Lnd: Required Safety Features

[capacitynetwork]

Background

Today one of the biggest nodes on network increased fee rate to 703 satoshi, then 10 satoshi.
A few days, TOR exit nodes connect and send payment through my node.

1) We need way to temporarily disable node or channels
2) High fee rate of over 1 satoshi per satoshi should not be possible in implementation.
3) We need way to blacklist nodes so they cannot open new connections

When network participants turn malicious, or error, we need fast ways to react and protect users.

[capacitynetwork]

Now 50.

We need ways to protect against mistakes, bad actors, and compromised security. This single node connects to over 20% of the network, and for many is the only or main route.

[PierreRochard]

Sorry about that @capacitynetwork!

I was orders of magnitude off while experimenting with update_channel_policy.

I do understand that I have responsibilities as such a large node and I will be more cautious going forward.

[githorray]

You can already limit the fees you pay with lncli. You might want to try that before going on a ban hammer raid... 🤗

[CommanderPoe]

Yet... those fees are stupidly high considering over 95% of the network keeps standard rate fees.

[PierreRochard]

@CommanderPoe is that the right heuristic for determining what a node's fees should be?

What if 95% of the network has fees that are too low?

I'm using 0.000100 sat now because that's what ACINQ is using and it seems as though the market will bear it.

[capacitynetwork]

@PierreRochard I am glad you did, it has raised some feature requests for protections we should have. Imagine if LNBig made the mistake, or somebody compromised major node.

I suggest:

1) We need way to temporarily disable node or channels
2) High fee rate of over 1 satoshi per satoshi should not be possible in implementation.
3) We need way to blacklist nodes so they cannot open new connections
4) We need _a way, to specify the maximum fee we will accept on a channel_, in lnd, not per payment.

For 4, some config setting of maxfeerate, maxbasefee, if channel policy is changed to above this, then channel automatically disabled. This will protect node operators and users. It cancels need for 2.

[PierreRochard]

@capacitynetwork I may or may not agree with your suggestions, but I don't know because it's unclear what you mean by "we" in every instance. Do you mean "we" as in the network as a whole, or you mean "me" as in "my node"?

[capacitynetwork]

@PierreRochard both. Alternatively, "lnd needs a way", or "lnd is missing a way".

When this error occurred, it was instantly to me clear that LND was lacking some functionality, or it was not exposed. We can not even disable or deactivate a channel temporarily on request.

Let say I create a third party script which detects when channel policy is updated to a maximum figure I do not want, I then make that script call which function in LND to do something about it? Force close only?

We can not disable /deactivate channels, set maximum acceptable channel fee base or rate, block a node.

[molxyz]

@capacitynetwork I may or may not agree with your suggestions, but I don't know because it's unclear what you mean by "we" in every instance. Do you mean "we" as in the network as a whole, or you mean "me" as in "my node"?

Lmao... There is no "we". Some people do not mind to pay a higher fee. I have paid a fee of 870 sat for one payment (using LND) and on another payment I paid a fee of 620 sat (using c-lightning which has fees for anonymity).

@capacitynetwork One thing to keep the network decentralized is the hubs have a higher minchansize and higher fee rates (so that they don't get too many channels and connections and people should try to connect/openchannel to other nodes which have lower fee rates). If you don't want to pay too high fees, use --fee_limit for your payments. But censorship and blacklisting should have no place in lightning network. If you want these negative rules, use fiat. End of story.

[PierreRochard]

Let say I create a third party script which detects when channel policy is updated to a maximum figure I do not want, I then make that script call which function in LND to do something about it? Force close only?

You should create such a script, though I dunno why the force close, you could just do a cooperative close since they're probably online.

I don't know that LND should build in business logic like this, that's what the API is for!

[capacitynetwork]

@capacitynetwork I may or may not agree with your suggestions, but I don't know because it's unclear what you mean by "we" in every instance. Do you mean "we" as in the network as a whole, or you mean "me" as in "my node"?

Lmao... There is no "we". Some people do not mind to pay a higher fee. I have paid a fee of 870 sat for one payment (using LND) and on another payment I paid a fee of 620 sat (using c-lightning which has fees for anonymity).

@molxyz This was a fee _rate of 705_. Not 0.000705, not 0.705000, but 705.032704 rate, not base, 705.032704 rate. Send 10,000 pay over 7,050,000 in fee.

Some people do not mind paying rate like this???

[PierreRochard]

I think we’re getting our wires crossed between my erroneously high fee rate and just high fee rates in general.

[capacitynetwork]

Let say I create a third party script which detects when channel policy is updated to a maximum figure I do not want, I then make that script call which function in LND to do something about it? Force close only?

You should create such a script, though I dunno why the force close, you could just do a cooperative close since they're probably online.

I don't know that LND should build in business logic like this, that's what the API is for!

I did not want to close, I wanted to deactivate or disable for temporary. Could not, no API function to deactivate or disable channel.

I think we’re getting our wires crossed between my erroneously high fee rate and just high fee rates in general.

Ok. I suggest it is a bug that FeeRate can be greater than 1.
Also missing feature that you have no warning of high fee, that I as a node that connect to you could not do anything about it, temporary disable you, be notified, have way to say I will not accept a channel with FeeRate above some value.

[lobsterpub]

1523

[cryptagoras]

I know it was a mistake, but the case of a "malicious" node operator spiking fees has happened in the past with some BCash dude and I can see it happening again for various reasons. Imo, the best and only required solution for that is to have LN wallets handle fees in a better way from a UX/UI perspective.

Have a user-configurable fee limit which prompts the user to allow higher fees when trying to find a payment route (e.x. default fee limit 0.2% and 50 sats, and if no routes are found, ask the user try with 150% of the previous limit or something) done.

Without that, no matter what some routing nodes do with disabling channels, it's not certain it will save the payeer, since the "malicious" op only needs one outbound channel (one either outdated, or "greedy" enough to want a cut of those juicy fees).

[Roasbeef]

You can simply reject channels with those nodes manually yourselves. In another light, those nodes don't hurt you when forwarding, as if your fees are lower, then clients will bias towards you. It's already possible for clients to enforce a fee limit when sending payments.

[molxyz]

@molxyz This was a fee _rate of 705_. Not 0.000705, not 0.705000, but 705.032704 rate, not base, 705.032704 rate. Send 10,000 pay over 7,050,000 in fee.

Some people do not mind paying rate like this???

@capacitynetwork I don't want to argue with you about this number that you keep bringing up while your screenshot shows Fee Rate 50.000000 sat Do you see it in the corner of 1ML site on that screenshot? So, if you had sent a payment for 10k sat the fee would have been 10000 x 50 = 500000 sat, not 7,050,000, unless i'm missing something.

Regardless the fee would be still too high I agree. But knowing who Pierre Rochard is, I think this was an honest mistake (I'll explain down below), you could talk to him and ask for a refund if this had happened to you, he's not a bad actor that you seem to be accusing him and blowing this issue out of proportion. I know someone else on IRC actually paid a fee around 19000 sat to another node also due to a mistake in that node's owner's settings and he got refunded.

Now if you go to the site you'll see the Fee Rate has been corrected to 0.000050 sat which is what he meant to set: https://1ml.com/node/0331f80652fb840239df8dc99205792bba2e559a05469915804c08420230e23c7c/channels

I think I know what happened, as I made the same mistake by trying to figure this out on my testnet nodes. If I set this lncli updatechanpolicy 1000 50 144, it would result in channel policy as "fee_rate_milli_msat": "50000000", and 1ML would list it as 50.000000 sat because it is actually 50 times the payment for a fee in satoshi. However, the fee is so large that it seems LND would not make anyone to pay this fee, Pierre's node would not be able to route any payment!

When it happened to the IRC user who had to pay that large fee a year ago we had this chat with @Roasbeef and I did ask roasbeef to prevent this happening again. I think LND does route away from ridiculously-huge fees, but I don't think paying 870 sat or 1200 sat is a problem for some people if that is the only route they can find and they don't mind paying it, or they can send their payments on-chain if they wish, which would be about the same or higher.

Also, again, by all means, please use --fee_limit every time you make a payment. If you still don't know how to use it, we could ask for this to be implemented in the code so every time a payment is made, if fee_limit is missing, a reminder pops up, or this can be put in lnd.conf if that makes you feel safer.

[capacitynetwork]

@molxyz This was a fee _rate of 705_. Not 0.000705, not 0.705000, but 705.032704 rate, not base, 705.032704 rate. Send 10,000 pay over 7,050,000 in fee.
Some people do not mind paying rate like this???

@capacitynetwork I don't want to argue with you about this number that you keep bringing up while your screenshot shows Fee Rate 50.000000 sat Do you see it in the corner of 1ML site on that screenshot? So, if you had sent a payment for 10k sat the fee would have been 10000 x 50 = 500000 sat, not 7,050,000, unless i'm missing something.

Fee was 705.032704, then 50, then 10, then fixed. Over 1-2 hour period.

Regardless the fee would be still too high I agree. But knowing who Pierre Rochard is, I think this was an honest mistake (I'll explain down below), you could talk to him and ask for a refund if this had happened to you, he's not a bad actor that you seem to be accusing him and blowing this issue out of proportion. I know someone else on IRC actually paid a fee around 19000 sat to another node also due to a mistake in that node's owner's settings and he got refunded.

Yes, he has confirmed mistake.

I think I know what happened, as I made the same mistake by trying to figure this out on my testnet nodes. If I set this lncli updatechanpolicy 1000 50 144, it would result in channel policy as "fee_rate_milli_msat": "50000000", and 1ML would list it as 50.000000 sat because it is actually 50 times the payment for a fee in satoshi.

Yes, this.

However, the fee is so large that it seems LND would not make anyone to pay this fee, Pierre's node would not be able to route any payment!

Where is this code?

Also, again, by all means, please use --fee_limit every time you make a payment. If you still don't know how to use it, we could ask for this to be implemented in the code so every time a payment is made, if fee_limit is missing, a reminder pops up, or this can be put in lnd.conf if that makes you feel safer.

Why have fee rate above 1. I do not understand, what is use case?

[capacitynetwork]

simply reject channels with those nodes manually yourselves

@Roasbeef do you mean check my node for updates to channel policy for every connected node every few minutes then close channels? Ok I code this, but how to disable channel? Am I missing API call to deactivate and activate channel?