A financially accountable
watching network
Patrick McCorry

PisaResearch
paddypisa

WHY IS OFF-CHAIN EXCITING?

1 tx tojoin
off-chain
protocol10k+ tx
authorised
off-chain

Bypass all blockchain latency and fees
While still retaining non-custodial security
guarantees.

1 tx toleave
off-chain
protocolOnly scaling solution that will exceed 10k tps
99% of transactions are LOCAL andnever reach the global network.

But what does an “off-chain
network” look like?

P2P Routing NetworkNon-Custodial Hubs

P2P Routing Network

Watching Network

Non-Custodial Hubs

P2P Routing Network

Watching Network

Non-Custodial Hubs

P2P Routing Network
Settlement System andRoot of Trust of all Layer 2

Watching Network

Non-Custodial Hubs

Open-source, global, permissionless andnon-custodial financial system.
It is coming…

P2P Routing Network
Settlement System andRoot of Trust of all Layer 2

Plasma Group

Settlement System andRoot of Trust of all Layer 2

Plenty of talks about channels + plasma.
We’ll “briefly” talk about how
replace-by-revocation works before
deep-diving into the watching network

Watching Network

What does a lightning channel look like? (replace-by-revocation)
Alice and Bob always have a transaction (“state”)
that only they can broadcast to trigger a dispute.

State 1A

State 1B

What does a lightning channel look like? (replace-by-revocation)
Authorising a payment is a two-step process

State 1A

State 1B

What does a lightning channel look like? (replace-by-revocation)
1. Both parties authorise a new state(a transaction only the counterparty can broadcast)State 1AσA

State 2B

σB

State 2A

State 1B

What does a lightning channel look like? (replace-by-revocation)
Either State 1 or State 2 can be broadcast…
Second step revokes old balance and confirms the new one.

State 2A

State 2B

State 1A

State 1B

What does a lightning channel look like? (replace-by-revocation)
2. Both parties will “revoke” the old state(i.e. share pre-image of hash)State 1A

State 1B

State 2A

State 2B

State 1A

State 1B

What does a lightning channel look like? (replace-by-revocation)
Complete!
Both parties can always broadcast the latest state.

State 2A

State 2B

State 1A

State 1B

What does a lightning channel look like? (replace-by-revocation)… and a growing list of revoked states… as we will see,this will be problematic...

State N(A)State 1

State ...

State N(B)State N-1

State 1

State ...

State N-1

What does a lightning channel look like? (replace-by-revocation)

What if Alice stops co-operating (she is offline)?
State N(A)State N(B)State 1

Bob can try to close the channel based on a
“revoked” state that repays him back Statehis 1
coins.
State ...
State ...
State N-1

State N-1

What does a lightning channel look like? (replace-by-revocation)

State N(A)State 1...

State ...

Block 10

State N(B)State N-1

State 1

State ...

State N-1

What does a lightning channel look like? (replace-by-revocation)

State N(A)State 1

State ...

State N(B)State ...

State N-1

State 1...

Block 10

State N-1

What does a lightning channel look like? (replace-by-revocation)

State N(A)State 1...

State ...

Block 10

State N(B)State ...

State N-1

State 1

State N-1

What does a lightning channel look like? (replace-by-revocation)

On-chain dispute process...

State 1...

State N(A)State N(B)
If there is no response by Alice by block 100,
then Bob will get all his coins back based on theState ...
State ...
State N-1
revoked state.

Block 10Block 11
State 1...

...

Block 100

State N-1

What does a lightning channel look like? (replace-by-revocation)

State N(A)State 1...

State ...

Block 10

State N(B)
Blocks are getting
minted...

State N-1

Block 11
State 1...

...

Block 100

State ...

State N-1

What does a lightning channel look like? (replace-by-revocation)

Yet no response from Alice…

State N(A)State 1...

State N(B)

But … if Alice were online… what exactly would she
respond with?
State ...
State ...
State N-1

Block 10Block 11
State 1...

...

Block 100

State N-1

What does a lightning channel look like? (replace-by-revocation)
JUSTICE TRANSACTION
Alice can steal all coins in thechannel (i.e. spend the outputs) bysigning a justice transaction

State 1

What does a lightning channel look like? (replace-by-revocation)

State N(A)State 1...

State ...

Block 10

State N(B)State ...

State N-1

Block 11
State 1...

...

Block 100

State N-1

What does a lightning channel look like? (replace-by-revocation)

State N(A)State 1...

State ...

Block 10

State N(B)State ...

State N-1

Block 11
State 1...

...

Block 100

State N-1

What does a lightning channel look like? (replace-by-revocation)

State N(A)State 1...

State ...

Block 10

State N(B)State ...

State N-1

Block 11
State 1...

...

Block 100

State N-1

What does a lightning channel look like? (replace-by-revocation)

Alice wins!

State N(A)State 1

State ...

State N(B)

Her JUSTICE TRANSACTION was accepted into the blockchain
before the dispute process expired!
State ...
State N-1
State N-1
She punished Bob for trying to cheat by taking all coinsin the channel.

...

Block 10Block 11
State 1...

...

Block 100

FAQ: Can Alice just keep a pre-signed justice tx around?

FAQ: Can Alice just keep a pre-signed justice tx around?
Why?
State 1
Bob has a LIST of REVOKED transactions
that only HE can broadcast….
State 2

State ...

State N

She must be ready to prove any of them
are invalid…
Remember, UTXO!

FAQ: Under the hood - what does it look like (roughly speaking)Funding Transaction

1 BTC, A & B

FAQ: Under the hood - what does it look like (roughly speaking)Bob’s Tx (State N)

Funding Transaction

1 BTC, A & B

σA

0.5 BTC,
B, t
A, H(S)
0.5 BTC,A

Every state compromises of
TWO transactions
1 transaction only Alice canbroadcast
1 transaction only Bob canbroadcast

Alice’s Tx (State N)
Symmetric to Bob’s tx
We omit it for spaceFAQ: Under the hood - what does it look like (roughly speaking)Bob’s Tx (State N)

Funding Transaction

1 BTC, A & B

σA

0.5 BTC,
B, t
A, H(S)
0.5 BTC,A

Bob’s balance
He can claim it after time t
OR
Alice can claim it
immediately if S is revealed

Alice’s balance
Alice’s Tx (State N)

She can redeem it immediately

FAQ: Under the hood - what does it look like (roughly speaking)Bob’s Tx (State N)

Funding Transaction

1 BTC, A & B

σA,σB

0.5 BTC,
B, t
A, H(S)
0.5 BTC,
A

Alice’s Tx (State N)

Bob broadcasts it
He can just sign andbroadcast it at any time… totrigger the dispute period(up to time t)FAQ: Under the hood - what does it look like (roughly speaking)Bob’s Tx (State N)

Funding Transaction

1 BTC, A & B

σA,σB

Alice’s JUSTICE TX

0.5 BTC,
B, t
A, H(S)

σA, S

0.5 BTC,AσA

Alice’s Tx (State N)

1 BTC, ANow we know how Lightning Channels(replace-by-revocation) roughly works…
Let’s better understand this watching
network

Watching Network

Monitor (Tadge) @ Scaling Bitcoin ‘16

Leaning
Watch Tower

Monitor (Tadge) @ Scaling Bitcoin ‘16

But what does she send to the watch tower?

Leaning
Watch Tower

Monitor (Tadge) @ Scaling Bitcoin ‘16

Bob’s Tx (State N)

σA,σB

Alice’s JUSTICE TX

0.5 BTC,
B, t
A, H(S)

σA, S

0.5 BTC,AσA

1 BTC, A

Leaning
Watch Tower

Monitor (Tadge) @ Scaling Bitcoin ‘16
Tx Locator
Let’s watching service find transaction when dispute is triggered
Encryption Key
Used to encryption Justice Transaction, only discoverable when adispute is triggered.

Leaning
Watch Tower

Bob’s TX (State N)
TXID [32 bytes]
TxLocator = [16:0]
Encryption Key = [16:32]

4410c8d14ff9f87ceeed1d65cb58e7c7b2422b2d7529afc675208ce2ce09ed7d
TxLocator

Encryption Key

Monitor (Tadge) @ Scaling Bitcoin ‘16
Encrypted Justice Transaction
Alice encrypts the pre-signed justice transaction.
It can ONLY be decrypted by watchtower if there is a dispute(or if bob leaks the key)

Encrypted Justice TX
Bob’s TX (State N)
TXID [32 bytes]
TxLocator = [16:0]
Encryption Key = [16:32]

σA, S
σA

1 BTC, A

Leaning
Watch Tower

Monitor (Tadge) @ Scaling Bitcoin ‘16
Send to the Watching Service
TxLocator & Encrypted JusticeTransaction

ator

c
TxLo

pted
y
r
c
& En

Jus

tice

n

ctio

sa
Tran

Leaning
Watch Tower

Monitor (Tadge) @ Scaling Bitcoin ‘16

Leaning
Watch Tower...

Block 10

TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor (Tadge) @ Scaling Bitcoin ‘16

Leaning
Watch Tower...

Block 10Block 11
State 1

TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor (Tadge) @ Scaling Bitcoin ‘16

Watching Service - 5 Steps
1.
2.
3.
4.
5.

...

Block 10Block 11
State 1

Extract Transaction ID
Compute TxLocator + Key
Find “encrypted blob”
Decrypt it!
Broadcast to the network

Leaning
Watch Tower
TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor (Tadge) @ Scaling Bitcoin ‘16

Watching Service - 5 Steps
1.
2.
3.
4.
5.

...

Block 10Block 11
State 1

Extract Transaction ID
Compute TxLocator + Key
Find “encrypted blob”
Decrypt it!
Broadcast to the network

Leaning
Watch Tower
TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor (Tadge) @ Scaling Bitcoin ‘16

Watching Service - 5 Steps
1.
Extract Transaction ID
2.
Compute TxLocator + Key
3.
Find “encrypted blob”
Let’s
look
at the4.
Decrypt
it! good, bad and the ugly
5.
Broadcast to the network...

Block 10Block 11
State 1

Block 12

Leaning
Watch Tower
TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor - THE GOOD
Channel-Privacy

Responder, not trigger

We don’t know anything
about channel until
dispute(Can also send us junk)

We CANNOT trigger any
disputes! Only respondif the counterparty
tries to cheat.

Leaning
Watch Tower
Simple Protocol
Just store encryptedblob and watch
blockchain to retrieve
decryption key

Monitor - THE GOOD, BAD
Channel-Privacy

O(N) Storage

Responder, not trigger

We don’t know anything
about channel until
dispute(Can also send us junk)

Watching service muststore a justicetransaction for EVERY
new state update.

We CANNOT trigger any
disputes! Only respondif the counterparty
tries to cheat.

Leaning
Watch Tower
Congestion BIG problem

Simple Protocol

Watching service only
has a pre-signed
transaction and very
very awkward to bumpfees

Just store encryptedblob and watch
blockchain to retrieve
decryption key

Monitor - THE GOOD, BAD, AND THE UGLY
Channel-Privacy

O(N) Storage

Responder, not trigger

We don’t know anything
about channel until
dispute(Can also send us junk)

Watching service muststore a justicetransaction for EVERY
new state update.

We CANNOT trigger any
disputes! Only respondif the counterparty
tries to cheat.

Leaning
Watch Tower
Congestion BIG problem

Simple Protocol

HOPES FOR AVAILABILITY

Watching service only
has a pre-signed
transaction and very
very awkward to bumpfees

Just store encryptedblob and watch
blockchain to retrieve
decryption key

Hire hundreds ofwatchers and only 1 isrewarded.
What if they don’t
respond? Tough luckView of how a “watching network” might work so far

Leaning
Leaning
Leaning
Leaning
Leaning
Leaning
Watch Tower Watch Tower Watch Tower Watch Tower Watch Tower Watch Tower

Hire multiple watch towers

Reward Policy?

And hope one responds!
Goal for “Monitor” was CHANNEL
Privacy.

Only the one watch tower who getstheir respective justice tx inthe blockchain will get rewarded.

WatchTower @ BPASE’18

σA, σB, i*
Signatures

State version

Leaning
Watch Tower*The actual construction is slightly different, it commits to the “version, randomness” which is revealed, but this is easier to explain.

WatchTower @ BPASE’18
Realtime payments via Lightning

$$
, i,

σ
σ A, B
&
r
cato
o
L
x
T

Leaning
Watch Tower
TxLocator:σA, σB, i*The actual construction is slightly different, it commits to the “version, randomness” which is revealed, but this is way easier to explain.

WatchTower @ BPASE’18
Watching Service - 5 Steps
1.
2.
3.

Extract Transaction ID
Look up the latest “i”
received
Broadcast it!

Leaning
Watch Tower
TxLocator:σA, σB, i...

Block 10Block 11
State 1

WatchTower @ BPASE’18
Watching Service - 5 Steps
1.
2.
3.

Extract Transaction ID
Look up the latest “i”
received
Broadcast it!
σA, σB, i

Leaning
Watch Tower
TxLocator:σA, σB, i...

Block 10Block 11
State 1

WatchTower @ BPASE’18
Watching Service - 5 Steps
1.
2.
3.

Extract Transaction ID
Look up the latest “i”
received
Broadcast it!

Leaning
Watch Tower
σA, σB, i...

Block 10Block 11
State 1

TxLocator:σA, σB, iWatchTower @ BPASE’18
Watching Service - 5 Steps
1.
2.
3.

Extract Transaction ID
Look up the latest “i”
received
Broadcast it!

Leaning
Watch Tower
TxLocator:σA, σB, i...

Block 10Block 11Block 12

State 1σA, σB, iWatchTower @ BPASE’18
Watching Service - 5 Steps
1.
2.
3.

Extract Transaction ID
Look up the latest “i”
received
Broadcast it!

Let’s look at the good, bad and the ugly

Leaning
Watch Tower
TxLocator:σA, σB, i...

Block 10Block 11Block 12

State 1σA, σB, iWatch Tower - THE GOOD
Verifiable Job

Separates TX + StateNo longer store junk.
We know it is a usefuljob.

We are broadcasting the“latest state” and notnecessarily a bitcointransaction. Cleaner
solution.

O(1) Storage
Only store the job withthe largest version.

Leaning
Watch Tower

Watch Tower - THE GOOD, BAD
Verifiable Job

Accountability? No

Separates TX + StateNo longer store junk.
We know it is a usefuljob.

No evidence a watch
tower was hired and ifthey don’t do theirjob, no way to proveit.

We are broadcasting the“latest state” and notnecessarily a bitcointransaction. Cleaner
solution.

No financial deterrent

O(1) Storage

We need to rely on the
reputation of awatching service (orhire multiple) since noskin-in-the-game

Only store the job withthe largest version.

Leaning
Watch Tower

Watch Tower - THE GOOD, BAD, AND THE UGLY
Verifiable Job

Accountability? No

Separates TX + StateNo longer store junk.
We know it is a usefuljob.

No evidence a watch
tower was hired and ifthey don’t do theirjob, no way to proveit.

We are broadcasting the“latest state” and notnecessarily a bitcointransaction. Cleaner
solution.

No financial deterrent

O(1) Storage

Consensus Upgrade

We need to rely on the
reputation of awatching service (orhire multiple) since noskin-in-the-game

Only store the job withthe largest version.

We need a new OP_CODE
for eltoo to work, so
we don’t get thebenefits of watch
tower.

Leaning
Watch Tower

PISA @ Scaling Bitcoin ‘19
We don’t care too much about the underlying payment
channel construction.
It can be replace-by-revocation (today)or replace-by-version (eltoo).

Monitor-style Jobs

Eltoo-style Jobs

Outpost-style Jobs

TxLocator +Encrypted TX

TxLocator &Authorised State
VersionTxLocator +Decryption Key(Find out later)

Leaning
Watch Tower

PISA @ Scaling Bitcoin ‘19

On-chain evidence

Signed Receipt

If PISA doesn’t
respond, clear
on-chain evidence.

An acknowledgementthat PISA accepted ajob

Leaning
Watch Tower
Requires a new
OPCODE to support
SPV Proof, parsing
receipt & covenants

PISA Contract
with security
depositPISA (Monitor) @ Scaling Bitcoin ‘19

TxLocator1 & ENCJustice

Leaning
Watch Tower

PISA (Monitor) @ Scaling Bitcoin ‘19

TxLocator1 & ENCJusticeSigned Receipt

Leaning
Watch Tower

PISA (Monitor) @ Scaling Bitcoin ‘19

TxLocator1 & ENCJusticeSigned Receipt
In-depth Signed Receipt
Encrypted Justice: ENCJusticeTransaction Locator: TxLocator1
Appointment Start: Block 10
Appointment Expiry: Block 500
Minimum Dispute Period: 50 blocks
Signature by PISA: σPISALeaning
Watch Tower

PISA (Monitor) @ Scaling Bitcoin ‘19

TxLocator1& ENCJustice
BONUS POINTS- Fairreal-time payments
We can useSigned
a simple
HTLC transfer to
Receipt
guarantee fair exchange of signed receipt +payment over the lightning network.
In-depth Signed Receipt
Just put H(R) in receipt and PISA reveals
Encrypted Justice:“R” toENCJusticeredeem HTLC payment.
Transaction Locator: TxLocator1
Appointment Start: Block 10
Appointment Expiry: Block 500
Minimum Dispute Period: 50 blocks
Signature by PISA: σPISALeaning
Watch Tower

Monitor (Tadge) @ Scaling Bitcoin ‘16

Scenario
Bob triggered a dispute,
PISA failed to respond,
Bob gets the coins.
How can Alice prove wrongdoing?

...

Block 10Block 11
State 1...

...

Block 110
Bob wins

Leaning
Watch Tower
TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor (Tadge) @ Scaling Bitcoin ‘16
In-depth Signed Receipt
Encrypted Justice: ENCJusticeTransaction Locator: TxLocator1
Appointment Start: Block 10
Appointment Expiry: Block 500
Minimum Dispute Period: 50 blocks
Signature by PISA: σPISAAnyone can verify the “dispute details” via blockchain:●
TxLocator1 FOUND●
Dispute triggered between block 10 and 500●
Assume for now dispute time is >50 blocks...

Block 10Block 11
State 1...

...

Block 110
Bob wins

Leaning
Watch Tower
TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor (Tadge) @ Scaling Bitcoin ‘16
In-depth Signed Receipt
Encrypted Justice: ENCJusticeTransaction Locator: TxLocator1
Appointment Start: Block 10
Appointment Expiry: Block 500
Minimum Dispute Period: 50 blocks
Signature by PISA: σPISALeaning
Watch Tower

Anyone can decrypt ENCJustice and verify:●
Valid justice transaction●
Not included in the blockchain at all...

Block 10Block 11
State 1...

...

Block 110
Bob wins

TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor (Tadge) @ Scaling Bitcoin ‘16
Reputational Accountability, not Financial
Publicly verifiable that PISA accepted the job andfailed to do its duty by the customer.
With a consensus upgrade, the evidence of SPV proof
for dispute + Bob’s spend transaction, could be used
to slash/refund customer.

...

Block 10Block 11
State 1...

...

Block 110
Bob wins

Leaning
Watch Tower
TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticeMonitor (Tadge) @ Scaling Bitcoin ‘16
Reputational Accountability, not Financial
Publicly verifiable that PISA accepted the job andfailed to do its duty by the customer.
With a consensus upgrade, the evidence of SPV proof
Let’s lookat spend
the good,bad andthebeugly
for dispute+ Bob’stransaction,
could
used
to slash/refund customer.

...

Block 10Block 11
State 1...

...

Block 110
Bob wins

Leaning
Watch Tower
TxLocator1:ENCJustice
TxLocator2:ENCJustice
TxLocator3:ENCJustice
TxLocator4:ENCJustice
TxLocator5:ENCJustice
TxLocator6:ENCJustice
TxLocator7:ENCJusticePISA - THE GOOD
Channel-Privacy

Accountability

By re-using the Monitor
protocol, PISA doesn’tknow what channel isbeing watched!

We can prove to anyone
that a PISA-tower
cheated.

Leaning
Watch Tower
Simple Protocol
Adopting a signed
receipt for different
channel constructions
is relatively
straight-forward.

PISA - THE GOOD, BAD
Channel-Privacy

O(1) OR O(N) Storage

Accountability

By re-using the Monitor
protocol, PISA doesn’tknow what channel isbeing watched!

Depends on theunderlying channel
construction (or if
ENCJustice is stored
on-chain via OUTPOST)

We can prove to anyone
that a PISA-tower
cheated.

Security Deposit hard

Simple Protocol

While there is “skin in
the game”, it may beunder-collateralised.
Provisions (2015) can
help.

Adopting a signed
receipt for different
channel constructions
is relatively
straight-forward.

Leaning
Watch Tower

PISA - THE GOOD, BAD, AND THE UGLY
Channel-Privacy

O(1) OR O(N) Storage

Accountability

By re-using the Monitor
protocol, PISA doesn’tknow what channel isbeing watched!

Depends on theunderlying channel
construction (or if
ENCJustice is stored
on-chain via OUTPOST)

We can prove to anyone
that a PISA-tower
cheated.

Security Deposit hard

Simple Protocol

Consensus Upgrade

While there is “skin in
the game”, it may beunder-collateralised.
Provisions (2015) can
help.

Adopting a signed
receipt for different
channel constructions
is relatively
straight-forward.

We need a new OP_CODE
for the slashingcondition. Very likely,
will not get into
Bitcoin soon.

Leaning
Watch Tower

Watching Networks
for Bitcoin (no forks)

No financial deterrent

Channel-Privacy

O(N) Storage/Updates

No way for theblockchain to
self-enforce that via
slashing.

By re-using the Monitor
protocol, PISA doesn’tknow what channel isbeing watched!

Depends in Monitor or
Outpost. O(N) implies
we need N-1 encryptedblobs, so it leaks
number of transfers.

Watching Networks
for Bitcoin (no forks)

Reputation
Accountability via
Signed Receipt
We can prove to anyone
that a PISA-tower
cheated.

No financial deterrent

Channel-Privacy

O(N) Storage/Updates

No way for theblockchain to
self-enforce that via
slashing.

By re-using the Monitor
protocol, PISA doesn’tknow what channel isbeing watched!

Depends in Monitor or
Outpost. O(N) implies
we need N-1 encryptedblobs, so it leaks
number of transfers.

Fair exchange payment+ job via offchain tx
PISA can be hired via
the lightning network.
Not knowing whichchannel hired it.

Watching Networks
for Bitcoin (no forks)

Reputation
Accountability via
Signed Receipt
We can prove to anyone
that a PISA-tower
cheated.
TX + State Intertwined== bumping fee is HARDPISA can’t sign state &broadcast it, must get
a “pre-signed” justicetx.

No financial deterrent

Channel-Privacy

O(N) Storage/Updates

No way for theblockchain to
self-enforce that via
slashing.

By re-using the Monitor
protocol, PISA doesn’tknow what channel isbeing watched!

Depends in Monitor or
Outpost. O(N) implies
we need N-1 encryptedblobs, so it leaks
number of transfers.

Fair exchange payment+ job via offchain tx
PISA can be hired via
the lightning network.
Not knowing whichchannel hired it.
Consensus upgrades
required
A lot of problems canbe fixed. We, as acommunity, must
seriously consider
them.

Watching Networks
for Bitcoin (no forks)
Responder, not trigger
We CANNOT trigger any
disputes! Only respondif the counterparty
tries to cheat.

No Verifiable Jobs
(May store junk)Important that PISA is
paid up-front forstoring “blobs” and not
via bounties.

Reputation
Accountability via
Signed Receipt
We can prove to anyone
that a PISA-tower
cheated.
TX + State Intertwined== bumping fee is HARDPISA can’t sign state &broadcast it, must get
a “pre-signed” justicetx.
Simple Protocol
Encrypting anddecrypting blobs isstraight forward, but
reducing O(N) storage“constant” is ugly.

PISA - WHERE ARE WE NOW?
PRIVATE TEST
Thanks to a heroic effort by Sergi
Delgado (speaker yesterday), we have aworking basic PISA implementation.
Do you want to try out our watch tower?
Please contact us!

Signed Receipt BOLT
Coming soon to a wallet near you!
(after guinea pigs try out our demo!)
Encrypted Justice: ENCJusticeTransaction Locator: TxLocator1
Appointment Start: Block 10
Appointment Expiry: Block 500
Minimum Dispute Period: 50 blocks
Cipher + Hash Function: AES-ACM & SHA256
Signature by PISA: σPISAPISA - Final word about “watchers” and their emerging role

Responder of LAST resort
Financial Liability & Insurance

What can a watch tower do?

Watchers take on the “financial liability” forusers who go offline.

Protect hubs against crashes + dos attacks byresponding to malicious customer closures

The “cost” of a watcher is some function offinancial liability, number of updates & numberof channels watched.

What can a watch tower NOT do?
Protect hubs against insider threats, theft ofsigning keys, etc.

PISA - Final word about “watchers” and their emerging role

Payment channel hubs

Routing Nodes

Customers generally trust hubs (we see thistoday), but for hubs, all their coins are“effectively” in a hot wallet and every
customer is an adversary.

Peers will open channels with anyone to searchout popular routes / best fees. They WON’T
know or trust their counterparty. So a watch
tower is essential.

Plasma Grouphttps://pisa.watch
Settlement System andRoot of Trust of all Layer 2

PisaResearch
paddypisa