Babilonia - probabilistic coinjoin and covert betting

Protocol Design
, ,
3

This is cool, thanks for sharing!

In the current flow, the adaptor round happens after funding confirmation. This creates a window when both parties have locked coins, but the settlement is unsigned. If someone stays silent, we are waiting until T_R.

I think the window can be removed by extending the RefundTx precedent (pre-sign before money moves) to the settlement:

  • 1-2. As now (funding info, thimbles + PoKs, K + \pi_B, nonces for all three sessions)
  • 3-4. As now (RefundTx partials)
    1. Dealer sends \sigma'_{A,P}, T, \pi_A, ctxt (current step 8)
    1. Player verifies against the PayoutTx template and sends \sigma_{B,P} (step 9)
    1. Dealer validates, signs FundingTx, and sends the PSBT (step 5)
    1. Player co-signs and broadcasts (step 6)
    1. Waiting for the transaction confirmation
    1. Dealer sends t and \sigma_{A,O} (step 10)
  • 11-13. Unchanged

This reordering should survive: neither t nor the completed signature becomes public before the funding transaction is confirmed. In this case, only the dealer can abort, and it only gives the player a free option against them, so it’s incentive-compatible. The player can’t exploit receiving the adaptor earlier either: the hiding of c doesn’t depend on whether his coins are committed yet.

Another effect: by the time any money moves, every proof is verified, and every signature exchanged, so a failed \pi_A, \pi_B or adaptor check aborts with zero footprint.

Another shower thought is “flip channels”: we lock U_1 and can make a lot of flips inside the channel; balances live in pre-signed state transactions, and we are doing flips off-chain:

  • a state is just a pre-signed spend of U_1 into the two balances; stale states are revoked (LN-penalty style)
  • during a flip, the stake moves into an in-flight output inside the state. O_K with fresh thimbles, K_k, t_k per flip (freshness per flip is critical: the loser learns a_c, and against a reused thimble pair, he could construct a K he can always spend)
  • the dealer’s enforcement stays the same
  • but we need to care about ordering: the pre-flip state (the one without the stake in flight) must be revoked before t_k is revealed, otherwise the loser just rolls back to it

Beyond fees, it strengthens privacy: any number of flips leaves only a two-transaction footprint (open + cooperative close), and the close pays out only the net result, so no per-bet amounts ever appear on-chain. Roles can also alternate per flip.

Additionally, we should be able to route flips between parties who don’t share a channel (assuming PTLC-capable channels):

  1. The handshake with messages that the paper describes.
  2. Dealer routes (a+b) to the player as a PTLC locked to K, timeout t_A. This is safe to commit first: the player can’t claim it without knowing t.
  3. Player routes his stake b to the dealer as a PTLC locked to T, timeout t_B < t_A (the gap leaves the player time to claim after the reveal). The order matters: the dealer knows t from the start, so if the stake were committed before the pot existed, they could just claim it and never send the pot at all.
  4. The dealer claims the stake, and the PTLC claim reveals the scalar t. The player computes a_c = ctxt - t^2, and if they won, they know \mathsf{dlog}(K), which allows them to claim (a+b). If the dealer never claims, both PTLCs time out - the refund path.
1 Like