<p>In lightning the receiver of the money comes up with a random secret and comits to it via the payment hash. Once all the hashed time lock contracts (htlcs) are set up along a path through the network from the sender to the receiver the recipient will release the secret preimage for the chain of htlcs to settle. The preimage can be seen as a proof of payment. However as with the onchain case there is some doubt. Every node along the route who participated in the payment will know the primage of the payment hash and could thus argue that they initiate the payment</p>

CC BY-SA 4.0
2019-12-09T10:10:26.087Z
Should the preimage be signed by the payer/payee?
Chris Chen
CC BY-SA 4.0
2019-12-09T10:20:24.803Z
the invoice which transports the payment hash is signed by the payee. The payee cannot really sign the preimage to gain something as every routing node could do that. There are currently proposals like stuckless and cancable payments as well as payment decorrelation. In that world the payer could actually proof (s)he was the the payer
Rene Pickhardt
CC BY-SA 4.0
2019-12-09T10:39:54.450Z
I still doubt how could a signed invoice (which contains the payment hash) together with the preimage could prove anything. How could the 3rd party be convinced, or be able to spot fake proofs?
Chris Chen
CC BY-SA 4.0
2019-12-09T14:38:12.070Z
The proof consists because we assume that the inverse of the hash function is unknown. Being able to provide the preimage is proof that the recipient was paid otherwise (s)he would not have released the secret
Rene Pickhardt
CC BY-SA 4.0
2019-12-09T17:44:36.263Z
But invoices can be generated with zero cost, right? How could the 3rd party distinguish between an actually paid invoice and an never-paid invoice which is used to pretend to be a paid one?
Chris Chen
CC BY-SA 4.0
2019-12-09T21:22:52.073Z
For the paid one the payer can show the preimage
Rene Pickhardt
CC BY-SA 4.0
2019-12-09T23:13:51.103Z
Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/101994/discussion-between-chris-chen-and-rene-pickhardt).
Chris Chen
CC BY-SA 4.0
2019-12-09T09:24:45.470Z
2019-12-09T09:24:45.470Z
Rene Pickhardt
<p>For regular on-chain payments, a txid can prove at least a transferring of value indeedly happened, at a specific time, despite that it may be totally irrelevant. For example, a malicious user can send his own money to himself, to pretend that he purchased some goods from an innocent merchant.</p>

<p>For LN off-chain payments, is it possible for a payer to prove to 3rd party that he had indeedly made a payment to the payee?</p>

<lightning-network><payment>
In LN, how could a payer prove to 3rd party that he indeedly made a payment to the payee?
Chris Chen
# In LN, how could a payer prove to 3rd party that he indeedly made a payment to the payee?

(Asked by: username_0 on 2019-12-09)

For regular on-chain payments, a txid can prove at least a transferring of value indeedly happened, at a specific time, despite that it may be totally irrelevant. For example, a malicious user can send his own money to himself, to pretend that he purchased some goods from an innocent merchant.

For LN off-chain payments, is it possible for a payer to prove to 3rd party that he had indeedly made a payment to the payee?

**Tags:** lightning-network, payment


---

## 1 answers

### Answer by username_1 on 2019-12-09. Score: 5 | Accepted answer

In lightning the receiver of the money comes up with a random secret and comits to it via the payment hash. Once all the hashed time lock contracts (htlcs) are set up along a path through the network from the sender to the receiver the recipient will release the secret preimage for the chain of htlcs to settle. The preimage can be seen as a proof of payment. However as with the onchain case there is some doubt. Every node along the route who participated in the payment will know the primage of the payment hash and could thus argue that they initiate the payment

> **Comments:**
> **username_0**: Should the preimage be signed by the payer/payee?  
> **username_1**: the invoice which transports the payment hash is signed by the payee. The payee cannot really sign the preimage to gain something as every routing node could do that. There are currently proposals like stuckless and cancable payments as well as payment decorrelation. In that world the payer could actually proof (s)he was the the payer  
> **username_0**: I still doubt how could a signed invoice (which contains the payment hash) together with the preimage could prove anything. How could the 3rd party be convinced, or be able to spot fake proofs?  
> **username_1**: The proof consists because we assume that the inverse of the hash function is unknown. Being able to provide the preimage is proof that the recipient was paid otherwise (s)he would not have released the secret  
> **username_0**: But invoices can be generated with zero cost, right? How could the 3rd party distinguish between an actually paid invoice and an never-paid invoice which is used to pretend to be a paid one?  
> **username_1**: For the paid one the payer can show the preimage  
> **username_0**: Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/101994/discussion-between-username_0-username_0-and-username_1).  

---

