PISA: Arbitration Outsourcing for State Channels by Patrick McCorry (Devcon4)

okay I could have start there okay so guys um my name is Patrick McCrory I'm an assistant professor at King's College London when I'm gonna present to you today is some work that actually originated from Devcon last year so last year me enough terrorists for Havana you know pina coladas and Cancun then he was tell me but and ridin her there trying to solve the monitor problem so when I went back to England I got talking to some people from you why you see like Siri Bakshi and Andrew Miller and then we sort of start to come up with a little solution so first we did it for payment channels and then I thought well actually why don't we go a step further and try to solve it first ear channels as well so that's sort of where we got to and I think I think it's very that one slide that isn't going to load but that's fine I'll do it at the very end and I also want to thank several people so I so I think there's two people in the audience crisp Oakland and Sarah Michael John they're both my co-authors alongside Andrew Miller on Syria Bakshi an e-2 bent off as well sounds gonna move on so everyone in this room pretty much as aware of what a steer channels about you've had five presentations of hostia channels work so I just want to give you a very very brief overview of how I think about them so basically with a steer channel the idea is our parties are coins into a contract and then they can run an application of Qi and locally amongst themselves so it was poker for example if Alice player hunt then everyone in the state channel must agree that alice is played her hand on but the blockchain gives you is two properties so first there's safety every party should always get the coins they deserve it should also guarantee liveness and we've had several people talk about that already so if one person doesn't cooperate then you could simply redeploy the up on the blockchain and finish it there so the application should always progress so what I'm gonna focus on is the bad case you know what if one person doesn't actually cooperate so you can imagine Alice's plan poker see reveals is Royal Flush she gets really lucky and she's about to win the poker game Bob says well I'm not gonna agree to this Alice if I created this state update then you know what you're gonna win the bat you're gonna take all of my money and then I've lost so how does Alice ensure that she can actually self enforce the correct execution of the poker game we use the dispute process and several talks already outlined how dispute process works and I'm just gonna go over briefly as well so what we have is something called kitsune channels and this would have came out recently and some people already adopted it which is awesome because it really helps appeaser but it's really straightforward we have a dedicated contract just for the disappear for this deer channel i'm just for the dispute process so all this single channel cares about is signatures from every party the hash of the state so not the actual bytes or the state itself does a commitment to it on a state version and during the dispute process would ever stay at house the largest counter will be considered the most recent and final of qi an agreed state so how does this work in practice so what Ollis will do is that ours will create a transaction broadcasted to the network and initiated dispute now the smart contract will say okay there is now a fixed time period for everyone to respond with their latest of Chian state that they are aware of so of course all is its gonna broadcast the state of the game where she's just about the win and because this is the most recent state of the game this should have the has counter after the fixed time period anyone can send a transaction to the smart contract to settle the despair to settle the dispute so what the smart contract will do is basically say what was the state I received with the largest counter that is the final state that people agreed off chiyan and that's all our dispute process cares about in this state channel so what's really nice then is that Alice can deploy the poker game so you can then deploy the food game state as well and then the up we'll look at the steer channel grab the harsh compare them and say yep that was indeed the game state that we agreed so that's pretty much how consumer would work and that's a really good way to think about the speed processes so the promise tier channels is that we now have this always online assumption that several talks have alluded to for this to work both parties have the MIT roomie and online I'm fully synchronized of the network they have the wats out for disputes that may occur so while kuttappan is that alice wins the poker game you knows he's really wealthy now maybe she can go buy a Lambo and then she just goes to sleep he knows he's gonna sleep and maybe play more poker tomorrow with Bob and the other and the rest of the gang so while all this is asleep Bob and the remaining people in the state channel because they're coupie and parties there could be five people in this da Channel they all collude they say well let's just be there's a poker analysis taking MOOCs of our money why don't we get that back why don't we trigger a dispute broadcast an earlier state of the game when in fact the game hasn't even started yet resolve the dispute and then get our coins out so that's what they could do so Bob could you know trigger the dispute sand the older qiyam state and then over the block just takes away and takes away and of course if Bob is successful he could then deploy the poker game and simply withdraw his coins from the channel now for all us to defend herself she has to come online and go all know Bob's trying to cheat me and then broadcast the latest state of the game where she in fact had you know won the poker game and that's really important because the problem here is that there could be an execution fork so whatever the parties agreed off chin while it's final if they're online that execution could get reversed if one party goes offline because the blockchain you know trumps everything so this isn't grid I mean we have these payment network state channel networks but now it relies in every one be an online and fully synchronized with the network and as most people actually who was where was the last time anyone here fully synchronized gifts who money's a fully synchronized gift here I got like one two three hands that's what you're all up against if you're gonna use tear channels you can't even synchronize GAF to protect yourself so really the question is can we help alleviate this new security requirement a bit I mean we can't get rid of it but we can alleviate it so this is where Pisa comes in and I know the peas is like a leaning tower and it's leaning the wrong direction but it's going to go to the moon you know that's the jerk I'm trying to make with it anyway that's why as a leaning tower but yeah the motivation behind Pisa is that we want to hire on a countable third party to watch the channel in our behalf so has some different properties so first we get Stier privacy so if I hire this third party this third party doesn't actually understand my stint all they receive is a hush the second aspect is fair exchange so what I really want is publicly verifiable evidence that I've hired the third party and at the same time the third party always wants to get paired when they agree to you know the resolve disputes of my behalf so it needs to be a fair exchange protocol there the third part is actually order one storage so what's really beautiful about this protocol is that as a customer if I hire this third party and I give him 1,000 jobs they only have the store the latest job they received for me they don't need to store all 1,000 jobs so relate 10,000 customers were actually looking at a couple of megabytes for four stories for the PISA tower and finally recourse as a friend also deterrent so piece of those cheat and this their party cheats and colludes with the rest of the channel you should hopefully be able to do something about that and financial financially penalized the tower for cheating so that's the idea behind Pisa let's go into a step by step so first we have two components we have this dear cello contract that as I mentioned already it only cares about hashes signatures on a state version or the number and it's actually a bit like a honey badger it's a compatible with most applications you can think about forced air channels then the second contract is the PISA contract itself and this really only does two things conceptually one is stores a large security deposit from the third party other than two it simply does wit's around for evidence that the third party has cheated if someone could present evidence it will effectively freeze the deposit and punish the third party that's the basis behind Pisa so how do you set up Pisa so we have this third party I mean as a little smiley face cuz you know he's gonna do this to make some money I was only asked to do is leave a smaller leave a deposit with the Pisa contract so in my 1990 animation is fluent across and now he's signed up he's left this deposit and everybody can see that this third party now wants to run a a service so the next question is how do we achieve steer privacy as I mentioned before because of the way the steer channel is designed all the customer has the sand is signatures for every party in the channel this is the blindest it hash on the incremental counter and they just send that to the tower and that's basically what a job looks like so actually all this job - all the piece all this third party does is relay messages on behalf of Arliss or the customer they're just a relay er effectively now the question is how do we get the fair exchange of this signed receipt um payment so obviously this is layer 2 so we want to pay the tower or the third party off chin so the third party to be paired via ridin or lightning and what you could also have which is really nice actually is a one-way payment channel with the third party because one-way payment channels off the property where the sender can go offline and never lose their coins they're protected against that fact but that only works for one-way payment channels other assumptions will make for the presentation is that the tower the third party they're already aware of the steer channel address on the on the blockchain they know were that you see a channel exists on this the second assumption will meuk is that the payment information is pre agreed ie we know how much were going to pay the tower on the the second point is basically how long is this third party gonna watch your channel for have you hired them for one hour three hours forever we'll assume that's pre agreed for now so how does this work first a customer will send the appointment to the third party the third party will do some sanity checking they'll get the matches they've received they'll look at the customers th a no contract on the blockchain and they'll say yep every was a dispute I could actually relay this message on the contract we would accept it then what the third party does is that they create a new signed receipt this contains the appointment information but it also includes this new hash that we call the receipt hush so what the third party will do is generate around a number they'll hot and they'll include the harsh as part of the same receipt neither customer gets this the customer does some sanity checking as well the customer says yep the tower has agreed to watch the job that I asked him to do and now the customer will send a conditional transfer to the tower to the third party now what is a conditional transfer and this kiss the transfer will say the following third party if you reveal the preimage of the receipt hush before time T you can get this payment and that's basically what the condition of transfer will say so then the third party can simply reveal the preemies ass that if you know computer before he reveals ask to the customer and neither customer has a signed receipt and also this preimage s so they can prove the anyone that the third party agreed the wats the channel on their behalf and the preemies proves that this third party was also paired so they've actually been paid for doing this job as well so that's why we call it a signed on ratified receipt of course what if the customer doesn't cooperate now what the third party could do is get this conditional transfer and simply broadcast it to the network and then redeem the payment via the blockchain so the third party can always get the payment as long as they're willing to reveal the preimage ass so that's where we get our fair exchange now the next question is you know what happens if bob apisa collude to cheat Alice she Mazda again Alice goes off lines he's asleep dreaming about being a Lambo bro and then Bob triggers a dispute while alice is offline he sends the state update which is an older state that were given more coins than he deserves now Jesus huge step in I'm Pisa could relay the message they know settle this dispute but Pisa doesn't you know Pisa is collude him a Bob oh my god is happening it's losing boom Bob wins he resolves the dispute he gets his coins from the channel on Alice's lost you know Alice we except and she's really angry you knows he's AWOL Pisa cheated me I thought it was accountable I thought Pisa would never cheat me so is it too late for Alice I mean is there anything else can do about this well there is I mean this is the accountability part that's quite important Alice has the signed receipt from the tower or from the third party that they agreed to watch the child on her behalf Alice also has that preimage s the proof the third party has been paired to do this job as well and while she also has it's a dispute record on the blockchain so there's a record of the dispute on the blockchain that you know there was the tower could have responded to resolve so what does Ollis do Alice gets the signed and ratified receipt and simply sends it to the Pisa contract the Pisa contract can request all of the disputes from the steer channel contract and simply and then the steer channel contract will return the list of disputes the Pisa contract then says okay that's too good the disputes let's look at the receipt was our a dispute that the third party could have resolved yes there was then what happens is that you know the third parties crying because his deposit has been frozen I know always gets a little bit revenge you know cease deny penalize that the third party for cheating now there is an alternative scheme where Alice could be compensated as well so instead of simply burning the deposit you could compensate Alice but that comes with some caveats as well so I can answer that during the FAQ of anyone's interested but basically the summary of peas in a nutshell yes dear privacy there's this fair exchange protocol there's order one storage and we have recourse as a financial deterrent I'm not sort of what you want out of this third-party service now in terms of really at work what I should mention is that Pisa is in the very first solution there was an initial YouTube video by Taj it's killing Bitcoin a few years ago for monitor and then you have the watchtower protocol as well that was presented at bps earlier this they was earlier this year maybe you were in February time now they're both for Bitcoin and what they mostly focus on is dear privacy I'm a customer I get some encrypted blob and then I give it off to the tower they never focus on accountability so if I hire the tower or the monitor I have no evidence that I've ever hired this tower so they cheat I have no evidence of hiring them and I have nowhere to either dummies the reputation or financially penalize them so what's beautiful about Pease is out loud that's what I guess that's our main contribution that's what we mostly focused on and because it's design for aetherium is deployable today and actually our protocol is somewhat compatible watchtower so we also improved the Bitcoin protocol as well and actually think this is a really good way for at least academic researchers to design protocols if you design it for aetherium you most certainly have to focus on the concept and actually when you design it's a smart contract given the concert given the Kent's concept it's really easy to write as a trusted third party that is a smart contract well normally when you focus on Bitcoin you know you sort of try to punch back when in the submission they get it to do something that really doesn't want to do so I mostly focus on doing stuff for aetherium now and then retrospectively see if this will also work on Bitcoin a lot of the time it's not really worth the while either because they won't update it but anyway that's my rant over so two years later you know see a channels have been an idea as I mentioned from Jeff's bloke I was 2015 that's three years later I believe we're on the verge of practical and deployable stare channels as we've seen today we've had lots of people building Stier channels last night on at the I attended an event and three out of eight presentations said they want to use their channels as part of their product there's still quite a bit of research to do but I believe see a channels are for a big part of it mostly an engineering challenge to go build it and see how they how well they work while parameters should be set etc etc so basically magic unicorns need not apply we no longer need magic unicorn fish dia channels to work so that's pretty much the summary of my talk what I went over today was Pisa was it the one in the middle which is an accountable third party in the past with Andre Miller I worked on sprites which was one of the first dear cello constructions or actually was mostly command focused during that dispute process us you a command a new self enforces da transition that way so the ghoul there was the ensure the steer channel never closes you just submit commands and that's how you do your steer transitions and then more recently I did I did a case study where a pretty must be built this two player bottle ship game and we really wanted to empirically evaluate how well steer channels work and we got some lessons from that as well but welcome Otto that was kid soon which is that application agnostic state channel where the steer channel really doesn't care what the application is basically you designed the application as normal for the blockchain you are this locking and unlocking unlocking mechanism then you can lock yourself into the state channel and then unlock yourself and what you really learn is that steer channels are mostly an optimistic way to scale if everyone cooperates we can optimistically run off Qin if one person doesn't cooperate then raises default to the tour twice you know the lower layer that's slow and expensive but we can always default back to that so I'd like to thank my co-authors of course I put their photos up there and I also want to thank the Athena foundation the theme Community Fund and the Research Institute from pin sponsor this research because with our sponsorship it's very difficult to get any research done so I guess that's the end of my talk so thank you guys for listening minutes apparently [Applause] hi thank you for an interesting talk first of all maybe a stupid question here but okay so the party's in a channel submit the latest version of the state the state hash and signatures of all the parties to Pisa yeah but if one of the parties is trying to act maliciously okay do they submit their signatures for each updated version of the state because well they can't do so if you think about the receipt the receipt will basically say I will relay this message according to this version number spoke with the peas at about the third party must do first is that given a job the third party must follow the it itself that this actually works so they look at the steer channel and they could just simulate it and say yep if there was a dispute this will always be accepted by the steer channel contract I think that's what you're alluding to kind of wondering like if somebody if a party in the channel withheld their signature oh yes so for example the poker gaming instance so all's plans are haand I'm Bob doesn't respond what always would have to do is send the previous state or about everyone agreed upon if you're missing a signature then the I won't be accepting it at the state channel okay thank you awesome I think I've got 19 seconds so I don't mind ending it here oh there's one question here there's time yeah yeah I think I was wondering if Alice has a lot of money at stake and they collude to get it out don't you require the the validator The Watcher to have more money at stake you do yes so there's different ways to think about this so obviously for the the third party if their collateral is less than their gonna win then they're always gonna cheat if there's a positive payoff so that's why I normally say a large security deposit they may have to have $10,000 locked up and there's three ways you could do it I mean you could do this you know simple punishment and that way there's always this constant financial deterrent one issue with you could do compensation so what the tower could they could lock up collateral so left $10,000 $1,000 could be directly allocated for Alice sir vollis does I mean if they do cheat Alice always gets refunded to $1,000 the issue of that is that they're actually strictly weakens the fan also deterrent and this is like a generic issue of any protocol that has a central deposit and why did I say that so if $1,000 is locked up for Alice the tower could also lock up $9,000 for Siebel and then Louise get those $9,000 back so that way it have to be fully collateralized to make sure Alice can never lose any money yeah actually have to have the sum of what everybody has at stake plus something that I'd lose it'll be trustless it would have to be fully collateralized but actually I think it worked quite well and risk as well so on the at the end the appendix of the paper we actually consider the kiyose of risk where what if it's over cauterized you know it's actually somewhat a fractional reserve it's actually still quite difficult for the Tower of the wind because you have to assume that everyone's offline where I'm actually maybe only two parties you're offline and everyone else is online when you're burning the the collateral you're actually giving money to everybody who has taken any so there's three Institute there's burn was just a tricky burns it and no one gets any coins or you could do the compensation where you reward the loser whoever lost their money so you could do both yeah I always find the fan also to make the burning most easier to think about because it's a constant at cost okay thanks Patrick [Applause]