Formal Treatment of Watchtowers and FPPW: A Fair and Privacy-Preserving Bitcoin Watchtower

This article formalises watchtower and its different properties including <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">agility</i>, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">privacy</i> against both watchtower and third parties, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">fairness</i> with respect to both watchtower and its client and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">coverage</i>. We also evaluate the existing schemes regarding these properties and show they cannot achieve all properties altogether. Furthermore, we prove that there is a trade-off between the level of fairness that a watchtower provides to its clients and the coverage it can achieve. We also introduce FPPW, the first Fair and Privacy-Preserving Watchtower for Bitcoin. This new scheme provides fairness with respect to all channel participants including both channel parties and the watchtower. It means the funds of any honest channel participants are safe even assuming that the other two participants are corrupted and/or collude with each other. Furthermore, the watchtower in FPPW learns no information about the off-chain transactions and hence FPPW provides privacy against the watchtower. We also show that FPPW coverage, i.e., the total capacity of channels that an FPPW watchtower can cover, is higher than that of PISA and Cerberus and FPPW can be implemented without any update in the Bitcoin script.