MAD-HTLC: Because HTLC is Crazy-Cheap to Attack

### Overview In this talk, Itay Tsabary presents "MAD-HTLC: Because HTLC is Crazy-Cheap to Attack," joint work with Matan Yechieli, Alex Manuskin, and Ittay Eyal. Hash Time Lock Contracts (HTLCs) are standard smart contract primitives fundamental to off-chain scaling solutions like the Lightning Network, atomic swaps, and contingent payments. While previously known to be vulnerable to miner bribery attacks on Ethereum via complex smart contracts, this research demonstrates that bribery attacks against HTLCs are simpler, cheaper, and directly applicable to Bitcoin via standard transaction fees. To resolve this vulnerability systematically, the authors propose MAD-HTLC, an incentive-compatible replacement based on the game-theoretic principle of Mutually Assured Destruction.

### Key Topics - **HTLC Miner Bribery Vulnerability:** HTLC security relies on the assumption that a valid preimage transaction published before timeout $T$ will be confirmed. However, this ignores miner extractable value (MEV). A sender (Batman) can bribe miners with higher transaction fees to delay the recipient's (Antman's) transaction until the timeout elapses, stealing the locked funds. - **Subgame Perfect Equilibrium (SPE) Analysis:** Using backward induction to model the game across rounds, the authors prove that when all miners are rational, attack bribery costs are independent of the timeout duration $T$, invalidating the assumption that longer timeouts mitigate attacks. - **MAD-HTLC Architecture:** A protocol leveraging miner incentives as deterrence. If both parties' preimages are exposed, any miner can claim the entire locked balance as MEV, ensuring both parties lose if an attack is attempted. - **Bitcoin MEV Feasibility:** Demonstrating through Bitcoin Core patches that implementing MEV and bribery logic requires minimal code and is practical today.

### Technical Details - **Cost & Empirical Findings:** Analysis revealed Bitcoin HTLCs securing over $26,000 where an attacker could pull off the bribery attack for a cost of merely $2. If the honest party attempts a counter-bribe bidding war, they require a linear fee of roughly 1% of the locked value (e.g., $260 on a $26,000 balance, which is 10,000 times higher than typical transaction fees). - **MAD-HTLC Design:** Built using two subcontracts (split for Bitcoin Script, consolidatable in Ethereum Solidity): 1. *Deposit Contract:* Redeemed by Antman presenting preimage 1, by Batman after timeout $T$ presenting preimage 2, or by *any miner* presenting both preimage 1 and preimage 2. 2. *Collateral Contract (Optional):* Prevents a spiteful Batman from releasing preimage 2 after Antman claims the deposit; Batman reclaims it after timeout $T$, unless both preimages are revealed, in which case miners take the collateral. - **Security & Incentive Proofs:** Formally modeled using an ideal functionality $\mathcal{F}$ and real hybrid protocol $\Pi$ using universal composability principles, proving indistinguishability alongside SPE game analysis. - **Overhead & Mainnet Evaluation:** The Bitcoin Script implementation adds an overhead of only a few dollars. Ethereum Solidity has an overhead of roughly $150, reducible to ~$10 when amortized. Deployments on mainnets showed Ethereum transactions were front-run (MEV active), while Bitcoin transactions confirmed smoothly without MEV interference. - **Bitcoin Core Patches:** To show MEV feasibility on Bitcoin, authors patched Bitcoin Core with a 150-LOC patch to coordinate bribe recognition and transaction delaying, and a 350-LOC patch establishing an external Python RPC infrastructure for custom MEV logic.

### Takeaways Increasing HTLC timeouts does not protect against rational miner bribery, and relying on the current immaturity of Bitcoin MEV is dangerous. MAD-HTLC provides a practical, drop-in replacement that aligns miner incentives to guarantee protocol execution with negligible fee overhead.