normal swap:

electrum/electrum/gui/qml/qeswaphelper.py

Lines 387 to 392 in 58a1bdf

	self.userinfo = ' '.join([
	_('Success!'),
	_('Your funding transaction has been broadcast.'),
	_('The swap will be finalized once your transaction is confirmed.'),
	_('You will need to be online to finalize the swap, or the transaction will be refunded to you after some delay.'),
	])

[ecdsa]

Note: we cannot rely on displaying a message on exit, because it will not work on Android, where the app can be killed by the system. I suggest we display a warning icon next to the unconfirmed transaction in the history, and a message in the tx details. For consistency, we should do the same on qt.