Source-linked AI summary
Discharged Payment Channels: Quantifying the Lightning Network's Resilience to Topology-Based Attacks
Elias Rohrer, Julian Malliaris, Florian Tschorsch
TL;DR
The Lightning Network’s prominence makes its topology a target, motivating analysis of its resilience to failures and attacks. The paper studies network structure, introduces channel exhaustion and node isolation attacks, and evaluates attack strategies. It reports that the network is susceptible to these attacks and recommends centrality-based or highest-ranked minimum-cut strategies according to attacker resources.
Problem
The Lightning Network’s prevalence makes it an attractive attack surface, yet its resilience to random failures and targeted attacks requires assessment.
Source: §I · p. 1Method
The authors analyze Lightning Network topology, introduce channel exhaustion and node isolation attacks, and evaluate targeted strategies using measures of adversarial advantage.
Source: §I · p. 1Results
The Lightning Network is susceptible to channel exhaustion and node isolation, and centrality-based or highest-ranked minimum-cut strategies are recommended depending on attacker resources.
Source: §I · p. 1, §VI · p. 9Takeaways & Limitations
The reported attack strategies can have severe consequences for payment success, reachability, and average payment flow in the Lightning Network.
Source: §I · p. 1, §VI · p. 9The discussion assumes nodes function as payment hubs and that an attacker can find an adequate endpoint with sufficient capacity for routing payments.
Source: F. Discussion · p. 9
Abstract
from arXiv · showhide
The Lightning Network is the most widely used payment channel network (PCN) to date, making it an attractive attack surface for adversaries. In this paper, we analyze the Lightning Network's PCN topology and investigate its resilience towards random failures and targeted attacks. In particular, we introduce the notions of channel exhaustion and node isolation attacks and show that the Lightning Network is susceptible to these attacks. In a preliminary analysis, we confirm that the Lightning Network can be classified as a small-world and scale-free network. Based on these findings, we develop a series of strategies for targeted attacks and introduce metrics that allow us to quantify the adversary's advantage. Our results indicate that an attacker who is able to remove a certain number of nodes should follow a centrality-based strategy, while a resource-limited attacker who aims for high efficiency should employ a highest ranked minimum cut strategy.
I. INTRODUCTION
The paper examines the Lightning Network’s topology and resilience to random failures and targeted attacks, introducing channel exhaustion and node isolation as attack vectors. It reports that the network is small-world and scale-free, and that targeted attackers can use strategies tailored to their resources.
I. INTRODUCTION
- The paper introduces channel exhaustion and node isolation attacks, which can disrupt the Lightning Network.Source: §I · p. 1
- Network-theory methods are used to assess small-world and scale-free properties as indicators of centralization, fault tolerance, and performance.Source: §I · p. 1
- The authors develop targeted attack strategies and quantify adversarial advantage using measures including reachability, payment success, and maximum flow.Source: §I · p. 1
- The Lightning Network is classified as both small-world and scale-free, and the authors report susceptibility to targeted attacks.Their empirical analysis uses a recent network snapshot.Source: §I · p. 1
- A centrality-based strategy is suggested for attackers able to remove a certain number of nodes, while resource-limited attackers seeking efficiency should use highest-ranked minimum cuts.Source: §I · p. 1
II. LIGHTNING NETWORK ANALYSIS
The Lightning Network’s topology is analyzed using graph measures and a recent public-network snapshot. Compared with graph models, it has shorter average distances but much higher central point dominance, indicating reliance on a few central nodes.
II. LIGHTNING NETWORK ANALYSIS
- HTLC processing requires every participant to remain online and responsive, making topology robustness a baseline for resilience to node failures such as DoS attacks.If a node goes offline, funds may remain locked for an extended period.Source: §II · p. 2
A. Data Collection and Methodology
- The evaluation uses a recent snapshot captured on Feb. 1, 2019, while assuming publicly available topology data represents the network’s essential traits despite potentially incomplete visibility.The passage says topology characteristics had not changed significantly despite network growth in the preceding months.Source: A. Data Collection and Methodology · p. 2
B. Graph Measures and Metrics
- The analysis models nodes as vertices and payment channels as edges, using shortest-path, degree, connectivity, and betweenness measures to characterize topology.High-betweenness nodes and articulation points are potential targets because their removal may more strongly affect connectivity.Source: B. Graph Measures and Metrics · pp. 2–3
- The PCN and scale-free graph have central point dominance more than ten times the random graph’s, while the PCN has the lowest average distance among the three graph types.The comparison suggests Lightning relies on a few central nodes to process payments.Source: B. Graph Measures and Metrics · p. 3, Table I · p. 3
C. Small-World Networks
The paper tests whether Lightning is small-world by comparing its clustering and mean shortest-path length with a similar random graph. The measured small-world score is far above the stated threshold.
C. Small-World Networks
- The small-world test compares the network’s clustering coefficient and mean shortest-path length with those of a random graph having similar parameters.The paper considers a network small-world when S ≫ 1.Source: C. Small-World Networks · p. 3
- S = 19.439 ≫ 1, classifying the Lightning Network as small-world, with Cg = 0.085 and Lg = 2.92 versus Cr = 0.005 and Lr = 3.45 for the random graph.The method compares clustering and mean shortest-path length against a random Erdős–Rényi graph.Source: C. Small-World Networks · p. 3
D. Scale-Free Networks
The paper tests whether Lightning’s degree distribution follows a power law using a fitted distribution and goodness-of-fit test. The reported fit supports classifying the network as scale-free.
D. Scale-Free Networks
- The power-law test fits the empirical degree distribution using a maximum-likelihood estimator and minimizes the Kolmogorov–Smirnov distance to select xmin.A goodness-of-fit test on synthetic data sets is then used to accept or reject the power-law hypothesis.Source: D. Scale-Free Networks · p. 4
- α = 2.18, xmin = 16, and p = 0.3314 support the scale-free hypothesis for the empirical PCN data.The goodness-of-fit test used 10,000 synthetic data sets.Source: D. Scale-Free Networks · p. 4
- The power-law degree distribution suggests a scale-free structure, which may benefit the network’s resilience to random failures.The paper also notes that scale-free networks’ few high-degree nodes make them prone to targeted attacks.Source: D. Scale-Free Networks · p. 4
E. Robustness Analysis
Random node removals often separate the Lightning Network, but the resulting components mostly contain only one or two nodes and have little routing-efficiency impact. The paper then introduces targeted attack vectors and an adversary model whose resources and goals vary.
E. Robustness Analysis
- Random node failures are likely to isolate at least one node, yet their impact on routing efficiency is very low because separated components mostly contain one or two nodes.The simulations randomly removed nodes and were run 100 times for each graph type.Source: E. Robustness Analysis · p. 4
III. ATTACKING THE LIGHTNING NETWORK
- The attack analysis considers channel exhaustion and node isolation, and quantifies adversarial advantage using measures including reachability, payment success, and maximum flow.Channel exhaustion can render whole parts of the network unreachable.Source: §III · p. 4
A. Adversary Model
- The adversary may participate in the peer-to-peer network or attack from outside, with resources treated as an evaluation parameter and goals ranging from censoring nodes to partitioning the network.A selfish payment hub may also seek higher fee gains by sabotaging competing nodes and paths.Source: A. Adversary Model · p. 4
B. Attack Vectors
The paper considers external denial of service, channel exhaustion, and payment griefing as ways to disrupt Lightning Network nodes, channels, and routes.
1) Denial of Service:
- A March 2018 DDoS reportedly took 20% of Lightning nodes offline; DoS can require a botnet or Internet-backbone access.The paper also includes BGP hijacking among external DoS techniques.Source: 1) Denial of Service · pp. 4–5
2) Channel Exhaustion:
- An attacker with sufficient funds can exhaust a channel by routing payments in its direction, potentially cutting parts off the network graph.Because current channel balances are not announced, the attacker may need repeated attempts; routing funds back to herself incurs only marginal fees.Source: 2) Channel Exhaustion · p. 5
3) Payment Griefing:
- Payment griefing exploits unpaid failed routing requests to temporarily claim channel capacity without charge.Longer paths can lock funds along the route, allowing griefing to eliminate specific edges and paths.Source: 3) Payment Griefing · p. 5
- Node isolation drains a target’s outbound channels through a sufficiently large attacker channel, with payment griefing available to improve efficiency.The figure depicts the attacker exhausting the target’s outgoing capacity and closing the channel.Source: 4) Node Isolation · p. 5, Figure 3 · p. 5
4) Node Isolation:
Node isolation prevents a target from routing outbound payments and can impose delays and extra costs before it regains routing capability; the paper also describes strategies for selecting attack targets.
4) Node Isolation:
- After isolation, a target cannot route outbound payments; if the attacker refuses payments and the target closes unilaterally, settlement is delayed beyond the usual 10–20 minutes.A cooperative close returns funds on-chain but still prevents their use for 1–2 block intervals.Source: 4) Node Isolation · p. 5
- To regain routing, the target must open a newly funded channel and pay a Bitcoin-network funding fee before it can rebalance channels.Old funds become reusable only after the closing channel settles.Source: 4) Node Isolation · p. 5
C. Attack Strategies
- The paper treats edge and node removal as possible by design, with required attacker resources varying by attack vector.For network-wide damage, proposed strategies rank nodes by descending degree, betweenness, or eigenvector centrality.Source: 4) Node Isolation · pp. 5–6, 1) Highest… · p. 6
2) Highest Ranked Minimum Cut Sets:
The section proposes a ranked minimum-cut strategy for network partitioning and metrics for comparing attack effects, including reachability, flow, payment success, and fee gain.
2) Highest Ranked Minimum Cut Sets:
- A resource-limited attacker can rank minimum cuts by how often they occur among sampled terminal pairs, prioritizing recurring bottlenecks for removal.A minimum cut has minimal accumulated capacity and partitions the graph when removed.Source: 2) Highest Ranked Minimum Cut Sets · p. 6
- A payment-hub adversary can simulate random payments, then target nodes appearing on many competing routes to try to increase its fee revenue.The ranking excludes routes involving the adversary’s own hub.Source: 3) Highest Ranked Parallel Paths · p. 6
D. Quantifying Adversarial Success
- Adversarial advantage is the relative decrease in a metric from its a priori value m to its a posteriori value m′; a larger Δm indicates greater success on that metric.The metric allows relative comparison of attack strategies from different perspectives.Source: D. Quantifying Adversarial Success · p. 6
- Reachability is measured as the number of nodes in the largest connected component, with its adversarial advantage given by Δr.This captures how many nodes remain connected after a partitioning attack.Source: D. Quantifying Adversarial Success · p. 6
- Average maximum flow between uniformly sampled node pairs measures routable capacity and supports calculation of adversarial advantage ΔF.The paper distinguishes this from expected payment success, since Lightning uses single-path routing.Source: D. Quantifying Adversarial Success · p. 6
- Expected payment success ratio estimates how likely random-node transactions are to be processed, and its adversarial advantage is Δs.The measure’s validity depends heavily on the transaction model and would benefit from empirical parametrization.Source: D. Quantifying Adversarial Success · p. 6
- Average fee gain across simulated payments can indicate the success of an internal adversary’s revenue-focused attack.The paper proposes accumulating fee gains for the adversary’s hub.Source: D. Quantifying Adversarial Success · pp. 6–7
IV. EVALUATION
A five-instance testnet scenario demonstrates the feasibility of node isolation by draining a target’s outbound channel capacities.
A. Proof of Concept
- The proof of concept used five independent lnd instances connected to Bitcoin testnet.The target had three channels with outbound capacities of 75,000, 100,000, and 125,000 satoshis.Source: A. Proof of Concept · p. 7
- The attacker opened a 400,000-satoshi channel to the target, enough to exhaust its three outbound channels.The target’s stated outbound capacities totaled 300,000 satoshis.Source: A. Proof of Concept · p. 7
- The attack was considered successful when repeated declining-size payments left the target able to route no more than 100 satoshis.The passage gives this threshold as approximately 0.0037 USD.Source: A. Proof of Concept · p. 7
B. Evaluation Model
The evaluation combines a snapshot-based payment model with tests of node-removal strategies. Central-node removals sharply impair payment success, reachability, and maximum flow, while minimum-cut attacks require less budget to isolate nodes.
B. Evaluation Model
- The simulations used the February 1, 2019 snapshot and treated each channel’s capacity as its balance in both directions, likely overestimating routable funds.The resulting metrics are described as a best-case estimate.Source: B. Evaluation Model · p. 7
- Payments used uniformly sampled source-target pairs and Ripple-derived volumes; the model excluded insufficient-capacity edges before applying shortest-path routing.The model assumes the single-path routing scheme used by the Lightning Network.Source: B. Evaluation Model · p. 7
C. Partitioning Attacks
- The partitioning tests removed nodes by degree, betweenness, eigenvector centrality, or highest-ranked minimum cuts, with uniform random removal as a baseline.They compared network states before and after removing a specified number of nodes.Source: C. Partitioning Attacks · p. 7
- Degree- and betweenness-based removal reduced payment success to around 10%, while random and minimum-cut strategies stayed near baseline.Before attacks, only 675 of 1,000 attempted payments succeeded.Source: C. Partitioning Attacks · pp. 7–8, Figure 4 · p. 7
- Degree and betweenness strategies achieved ∆r values above 0.5, and eventually drove average maximum-flow advantage to ∆F ≈1.0.The latter result corresponds to a near-total collapse of maximum flow.Source: C. Partitioning Attacks · p. 8, Figure 6 · p. 8
- Centrality-based strategies required the largest node-isolation budgets, whereas the minimum-cut strategy had very low budget requirements.This motivates comparing attack efficiency as well as damage after removing a fixed number of nodes.Source: Figure 5 · p. 7, C. Partitioning Attacks · p. 8
D. Efficiency of Node Isolation Attacks
Budget-based tests find highest-ranked minimum cuts especially efficient for damaging reachability and maximum flow, while node-based fee-gain attacks show no clear trend. The discussion describes possible mitigation measures and assumptions relevant to isolation attacks.
D. Efficiency of Node Isolation Attacks
- Highest-ranked minimum cuts stood out for efficiency, with ∆r and ∆F above 0.5; around 200 BTC could yield ∆s = 0.4 for minimum-cut and random strategies.The minimum-cut strategy targets connecting edges and nodes, affecting connectivity and available capacity.Source: D. Efficiency of Node Isolation Attacks · p. 8
- Reliable disruption of all payment attempts required high budgets across strategies, and efficiency ordering was not always clear because some results fluctuated.For node isolation, the simulation removed a node only when the remaining budget covered all its edges and removed only complete cuts.Source: D. Efficiency of Node Isolation Attacks · p. 8
E. Fee Gain
- Eliminating competing nodes could yield fee gains for a top-10-capacity payment hub, but the experiments showed no clear trend.The authors consider node-based elimination too coarse and propose investigating channel-based elimination.Source: E. Fee Gain · p. 9
F. Discussion
- The analysis assumes payment hubs accept incoming channels and that an attacker can find an endpoint with sufficient capacity to route payments back to herself.This is especially relevant when the attacker does not use payment griefing attacks.Source: F. Discussion · p. 9
- Rate limiting incoming channels and volume may hinder rapid isolation, but splitting funds across identities and channels may circumvent simple rate limits.Autopilot algorithms could also monitor metrics and restructure topology against targeted partitioning.Source: F. Discussion · p. 9
V. RELATED WORK
Prior PCN research largely addressed privacy, concurrency, routing, and dispute handling, while topology-based attacks had received little attention. The paper concludes that channel exhaustion and node isolation can severely affect Lightning Network performance.
V. RELATED WORK
- Prior PCN research focused largely on privacy, concurrency, and routing, while topology-based attacks were mostly neglected in security discussions.Existing security work mainly treated dispute handling under assumptions of responsive, blockchain-synchronized parties.Source: §V · p. 9
- Concurrent work also found small-world and scale-free properties in Lightning Network topology, while other studies examined cryptocurrency networks and node isolation.The cited examples include topology analyses of major cryptocurrency mainnets and Gnutella.Source: §V · p. 9
- The authors characterize their work as orthogonal to prior work and as adding a perspective to PCN research.The related-work discussion distinguishes its focus on topology-based attacks from the topics it says were mostly neglected.Source: §V · p. 9
VI. CONCLUSION
- The conclusion reports that channel exhaustion and node isolation can severely affect payment success ratio, reachability, and average payment flow.The analysis examined Lightning Network topology and resilience to random failures and targeted attacks.Source: §VI · p. 9