Multi-Party Channels inthe UTXO Model
Challenges and Opportunities

Laolu Osuntokun@roasbeef
Co-Founder & CTO, Lightning Labs

Table of Contents
I. Single-Party Chans + The Promise of Multi-Party Chans (MPC)
II. UTXO Model vs Account Model for MP-Chans
III. Existing Constructions for UTXO-based MP-Chans
IV. New Directions in MP-Chans
V. Open Problems in MP-Chan Construction

Single Party Chans - Overview

●
●

●
●
●

Emulate a shared account using a 2-of-2 multi-sig
Lorem ipsum dolor sit amet,
On-chain control transactions:consectetur adipiscing elit, sed do○ Open○ Cooperative closeeiusmod tempor incididunt ut labore○ Force close
et dolore magna aliqua.
○ Splice-In/Splice-Out
Rapid off-chain balance updates
Atomic conditional payments via HTLCs
Ut enim ad minim veniam, quis
○ Hash Time Locked Contracts
Bridging channels via HTLCs
nostrud exercitation ullamco laboris○ Starts to get more network-ynisi ut aliquip ex ea commodo
consequat.

Single Party Chans - Limitations

●

●

●

Flow of funds constrained by topology ofLorem ipsum dolor sit amet,channels
consectetur adipiscing elit, sed do○ Requires planned bootstrapping effort
for swift onboarding experienceeiusmod tempor incididunt ut labore(autopilot)
Unable to dynamically create new channels et dolore magna aliqua.
off-chain○ Each new user on-boarded to LN requires
on-chain txn (ignoring custodial wallets) Ut enim ad minim veniam, quis
Each channel requires a single UTXO
nostrud exercitation ullamco laboris○ Can only be so many UTXOs in thenisi ut aliquip ex ea commodo
system…
consequat.

Multi-Party Channels - Opportunities

●●

●

●
●

Generalization of two-party contracts to multi-party
Lorem ipsum dolor sit amet,
contracts
consectetur adipiscing elit, sed do○ Extends payment ability to allow n-to-n interaction
No longer need a new utxo for each channel eiusmod tempor incididunt ut labore○ Single UTXO potentially creates 1000s of channels
et dolore magna aliqua.
○ multi-signature techniques, can make fundingtransactions appear as multi-input sweeps!
Able to collocate into “economic zones”○ Frequently transacting parties Likely save Ut
onenim ad minim veniam, quis
networkwork level forwarding fees
nostrud exercitation ullamco laboris○ Off-chain channel creation/destruction
nisi ut aliquip ex ea commodo
Dynamic route creation in the Lightning Network○ Able to dynamically “tunnel” payments consequat.
Applications:○ MMO gaming Servers○ P2P payment focused applications○ Bill-splitting, etc

Multi-Party Channels - UTXOs vs Accounts

●

●

●

Most existing constructions in the account model:○ Single contract with “virtual” accounts within
thecontract
Lorem
ipsum
dolor sit amet,○ Existing constructions/deployments
consectetur adipiscing elit, sed do■ Plasma● Hierarchical side chains with exit clauses, root chain stamped
eiusmod tempor incididunt ut labore
in main chain■ NOCUSTet dolore magna aliqua.
● Creates “bi-modal” accounts on-chain and off-chain
Challenges in UTXO model○ Lack of state in contracts seems to force hierarchicalconstructions
Ut enim ad minim
veniam, quis
○ Hierarchical constructions can have large on chain footprint
nostrud
exercitation ullamco laboris○ Limited scripting restricts range of challenge
proofsAdvantages of UTXO modelnisi ut aliquip ex ea commodo○ Able to easily create new contracts off-chainconsequat.
■ No need to “counterfactual instantiation”
or w/e○ Hierarchical states allow flexibility + decoupled updates

UTXO Based Multi-Party Channels - Lineage

●

●

●

●Duplex channels○ Nested commitment replacement by relative lock-time
Lorem ipsum dolor sit amet,■ Invalidation tree recursively applies relative-lock time to achieveconsectetur adipiscing elit, sed do
longer channel lifetime○ Addition of kick-off transactions later allowed for indefinite channel
eiusmod tempor incididunt ut labore
lifetime
Eltoo (or signed sequence locks!)
et dolore magna aliqua.
○ Commitment replacement by version○ Addresses on-chain state blowup issue due to usage of invalidation trees
Channel Factories
Ut enim ad minim veniam, quis
○ Framework for hierarchical multi-party channels
nostrud
exercitation ullamco laboris○ Originally used invalidation-trees for n-party
commitments○ Addition of eltoo reduces already large on-chain
footprint
in theworst casenisi ut aliquip
ex eacommodoLightning Factories○ Recently published (like earlier this week)consequat.
○ Applies replacement-by-revocation to a channel factory-like framework○ Utilizes BLS signatures to reduce communication complexity○ Doesn’t appear to solve state blow up issues

UTXO Based Multi-Party Channels - Channel Factories●●Hierarchical n-party channel construction:○ Layers of intermediate transactions creating
variousLorem
ipsumsizes
dolorofsit amet,mult-sigs
consectetur
adipiscing elit, sed do○ Further down tree (towards leaves) # of keys
in sigs grows
smaller (fan-out)eiusmod tempor incididunt ut labore
Channel Factory Terminology
et dolore magna aliqua.
○ Hook■ Initial n-of-n multi-sig funding transaction■ Requires all parties to sign-off for updates
Ut enim ad minim
veniam, quis
■ Can utilize key-aggregation/multi-signatures
to shrinkto single key
nostrud exercitation ullamco laboris○ Allocation:nisi utsubset
aliquip ex ea commodo■ Sub-divides hook into smaller multi-sig■ Used to shape structure of relationships further down
consequat.
in tree○ Commitment:■ Leaf nodes of 2-party channels■ Usage of eltoo at leaves allows for n+ leaf chansUTXO Based Multi-Party Channels - Channel FactoriesLorem ipsum dolor sit amet,consectetur adipiscing elit, sed doeiusmod tempor incididunt ut labore
et dolore magna aliqua.

Ut enim ad minim veniam, quis
nostrud exercitation ullamco laborisnisi ut aliquip ex ea commodo
consequat.

New Directions - New User Off-Chain Chan Creation

●

●

●

Able to join new channels without on-chain transactions○ Partially addresses on-boarding problemof ipsum
new users
tosit
LNamet,Lorem
dolor■ “Alice has no Bitcoin, how do we get her onto Lightning without anconsectetur adipiscing elit, sed doon-chain transaction”○ Simply modify existing allocation to add
key ofnew usereiusmod
temporincididunt ut labore○ User then able to update channel in place, never touching chain!
et dolore
magnaUTXO
aliqua.
○ Allows for dynamic growth of # of users
in channel,
growthcontained!
Requires new trust assumption
Ut enimadthreshold
minim veniam,quisusers○ Able to obtain valid channel audit proofs
fromof active
in channel
nostrud exercitation ullamco laboris○ Need to ensure being “teleported” into latest valid state within channel
ut aliquip
ex eacommodo○ As all updates off-chain can’t use rawnisi
chain
to verify“freshness”
ofproposed stateconsequat.
■ MP-Chans like icebergs, can only see hook, not below toallocation/commitments■ Similar to “weak subjectivity” assumption in PoS
Can also splice in/out new funds/participants via sighash no_input

New Directions - Threshold Channel Audit Proofs

●

●

●

Intra/inter multi-party channel operations, require
Lorem “freshness”
ipsum dolor sit
arguments
amet, ofchannel stateconsectetur adipiscing elit, sed do○ Otherwise can sign away output or state to/from a channel that actuallydoesn’t exist!
eiusmod tempor incididunt ut labore○ Typically only have limited visibility into surrounding channel tree
et dolore magna aliqua.
Audit proof:○ Introduce new modified sighash: single sha instead of double-sha○ Require entities from leaf to root/hook to sign description of channel stateenim
ad minim veniam,■ Need enough information to be Utableto reconstructtxid ofquis
txns○ Proof verifier specifies threshold of parties
atexercitationeach internalullamco
branchlaboris(n-of-nnostrudmulti-sig)
nisi ut aliquip ex ea commodo
Required for:○ New user off-chain channel creationconsequat.
○ Cross sub-tree swap operations

Lightning Cross Over - Route Tunneling

●

●

●

●

The current LN graph is generally relatively static
Lorem ipsum dolor sit amet,○ Channels take up to 6 confs before becoming routable by remote parties
consectetur adipiscing elit, sed do○ Channel closes can take 10 of minutes to execute○ Graph verified by nodes to prevent DoS/sybil
eiusmodattacks
tempor incididunt ut labore
Multi-party channels allow for dynamic channel creation, there for dynamic
et dolore magna aliqua.
route creation!
○ Channel relationships in mp-chans exist in “another dimension”○ Can be used by nodes “above ground” to advertise short cuts route thattunnel through channel formation Ut enim ad minim veniam, quis
○ Able to create new channels in seconds
to satisfy
directional
flow above
nostrud
exercitation
ullamcolaborisabove groundnisi ut aliquip ex ea commodo
Requires distance-vector like announcements○ In contrast to circuit-switching widelyconsequat.
utilized today○ Supplemented by proposals for balanced congestion aware packet
switching within the network
Can also be used as a bridge to multiple mp-chans○ Used recursively to dramatically reduce network diameter

Lightning Cross Over - Multi-Party Nodes

●

●

●

Alternatively, can advertise mp-chan as single
Lorem
regularipsumchannel
dolor sit amet,○ Series of smaller mp-chans linking either single chans or other mp-chansconsectetur adipiscing elit, sed do○ Channel “colony” addressed externally by single node public key
Allows multiple nodes to aggregate channels
and combine
liquidity ut laboreeiusmod
tempor incididunt○ Shrinks the size of the public graph, 100s of channels seen as a single
et dolore magna aliqua.
channelCurrent protocol implements limit on # of outstanding HTLCs per channel○ Usage of AMP combined with a max HTLC size (essentially an MTU)
Ut enimad minim veniam, quis
results in constrained commitment space
network-wide■ Limits set for single transactionnostrud
penalty(966 HTLCs)
can easilybeexercitation
ullamcolaborisraised to target max transaction weight policy limit
ut aliquip
ex ea commodo○ Mp-chans essentially allow queue size nisi
to grow
dynamically
via nestedcommitments!
consequat.
■ Similar trick (indirect commitments) can be used for regularchannels as wellLightning Cross Over - Hierarchical Prefix Addressing●●

How to handle receives over multi-node (network
Lorem ipsumaggregated)
dolor sitmp-chan?
amet,○ Today HTLCs targeted at single destination public key
consectetur adipiscing elit, sed do○ Multi-node channels potentially contain hundreds of nodes
Solution:eiusmod tempor incididunt ut labore○ Individual parties within the mp-chan self-organize to assign address
dolore magna
aliqua.
based on up-to-date structure of theetcommitment
tree○ Destination address within commitment tree placed in EOB (extra onionblob)
Ut enimad intermediate
minim veniam,allocations
quis○ Parsed from left-to-right respecting fanout of
to dispatch payment to proper leaf node:
nostrud exercitation ullamco laboris■ Ordering of keys in allocation sorted to allow deterministic parsing
nisi ut aliquip ex ea commodo■ Example for 8 -> 4 -> 2 (x4) channel:● [10][1]consequat.

Cross Channel Swaps via Swaptions

●●
●

●

Lorem ipsum dolor sit amet,Possible to exchange positions within a particular channel, or even tradeconsectetur adipiscing elit, sed dopositions within distinct channels○ Swap itself creates new channel state,
no needto threadprior history
eiusmod
temporincididunt
ut labore
Vanilla atomic swaps have free option issues as single party can halt execution
et dolore magna aliqua.
Atomic Swaption:○ Alice sells Bob the option to swap positions within same/distinct channel○ Regular atomic swaps use a single secretenim ad
minim veniam, quis
○ Atomic swaptions instead involve twoUt
distinctsecrets○ Two layers of transactions:nostrud exercitation ullamco laboris■ Acceptance layer:
nisi ut
aliquip
ex ea commodo● Alice can accept by revealing
secretA whichleads tosecond-layer that unilaterally
pays Bob the premium
consequat.
■ Exercise layer:● Bob can exercise the option till expiration by revealing his
secret B
Potentially allows the sale/transfer of channels within distinct channels!

Channel Orchestration Servers●●Lorem ipsum dolor sit amet,
Distributed version requires quadratic communication for re-allocations
consectetur adipiscing elit, sed do
scaling with number of participants in internal node
○ Shifting to single-key n-of-n (schnorr)eiusmod
requirestempor
additionalroundut
trips
forincididunt
laboreeach signature
et todoloremagna
aliqua.
Can use a message passing server to reduce
linearcommunication
between parties○ Channel participants use server as rendezvous location over Tor onion
Ut enim ad minim veniam, quis
services○ Leaks timing information of updates,nostrud
but server
doesn’t necessarilyknow
exercitation
ullamco laboris
which channels are being updated
nisi utmessages
aliquip ex mix-net
ea commodo■ Participants can send/receive dummystyleconsequat.

Channel Orchestration Servers - Offline Payment Receipt●●

Lorem ipsum dolor sit amet,
Why not also use orchestration server as offline mailbox?
consectetur adipiscing elit, sed do○ Participants pay orchestrator to deliver message with set deadline○ Allows for quasi-offline payment sending/receipt
eiusmod tempor incididunt ut labore○ During clearing phase (HTLC add), if participants not offline within
et dolore magna aliqua.
threshold, cancel back
○ During settle phase, fully async as receiver only comes online to reveal
secretUt enim
minim
veniam,quis toSimilar model possible over “regular” network,
butad
would
need
to pre-pay
several parties to compensate for longer HTLC
lifetime
nostrud
exercitation ullamco laborisnisi ut aliquip ex ea commodo
consequat.

Open Problems

●
●
●
●

●

Lorem ipsum dolor sit amet,
Cut-thru to reduce on-chain footprint in mass exit case?
consectetur adipiscing elit, sed do
Usage of covenants to allow hook transaction
modifications w/o all parties involved? eiusmod tempor incididunt ut labore
Health checking protocol to splice out inactive parties
et dolore magna aliqua.
within allocations
Language for expressing complex multi-step
re-allocations and swaps?
Ut enim ad minim veniam, quis
○ BitML?
Efficient execution of fees+timelocks in nostrud exercitation ullamco laboris
packet-switched model?
nisi ut aliquip ex ea commodo
consequat.

Thank You!
Questions?