►
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/2/state-channels-systemic-security-considerations-and-solutions
The principal author of the Lightning Network describes how to improve state channels on Ethereum to maximize the chance of transactions being processed despite protocol constraints.
Speaker(s): Joseph Poon
Skill level: Intermediate
Track: Security
Keywords: validator, state, contract, fidelity, incentives, risks, modularity, solutions
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 2 was held in Shanghai, China on Sep 19 - 21, 2016.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
B
Hi
everyone
today
I'm
going
to
talk
about
how
to
construct
state
channels
in
a
secure
way
as
a
lot
of
the
channel
type
constructions
are
going
to
become
more
popular
in
the
coming.
You
know,
months
and
years
ahead.
State
channels
perhaps
have
some
greater
complexity
when
it
comes
to
certain
aspects
of
the
design,
but
the
general
promise
is
fairly
interesting
insofar
as
perhaps
I
have
five
channels
with
some
end.
B
B
But
these
are
also
explicit
costs
right.
You
will
outright
pay
the
minor
or
validate
or
set
a
higher
amount,
purely
because
you're
going
make
more
money.
So
the
solution
is
to
only
allow
one
participant
to
enforce
a
state,
a
set
of
states.
You
know
within
some
larger
set
of
the
contract,
and
this
an
alternate
there
may
be
alternate
solutions,
but
this
is
the
you
know.
This
is
a
good
rule
of
thumb.
For
now
you
could
do
other
constructions
using
different
types
of
like
cascading
bonding
structures,
but
that
could
end
up
being
fairly
complex.
B
Additionally,
penalties
need
to
be
predefined.
You
could
have
some
type
of
you
know.
Adjudicator
third
party,
you
know
end
participants,
but
usually,
if
it's
a
two-party
contract,
you
need
to
pre
defined
everything
using
fidelity
bonds
and
what
you're
functionally
doing
is
you're,
creating
the
incentives
for
the
participants
to
be
staying
off
chain
right.
If
you
have
the
incentive
structure
aligned
correctly,
then
you
know
we
can
attest
to
the
state.
We
both
agree
on
the
current
state
and
we
both
know
if
we
deviate
that
we
will
not
win.
B
Systemic
risks
are
also
something
to
seriously
consider
math
spam
risks,
etc,
etc.
You
know
like
there
there
are
different
solutions
for
these
types
of
things
like
time
stop
constructions.
This
is
a
current
area
of
research,
but
this
is
not
specific
to
channels.
Anything
with
fidelity.
Bonds
are
going
to
have
this
issue
and
it's
and
it's
a
fairly
interesting
thing
just
resolved
and
the
most
clean
way
to
resolve.
A
lot
of
this
is
to
be
using
relative
timestamps
when
you're
using
a
relative
timestamp
of
your
contract.
B
Generally,
the
cost
of
enforcement
is
going
to
be
relatively
persistent,
provided
that
the
size
of
the
enforcement
of
the
attestation
is
smaller
functionally.
So,
if
you're,
making
a
large
attestation
and
you're
making
incorrect
attestation,
the
enforcement
of
that
is
probably
going
to
be
smaller,
but
it's
good
to
make
sure
that
it
is
that
way.
The
costs,
the
blockchain
costs,
are
commiserate.
B
B
Module
is
sorry.
Okay,
modularity
in
this
case,
is
more
of
like
a
UT
Excel
model
and
that's
fairly.
That's
the
aut.
X
model
is
interesting
in
so
far
as
you
have
predefined
inputs
have
some
set
of
predefined
outputs
and
that
get
in
you
have
a
net
potential
like
network
of
contracts
that
can
sort
of
like
build
some
kind
of
circuit
path.
B
And,
oh
sorry,
there
you
go
so.
Ultimately,
you
always
do
want
to
be
able
to
enforce
things
on
chain
and
cannot
ignore
that
aspect
and
when
you
compute
across
a
network
of
participants,
the
cost
multiply
now.
A
lot
of
this
sounds
really
really
scary,
and
you
know
this
is
about
risks
and
solutions
and
I.
Think
when
you
look
at
these
types
of
constructions
right
what
you
have
are
you
have
multiple
participants
that
want
to
be
able
to
transact
with
anyone
else
in
the
network.
B
Right
so
I
have
let's
say:
I'm
Alice
I
want
I
want
to
have
some
type
of
financial
contract.
Let's
say
it's
some
options:
contract
of
some
kind
or
some
futures
contract,
whatever
it
may
be,
and
it's
a
conditional
payment
with
some
terms
hdl-c
referring
to
you,
have
some
contract
term
and
some
expert
that
can
be
refunded
and
cancellation
of
that
contract.
B
So,
ideally,
you
want
to
be
constructing
this
off
chain.
So
if
I'm
Alice
I
don't
have
any
commute,
any
communication
on
chain
with
Dave,
so
I
have
I,
have
some
on
chain
record
some
contract
with
Bob
and
ultimately
the
funds
will
eventually
propagate
through
to
Dave
I,
have
the
option
of
enforcing
this
on
chain,
but
I
elect
to
do
it
off
chain
because
it's
cheaper,
etc,
etc.
If
at
any
time
either
party
can
prove
the
attestations
on
chain.
B
However,
the
problem
from
this
is
that,
when
you
attest
on
chain,
the
cost
can
be
higher.
A
lot
of
the
benefits
of
this
technology
is
that
you
can
resolve
a
lot
of
incentive
structures
on
the
blockchain,
so
an
example
would
be
like
I
was
talking
like
Zuko
was
talking
to
me
about
the
the
sort
of
like
a
free
option
problem
right
last
night.
B
You
is
the
ability
to
a
demise,
a
lot
of
the
contracts
themselves,
so
that
you
can
make
the
individual
contract
terms
incredibly
small
and
do
a
tit
for
tat
increase
of
the
actual
contract.
So,
let's
say
I
wanted
to
enter
into
an
options
contract
with
someone
or
some
futures
contracts.
I
can
make,
can
design
a
contract
for
10
sets
and
the
free
age.
The
the
free
option
problem
starts
becoming
negligible
to
the
point
where
it
doesn't
even
matter,
and
you
can
do
that.
B
However,
with
complex
contracts,
there
is
some
issues
when
it
comes
to
requiring
the
participants
to
enforce
a
lot
of
these
things,
but
instead
of
computing
the
nor
contract
on
chain,
you
should
be
attesting
to
the
result,
and
earlier
in
the
day,
there
was
a
talk
about
true
bits.
So
let's
talk
about
doing
a
true
bit
type
construction
on
channels
and
especially
in
network
of
channels
instead,
instead,
in
this
case,
when
you
are
testing
on
Chane,
both
participants
end
up
funding
with
Carol
doing
like
a
like.
She
just
selects
where
the
funds
come
from.
B
B
So
what
she's
saying
is,
if
I'm
wrong,
we
can
do
the
full
computation
on
Shane,
but
we
don't
need
to
right
now.
I'm
saying
this
is
the
result
I'm
telling
you
this
is
the
result.
You
don't
every
every
single
node
on
the
blockchain
does
not
need
to
compute
this,
so
she
puts
up
the
bond
and
after
some
end
period
of
time,
let's
say
over
these
four
days.
She
gets
her
payment,
Alice
and
Bob.
B
Normally
computes
it
off
blockchain
because
you
know
like
their
computing
they're
communicating
normally
in
this
case,
Bob
and
Carol
are
not
communicating
normally,
so
they
need
to
go
to
the
blockchain
and
that's
kind
of
a
good
situation.
If
you're
Carol
you
put
up
some
bond,
you
get
your
bond
back,
you
also
get
the
payment
from
Bob
and
then
you
can
deliver
the
payment
to
Dave.
Remember
in
this
case,
Bob
and
Carol
are
sort
of
like
intermediary
actors,
who
you
don't
really
trust
in
this
situation.
B
Alice
is
paying
Dave,
but
Alice
doesn't
have
on
blockchain
construction
with
Dave,
so
Alice
has
the
contract
flow
through
Bob
and
then
to
Carol
Dave.
But
let's
say
Carol
is
a
malicious
actor
and
wants
to
deceive
the
blockchain.
What
happens
in
this
case
right
in
this
case,
Bob
is
asked.
Bob
enforces
this
and
said:
tells
the
blockchain
hey
Carol
is
lying.
You
should
compute
this
and
Bob
can
similarly
put
up
a
separate
bond
to
discourage
Bob
from
you
know,
from
overly
requiring
the
blockchain
to
compute
too
much.
B
Let's
say
Bob
is
correct.
Everyone
all
the
nodes
compute
this
and
they
say
oh
yeah,
Carol,
made
an
incorrect
attestation.
Carol
should
lose
her
bond
and
she
loses
her
bond
above,
and
this
construction
allows
for
a
minimization
of
the
amount
of
computation
that
you
need
to
do
on
the
blockchain
entirely,
and
this
is
using
a
construction
on
top
of
this
type.
This
type
of
construction
allows
for
you
to
do
this
in
a
network
of
channels.
B
Additionally,
if
you
know
like
a
concern,
would
be
well
if
I'm
Carol
I,
don't
have
enough
money.
I
want
to
put
up
this
bond.
What
do
I
do
if
you're
a
third
party?
It's
not
an
issue
because
well
you
know
the
inputs,
you
know
the
outputs,
you
can
compute
it.
You
know.
You
know
this
bond
is
good.
Bob
can't
dispute
it,
so
you
can
put
up
really
any
amount
of
money
provided
that
you're
computing
correctly.
B
The
bond
is
an
interesting
structure,
because
what
it
gives
you
is
the
ability
to
account
for
the
cost
of
high
computation.
So
what
happens
is
if,
if
the
bond
is
if
the
contract
is
a
very
costly
contract
to
compute,
you
can
attach
a
similarly
expensive
bond,
but
the
benefit
of
this
type
of
construction.