Discharged Payment Channels: Quantifying the Lightning Network's Resilience to Topology-Based Attacks

TL;DR

This paper analyzes the Lightning Network's topology to assess its resilience against topology-based attacks, revealing vulnerabilities and proposing strategies for targeted disruptions.

Contribution

It introduces the concepts of channel exhaustion and node isolation attacks and develops metrics to quantify attack effectiveness on the Lightning Network.

Findings

Lightning Network exhibits small-world and scale-free properties.

Targeted attacks based on centrality are most effective against the network.

Resource-efficient attacks can be optimized using highest ranked minimum cut strategies.

Abstract

The Lightning Network is the most widely used payment channel network (PCN) to date, making it an attractive attack surface for adversaries. In this paper, we analyze the Lightning Network's PCN topology and investigate its resilience towards random failures and targeted attacks. In particular, we introduce the notions of channel exhaustion and node isolation attacks and show that the Lightning Network is susceptible to these attacks. In a preliminary analysis, we confirm that the Lightning Network can be classified as a small-world and scale-free network. Based on these findings, we develop a series of strategies for targeted attacks and introduce metrics that allow us to quantify the adversary's advantage. Our results indicate that an attacker who is able to remove a certain number of nodes should follow a centrality-based strategy, while a resource-limited attacker who aims for high efficiency should employ a highest ranked minimum cut strategy.

Tables

Table 1. TABLE I: Comparison of graph measures for different graph types.

	PCN	Scale-free	Random
Node count	2400	2400	2400
Edge count	13884	11975	13941
Diameter	6	5	6
Average distance	2.92	3.25	3.45
Central point dominance	0.16	0.09	0.005

Table 2. TABLE II: Average number of connected components after random failures for differen graph types.

Failures	PCN	Scale-free	Random
1	1.13	1.00	1.00
2	1.20	1.00	1.00
3	1.61	1.00	1.00
5	2.86	1.00	1.01
10	3.66	1.00	1.00
50	14.00	1.00	1.03

Equations

$$c_B(v)=\sum _{s,t\in V}\frac{\sigma (s,t|v)}{\sigma (st)},$$

$$C=\frac{3\cdot \text{number of triangles}}{\text{number of paths of length 2}}.$$

$$S=\frac{{\gamma }_g}{{\lambda }_g}\text{with}{\gamma }_g=\frac{C_g}{C_r}\text{ and }{\lambda }_g=\frac{L_g}{L_r}.$$

$${\Delta }_m=\left|\frac{m-m^{\prime }}{m}\right|=\left|1-\frac{m^{\prime }}{m}\right|.$$

$$\overline{F}=\frac{\sum _{i=1}^n{F}_i(s_i,t_i)}{n}$$

$$s=\frac{\#\text{successful payments}}{\#\text{attempts}}.$$

$$\overline{g_h}=\frac{\sum _{i=1}^n{g}_{i,h_a}}{n}$$

Full text

I Introduction

As cryptocurrencies gain more real-world relevance, they are currently faced with serious scalability issues [1]. Payment channel networks (PCNs) address some of these issues by processing transactions off-chain. To this end, nodes open so-called payment channels, which are secured by the blockchain. They can be used to realize direct payments between channel endpoints as well as multi-hop payments, even though no direct channel exists. As a consequence, PCNs facilitate high transaction rates that are not limited by the sheer number of processable transactions anymore, but individually by the network’s maximum flow capacity for source-destination paths.

While there are different payment channel designs [2, 3, 4, 5, 6], the Bitcoin Lightning Network [7] is arguably the most prevalent PCN implementation to date: at the time of writing, it features a large, rapidly growing network of around 2,500 public nodes and a total capacity of more than 400 BTC ($\approx$ 1.4 million USD). At the same time, this makes the Lightning Network an attractive attack surface for adversaries.

In this paper, we analyze the Lightning Network’s PCN topology and provide details on random and targeted attacks. Moreover, we introduce the notion of exhaustion attacks, node isolation attacks, and develop a series of adversarial strategies. Most notably, we show that the Lightning Network is susceptible to these attacks and can indeed be disrupted.

To this end, we apply methods from the field of network theory [8, 9, 10], to determine essential graph properties of the Lightning Network. In particular, we evaluate whether the Lightning Network can be considered a small world [11] and/or scale free network [12]. While the latter is known to tolerate random node failures very well, the first exhibits short path lengths and high clustering coefficients when compared to random graphs. Both characteristics support the assessment of the Lightning Network’s PCN topology in terms of centralization, fault tolerance, and performance.

We use the insights from our network analysis to investigate possible strategies for targeted attacks, which may lead to a network split. In particular, we not only consider denial-of-service (DoS) attacks, but also discuss how malicious Lightning Network nodes can exhaust payment channels, effectively isolating entire nodes. An adversary can use this attack vector to render whole parts of the network unreachable. We develop a series of attack strategies and quantify the adversary’s advantage along a number of metrics, including reachability, payment success, and maximum flow.

Our results indicate that the Lightning Network can be classified as a small-world as well as scale-free network topology. Accordingly, our assumption that the network is generally vulnerable to targeted attacks is confirmed. We demonstrate the network’s susceptibility to targeted attacks by conducting an empirical analysis based on a recent snapshot of the Lightning Network. The results suggest that an attacker who is able to remove a certain number of nodes should follow a centrality-based strategy, while a resource-limited attacker who aims for high efficiency should employ a highest ranked minimum cut strategy. The main contributions of our work can be summarized as follows:

• •

We study the current state of the Lightning Network’s PCN topology and assess its resilience to random failures and targeted attacks.

• •

We systematize topology-based attacks against PCNs.

• •

We introduce channel exhaustion and node isolation attacks as additional attack vectors.

• •

We develop various adversarial strategies and quantify their prospects in terms of the adversarial success.

The remainder of this paper is structured as follows. Section II is concerned with our findings regarding the network’s basic characteristics. In Section III, we present the possibility of exhaustion attacks and derive adversarial strategies. Moreover, we evaluate the feasibility of such attacks and quantify their prospects and costs in Section IV. In Section V, we discuss related work, before concluding the paper in Section VI.

II Lightning Network Analysis

In the Lightning Network, every node has a global view of the payment channel network (PCN) topology and is responsible for finding routes on the basis of this data set, i.e., conducting source routing. The routing information is distributed by broadcasting channel_announcement and channel_update messages via the Lightning Network’s own peer-to-peer network. These messages contain relevant channel information, such as signatures, channel capacities, and fees. However, mainly due to privacy reasons, actual channel balances are not included. As a consequence, it cannot be predetermined whether sufficient funding is available to route a payment. In case of a failed payment attempt, the client needs to repeat the process until successfully completed.

The payment channel design of the Lightning Network ensures balance security for multihop payments through the use of hash time locked contracts (HTLCs). In this construction, the receiver of a payment first issues a payment request containing a hash $H(r)$ of a secret value $r$. The sender then initiates the payment and sends a transaction to the first node on the payment path that may only be redeemed by revealing the pre-image $r$. This process is repeated for every hop on the path, until a transaction reaches the receiver of the payment. The receiver then redeems the payment by publishing $r$, allowing all nodes on the path to claim their locked funds as well. To enable atomicity, HTLCs allow to revert stuck payment negotiations after the expiration of the transaction time locks, which currently defaults to one hour [13].

We can see that HTLC processing requires all participants to be online and respondent. Otherwise, if a node goes offline, funds may be locked for an extended time period. In the worst case, it is even possible that an adversary publishes outdated states, effectively stealing coins. The robustness of the PCN topology therefore is the baseline for the resilience of the Lightning Network, e.g., to node failures due to DoS attacks. In the following, we evaluate metrics like the betweenness centrality, clustering coefficient, and degree distribution to draw conclusions on whether the topology exhibits properties similar to small-world or scale-free networks. These common properties provide insights on the degree of centralization and the sensitivity to random failures as well as targeted attacks.

II-A Data Collection and Methodology

Over the span of two measurement periods (Oct.–Nov. 2018 and Jan.–Feb. 2019), we gathered information on the Lightning Network’s topology. To this end, we used two virtual machines based on Ubuntu Server $18.04$, which run bitcoind111[14]\addtocategoryskipbibbitcoind and lnd222[15]\addtocategoryskipbiblnd, respectively. We utilized the RPC describegraph to retrieve the topology and regularly store snapshots in a .json file. For the data analysis we developed a python evaluation script, using the networkx [16] and powerlaw [17] libraries. Our code and all data sets are available online333https://gitlab.tu-berlin.de/rohrer/discharged-pc-data.

In general, a node’s view of the topology depends on the information it gets from its neighbors. Moreover, not all channels have to be announced publicly. Therefore, there is no guarantee to have a complete view of the network. However, we assume that the publicly available data characterizes the network’s essential traits. While the network has immensely grown in terms of the number of nodes as well as in total capacity the past months (see Figure 1), we can observe that the topology’s characteristics have not changed significantly. The following analysis is based on a recent data set, which was captured on Feb. 1, 2019 0:00 AM.

II-B Graph Measures and Metrics

We consider the Lightning Network’s PCN topology as a graph $G=(V,E)$, where $V$ is the set of nodes and $E$ the set of edges, i.e., payment channels. The degree $deg(v)$ of a vertex $v$ is defined as the number of its channels. A channel between node $v_{i}$ and node $v_{j}$ is denoted as $e_{ij}$. A path between two nodes consists of one or more channels. The distance between two nodes is defined as the shortest path between these nodes. The diameter is the longest distance between any two nodes in the network. Similar to the diameter, the average path length is defined as the average distance between any two nodes.

Betweenness is a metric for centrality [8]. The betweenness of a node is the number of shortest paths between any two nodes in the network that pass through the node. The betweenness centrality $c_{B}(v)$ of a node $v$ is given by

[TABLE]

where $\sigma(st)$ is the number of all shortest paths between $s$ and $t$, and $\sigma(s,t|v)$ is the number of all shortest paths between $s$ and $t$ that include $v$. To normalize the value such that $c_{B}\in[0,1]$, $c_{B}$ is divided by the number of all pairs of nodes that do not include $v$, that is, $(n-1)(n-2)/2$ for undirected graphs with $n$ being the total number of nodes. Accordingly, it describes the share of shortest paths that pass this node. In general, betweenness centrality is an indicator of how much control a node has over the network.

A subgraph $G^{\prime}=(V^{\prime},E^{\prime})$ where $V^{\prime}\subseteq V$ and $E^{\prime}\subseteq E$ is called connected component if any node $v^{\prime}\in V^{\prime}$ can be reached by any other node in $V^{\prime}$. A graph is biconnected if it is still connected after removing any arbitrary node. A biconnected component is a largest possible biconnected subgraph. If a node is member of more than one biconnected component, it is called an articulation point or cut vertex. As the removal of nodes that have a high betweenness and/or are articulation points may have an increased impact on network connectivity, they are potential targets of directed attacks.

Graph metrics typically gain meaning only in comparison to other graphs of the same size. In Table I we compare the PCN graph to a random Erdös-Renyi graph [18] and a scale-free Barabasi-Albert graph [19]. Note that while the graphs share similar parameters, the scale-free graph has less edges due to the method of preferential attachment.

From the comparison, we can observe that currently all three graph types share a diameter of 5–6 hops. At the same time, though, the PCN graph has the lowest average distance, which is a favorable property for users as it reduces the failure probability and saves routing fees. In terms of centrality, we compared the central point dominance, defined as the maximum betweenness centrality of all nodes. We can see that the PCN and the scale-free graph have a central point dominance more than ten times as high as the random graph’s. The result suggests that the Lightning Network relies on few central nodes in order to process payments.

II-C Small-World Networks

Small-world networks are characterized by nodes that tend to cluster and have a high density of edges. More formally, the diameter grows logarithmically with the number of nodes. In order to test the “small-world-ness” of the Lightning Network, we use the method introduced in [11]. It is based on comparing the clustering coefficient to a clustering coefficient of a random graph with similar parameters, which serves as a reference.

While different definitions of the global clustering coefficient exist, we use the transitivity definition [9]. Accordingly, the clustering coefficient $C$ is defined as

[TABLE]

Note, a factor of $3$ is used to compensate that each triangle has three paths of length $2$. Thus, $C=1$ for cliques.

Now, let $L_{g}$ and $L_{r}$ denote the mean shortest path length of the PCN graph $G$ and a random Erdös-Renyi graph $R$, respectively. Likewise, let $C_{g}$ and $C_{r}$ describe the clustering coefficient. In accordance with [11], we consider a network as small-world if $S\gg 1$, where

[TABLE]

Applying the described method to our empirical data yields $C_{g}=0.085$ and $L_{g}=2.92$ for the PCN graph and $C_{r}=0.005$ and $L_{r}=3.45$ for the random graph. We can already see that the Lightning Network is more clustered and yields on average shorter distances. We can conclude that the Lightning Network can be classified as a small-world network, as $S=19.439\gg 1$.

II-D Scale-Free Networks

Scale-free networks are characterized by a few nodes having a very high degree and many nodes having low degrees. More specifically, the degree distribution is similar to a power law distribution, where the fraction of nodes $P(k)$ having a degree $k$ is described as $P(k)\sim k^{-\alpha}$ with $\alpha$ typically ranging between 2 and 3 [12].

Scale-free networks emerge if a new node can choose its neighbors freely and prefers well-connected nodes. In the Lightning Network, we have a comparable situation. New nodes have an incentive to preferably open channels to highly connected nodes, hence reaching a larger share of the network with fewer hops. In comparison to random graphs, scale-free networks are generally robust to random failures, as the chance of a critical amount of high-degree nodes failing concurrently is very small. However, since a few nodes have high degrees, scale-free networks are prone to targeted attacks.

In Figure 2, we show the degree distribution of the 100 nodes with highest degree in the Lightning Network: the initial impression makes the hypothesis of a power-law distribution, i.e., scale-free network, plausible. To examine whether the Lightning Network is actually scale-free, we investigate the degree distribution along the lines of [12]. The empirical data are plotted in a log-log plot in Figure 2. On the x-axis we show the node degree $k$ and on the y-axis the probability for a certain node degree $P(k)$. For a power law distribution we expect a negative linear trend, where the slope determines the scaling factor $\alpha$. However, this alone is not sufficient to draw conclusions. To get sound results, we additionally perform a power-law fit using a maximum likelihood estimator. More specifically, we use the Kolmogorov-Smirnov (KS) distance [10] to determine the difference between the actual data and a proposed power-law fit. By minimizing the KS distance for $x$, we retrieve an $x_{min}$.

With $\alpha$ and $x_{min}$, we can derive a power-law distribution, but to draw conclusions it requires a goodness-of-fit test. Based on a number of synthetic data sets and respectively fitted distribution parameters (derived from the regression model), it generates a $p$-value, which we use to accept or reject the hypothesis of a power-law distribution. The authors of [12] suggest to use synthetic data sets with a high number of samples (ideally $10,000$ samples) and to reject the scale-free hypothesis if $p\leq 0.1$.

Applying this method to the empirical PCN data yields an $\alpha=2.18$ and an $x_{min}=16$. For the goodness-of-fit test we created $10,000$ data sets, that in sum yielded a $p$-value of $p=0.3314$, clearly substantiating the scale-free hypothesis.

In conclusion, the degree distribution of the Lightning Network can be classified as power-law distributed, suggesting a scale-free network structure overall. Therefore, the network may benefit from the robustness property of scale-free networks against random failures.

II-E Robustness Analysis

To draw conclusions about the robustness of the Lightning Network, we again compare it to other graph types (Table II). We randomly removed a certain amount of nodes to simulate random failures. Each time, the simulation was run 100 times for the Lightning Network, a scale-free Barabasi-Albert graph [19], and a random Erdös-Renyi graph [18], respectively. The random removal of nodes has nearly no impact on the random graph and the scale-free graph but separates the PCN graph. The isolated components mostly consist of one and two nodes and therefore will barely affect routing efficiency. Yet, the graph separates and a random failure is very likely to separate at least one node from the network. In conclusion, the impact of random failures on the routing efficiency is very low. Nevertheless, the prospects of targeted attacks seems promising. Based on this insight, we discuss several attack vectors and their impact on the network in the following sections.

III Attacking the Lightning Network

As we have seen in the previous section, the Lightning Network is actually rather centralized and exhibits a heavily skewed degree distribution. This raises the question how the network topology copes with attacks that target specific points of interest. In the following, we present specific attack vectors, including channel exhaustion and node isolation attacks, and discuss a number of feasible attack strategies. Moreover, we introduce metrics that allow us to quantify the adversarial advantage of each strategy.

III-A Adversary Model

With its growing success, the Lightning Network becomes an increasingly interesting target for different kinds of adversaries. We assume an active adversary that may participate in the peer-to-peer network, or attack its topology from the outside. At this point, we do not make any assumptions about the adversary’s resources as this will be a parameter of our evaluation. In general, we assume however that the adversary is always eager to act as efficiently as possible, i.e., minimizing resources to maximize its adversarial advantage.

The adversary’s motivation (or goal) may vary and therefore determines the attack vectors and strategies. For example, an adversary may be interested in eliminating single nodes, e.g., to impede or censor their participation in the network. She could also be interested in disrupting the network as a whole and aim for a partitioning attack that could impair the payment processing or even inhibit it entirely. Lastly, the adversary may be a “selfish” node in the Lightning Network, e.g., a payment hub, and interested in increasing her fee gain by sabotaging competing nodes and payment paths.

III-B Attack Vectors

III-B1 Denial of Service

We consider denial-of-service (DoS) attacks as a general attack vector to disrupt a node’s connection to the Lightning Network by using “external” means, i.e., not directly speaking the Lightning protocol. DoS attacks are typically mounted by flooding nodes with superfluous requests to overload their system. We however also include a broader range of DoS attack techniques, such as BGP hijacking to make nodes unreachable.

In general, a DoS attack on specific nodes in the Lightning Network allows an adversary to inhibit these nodes from partaking in regular payment processing. This attack vector usually requires a reasonably strong adversary controlling a botnet or having access to the Internet backbone. In March 2018, the Lightning Network was reportedly hit by a DDoS attack that took 20% of nodes offline [20]. This incident shows that DoS is not a mere theoretical threat, but a feasible attack vector that has to be taken into account.

III-B2 Channel Exhaustion

Each payment channel in the Lightning Network has a certain capacity and can therefore only route payments up to this capacity. We argue that this fact provides an attack vector: an attacker with sufficient funds is able to exhaust, i.e., block, a payment channel by routing a payment over the targeted channel in the respective direction. The attacker may not be able to infer the current channel balance as nodes only announce a channel’s initial capacity. She therefore may need to route multiple payments to eventually exhaust a channel. To this end, the attacker could perform a binary search, starting with the maximum channel capacity and trying to route this volume. In order to not waste funds, the attacker is able to route funds back to herself, in which case only marginal routing fees accrue.

Using this technique, an adversary is able to disturb the payment flow in the network and manipulate it to its advantage. In particular, this attack may be used to cut parts off the network graph, leaving it in decomposed state.

III-B3 Payment Griefing

The threat of channel exhaustion can currently be elevated by combining it with an attack vector called payment griefing [21, 22]: as there is currently no fee on failed routing requests, the adversary may initiate an arbitrary number of HTLC payments to a node under her control. This node may then simply ignore incoming HTLC requests, forcing the involved nodes to wait for the time locks to expire. Upon expiry, the entire state is rolled back, circumventing fee deduction. Therefore, payment griefing allows an adversary to temporarily claim channel capacity free of charge.

Channel exhaustion in general and payment griefing in particular can be amplified by choosing longer payments paths. In this case, the adversary’s stake is able to exhaust/lock funds along the path. With payment griefing, though, we can eliminate specific edges and paths in the PCN topology.

III-B4 Node Isolation

By deliberately exhausting all channels of a node, we can isolate this node completely and effectively hinder it from participating. As shown in Figure 3, a malicious node $E$ can zero all outbound channel balances of a target node $A$. The attack requires $E$ to first open a channel with a capacity that is equal or greater than the total balance of $A$’s outbound channels (cf. Figure 3b). Since the Lightning Network implements source routing, the attacker is able to determine routes and exhaust each channel by issuing a number of payments with respective payment volumes (cf. Figure 3c). Of course, to improve efficiency, the attacker can also make use of payment griefing. This attack vector can be considered a generalization of the channel exhaustion, described previously.

Node isolation leaves the target node unable to route outbound payments. While the node can of course still receive payment requests, it is unable to fulfill them because all of its funds have been shifted to the adversary’s channel (cf. Figure 3d). In this situation, both sides can decide to close the channel, which would return the funds to the target node on-chain. Note that this would additionally deter the target node from using the funds for 1–2 block intervals, i.e., 10–20 minutes. The adversary however could also leave the channel open and refuse to process payment requests at which point the target node is forced to close the channel unilaterally. In this case, the settlement transaction can only be redeemed after the expiration a of the lock time, which adds a delay that is typically larger than 1–2 block intervals.

This attack vector effectively incapacitates the node from functioning as a payment hub, i.e., it eliminates the node from the routable network graph. In order to recover from this state, the target node needs to open at least one newly funded channel. As its old funds can only be reused after the closing channel was successful settled, it has to invest additional funds to be able to start rebalancing its channels and eventually regain its routing capabilities. Note that this comes with an additional overhead for the target node, since it has to pay fees for the funding transaction in the Bitcoin network.

To conclude, even by design, it is possible to remove edges and nodes from the routable Lightning Network. However, depending on the utilized attack vector, the adversary may have to provide more or less resources to carry out the attack.

III-C Attack Strategies

Equipped with the means to remove edges and nodes, the adversary may try to cause maximum damage along the lines of the previously discussed adversary goals. Depending on these goal, however, she may choose a different strategy, i.e., a different set of nodes and edges to attack. In the following we discuss a number of attack strategies.

III-C1 Highest Degree/Betweenness/Eigenvector Centrality Nodes

An adversary aiming to damage the network as a whole might try to destabilize or even partition the network graph, effectively impeding oder hindering cross-network payment routing. For this, the adversary might try to remove the participants according to their importance in the network. Promising strategies therefore prioritize central nodes with respect to some kind of centrality metric. Therefore, as an initial strategy, we propose that the attacker may target nodes based on their degree in descending order.

Moreover, the attacker may target nodes based on the previously mentioned betweenness centrality [8] or their eigenvector centrality [23], which can consider not only the topological location, but also the edge capacities of a node.

III-C2 Highest Ranked Minimum Cut Sets

A minimum cut set of a graph is a set of edges with minimal accumulated capacity that, when removed, partitions the graph. Therefore, minimum cuts are prime target when an adversary aims for network partitioning. However, not all cuts are created equal: while some may partition the network quite effectively, others may only cut off a single node. Given that the adversary has only limited resources at her disposal, it is important to prioritize the targeted minimum cuts according their importance in real world payment scenarios. Therefore, we propose to calculate a high number of potential $(s,t)$-cuts for randomly picked terminals $s$ and $t$, and rank the individual cuts by the number of their occurrences. By targeting the highest-ranked cuts, the adversary focuses on the network bottlenecks hindering payment processing first.

III-C3 Highest Ranked Parallel Paths

An adversary that participates in the network as a payment hub may be interested in increasing her revenue by eliminating competitors. Of course, the adversary may again target competing hubs by their importance in the network, e.g., by node degree. However, such a strategy would not consider how payments are routed in the Lightning Network. Therefore, we propose to simulate random payments and record the resulting payment paths. Excluding the paths involving the adversary’s hub, nodes can be ranked according to their involvement in the remaining payment paths. Accordingly, the adversary eliminates nodes that are part of many competing routes with the intention to increase her fees by processing more payments.

III-D Quantifying Adversarial Success

In the following, we propose a number of metrics that allow us (and the adversary for that matter) to quantify the impact of an attack strategy. To provide an overall metric, we define the adversary’s advantage of an adversary, i.e., success of the attack, as the relative decrease in the respective metric concerning the a priori measurement $m$ and the a posteriori measurement $m^{\prime}$:

[TABLE]

The higher $\Delta_{m}$ becomes the higher the adversary’s success according to metric $m$ will be. It generally provides a way to relatively compare the prospect of different attack strategies from different perspectives.

An attacker may try to partition the network into a number of subgraphs. While the impact of such an attack is limited when the adversary is only excluding single nodes, it may be much more severe if she can cut off larger segments of the network. A sound measure for general network robustness should capture the share of nodes that are disconnected from the network graph. We therefore propose the number of reachable nodes $r$ as a metric. Given all connected components $C_{i}$, we define the largest connected component $C_{1}$ to be the Lightning Network. Accordingly, we can calculate $r$ as the network’s node cardinality $r=|C_{1}|$. This metric can be used to calculate the adversarial advantage $\Delta_{r}$ as defined above.

However, as some nodes are more central and provide a larger share of the network’s total capacity than others, the impact of node isolation on the liquidity of the network may vary heavily depending on the target. To quantify the impact, we propose the average maximum flow as another metric: for $n$ rounds, we draw a pair of nodes $s_{i},t_{i}\in V,\,i\in\{1\ldots n\}$ by uniform random sampling and calculate the maximum flow $F_{i}(s_{i},t_{i})$ along the lines of [24, 25]. The average maximum flow is then given by

[TABLE]

and can be used to calculate the adversarial advantage $\Delta_{F}$.

While the average maximum flow is a good indicator of the routable capacity in the network, it does not necessarily reflect the actual expected payment success, since currently the Lightning Network only uses single-path routing to fulfill payments. Therefore, we additionally introduce the expected payment success ratio $s$ as a metric for how likely payments can be processed by the network. To get a sound estimation, we simulate a high number of transactions between random nodes and calculate the success ratio as

[TABLE]

Accordingly, the adversarial advantage is given by $\Delta_{s}$. As the validity of this measure heavily depends on the transaction model, it will especially benefit from parametrization based on empirical data.

In order to quantify the potential success of an internal adversary aiming for increased revenue, we propose to simulate a high number of payments and accumulate the fee gain $g_{i,h}t$ for the adversary’s hub $h_{a}$ that accrues over all simulated payments $i\in\{1\ldots n\}$. The average fee gain

[TABLE]

may then be used to indicate the adversary’s success.

IV Evaluation

IV-A Proof of Concept

In order to validate the feasibility of our node isolation attack, we built a simple toy scenario mimicking the attack shown in Figure 3. We ran five independent lnd instances, which were connected to the Bitcoin testnet. The target node $A$ established three channels with outbound capacities set to 75,000, 100,000, and 125,000 satoshis, respectively. The attacker $E$ established a channel with a total capacity of 400,000 satoshis to $A$, which is sufficient to exhaust $A$’s channels and therefore hinder any other node from routing through $A$. In our example, we repeatedly sent payments of declining size until $A$ was able to route no more than $100$ satoshis (currently $\approx 0.0037$ USD), at which point we considered the attack to be successful.

IV-B Evaluation Model

The following evaluation of topology-based attacks on the Lightning Network is based on simulations we implemented using networkx [16]. As before, the snapshot from Feb. 1, 2019 is used as our reference dataset. While the dataset provides real-world data on nodes, edges, and edge capacities, it does not include the actual channel balances. We therefore assumed the given capacities to be the balance both ways, likely resulting in an overestimation of the routable funds, i.e., yielding a best-case estimation for the considered metrics.

The proposed metrics and attack strategies rely on the availability of a solid payment model that reflects how transactions of a certain volume traverse the network. Due to the lack of real-world transaction data of the Lightning Network we draw source and target nodes uniformly at random from the network nodes. By doing this, we refrain from introducing unnecessary complex and artificial assumptions. We also assume a single-path routing scheme as currently implemented by the Lightning Network: each payment is processed by first excluding all edges with insufficient capacities from the routable network graph. On the remaining graph, shortest path routing is performed.

As our data base for payment volumes, we collected real world payment data from the Ripple network [26]. For this, we retrieved all XRP transactions that occurred at our reference date Feb. 1, 2019 and converted it to the respective values in satoshis. The transaction volumes are chosen by uniform random sampling from this data set.

All algorithms are repeated 1,000 times to ensure statistical significance. Furthermore, to ensure the reproducibility of the applied metrics, we opted to fixate the pseudorandom number generator’s seed value for each round of simulation. Thereby, the same input data is utilized by all metrics, improving the comparability between measurements.

IV-C Partitioning Attacks

As we have seen, a capable adversary may isolate single nodes in the network. In the following, we analyze the Lightning Network’s resilience to an adversary aiming for maximal damage to the network, i.e., network partitioning. To this end, we assume that the attacker is capable of removing a certain number of nodes from the routable network graph, e.g., by the means of DoS attacks or node isolation attacks. We simulated the previously introduced attack strategies and recorded the network state before (a priori) and after (a posteriori) the attack: removing nodes by decreasing degree, by decreasing betweenness and eigenvector centrality, and by highest ranked minimum cuts. Moreover, we evaluated uniform random node removal as a baseline.

As an initial measure, Figure 4 shows the payment success ratio $s$ before (horizontal line) and after the respective attacks happened. Notably, even before the attack only $675$ out of the 1,000 tried payments succeeded. Moreover, we can see that the strategies work out quite differently, with degree-based removal and betweenness-based removal resulting in a steep decrease of the success ratio (down to around 10% success), while the random and minimum cut strategies measure around the baseline. Accordingly, the adversary’s advantage for the success rate $\Delta_{s}$ is the highest for the former strategies, as shown in Figure 6. Similar results can be seen for the reachability, where the degree and betweenness strategies achieve $\Delta_{r}$ values of larger than $0.5$, i.e., cutting off more than half of the network.

Moreover, the average maximum flow of the network is heavily impaired when removing central nodes. Here, the eigenvector strategy is superior until it is outperformed by the degree and betweenness strategies. The latter two eventually lead to a near-total collapse of the maximum flow, i.e., $\Delta_{F}\approx 1.0$, rendering the remaining network useless.

So far, targeting nodes based on their centrality seems to be the most promising strategy for an adversary that is capable of eliminating a certain number of nodes. However, as we see in Figure 5, the centrality-based strategies also require the largest budget to successfully mount node isolation attacks, while the minimum cut strategy exhibits really low budget requirements. In the following, we therefore evaluate the efficiency of our attack strategies.

IV-D Efficiency of Node Isolation Attacks

In order to evaluate the efficiency of the attack strategies, we assigned each adversary a budget and then analyzed the “damage” it can cause. In particular, we simulate a node isolation only, if the attacker’s (remaining) budget is large enough to remove all edges. Otherwise, the simulation skips the node and tries to utilize the available funds on the next target proposed by the respective strategy. Likewise, we only remove complete cuts. As a consequence, the minimum cut strategy does not always consume the full budget.

The results are shown in Figure 7: independently of the strategy, we observe that it requires high budgets to give the adversary the power to reliably disturb all payment attempts, which would result in a high advantage score $\Delta_{s}$. Notably, the previously underperforming minimum cuts and random node removal strategies exhibit the best efficiency properties, e.g., an adversary could attain an advantage of $\Delta_{s}=0.4$ when spending around $200$ BTC. Similar behaviour can be seen for the impact on the adversary’s advantage in terms of the reachability $\Delta_{r}$ and average maximum flow $\Delta_{F}$. While some strategies seem to be subject to fluctuations, which do not always allow to infer a clear ordering in efficiency, the highest ranked minimum cut strategy again clearly stands out as the most efficient in terms of the $\Delta_{r}$ and $\Delta_{F}$, exhibiting values above $0.5$ in both cases. This is not surprising, since the maximum cut strategy targets the connecting edges and nodes first, whose removal has a significant impact on graph connectivity and the available network capacity.

IV-E Fee Gain

In contrast to disrupting the network, an adversary might be interested in increasing its own profit by strategically eliminating competing nodes. We assumed that this adversary is an established payment hub in the network (amongst the top 10 nodes ranked by total capacity). According to our strategies, most notable highest ranked degree and highest ranked parallel paths, we eliminated up to 30 nodes. We used the average fee gain as metric to quantify the adversary’s success. While the adversary can indeed profit from eliminating nodes, we cannot observe a clear trend. In fact, we believe that node-based elimination strategies are too coarsely grained. Instead, we argue that an channel-based elimination strategy might be superior, which we intend to investigate in the future.

IV-F Discussion

In our analysis, we assume that each node functions as a payment hub, i.e., accepts incoming payment channels. Moreover, the attacker is assumed to find an adequate endpoint with sufficient capacity to route payments. This is especially important if the attacker does not execute payment griefing attacks, but needs to route payments back to herself. In this case, the attacker has to ensure that some nodes in the network first establish channels of sufficient volume to her secondary node, i.e., her target node is connected with high enough inbound capacity.

In order to mitigate the possibility of node isolation attacks, the client software should employ rate limiting techniques to limit the number of incoming channels and incoming channel volume. This would make it harder for an adversary to quickly establish high-volume channels from an advantageous position in the topology. However, a client probably cannot mitigate the risk of node isolation attacks entirely, since the attacker may circumvent simple rate limiting strategies by splitting the funds over multiple identities and channels.

Moreover, network partitioning attacks may be counteracted by the so-called autopilot algorithms responsible for automated payment channel creation. This may be achieved by monitoring previously discussed metrics and restructuring the topology accordingly to make it less susceptible to targeted attacks.

V Related Work

Payment channels were introduced to scale cryptocurrencies to high transactions rates. Several channel designs have been proposed over the past years [2, 3, 4, 5, 6]. While some designs are restricted to single-hop payments, others can also be used for multi-hop payments and therefore are qualified for PCNs. The Lightning Network for Bitcoin and the Raiden Network for Ethereum emerged as the most prominent PCN implementations. A technical overview focusing on Bitcoin’s PCN design space is provided by [27].

Most of the research in the area focuses on challenges concerning privacy, concurrency, and routing [28, 29, 30, 31, 32]. Concurrently to our work, the authors of [33] explore the Lightning Network’s topology and also confirm that the network exhibits properties similar to small-world and scale-free networks. Security of PCNs was mainly discussed in the context of dispute handling [34, 35], which assumes each party to be responsive and synchronized with the blockchain at all times. While this discussion relates to node failures as well, security in general and topology-based attacks in particular have been mostly neglected, though.

When it comes to the mainnets of major cryptocurrencies, most notably Bitcoin and Ethereum, network and centrality measurement studies [36, 37, 38] as well as security analysis concerning node isolation [39] exist. Beyond cryptocurrencies, many topology analyses have been conducted. For example, the peer-to-peer network Gnutella has been classified as a small-world network [40].

In general, our work is orthogonal to the previous work and therefore contributes an important new perspective to the area of PCNs.

VI Conclusion

In this paper, we analyzed the Lightning Network’s payment channel topology and investigated its resilience towards random failures and targeted attacks. We’ve shown that the current Lightning Network can be subjected to channel exhaustion or node isolation attacks and that these attack vectors may indeed have severe consequences for the payment success ratio, reachability, and average payment flow of the network.