Blockchain/Level V · Layers/5.1 Lightning/Lesson 5
Penalties and watchtowers
The revocation key, the timelock window, and the third party who watches
MaterialsA block explorer capable of viewing transaction scripts (e.g., mempool.space)The BOLT #2 specification documentA text editor for reviewing script logic
Wonder
- Why does broadcasting a transaction that is technically valid but outdated result in total loss rather than partial gain?
- How can a node be offline for weeks without its counterparty stealing its funds?
- What specific Bitcoin consensus change would allow two parties to simply overwrite old states with new ones, eliminating the need for penalty logic entirely?
Explore
- Lightning channels rely on signed commitment transactions that represent a snapshot of the balance. If one party goes offline and their peer broadcasts an outdated state where the peer holds more funds, this constitutes a protocol breach. The honest node requires a mechanism to react immediately to reclaim its balance, even after weeks of disconnection. Without such protection, security depends entirely on constant connectivity.
- The defense relies on revocation secrets. Each time the channel state updates, each side reveals the secret behind its previous commitment, which lets the other side derive a revocation key for that old state. If a peer later broadcasts it, the honest party already holds that key. This allows them to spend the cheater’s output immediately, bypassing any delays. The broadcaster’s own output is held by a relative timelock, typically between 144 and 2,016 blocks (about a day to two weeks) depending on implementation and channel size.
- This mechanism requires someone to watch the chain. A node that is offline too long cannot detect the broadcast in time. Watchtowers solve this by holding encrypted penalty transactions prepared by the user. These backups are keyed to specific transaction IDs, ensuring privacy until a breach occurs. The tower monitors the mempool and blockchain for these specific IDs.
- When a watchtower detects an old state entering the chain, it decrypts the relevant backup using the breaching transaction’s ID. It then broadcasts a penalty transaction that spends the fraudulent output to the honest party. This confiscates the cheater’s entire balance as a penalty for breaking protocol rules. The threat of total loss outweighs the potential gain from cheating.
- Force-closing channels also carries significant costs. Timelocks delay access to funds, and fee reserves must be held to ensure transactions propagate during high-fee periods. These economic frictions incentivize cooperative closures. Users who run their own nodes bear these risks directly; those using custodial services transfer this burden to the provider.
- An alternative design, eltoo or LN-Symmetry (Decker, Russell and Osuntokun, 2018), would replace penalties with simple state replacement. It needs a soft fork: SIGHASH_ANYPREVOUT (BIP118), or alternatives such as CTV combined with CHECKSIGFROMSTACK. Until this activates, the current penalty-and-revocation model remains the only secure enforcement mechanism for Lightning channels in production.
Key facts
- Because each old state’s revocation secret was handed over when it was replaced, broadcasting that state lets the counterparty claim the entire channel balance.
- The broadcaster’s output waits behind a relative timelock (often 144 to 2,016 blocks), giving the victim time to react.
- Watchtowers hold encrypted state backups keyed to transaction IDs, preserving privacy until an on-chain breach is detected.
- The eltoo protocol design would eliminate penalty transactions via simple state replacement but requires the BIP118 soft fork for activation.
- Force-closures require holding fee reserves and waiting through timelocks, making them economically costly compared to cooperative closures.
- With each update, each side reveals the secret for its previous commitment, enabling a penalty if that state is ever broadcast.
Exercise nine, six, three, one
9CollectList 9 distinct protocol states or events in a Lightning channel lifecycle that involve key exchanges, signatures, or on-chain broadcasts.
6ClusterGroup these 9 items into 6 categories based on their security implications: cooperative actions, unilateral enforcement, privacy preservation, economic costs, consensus dependencies, and state transitions.
3DistillReduce the 6 groups to 3 core trade-offs that define the risk profile of running a non-custodial Lightning node.
1CrystallizeWrite one sentence explaining why the threat of total loss via revocation secrets is necessary for the security of off-chain payments.
Fact check
Dates, figures and claims checked against the published sources listed below.