(Vir irtual) State Channels Sebastian Faust Credits: Stefan - PowerPoint PPT Presentation

BDLT 2019, Vienna, Austria Off-chain Protocols: (Vir irtual) State Channels Sebastian Faust Credits: Stefan Dziembowski, Lisa Eckey, Julia Hesse, Kristina Hostakova, Sebastian Stammler 1

Hot topic in cryptocurrencies and academia “ Channels ” is our payment Plasma main focus in this talk. channels MVP Initiated by [Decker & state Wattenhofer] [Poon channels & Dryja] (plus many Plasma informal online channel Cash publications). networks “ Plasma ” initiated by [Poon & Buterin] (plus countless informal online publications). 2

Many interesting state channel projects We follow the terminology of Perun (L4 Counterfactual, Connext und Magmo are very similar) 3

Main goal: off-chain contracts On-chain contract: deployment and execution on-chain Chess contract Alice Bob Off-chain contract: deployment and execution off-chain Chess contract Bob Alice 4

State Channel Variants Goal: Off-chain execution of contracts Alice Bob Ingrid Ledger state channel: channel built „ over ledger “ This talk Virtual state channel: channel built „ over ledger channels “ Multiparty state channels: channels for multiparty contracts 5

Outline 1. Introduction 2. Ledger Channels a. Recap: Ledger Payment Channels b. Ledger State Channels 3. Virtual State Channels 4. Security analysis 5. Summary 6

Main ingredient of off-chain protocols Smart contract ≈ „ programmable money “ 𝒚 𝑩 + 𝒚 𝑪 coins Examples: Ethereum Contract rules (in Ethereum written in Solidity) 𝑦 𝐵 + 𝑦 𝐶 Function call f Updating the 𝑦 𝐶 𝑦 𝐵 coins on input m coins coins state Alice Bob 1. Parties deploy contract and deposit coins to the contract 2. Execute the contract 3. Coins can be assigned back to the users 7

Ledger Payment Channels Goal: Execute payments off-chain directly over ledger Examples: Raiden Network in Ethereum, Lightning Network in Bitcoin 𝟑 coins 1 coin 1 coin 2 coins Payment channel contract 1.1 0 0.9 2 1 1 Bob Bob Alice 2. Update 1. Create 3. Close Dispute Off-chain! On-chain On-chain On-chain 8

Updating the ledger payment channel Goal: Update to new balance 0.99 for Alice and 1.01 for Bob Idea: exchange signatures on message containing new balance m := (0.99, 1.01, 1) An index called version number New balance of the parties 1.01 1 0.99 1 Alice Bob 𝝉 𝐂𝐩𝐜 ≔ 𝐓𝐣𝐡𝐨 𝐂𝐩𝐜 ( 0.99, 1.01, 1 ) 𝝉 𝐁𝐦𝐣𝐝𝐟 ≔ 𝐓𝐣𝐡𝐨 𝐁𝐦𝐣𝐝𝐟 ( 0.99, 1.01, 1 ) 𝝉 𝐁𝐦𝐣𝐝𝐟 𝝉 𝐂𝐩𝐜 9

Further updates For each update increase version number: version = version + 1 1.02 0.98 Alice Bob 𝝉 𝐁𝐦𝐣𝐝𝐟 ≔ 𝐓𝐣𝐡𝐨 𝐁𝐦𝐣𝐝𝐟 ( 0.98, 1.02, 2 ) 𝝉 𝐂𝐩𝐜 ≔ 𝐓𝐣𝐡𝐨 𝐂𝐩𝐜 ( 0.98, 1.02, 2 ) 𝝉 𝐁𝐦𝐣𝐝𝐟 𝝉 𝐂𝐩𝐜 10

Closing the payment channel Suppose Bob wants to close the channel 0.98 1 .02 Alice Bob Payment channel Alice gets notified that contract Close(0.98, 1.02, 2, 𝝉 𝐁𝐦𝐣𝐝𝐟 ) close was sent Close(0.98, 1.02, 2, 𝝉 𝐁𝐦𝐣𝐝𝐟 ) Ping() Alice has 1 hour Verify 𝝉 𝐁𝐦𝐣𝐝𝐟 and pay time to react out balance 1.02 coins 0.98 coins 1 hour = maximal time needed to post on the ledger 11

Handling disuptes Suppose malicious Alice closes channel with earlier balance 0.98 1 .02 Alice Bob Payment channel contract Close(0.99, 1.01, 1, 𝝉 𝐂𝐩𝐜 ) Close(0.99, 1.01, 1, 𝝉 𝐂𝐩𝐜 ) Close(0.98, 1.02, 2, 𝝉 𝐁𝐦𝐣𝐝𝐟 ) Close(0.98, 1.02, 2, 𝝉 𝐁𝐦𝐣𝐝𝐟 ) Verify 𝝉 𝐁𝐦𝐣𝐝𝐟 and 𝝉 𝐂𝐩𝐜 Pay out balance according to highest 0.98 coins 1.02 coins version number 12

Outline 1. Introduction 2. Ledger Channels a. Recap: Ledger Payment Channels b. Ledger State Channels 3. Virtual State Channels 4. Security analysis 5. Summary 13

State channels – motivation One way to look at the payment channels: Alice and Bob maintain a simulated ledger between themselves. The contents of the “ simulated ledger ” is registered on the “ real ledger ” only if: • the channel is closed , or • the parties run into a dispute . A natural question : can we also have contracts “inside of the simulated ledger”? 14

Ledger State Channels Goal: Execute contracts off-chain directly over ledger 𝟑 coins 2 coins 1 coin 1 coin State channel contract 2 0 1 1 Bob Bob Alice 2. Add 3. Execute 1. Create 4. Close Off-chain! Off-chain! On-chain On-chain 15

Add a contract Recall: Contracts own coins and maintain state Idea: Extend signed tuple by coins and state of contract m := ( 𝒚 𝑩 , 𝒚 𝑪 , 𝒛 , 𝒕𝒖𝒃𝒖𝒇 , version ) Contract’s off - Contract’s Alice’s Bob’s chain state coins coins coins 𝑧 = 𝑧 𝐵 + 𝑧 𝐶 𝒚 𝑩 - 𝒛 𝑩 𝒚 𝑩 𝒚 𝑪 - 𝒛 𝑪 𝒚 𝑪 Bob Bob Alice Initial state 𝝉 𝑩𝒎𝒋𝒅𝒇 = 𝑻𝒋𝒉𝒐 𝑩𝒎𝒋𝒅𝒇 (𝒏) 𝝉 𝑪𝒑𝒄 = 𝑻𝒋𝒉𝒐 𝑪𝒑𝒄 (𝒏) 16

Executing a contract Suppose Alice wants to execute contract on function Move with input a Function Input 𝒛 𝒛 Move(a) Alice Current state New state’ How can a contract execution be done in a state channel ? 1. Peaceful execution: optimistic ( off-chain ) 2. Forceful execution: in case of dispute ( on-chain ) 17

Peaceful execution Idea: Executing the contract in the state channel Suppose latest state was: ( 𝒚 𝑩 , 𝒚 𝑪 , 𝒛 , 𝒕𝒖𝒃𝒖𝒇 , version) Execute Move(a) Bob Bob Alice Both parties locally compute: 𝒛 𝒛 Move(a) Current state New state’ Parties exchange signatures on: ( 𝒚 𝑩 , 𝒚 𝑪 , 𝒛 , 𝒕𝒖𝒃𝒖𝒇′ , version+1) 18

Forceful execution Idea: If dispute during execution occurs, parties move on-chain Bob does Suppose latest state was: ( 𝒚 𝑩 , 𝒚 𝑪 , 𝒛 , 𝒕 tate, version) not reply Execute Move(x) Bob Bob Alice register Move(x,a) Register latest state ( 𝒚 𝑩 , 𝒚 𝑪 , 𝒛 , 𝒕𝒖𝒃𝒖𝒇 , version) in channel contract From then on: continue execution on-chain 19

Security and efficiency guarantees Consensus on create & add: Agreement required from Alice & Bob 1. Create: Contract requires confirmation from both parties 2. Add: Protocol requires signature from both parties Bob Bob Alice Guaranteed execution: Once contract is added, its execution cannot be halted  achieved via forceful execution Optimistic execution in O(1) rounds: When both parties honest contract execution is in real time  achieved via peaceful execution 20

Summary – ledger channels Main features compared to on-chain transactions • Low costs • Instantaneous updates/execution Payment channels State channels Purpose 2-party payments 2-party contracts Create channel On-chain On-chain Update/Execute Off-chain balance changes Off-chain contract execution Close On-chain On-chain 21

Outline 1. Introduction 2. Ledger Channels a. Recap: Ledger Payment Channels b. Ledger State Channels 3. Virtual State Channels 4. Security analysis 5. Summary 22

Channel networks Problem: every pair of parties requires a separate channel Can we do better? Yes! Alice Bob Ingrid Option 1: Routing each payment via Ingrid • Hashed Timelock Contract (HTLC): used for payments in e.g., Lightning Option 2: Creating virtual state channels • Used for state channel networks 23

Virtual state channel – overview virtual channel contract Bob, let’s play! Alice Bob Ingrid Off-chain! Off-chain! Off-chain! Off-chain! 2. Add 3. Execute 4. Close Virtual channel 1. Create 2. Add 4. Close 1. Create 3. Execute Ledger channel Off-chain! On-chain On-chain Off-chain! 24

Virtual state channel: create Add contract 𝑫 𝑩 Add contract 𝑫 𝑪 𝟐 𝟐 𝟐 𝟐 Alice Ingrid Bob 𝟏. 𝟐 𝟏. 𝟑 Our goal 𝑫 𝑩 𝑫 𝑪 𝟏. 𝟑 𝟏. 𝟐 𝟏. 𝟑 𝟏. 𝟐 Ingrid puts collateral 𝟏. 𝟑 Ingrid puts collateral 𝟏. 𝟐 to take role of Bob to take role of Alice Virtual Channel Contract (VCC) 25

Virtual state channel: create 𝑫 𝑩 : OK! 𝑫 𝑪 : OK! 𝟐 𝟐 𝟐 𝟐 Alice Ingrid Bob Ingrid agreed Ingrid agreed 𝑫 𝑩 𝑫 𝑪 𝟏. 𝟑 𝟏. 𝟐 𝟏. 𝟑 𝟏. 𝟐 Ingrid puts collateral 𝟏. 𝟑 Ingrid puts collateral 𝟏. 𝟐 to take role of Bob to take role of Alice Virtual Channel Contract (VCC) 26

Virtual state channel: create 𝑫 𝑪 𝑫 𝑩 𝟏. 𝟘 𝟏. 𝟘 𝟏. 𝟗 𝟏. 𝟗 𝟏. 𝟐 𝟏. 𝟑 𝟏. 𝟐 𝟏. 𝟑 Alice Ingrid Bob 𝟏. 𝟐 𝟏. 𝟑 Summary: Use sub-protocol „ add “ of underlying state channel to add contract representing virtual state channel 27

Virtual state channel: contract lifecycle Alice Bob 𝟏. 𝟐 𝟏. 𝟑 𝟏. 𝟐 𝟏. 𝟐 𝟏. 𝟑 𝟏. 𝟑 1. Adding contract Exchanging signatures on new 2. Peacful execution of contract version tuples between parties 3. Closing contract 28

Virtual state channel: close Before close: Alice gained 0.1 coins and Bob lost 0.1 coins 𝟏. 𝟗 𝟏. 𝟘 𝟏. 𝟘 𝟏. 𝟗 Alice Alice Ingrid Bob Bob 𝟏. 𝟑 𝟏. 𝟐 After close: 𝟏. 𝟘 𝟐. 𝟐 𝟏. 𝟘 𝟐. 𝟐 Alice Alice Ingrid Bob Bob 𝟏. 𝟑 𝟏. 𝟐 Financially neutral Gained 0.1 coins Lost 0.1 coins 29