Abstract: BitMEX Research has upgraded its lightning nodes to include watchtower functionality. The watchtower functionality is a mechanism for connecting to another friendly node, which monitors your lightning channels for you and prevents a dishonest counterparty from stealing your funds, even when you are offline. We successfully conducted an experiment, proving the watchtower concept actually works, at least in our case. It is encouraging that the watchtower concept, which has been around for years in theory, now actually works in practise.
(Source: Alcatraz, flickr)
Overview
This piece on watchtowers follows on from our three previous pieces on the lightning network:
- Lightning Network (Part 1) – Motivation
- Lightning Network (Part 2) – Routing Fee Economics
- Lightning Network (Part 3) – Where Is The Justice?
On 29 June 2019, LND 0.7.0 (Go implementation of lightning) was released and this included the watchtower functionality. A watchtower is a third party lightning node, that can detect if a dishonest party attempts to steal funds and then broadcast a justice transaction, sending the funds back to the honest party, even when the honest node is offline.
There two modes of watchtower functionality
|
Client/Tower User |
Server | |
|
Description |
The client connects to a watchtower server. Whenever the lighting channel states change, data is sent over to the watchtower server with the latest channel state. In the event of a channel breach, the watchtower can broadcast a justice transaction, sending the funds to the honest node’s onchain wallet. |
The watchtower server does not need to have any lighting channels or make any payments. The server connects to a lightning client and monitors the client’s lightning channels for them, on their behalf. |
|
Operational details | To connect the node to a watchtower server, one needs to add the following line to the lightning configuration file: > wtclient.private-tower-uris=tower-public-key@ip-address:9911 Where the public key and IP address is provided by the watchtower server. |
To activate a watchtower server, one needs to add the following line to the lightning configuration file: > watchtower.active=1 After this, one can run the command: > lncli tower info The watchtower server should then display the watchtower public key (different from the lightning node public key). This key is needed by the watchtower client. Due to potential denial of service threats, it is currently not advisable to publish the watchtower public key. One can check if the watchtower is working by viewing the logs. |
It is possible for a node to be both a watchtower server and client at the same time. If you run two nodes, each node can be the watchtower server of the other. BitMEX Research currently has three operating lightning nodes and the nodes all watch over each other in a loop configuration.
Successful test of the watchtower
On 30th July 2019, BitMEX Research successfully tested the watchtower system. Much like our previous piece on justice transactions, we tried to cheat ourselves, but this time used a watchtower. In an encouraging sign, the watchtower functionality correctly worked and the would-be thief was punished.
In order to do this test, we needed to run three nodes:
- The dishonest node – BitMEXThief
- The node using the watchtower service – BitMEXTowerClient (the user of the watchtower service)
- The watchtower itself – BitMEXResearch
Manually constructing a watchtower justice transaction
(Source: BitMEX Research)
The eventual justice transaction, broadcast by our watchtower can be seen here.
Conclusion
All BitMEX Research lightning nodes are now protected by watchtowers. While a watchtower is a large improvement in security, in our view, a greater problem than dishonest channel breaches, is the risk of a lightning node’s memory becoming accidentally lost or destroyed – under such circumstances the node could lose the latest channel states. A watchtower does not fix that problem, although there have been improvements in this area, with Static Channel Backups (SCBs). Using SCBs, as long as no new channels were created post backup, all the funds should be safe.
A successful test of the watchtower does provide us with a greater degree of assurance about the robustness of the lightning network. It is encouraging that ideas such as watchtowers, which have been theoretically discussed for years, finally exist. However, when it comes to improving the robustness and reliability of the lightning network, there is still a long way to go.