[Paper Review] Hijacking Routes in Payment Channel Networks: A Predictability Tradeoff

Saar Tochner, Stefan Schmid+1 more|arXiv (Cornell University)|Sep 15, 2019

Blockchain Technology Applications and Security22 references35 citations

TL;DR

The paper identifies a route-hijacking DoS vulnerability in off-chain payment networks (Lightning), empirically analyzes routing implementations, and reveals a fundamental tradeoff: reducing predictability increases security but raises costs.

ABSTRACT

Off-chain transaction networks can mitigate the scalability issues of today's trustless electronic cash systems such as Bitcoin. However, these peer-to-peer networks also introduce a new attack surface which is not well-understood today. This paper identifies and analyzes, a novel Denial-of-Service attack which is based on route hijacking, i.e., which exploits the way transactions are routed and executed along the created channels of the network. This attack is conceptually interesting as even a limited attacker that manipulates the topology through the creation of new channels can navigate tradeoffs related to the way it attacks the network. Furthermore, the attack also highlights a fundamental design tradeoff for the defender (who determines its own routes): to become less predictable and hence secure, a rational node has to pay higher fees to nodes that forward its payments. We find that the three most common implementations for payment channels in Bitcoin (lnd, C-lightning, Eclair) approach routing differently. We begin by surveying the current state of the Lightning network and explore the routes chosen by these implementations. We find that in the current network nearly 60\% of all routes pass through only five nodes, while 80\% go through only 10 nodes. Thus, a relatively small number of colluding nodes can deny service to a large fraction of the network. We then turn to study an external attacker who creates links to the network and draws more routes through its nodes by asking for lower fees. We find that just five new links are enough to draw the majority (65\% - 75\%) of the traffic regardless of the implementation being used. The cost of creating these links is very low. We discuss the differences between implementations and eventually derive our own suggested routing policy, which is based on a novel combination of existing approaches.

Motivation & Objective

• Motivate scalability and routing security concerns in off-chain payment networks.
• Characterize how routing decisions and channel fees influence attack surface.
• Empirically evaluate current Lightning implementations and network topology.
• Analyze attack feasibility for colluding central nodes and external attackers.
• Discuss design and policy tradeoffs to mitigate hijacking risks.

Proposed method

• Model the payment channel network as a graph where edges are channels.
• Survey routing algorithms used by lnd, C-lightning, and Eclair and their weight calculations.
• Empirically analyze live Lightning Network data (July 2019) to assess centrality, path usage, and fees.
• Simulate DoS route-hijacking attacks with colluding central nodes and with external attackers creating new channels.
• Evaluate attacker strategies via centralized centrality and submodular optimization properties.
• Propose a routing policy blend inspired by existing approaches and discuss defense strategies.

Experimental results

Research questions

• RQ1 How feasible is a route hijacking DoS attack in current Lightning Network implementations?
• RQ2 How many new channels or which central nodes are required to hijack a majority of routes?
• RQ3 How do different routing implementations (lnd, C-lightning, Eclair) compare in vulnerability and routing behavior?
• RQ4 What are the security and economic tradeoffs (price of predictability) for defenders when selecting routing strategies?
• RQ5 What practical mitigation or routing policy changes could reduce hijacking risk without crippling network performance?

Key findings

• Five new low-fee links can hijack around 65%–75% of traffic (across implementations).
• Approximately 60% of paths pass through the top five nodes and 80% through the top ten nodes, enabling targeted collusion-based disruption.
• Just five external links can draw the majority of traffic (65%–75%), and 30 links can raise this to about 80%.
• Nodes largely use default fees; little evidence of selfish routing, suggesting vulnerability to low-fee hijacking strategies.
• Routing implementations differ (lnd, C-lightning, Eclair) in path selection but all exhibit centrality-based vulnerabilities; Eclair’s top-3 randomization provides limited protection.
• A fundamental design tradeoff exists: reducing predictability by choosing alternative routes increases security but raises routing fees for the defender.