JavaScript isn't enabled in your browser, so this file can't be opened. Enable and reload.

1 of 78

Scaling Cryptocurrencies�via State Channels

Patrick McCorry

�with lots of help from Andrew Miller, Iddo Bentov, Surya Bakshi, Chris Buckland, Sarah Meiklejohn, and Karl Wust.

paddypisa

2 of 78

Cryptocurrencies do not scale.

https://github.com/stonecoldpat/anonymousvoting

7 tps (sort of)

1 MB blocks

12 tps (sort of)�

Complexity of transaction

paddypisa

3 of 78

What is the problem?

“Decentralisation and Public Verifiability”

Large user-base vs Large set of validators

paddypisa

4 of 78

OK. How can we scale?

“Off-chain”

�Local consensus amongst participants involved in application

Centralised

�“The chosen one” produces blocks and there is no competition!

Tweak Consensus Protocol

�DAG blockchain, etc.

Sidechain

�Peg coins to “another” blockchain that is maintained by another group of maintainers.

Local Consensus (Channel)

All parties execute and authorise every update.

Sharding

�Distribute processing across several shards

paddypisa

5 of 78

OK. How can we scale?

“Off-chain”

�Local consensus amongst participants involved in application

Centralised

�“The chosen one” produces blocks and there is no competition!

Tweak Consensus Protocol

�DAG blockchain, etc.

Sidechain

�Peg coins to “another” blockchain that is maintained by another group of maintainers.

Local Consensus (Channel)

All parties execute and authorise every update.

Sharding

�Distribute processing across several shards

paddypisa

6 of 78

Spilman Payment Channels

Duplex Micropayment Channels

Lightning Channels

Raiden Channels

Payment channels

Only re-distribute deposit

7 of 78

Spilman Payment Channels

Duplex Micropayment Channels

Lightning Channels

Raiden Channels

Sprites Channels

(us!)

Perun Channels

Counterfactual

Kitsune�(us!)

State channels

gaming, voting, auctions, etc

Payment channels

Only re-distribute deposit

8 of 78

What is a state channel?

Every party collectively authorises a new state of an application locally amongst themselves.

�The blockchain acts as a root of trust to guarantee:

Balance Security : Each party gets the coins they deserve

State Progression : The application will always progress

paddypisa

Observation: Liveness is *not really* a problem for payment channels!

9 of 78

What modifications are required before an application can be deployed as a state channel?�

What applications make sense in a state channels?

What are the inherent weaknesses?

10 of 78

What modifications are required before an application can be deployed as a state channel?�

What applications make sense in a state channels?

What are the inherent weaknesses?

11 of 78

Application Contract

State Channel Contract

12 of 78

Block 1

One way to set up the state channel

Let’s assume that battleship is already deployed

13 of 78

Block 1

Block 2

One way to set up the state channel

σ_A,σ_B, “lock”

Alice and Bob agree to “lock up” the contract

14 of 78

Block 1

Block 2

One way to set up the state channel

σ_A,σ_B, “lock”

Alice and Bob agree to “lock up” the contract

15 of 78

Block 1

Block 2

One way to set up the state channel

σ_A,σ_B, “lock”

Alice and Bob agree to “lock up” the contract

16 of 78

Block 1

Block 2

Block 3

One way to set up the state channel

State channel is created and the battleship game is frozen!

17 of 78

How do we play battleship off-chain?

18 of 78

Let’s pretend….

It is Alice’s turn to take a shot.

State 0

Turn in Game: Alice

Counter: 0

19 of 78

If you squint hard enough…

Alice is shooting from a real battleship

20 of 78

Replace by Monotonic Counter (or Version)

New state of game:

Bob’s turn to take a shot

State 0

Turn in Game: Alice

Counter: 0

State 1

Turn in Game: Bob

Counter: 1

21 of 78

State 0

Turn in Game: Alice

Counter: 0

How does she “lock in” her shot?

State 1

Turn in Game: Bob

Counter: 1

22 of 78

State 0

Turn in Game: Alice

Counter: 0

State 1

Turn in Game: Bob

Counter: 1

Attack command,

State1

How does she “lock in” her shot?

23 of 78

State 0

Turn in Game: Alice

Counter: 0

State 1

Turn in Game: Bob

Counter: 1

Attack command,

State1

Bob computes the following…

State1’ = transition(state0, attack)

Does State1’ == State1?

Yay! Accept it!

How does she “lock in” her shot?

24 of 78

State 0

Turn in Game: Alice

Counter: 0

State 1

Turn in Game: Bob

Counter: 1

How does she “lock in” her shot?

25 of 78

State 0

Turn in Game: Alice

Counter: 0

State 1

Turn in Game: Bob

Counter: 1

How does she “lock in” her shot?

26 of 78

State 0

Turn in Game: Alice

Counter: 0

All signed! Yay!

State 1

Turn in Game: Bob

Counter: 1

27 of 78

Looks too good to be true?

What if Bob doesn’t respond?

28 of 78

33 of 78

Always online assumption:

All parties must remain online to detect and defend against execution forks

Alice is asleep and offline!

I can broadcast an older state and pretend the game never happened!

Bawhahaha

ZZZZzzzzZzzzzzz

34 of 78

Always online assumption:

All parties must remain online to detect and defend against execution forks

Block 1

Initiate Dispute

Initiates Dispute

Bob prepares to perform execution fork

35 of 78

Always online assumption:

All parties must remain online to detect and defend against execution forks

Block 1

Initiate Dispute

Old Game State

Bob updates the blockchain with an older hstate_i-1

σ_A,σ_B,hstate_i-1 ,i-1

Block 2

Update State i-1

36 of 78

Always online assumption:

All parties must remain online to detect and defend against execution forks

Block 1

Initiate Dispute

Block 2

Update State i-1

Block 3

37 of 78

Always online assumption:

All parties must remain online to detect and defend against execution forks

Block 3

Block 2

Block 1

Initiate Dispute

Update State i-1

38 of 78

Always online assumption:

All parties must remain online to detect and defend against execution forks

Block 3

Block 4

*tense*

Will Bob get away with it?

Will Alice wake up to stop it?

Find out in the next slide!!!

Block 2

Block 1

Initiate Dispute

Update State i-1

39 of 78

Always online assumption:

All parties must remain online to detect and defend against execution forks

Block 3

Block 4

Block 2

Block 1

Initiate Dispute

Update State i-1

Update State i

Block 5

Latest Game State

Alice wakes up and updates the blockchain with the latest hstate_i

σ_A,σ_B,hstate_i ,i

40 of 78

Always online assumption:

All parties must remain online to detect and defend against execution forks

Block 3

Block 4

Block 2

Block 1

Initiate Dispute

Update State i-1

Update State i

Block 5

Execution Fork is Cancelled!

Alice keeps her winnings, but only because she remained online and responded at the right time!

41 of 78

Can we help alleviate this new security requirement?

paddypisa

42 of 78

43 of 78

Pisa: Hire an accountable third party!

State Privacy

Custodian should not learn about the state he is watching (unless there is a dispute on-chain!)

Fair Exchange

Custodian should be paid upon accepting appointment from customer

O(1) Storage

Custodian only has to store the latest job received from the customer!

Recourse as Financial Deterrent

There should be indisputable evidence that can be used to punish a malice Custodian

44 of 78

Application-Agnostic State Channel (Kitsune)

Pisa Contract

Only cares about state hashes, signatures and counters.

Achieving State Privacy

51 of 78

Achieving State Privacy

An Appointment to Pisa only contains:

A state hash, state version, and signature from all parties.

σ_A,σ_B,σ_C, H(state_i+1,r), i+1

paddypisa

52 of 78

Fair exchange of payment and cryptographic receipt

53 of 78

Fair Exchange of Payment + Receipt

Payment + Appointment

paddypisa

54 of 78

What if PISA cheats?

55 of 78

Alice is back online… it is too late?

OH NO! Pisa cheated me!!!!

I’ve lost all my coins!

56 of 78

It isn’t too late…

she has evidence that Pisa cheated

Dispute Record*

State channel contract records all successful disputes

Ratified and signed receipt

Evidence Pisa promised to prevent execution fork

57 of 78

Evidence: Signed (and Ratified) Receipt + Dispute Record

Pisa Contract

State Channel Contract (Kitsune)

Signed (and Ratified) Receipt

58 of 78

Evidence: Signed (and Ratified) Receipt + Dispute Record

Pisa Contract

State Channel Contract (Kitsune)

Signed (and Ratified) Receipt

Request Disputes

59 of 78

Evidence: Signed (and Ratified) Receipt + Dispute Record

Pisa Contract

State Channel Contract (Kitsune)

Signed (and Ratified) Receipt

Request Disputes

List of disputes

60 of 78

Evidence: Signed (and Ratified) Receipt + Dispute Record

Pisa Contract

State Channel Contract (Kitsune)

Signed (and Ratified) Receipt

Request Disputes

List of disputes

*compares receipt + list of disputes*

Yup! Pisa could have saved the day.

Sorry, I must forfeit the entire security deposit.

61 of 78

Revenge is sweet

62 of 78

	Privacy Preserving	Verifiable Job	Storage	Fair Exchange (Job + Reward)	Publicly Verifiable Warrant	Financial Deterrent (and Accountability)	Deployable Today
Monitor			O(N)
WatchTower			O(1)
PISA			O(1)

All good!

Not in original protocol,

but compatible

Nope

63 of 78

We are building it

Untrusted Co-ordinator & k-out-of-N watchers

Criticism: There is only one watcher, how can we trust it?
Moving forward: A distributed set of watchers can agree to watch it (tradeoff between availability of watchers and security deposit)

Proving liabilities and assets watched over?

PISA could be watching 10k channels worth $1m, but only have $10k locked up.
We are investigating Proof of Solvency to give a guarantee about liabilities and assets.
http://www.jbonneau.com/doc/DBBCB15-CCS-provisions.pdf

Why don’t you have a side-chain for hiring a bunch of watchers at the same time?

We don’t need it. It doesn’t appear worth the engineering effort.
We are going to build distributed watchers and keep the “off-chain” principle that makes them great

64 of 78

Final thoughts and future work

65 of 78

1 transaction to turn on channel

200+ transactions authorised off-chain for a single game of battleship

1 transaction to turn off channel

Ideal case: No latency, no fees, two transactions on the blockchain

66 of 78

1 transaction to turn on channel

200+ transactions ALL on-chain for a single game of battleship

2-3 off-chain transactions to set up game

Worst case: Commit to playing game, turn off channel, play entire game on-chain.

1 transaction to turn off channel

Outstanding Research Problems?

Reputation system is non-trivial

We cannot yet distinguish why the channel failed
Did Alice really send a signed state to Bob? Or is Bob simply lying? �

Inducing Cooperative Behaviour

What needs to be satisfied to ensure all parties are willing to cooperate within the channel?
At the same time, an honest party must never be discouraged from disputing too!�

Self-inspection of Blockchain Congestion

Transaction fees go to the moon when the blockchain is congested
Can we look at the previous k of n blocks to determine if “it was affordable for an honest party to resolve a dispute?”

71 of 78

Off-chain (Layer-2) Eco-System Overview

Off-chain Channels

Battleship

Payments

Off-chain (Layer-2) Eco-System Overview

Watchers

Off-chain Channels

Battleship

Block 1

Block 2

Block 3

Payments

Non-Custodial Hubs

Settlement System and Root of Trust of all Layer 2

76 of 78

Off-chain (Layer-2) Eco-System Overview

Watchers

Off-chain Channels

Battleship

Block 1

Block 2

Block 3

Payments

Non-Custodial Hubs

Settlement System and Root of Trust of all Layer 2

Our vision: https://goo.gl/tNi1ch

77 of 78

Two years later.

We are on the verge of practical and deployable state channels.

Magic unicorns need not apply.

78 of 78

Thanks for listening!

Sprites (2017), one of the first state channel constructions:

Self-enforce state transitions via submitting commands
https://arxiv.org/abs/1702.05812

Pisa (2018), an accountable third party to watch the channel

Financial deterrent, O(1) Storage, Cryptographic Warrant
http://hackingdistributed.com/2018/05/22/pisa/�https://github.com/PISAresearch/pisa

Kitsune (2018), an application-agnostic state channel:

Battleship case study!
https://medium.com/@stonecoldpat/you-sank-my-battleship-7cfdc4533bf5 https://github.com/stonecoldpat/statechannels