RFC: LN protocol using BSQ proof of burn

[alkum]

A discussion with @chimp1984 led to a possible LN protocol that uses BSQ proof of burn to mitigate fraud.

Here are the main details. Please feel free to discuss, comment, critique below.

---

Protocol constraints:

• It must run in a decentralized fashion
• It must allow for mediation in case of disputes
• It must provide mechanisms to disincentivize fraud

Participants:

• Alice: BTC buyer
• Bob: BTC seller
• Carol: mediator
• DAO: Bisq DAO

sequenceDiagram
    autonumber
    
    participant Alice
    participant Bob
    participant Carol
    participant DAO
    
    alt Deposit Phase v1: Deposits paid via LN
        Alice->>Carol: Send BTC deposit (LN)
        Bob->>Carol: Send BTC deposit (LN)
        Carol->>Carol: Burn BSQ
        Carol->>Alice: Provide proof of burn
        Carol->>Bob: Provide proof of burn
    else Deposit Phase v2: Deposits paid on-chain
        note over Alice,Carol: Atomic BTC-BSQ swap, 1 on-chain tx, see below
    end
    
    note over Alice,Bob: Trade begins
    Alice->>Bob: Send fiat / altcoin
    Bob->>Alice: Send BTC (LN)
    
    alt Successful trade
        note over Alice,Bob: Both confirm
        Carol->>Alice: Return BTC deposit
        Carol->>Bob: Return BTC deposit
    else Disputed trade
        note over Alice,Bob: One participant opens dispute
        note over Alice,Carol: Mediator intervenes
        note over Alice,Carol: Mediator confiscates deposit of party in the wrong<br/>Mediator refunds deposit of party in the right
    end
    Carol->>DAO: Open reimbursement request for ALL burned BSQ<br/>(Alice and Bob deposits)
    note over DAO: DAO cycle ends
    DAO->>Carol: Reimburse BSQ

Loading

Initial deposit phase can be an atomic BTC-BSQ swap:

flowchart LR
    AliceOut[Alice out] -->|"x BTC<br/>(deposit)"| Swap{Atomic Swap}
    BobOut[Bob out] -->|"y BTC<br/>(deposit)"| Swap
    CarolOut[Carol out] -->|"z BSQ<br/>(market equiv. of x+y BTC)"| Swap
    Swap -.->|"change BTC<br/>(if Alice's utxo > x)"| AliceIn[Alice in]
    Swap -.->|"change BTC<br/>(if Bob's utxo > y)"| BobIn[Bob in]
    Swap -->|x + y BTC| CarolIn[Carol in]
    Swap -->|"z BSQ<br/>(burned)"| Miner[Miner fee]

Loading

Notes:

• Carol must hold enough BTC and BSQ liquidity
• There are two proposed ways to handle the deposits: v1 (LN), or v2 (on-chain)

Risks:

• [Deposit Phase v1 / LN] Rogue mediator could enter trade(s) as Bob, wait until Alice deposits BTC, then run away with deposited BTC.
  • Possible mitigations
    • Have Bob deposit 100% of trade amount, while only asking less (15-50%) from Alice?
    • Have mediator bond value be much higher relative to max possible LN trade value?
• In high-fee environments (e.g. 100 sat/vB) the burned BSQ might not be enough to cover mining fee

[MwithM]

Wow looks like a beautiful idea.

1. Deposits will need to be over 100% of the trade amount to prevent that first to pay becomes vulnerable? (i.e. if place 0.02 BTC for a 0.1BTC trade (20% security deposit), once I receive a 0.1BTC payment I can run away and still gain 0.8BTC).
2. Mediators shouldn't have to actively pick trades, I suppose that as long as mediator has funds the wallet will create the swap for the deposit tx. If addresses or xpubs are shared with traders, that info could be used to pick best suited mediators (those with higher liquidity or to prevent them from exceeding their locked bond (see 3)).
3. Rogue mediator could play Bob's role as well and after receiving the payment not pay owed BTC nor return the deposited BTC. A bonded role for mediation is still needed.

[MwithM]

It allows to trade any pair!!!

[alkum]

Good point about deposits. Not sure yet what a good ratio would be, maybe we can start with the Bisq 1 ranges.

Re: mediators, yes, ideally all these steps are automated or need minimal manual intervention. Also interesting thought on mediator selection.

Re: rogue mediator. Sounds like a risk in the deposits-via-LN variant, not a risk when deposits are automated and bundled in an atomic swap. Still, I'd say you're right, the mediator bond is still needed and as long as the max LN trade amount is much smaller relative to the mediator bond, it should be fine. This means the bond might not be enough for bigger trades and similar protocols though.

[MwithM]

If mediator always need to burn BSQ equal to the amount of security deposits (which, as per my first point above should be at least 100% of trade amount), it means that mediators will need to burn 2 times BSQ equivalent to the amount of the trade. DAO would have to reimburse every cycle an amount of BSQ equal to 2 times the trading volume.
Basically, it's like sending all trades to arbitration but requiring the arbitrator to spend 2 times the trade amount in advance.

Locking 15% security deposit + seller's trade amount into a 2of2 and sending this amount in case of dispute to an arbitrator who has burns BSQ only in case of dispute removes the burningman but still requires a lot of capital from arbitrator, instead of 200% now it's 130% of the trade amount. It's a similar sitiuation as the current, where burningman's bonded role amount hardly covers the amount to be reimbursed from traders sending funds to donation address.
Another bummer: Locking the trade amount impedes trading any pair of assets.

[alkum]

I updated the description by adding the risk of the rogue mediator you mentioned, that was a good observation. To safeguard against that, it might be enough to ask Bob for a 100% deposit, while letting Alice post a smaller deposit (15-50%?).

Then it would be maybe 115-150% of the LN trades only, which are low value => low volume (relative to other types of trades). Sounds doable for a mediator to have enough BSQ liquidity to cover that, especially since that BSQ liquidity will be replenished every cycle (via reimbursement).

Another bummer: Locking the trade amount impedes trading any pair of assets.

You mean for the duration of the trade? The low trade amounts (LN) would hopefully not lock up too much available capital from the sellers, even with multiple ongoing LN trades.

[MwithM]

I think that arbitrator suits better for the role, as he will perform a payout and not simply suggest one that Bob and Alice must accept.

Bob placing 100% of the trade amount should stop Bob from "forgetting" about the trade once he receives the payment from Alice. 105-130% will be better, so there is an incentive to acknowledge having received the payment so not all trades get into arbitration.

Bob placing a >100% the security deposit doesn't stop Bob from being the arbitrator as well. A high enough BSQ bond would stop Bob from getting Alice's security deposit deposit and payment, while keeping Bob's security deposit as well.
A high enough bond means an amount that covers all possible trades that Bob-arbitrator could create until someone notices that Bob-arbitrator has become rogue. If all trades get into arbitration.

Locking a >100% security deposit amount on the side that sends the last (Bob) makes it less appealing to trade any asset (alt-alt, alt-fiat) but is still possible.

[pazza83]

Hi @alkum thanks for this.

Looks interesting. I think it would be great to add a LN protocol to Bisq. It would increase accessibity for traders to trade small amounts of BTC over lightning network. I had a play around with RoboSats and liked the simple user experience provided.

Other than to mitigate fraud I am not sure what the LN protocol using BSQ proof of burn is looking to solve? I am assuming any implementation of the LN protocol it is to reduce on-chain fees. This would then allow for trades of any size being economical. I appreciate the protocol above reduces the number of on-chain transactions to one, but it would be great to get it to zero!

If the assumption is to reduce on-chain fees does the burning of the BSQ not pass on the on-chain fees to the Mediator / DAO, or traders if included in trade price?

In a high fee environment eg 100 sat/vB would this not make only large trades economical?

Would an alternative work where there is no BSQ burn needed and trades could be limited in size to reduce risk of rogue mediator?

I am not very familiar wit LN protocols. It would be helpful if you could explain what is stopping trades occurring on the LN that mirrors the existing Bisq 1 protocol?

• 2 of 2 multi-sig
• Time lock where only one trader is needed to make a delayed payout transaction to arbitration

Many thanks

[alkum]

Hey @pazza83 thanks for the detailed write-up.

Yes RoboSats looks promising, already exploring a few options of how to integrate a similar concept. However, if I understood it right, it runs a semi-centralized approach. Will have to further investigate, to see which steps are p2p and which steps (invoices) happen via the 3rd party / RoboSats.

Other than to mitigate fraud I am not sure what the LN protocol using BSQ proof of burn is looking to solve?

Because LN doesn't have multisig (as used in current Bisq trades), that means deposits have to be handled differently. Since they cannot be paid "into a multisig", they would now have to be paid to someone who can get involved in case of disputes and confiscate the deposit of a dishonest trader. That's basically the mediator.

This means the mediator would hold the BTC deposits for the duration of the trade, possibly multiple deposits from multiple trades. This opens the door for a malicious mediator who can just keep the deposits and dissapear. To prevent this, the mediator is asked to burn an equivalent amount of BSQ upon receiving the deposits, which he can reclaim back from the DAO at the end of the cycle.

So the point of the BSQ burning is to disincentivize the mediator from stealing the deposits, which he would now be in full control of (no multisig on LN).

Would an alternative work where there is no BSQ burn needed and trades could be limited in size to reduce risk of rogue mediator?

Great question.

Come to think about it, that might already be the case because of the nature of LN trades.

As discussed above with @MwithM , the trade amounts (and therefore deposits) are low because these are LN trades, so the mediator bond, which is 10 000 BSQ, might already be enough of a deterrent against theft. The LN trades are probably max 50-100 BSQ. Nobody would risk losing 10 000 BSQ for maybe stealing a few hundred BSQ worth of deposits (best case, multiple parallel LN trades).

Looks to me like the BSQ burning might not even be necessary then, for this type of LN protocol. @chimp1984 thoughts?

In a high fee environment eg 100 sat/vB would this not make only large trades economical?

Good point, will add it to the description above as a risk. Burned BSQ might not be enough to cover miner fees then.

[chimp1984]

Looks to me like the BSQ burning might not even be necessary then, for this type of LN protocol. @chimp1984 thoughts?

One thing is security the other regulatory risks. When the 3rd party (Carol) holds funds of others its usually under regulatory rules (financial intermediary, require license above certain amounts). With burning BSQ Carol does not hold funds anymore but converts received BTC to the DAO in form of burning the equivalent amount. So the DAO becomes the 3rd party which need to be trusted, but as there is no wallet to steal from the DAO and the DAO cannot run aways those legal risks should be mitigated.
One can see it from the worst case perspective to confirm that the situation carries less risk:
If Carol gets hacked and her BTC gets stolen she still had burned the BSQ (ignoring the short time between receiving BTC and burning BSQ if not using the atomic model). For her its pretty bad as she will not get the BSQ back from the DAO, instead the traders can request reimbursement of the missing BTC in equivalent BSQ. Usually Carol would return the BTC for them and she is doing the work for reimbursement (similar like refund agent).
So overall a rouge Carol or in case of theft the traders are not at risk, nor the DAO. Carol carries all that risk. Therefore I dont see a regulatory risk as she is not risking other peoples funds.
If the DAO goes rouge they destroy the project by killing its reputation. The BSQ cannot be stolen as they got burned. Only risk here is that the DAO has a vulnerability or fails otherwise. But time span between trade and reimbursement is rather short (about 1 month) so that risk should be manageable.

But to be honest, I doubt the costs and complexity is justified. I guess there are easier, cheaper or more secure protocols. But still good to think about all those potential solutions as they are all tools in a box and might lead to some other construction which has better cost/benefit ratio.

And I agree for low amounts the security might not be needed, but then its the question if the reputation based protocol (burned BSQ or BSQ bond based) is not easier and cheaper with similar security for those low amounts, and comes with no regulatory risks as its the case if a 3rd party holds funds of traders.

[MwithM]

Another concern I have is that, if the same agent collects trader's funds and refunds them, that's a money transmitter. It's quite similar to a 2of3 multisig, or worse, as at least in a 2of3 multisig it can be stated that Carol doesn't have complete control of funds. Even if Carol burnt BSQ and that amount does not suppose a profit to her, she still has control over trader's funds.

[chimp1984]

Yes agree. But with buring BSQ the situation is different. See my reply above. Still unclear how lawyers would interpret that, but at least it has some different risk situation.

[MwithM]

A way to prevent the overall concerns would be:

Arbitrator locks (into a bonded role) X amount of BSQ, which is very similar to burning them but only once at arbitrator's career.
Trades that need arbitration get into a queue of trades under dispute, and only arbitrators with pending trades volume under a certain threshold (80%) of BSQ bonded role value are eligible to arbitrate those disputes.
I still find that legally, trespassing the money transmitter's line would be very close, but the capital requirements for mediators would be highly reduced and burningman would not have to carry any more reimbursement funds, which is a huge step towards decentralization.
There's a technical issue that I'm not aware if it's possible, which is checking safely that arbitrators don't get more trades than they should. Arbitrators would need to be trusted into not generating fake disputes (they're Alice and Bob) to get compensation, which is something that happens now and is mitigated through arbitration fees.