If Alice and Bob open a state channel with each other, for example a payment channel, and the state is as follows:

Alice initial balance: 1ETH
Bob initial balance: 1ETH

Bob sends Alice 0.20ETH
Alice sends Bob 0.25ETH
Bob sends Alice 0.30ETH

Final state: Bob=0.75ETH , Alice=1.25ETH

And Alice attempts to finalize the channel and settle on the main chain, however Bob (a malicious actor) proposes an alternate finalization as follows:

Bob sends Alice 0.20ETH
Alice sends Bob 0.25ETH
Bob sends Alice 0.01ETH
Bob sends Alice 0.01ETH

Final state: Bob=1.03ETH , Alice=0.97ETH

How is the contract able to decide which is the malicious actor in this scenario?

The only solution I could think of is if Alice wishes to publish the state to the blockchain, the final signature must be from Bob and vice-versa, but I couldn't find much documentation on this problem so I'm not sure if that solution fails in certain scenarios or not.


This is typically solved by requiring that transactions are signed by both parties. This way it is clear that both agree, and neither side can change an agreed state of the channel.

However, this approach does not avoid a malicious actor trying to get around having to pay later transactions by closing the channel using an earlier state. In your example this would happen if Bob closes the channel using the state that was agreed after the second transaction.

In order to avoid this, a nonce (a strictly increasing number) can be added to every state. If one of the parties wants to close the channel, the channel goes into a settlement state for a certain time, which gives the other party the opportunity to supply a state with a higher nonce.

In our example, after Bob requests to close the channel with the state after the second transaction, Alice would provide the state after the third transaction, which would be used to close the channel with the fair state.

  • 3
    Just a note: the state being "signed by both parties" is often achieved by one party signing the state and the other party submitting it to the blockchain. The transaction to the blockchain is signed, so both parties have signed, just not the exact same thing. So OP's notion of "if Alice wishes to publish... the final signature must be from Bob and vice-versa" is a great way to do it.
    – user19510
    May 5 '18 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.