HaroldShepardO1C

privacy

Telegram Encryption - The Most Backdoor-Looking Bug I’ve Ever Seen (2021)

tech

# Puzzle

On Twitter, Asanoha has posted a challenge worth 100k sats to [unscramble some letters](https://twitter.com/SimplestBTCBook/status/1768509953738788874) into a 12 word seed phrase.

It's a little unclear from the first tweet, but he has a couple hints that explain

1. the weird characters mean nothing.

2. the letters in the picture are [all the letters used in the seed phrase](https://twitter.com/asanoha_gold/status/1768554498102796644).

3. it's the BIP-39 seed word list

# Method

(I was working on this while feeding three super-hyper kids, so I may have missed some details, but I'm posting what I've done so far in case it's helpful to anyone, because I think I'm not gonna be able to work on it much more.)

1. I started by looking to see what letters were not present in the puzzle picture. They are

`b d k l r v w x z`

2. I downloaded the BIP-39 word list and removed all the words that contained the above letters. This leaves you with 366 words[^1]

[^1]: FractalEncrypt said he [got the list of words down to 547](https://twitter.com/FractalEncrypt/status/1769038820769472961) and I'm not at all sure why he got that number of words. He's a pretty smart guy, so I think I may have screwed something up in my reasoning. Nevertheless: onward!

`access
account
accuse
acoustic
act
action
again
age
agent
aim
among
amount
ancient
announce
antenna
antique
aspect
asset
assist
assume
asthma
atom
auction
august
aunt
auto
autumn
cactus
cage
camp
can
cannon
canoe
captain
case
cash
casino
cat
catch
caught
cause
caution
cement
census
champion
change
chaos
chase
chat
cheap
cheese
chef
chest
chief
choice
choose
cinnamon
coach
coast
coconut
coffee
coin
come
comic
common
connect
cost
cotton
couch
cousin
cup
cushion
custom
cute
east
echo
egg
eight
emotion
enact
engage
engine
enhance
enough
equip
escape
essence
estate
ethics
face
faint
faith
fame
famous
fan
fashion
fat
fatigue
fee
fence
fetch
fiction
fine
finish
fish
fit
fitness
foam
focus
fog
foot
fun
gain
game
gap
gas
gasp
gate
gauge
genius
genuine
ghost
giant
gift
goat
goose
gossip
guess
gun
hat
height
hen
high
hint
hip
home
hope
host
huge
human
hunt
ice
icon
image
imitate
immense
immune
impact
impose
inch
income
infant
inject
inmate
innocent
input
insane
insect
intact
into
issue
item
jeans
join
juice
jump
just
machine
magic
magnet
main
man
manage
mango
mansion
mass
match
math
mean
meat
mechanic
mention
menu
mesh
message
mimic
minimum
minute
miss
mom
moment
month
moon
mosquito
motion
mountain
mouse
much
muffin
museum
music
must
name
nation
nest
net
nice
night
noise
nominee
nose
note
nothing
notice
nut
ocean
off
office
often
omit
once
one
onion
open
opinion
oppose
option
output
pact
page
panic
pass
patch
path
patient
pause
peace
peanut
peasant
pen
pet
phone
photo
piano
picnic
piece
pig
pigeon
pipe
pitch
poem
poet
point
position
post
potato
punch
push
put
quantum
question
quit
quote
safe
same
satoshi
sauce
sausage
scan
scene
scheme
science
scout
sea
season
seat
section
segment
sense
sentence
session
setup
shaft
shift
shine
ship
shoe
shoot
shop
siege
sight
sign
since
sing
situate
smooth
snap
sniff
soap
soft
someone
song
soon
soup
south
space
spice
spin
spoon
spot
staff
stage
stamp
state
stem
step
sting
stomach
stone
stuff
success
such
suggest
suit
sun
sunset
suspect
sustain
tag
tape
taste
tattoo
teach
team
ten
tenant
tennis
tent
test
that
theme
then
thing
this
thought
time
tip
tissue
toast
toe
tomato
tone
tongue
tonight
tooth
top
topic
toss
tuition
tuna
unique
unit
upon
upset
usage
use`

3. I'm assuming because some letters are repeated in the puzzle picture, all the letters used in the seed phrase are shown in the picture, meaning the 12 word seed phrase has 46 characters. They are

`pqnieoeuoeheisfppspmecsacaosohegntigujgpeiafss`

4. Now, the goal is to take my 366-word list and check it to see if there is some twelve word combination that matches 46 characters and that repeats each character as many times as is shown in the puzzle picture. I'll post a comment if I figure out how to do this.

100k sat prize for solving bitcoin seed phrase puzzle

lightning

Bitcoin Purifier: Purify Your Node

MarvinJamesTYU

libertarian

What is a plebpoet? My Opening Remarks

EricClayton5JN

**"Do not listen to "men" with open mouth disease"**

![](https://m.stacker.news/63743)

ecash

Not Really An Orange Pill Story, But It Feels Significant

RitaStevensonNYA

> Reimplementing Bitcoin Core is generally a bad idea.

I disagree strongly. Implementation follows specification, not the other way round. Bitcoiners forgetting their principles about decentralization when it comes to Bitcoin-core is just cognitive dissonance.


These are just child-illnesses. With a few more years of lifetime the Bitcoin ecosystem will be rocksolid.

Bitmain Labels Miners That Can Mine Multiple Hashing Algorithms “Trans Miners”

CharleneDixonM4T

You should thank them. Reddit is a dumpster fire. Don't waste your time there. Here are some sats. Try hanging around here. Vote with your feet.

I would like everyone's suggestions and input for the next Satsraiser. 

So far, @grayruby suggested Open Sats at one point. 

I have been speaking to the man who runs Orphans Of Uganda. They just joined Stacker News this morning.  I am impressed with the information I've gotten so far.

Please let me know about your favorite bitcoin projects.

Suggestions For Next Satsraiser

bitcoin

# Introduction

> [Users of] the Lightning Network...trust third parties (TTPs) with the security of funds owned in the system. ... [This is because the] Lightning Network is vulnerable to hashrate majority collusion and flood and loot attacks, where the attackers can steal but not freeze the funds owed to their channel counterparties. [source](https://lightco.in/2023/12/13/lightning-validia-rollups/)

This is an interesting paragraph imo. The first sentence reminds me of this maxim: it's custodial if someone can steal it. If John's first sentence here means (and I'm not sure it does) that every lightning user trusts someone not to steal their money, then it seems to follow that every lightning wallet is actually custodial, including every lightning full node. If that is true, it means the entire lightning network is actually a custodial system, not just products like WoS, but even network infrastructure like LND and CLN. It's really all just a cleverly disguised custodial system, if I understand John's thesis here correctly (which, I probably don't -- he probably doesn't mean that).

The second two sentences I quoted appear to back up the first one. If his thesis is: "there's always someone who can steal your money on lightning" then it is wise to identify who that is, because that person is actually a disguised custodian. John identifies two ways someone can steal from your lightning channel: "hashrate majority collusion and flood and loot attacks."

# Flood and Loot

The second attack ("flood and loot attacks" aka FAL attacks, aka Forced Expiration Spam attacks, aka FES attacks) is outlined in section 9.2 of [the lightning network whitepaper](https://lightning.network/lightning-network-paper.pdf) where it is described as "[maybe] the greatest systemic risk when using the Lightning Network." A FES attack is (1) hard to pull off (2) always at massive risk of failing (3) likely to cause loss of funds *for the attacker* if it *does* fail.

To accomplish a FES attack, the attacker must first create a situation where bitcoin blocks suddenly become very congested, or he must act quickly when that situation arises through some other cause. Next he must force close his channel with you using an "old state" where he owes you less money than you're actually due.

The victim is expected to broadcast a "justice transaction" when this happens, but due to sudden network congestion, the justice transaction is not expected to pay a sufficiently high fee to get into a block. Moreover, the input to a justice transaction is a utxo from a multisig address "owned by" the attacker and the victim jointly, which prevents the victim from using RBF to unilaterally bump the fee (to use RBF on a multisig utxo, both parties have to agree on the new feerate and cosign it -- which the attacker won't do).

The FES attack isn't over yet, though. The attack will fail if the victim successfully uses CPFP or a centralized transaction accelerator to bump the fee on the justice transaction, which, if the victim succeeds, that will cost the attacker all of the money they had in the lightning channel with the would-be victim. So he must hope the victim does not do that. And even if all of that turns out to be true, the attacker *still* might fail if, before the timelock on the attacker's force closure transaction expires, fees fall to levels that allow the victim's justice transaction to get mined.

It seems extremely unlikely that all of these factors are under the attacker's control, especially the part where the victim can just use CPFP or a transaction accelerator to foil the attack. So I personally don't think the FES attack "counts" as a proof that a trusted third party can steal your money. I don't think it proves John's thesis (which I probably misunderstood, but here I am acting as if I did not).

FES attacks do not imply that lightning is custodial or that anyone can steal your money. The victim is in control of whether or not the attack succeeds. Foiling it is even something you can automate through judicious software that watches for FES attacks and uses CPFP and transaction accelerators when they happen. Moreover, since foiling such an attack actually *earns the victim some money* (you get all of your counterparty's money when you successfully broadcast a justice transaction) there is an incentive to build an auto-foiler directly into lightning wallets. I'm not sure if any has done this but I wouldn't be surprised if Acinq has.

# Miners Can Steal

John calls the other attack "hashrate majority collusion." It refers to the fact that miners can censor transactions from getting into blocks, but only if they control a "hashrate majority" i.e. 51% of mining rigs. If you can convince a group of miners to do that for you, you can steal from your lightning counterparty in the following manner: force close your channel with them using an "old state" where you owe them less money than they're actually due.

Next, expect your counterparty to broadcast a justice transaction to stop your attempted theft, but tell your group of miners not to mine that transaction. Also, if anyone *else* mines that transaction, tell your group of miners to orphan that block and mine a different block to replace it -- one without the justice transaction in it. As long as your group of miners really has 51% of the hashrate they will eventually "win the fight" (though it may take weeks to do so if they only have 51% of mining rigs), the timelock on your force closure will expire, and you will get to keep whatever money you owed your counterparty because they couldn't get their justice transaction mined in time to prevent the theft.

In my opinion, the existence of this attack does not imply that lightning is custodial or that anyone can steal your money. The attack assumes that your counterparty can collude with 51% of miners, but that does not seem plausible to me. The most plausible way to do it that I can think of is to bribe the two largest mining pools. But those pools do not "control" 51% of mining rigs. The actual mining rig owners are just "members" of various pools, and not only can they switch to a new pool at a whim, they appear to do so very responsively in reaction to things like twitter mobs yelling "censorship!" about things like (1) Antpool following OFAC guidance (2) Foundry pool *merely announcing an intention* to comply with OFAC in the future and (3) most recently, Ocean censoring inscriptions.

I don't think John actually thinks this, but suppose for a moment that he believed all the members of large mining pools are actually trusted counterparties to every lightning channel. I think that would only be true if (1) they chose to collude together with one of the members of that channel to orchestrate a "miners can steal" attack, (2) they were able to maintain a hashrate majority for the duration of the attack (3) to the point of orphaning other miners who tried to mine your justice transaction (4) and stop their mining pool members from leaving the pool due to the clear censorship happening.

I just don't think this attack is serious. There is no evidence of that scale of collusion, and I don't even think it's *possible* without some sort of collusion *tool,* evidence of whose existence is lacking, unless I'm in the dark about it.

# Conclusion

Both of the attacks John identifies are not serious in my opinion. They do not support the thesis (which I probably misunderstood, and which he probably does not claim to make) that all lightning users actually trust a third party not to steal their money, which, if it was true (I don't think it is), would imply that the lightning network is actually a giant custodial system. I hope this essay helps clarify why I think John is wrong (or rather, why I probably misunderstood him -- again, I don't think he really believes the thing I am arguing against).