Impact of the balance discovery attack in lightning network and possible countermeasures

Abstract

Bitcoin has a low throughput of around 7 transactions per second. Payment Channel Networks (PCN) form a class of techniques created to solve the scalability problems that permissionless blockchains such as Bitcoin face. The Lightning Network (LN) is the biggest PCN to date. As of November 2023, LN is an interconnected network with 15 thousand nodes and 63 thousand channels, representing a total payment capacity of 5300 bitcoins (201M USD). The Lightning Network (LN) is a PCN that runs as a peer-to-peer network on top of Bitcoin and improves scalability by keeping most transactions off-chain without sacrificing the trustless character of Bitcoin. LN nodes establish trustless payment channels by locking funds in a funding transaction. The distribution of the funds can be modified with near-instant transactions without broadcasting them to the blockchain. By chaining channels together, it is possible for two nodes to transact without having a direct channel between them. This results in far fewer transactions needing to be broadcast and a theoretical number of off-chain transactions per second that can rival established, centralized payment systems. With off-chain transactions one can obtain more privacy than with on-chain transaction: individual payments through LN should be able to stay private. However, recent research suggests that this is not the case. Previous work has shown that channel balances can be tracked with the Balance Discovery Attack (BDA). The BDA has been proven to be successful in determining the balance of the largest part of channels in the network. Monitoring the changes in channel balances over time enables an adversary to track individual payments in LN as such the BDA is a big privacy risk. In this work we explore an extended algorithm for the BDA as well as a new type of attack that leverages the differences between LN client software implementations. Our improved algorithm improves the original BDA by performing two-way payments from both sides of a payment channel. The new type attack uses malformed payments to shutdown payment channels an adversary is not part of. Subsequently, this work applies approximate differential privacy as a possible countermeasure against the BDA by hiding payment amounts of a realistic size in LN. To our knowledge, this is the first time that strong privacy guarantees in the sense of approximate differential privacy are achieved in the setting of LN. We prove the feasibility with our prototype, compatible with LN today. Our solution is evaluated in terms of cost and utility and we show that the latter is not affected by our solution. We also introduce a second countermeasure, dubbed Payment Splitting and Switching (PSS): a way of splitting up payments in LN at intermediary hops along the payment path. PSS drastically reduces the information an attacker can obtain through a BDA. Using real-world data in an LN simulator we demonstrate that the information gain for the attacker drops up to 62% when PSS is deployed. Apart from its potential as mitigation against BDA, PSS also shows promise for increased LN throughput and as a mitigation against other types of attack.