<p>Such an attack is not limited to just Lightning; it could happen with just normal transactions and normal Bitcoin usage. However performing such an attack is very expensive and unlikely. It would require A to control as much hashrate as the entire network has. Otherwise blocks will come slowly for B and eventually warn him if too few blocks are received within a given time frame. Furthermore, if blocks were invalid, B will ban A's nodes and find other nodes to connect to. A would also have to control B's internet connection in order to prevent him from connecting to other people and opening channels with people other than A.</p>

<p>Lastly, the lightning network has a minimum balance requirement (minimum must be kept for both parties after it has been met, but both parties do not need to start with the minimum in the channel) so B would not lose all of his money. There is also currently a maximum amount that can be put in a channel so not a lot of money is risked.</p>

CC BY-SA 3.0
2017-06-18T03:50:44.083Z
Well, a large attacker A could trick B into accepting an already-spent transaction (ie a double spend), but couldn't actively steal any of B's bitcoins. So I don't think its true that this kind of attack is possible on pure Bitcoin. But it sounds like what you're saying i essentially, "yes, an attacker like this could steal up to the amount of bitcoins committed to the channel". Is that right?
B T
CC BY-SA 3.0
2017-06-18T04:30:39.393Z
Yes. I think this attack would work in theory, but in practice, it would basically be impossible, or at the very least, be prohibitively expensive to do for a very very small reward.
Ava Chow
CC BY-SA 3.0
2017-06-18T05:17:55.593Z
I understand that surrounding someone's network with MITM isn't trivial. But could you elaborate what makes this basically impossible, or what about it would be inherently expensive?
B T
CC BY-SA 3.0
2017-06-18T05:33:11.040Z
In order for A to attack B, A needs to fully control B's internet connection. Otherwise B will be able to make a connection to another node and get the actual blockchain. That in itself is pretty hard to do. Then, if you were to get that somehow, you would need to be able to mine blocks at the same difficulty and rate that the network currently does. In order to do that, you have to have the same hashrate as the network, otherwise B's full node will warn him that blocks are too slow. That is prohibitively expensive.
Ava Chow
CC BY-SA 3.0
2017-06-18T06:04:28.230Z
Ok, yes, if we're talking about the blockchain I agree. But this question is about the lightning network, not the blockchain.
B T
CC BY-SA 3.0
2017-06-18T06:30:44.963Z
The lightning network requires the blockchain. The current implementations require a full node in order to work properly. Otherwise the lightning client won't know if the other party tried to use an old commitment transaction. Since LN uses the blockchain, not having access to it also means that a person's LN client won't function properly.
Ava Chow
CC BY-SA 3.0
2017-06-18T06:44:26.950Z
Yes indeed it does require the blockchain. I'm not sure if you're quite understanding what I'm saying here.
B T
CC BY-SA 3.0
2017-06-18T06:59:03.407Z
Then what are you saying? AFAIU, your idea is that you have A open and fund a channel with B and B opens and funds a different channel with A. A then transfers to himself via B to drain the second channel. Then he broadcasts an old commitment for the first channel and closes the second normally.
Ava Chow
CC BY-SA 3.0
2017-06-18T06:59:06.617Z
What I am saying is that in order for this to work, A needs to prevent B from learning about the old commitment transaction. That prevention is what makes this virtually impossible and prohibitively expensive since the commitment transaction is just a normal Bitcoin transaction. So A needs to do all of the blockchain related things to prevent B from learning about that transaction
Ava Chow
CC BY-SA 3.0
2017-06-18T13:27:59.827Z
B has another safety against MITM: he can let C to Z watch the blockchain and have them send the punish transaction on his behalf. A would have to MITM all those connections too and if properly set up with authentication, B will detect that he's being attacked.
Jannes
CC BY-SA 3.0
2017-06-18T03:38:04.223Z
2017-06-18T04:23:24.373Z
2017-06-18T04:23:24.373Z
Ava Chow
<p>It seems like a man in the middle attack could be performed in a Lightning Network. </p>

<p>Let's say A opens a channel with B. If A manages to control all the connects B has to the bitcoin network (becoming a man in the middle), A can prevent B's attempts to propagate or publish refund transactions. In this case, A can send some money through B to another address A controls, then publish the original balance transactions. If A can continue to MITM B for the 10 days (or whatever) it takes for that transaction to go through, A would have successfully stolen all the funds A was able to convince B to transfer. </p>

<p>B could potentially become aware that either the blockchain data he's getting isn't valid or simply become aware the balance transaction has been published, but if he can't get on the bitcoin network to publish the refund, he's screwed. </p>

<p>Is this scenario possible?</p>

<lightning-network>
Is the Lightning Network susceptible to man in the middle attacks?
B T
# Is the Lightning Network susceptible to man in the middle attacks?

(Asked by: username_0 on 2017-06-18)

It seems like a man in the middle attack could be performed in a Lightning Network.

Let's say A opens a channel with B. If A manages to control all the connects B has to the bitcoin network (becoming a man in the middle), A can prevent B's attempts to propagate or publish refund transactions. In this case, A can send some money through B to another address A controls, then publish the original balance transactions. If A can continue to MITM B for the 10 days (or whatever) it takes for that transaction to go through, A would have successfully stolen all the funds A was able to convince B to transfer.

B could potentially become aware that either the blockchain data he's getting isn't valid or simply become aware the balance transaction has been published, but if he can't get on the bitcoin network to publish the refund, he's screwed.

Is this scenario possible?

**Tags:** lightning-network


---

## 1 answers

### Answer by username_1 on 2017-06-18. Score: 1

Such an attack is not limited to just Lightning; it could happen with just normal transactions and normal Bitcoin usage. However performing such an attack is very expensive and unlikely. It would require A to control as much hashrate as the entire network has. Otherwise blocks will come slowly for B and eventually warn him if too few blocks are received within a given time frame. Furthermore, if blocks were invalid, B will ban A's nodes and find other nodes to connect to. A would also have to control B's internet connection in order to prevent him from connecting to other people and opening channels with people other than A.

Lastly, the lightning network has a minimum balance requirement (minimum must be kept for both parties after it has been met, but both parties do not need to start with the minimum in the channel) so B would not lose all of his money. There is also currently a maximum amount that can be put in a channel so not a lot of money is risked.

> **Comments:**
> **username_0**: Well, a large attacker A could trick B into accepting an already-spent transaction (ie a double spend), but couldn't actively steal any of B's bitcoins. So I don't think its true that this kind of attack is possible on pure Bitcoin. But it sounds like what you're saying i essentially, "yes, an attacker like this could steal up to the amount of bitcoins committed to the channel". Is that right?  
> **username_1**: Yes. I think this attack would work in theory, but in practice, it would basically be impossible, or at the very least, be prohibitively expensive to do for a very very small reward.  
> **username_0**: I understand that surrounding someone's network with MITM isn't trivial. But could you elaborate what makes this basically impossible, or what about it would be inherently expensive?  
> **username_1**: In order for A to attack B, A needs to fully control B's internet connection. Otherwise B will be able to make a connection to another node and get the actual blockchain. That in itself is pretty hard to do. Then, if you were to get that somehow, you would need to be able to mine blocks at the same difficulty and rate that the network currently does. In order to do that, you have to have the same hashrate as the network, otherwise B's full node will warn him that blocks are too slow. That is prohibitively expensive.  
> **username_0**: Ok, yes, if we're talking about the blockchain I agree. But this question is about the lightning network, not the blockchain.  
> **username_1**: The lightning network requires the blockchain. The current implementations require a full node in order to work properly. Otherwise the lightning client won't know if the other party tried to use an old commitment transaction. Since LN uses the blockchain, not having access to it also means that a person's LN client won't function properly.  
> **username_0**: Yes indeed it does require the blockchain. I'm not sure if you're quite understanding what I'm saying here.  
> **username_1**: Then what are you saying? AFAIU, your idea is that you have A open and fund a channel with B and B opens and funds a different channel with A. A then transfers to himself via B to drain the second channel. Then he broadcasts an old commitment for the first channel and closes the second normally.  
> **username_1**: What I am saying is that in order for this to work, A needs to prevent B from learning about the old commitment transaction. That prevention is what makes this virtually impossible and prohibitively expensive since the commitment transaction is just a normal Bitcoin transaction. So A needs to do all of the blockchain related things to prevent B from learning about that transaction  
> **username_2**: B has another safety against MITM: he can let C to Z watch the blockchain and have them send the punish transaction on his behalf. A would have to MITM all those connections too and if properly set up with authentication, B will detect that he's being attacked.  

---

