Watchtower Protocol 瞭望塔協議

Watchtower Data Structures:

Justice Transaction Blob:

Encrypted data sent from client to watchtower:

Plaintext contents:
  • sweep_address: Destination for penalty funds
  • revocation_key: Revocation private key
  • to_local_delay_key: Delayed payment private key
  • to_remote_key: Remote payment private key (optional)

Or directly contains:
  • Pre-signed Justice Transaction

Locator:

For matching breach transactions on blockchain:

locator = txid[:16] (first 16 bytes)

Design considerations:
  • Long enough to avoid collisions
  • Short enough to save storage
  • Doesn't reveal full txid (privacy)

Encryption Key:

Blob encrypted using txid:

encryption_key = SHA256(breach_txid)

Encryption schemes:
  • ChaCha20-Poly1305
  • AES-GCM (alternative)

Result:
  • Watchtower cannot read blob contents
  • Can only decrypt when breach tx appears
  • Breach tx txid is the decryption key

Client-Watchtower Communication:

Session Establishment:

  Client                              Watchtower
     |                                    |
     |---- CreateSession ---------------->|
     |     {                              |
     |       blob_type,                   |
     |       max_updates,                 |
     |       reward_address (optional)    |
     |     }                              |
     |                                    |
     |<--- CreateSessionReply ------------|
     |     {                              |
     |       session_id,                  |
     |       accepted / rejected,         |
     |       fee_rate                     |
     |     }                              |

State Update:

  Client                              Watchtower
     |                                    |
     |---- StateUpdate ------------------>|
     |     {                              |
     |       session_id,                  |
     |       seq_num,                     |
     |       locator,                     |
     |       encrypted_blob               |
     |     }                              |
     |                                    |
     |<--- StateUpdateReply --------------|
     |     {                              |
     |       code: ACCEPTED / REJECTED,   |
     |       last_applied                 |
     |     }                              |

Delete Session:

DeleteSession {
  session_id
}

Used to clean up resources after channel closes

Watchtower Monitoring and Response:

Monitoring Phase:

For each new block:

for each tx in block:
  locator = tx.txid[:16]
  if locator in database:
    # Possible breach!
    blob = database.get(locator)
    key = SHA256(tx.txid)
    try:
      justice_data = decrypt(blob, key)
      broadcast_justice_tx(justice_data, tx)
    except DecryptionError:
      # False positive (locator collision)
      continue

Building Justice Transaction:

Using decrypted data:

1. Identify breach commitment tx outputs
   • to_local output (delayed)
   • to_remote output
   • HTLC outputs

2. Build spending transaction
   • Sign using revocation private key
   • Set appropriate fee rate
   • Send to sweep_address

3. Broadcast Justice Transaction
   • Use highest fee rate
   • Monitor for confirmation

Privacy Design:

What Watchtower Does NOT Know:

[X] Client identity (can use Tor)
[X] Channel counterparty
[X] Channel capacity
[X] Normal transaction activity
[X] Fund amounts (until breach occurs)
[X] Blob contents (until breach occurs)

What Watchtower DOES Know:

[O] Client has Lightning channels
[O] Frequency of channel state updates
[O] Approximate number of channels (by session count)
[O] Full transaction when breach occurs

Further Privacy Enhancements:

1. Use multiple watchtowers
   Distribute trust, no single point of knowledge

2. Add fake updates
   Obscure real activity patterns

3. Delay updates
   Batch send, hide real-time activity

4. Tor connection
   Hide IP address

Reward Transaction Structure:

Justice Transaction with Reward:

Inputs:
  Breach commitment transaction outputs

Outputs:
  [0] Watchtower reward: X sats
      to: reward_address (provided by watchtower)
  [1] Client balance: remainder - fees
      to: sweep_address (provided by client)

Reward Ratio Negotiation:
  • Fixed amount
  • Percentage
  • Composite model