MASTERING-BITCOIN · Interactive Practice

Cheat-Proofing a Payment Channel: The Timelock Trick

IKey Formulas

Formula	Name	Description
$H_n = H_{base} - (n-1)\cdot d$	Decrementing timelock	Maturity height of commitment $n$ with decrement $d$
$N_{max} = \dfrac{\Delta}{d}$	Max commitments	Headroom $\Delta$ blocks divided by decrement $d$ per step
$H_{refund} = H_{fund} + \Delta$	Refund ceiling	Refund matures $\Delta$ blocks after funding confirms
$T \approx \dfrac{\Delta}{144}$	Channel lifetime	$\Delta$ blocks at ~144 blocks/day gives days of lifetime

Here $H_{base}$ is the refund / commitment-1 height, $d$ is the per-commitment decrement, and $\Delta$ is the total block headroom (e.g. 4,320 blocks ≈ 30 days).

IIVisualization 1: The Decrementing Timelock Ladder

Conceptual question: Why can Emma never profitably broadcast an old commitment?

Each newer commitment carries a shorter timelock, so it matures earlier and can spend the funding output before any older commitment is even valid. Use the controls to see which commitment "wins the race."

⚙ interactive visualization — coming to this page format soon

Notice: the most recent commitment (#N, shown in green) always has the lowest maturity height, so it becomes spendable first. Once it spends the funding output, every older commitment is grayed out by the double-spend rule.

Reflect: With decrement $d = 1$ , commitment #600 matures 599 blocks before commitment #1. What happens to that gap if you increase $d$ ? What does a larger $d$ cost you in total channel headroom?

IIIVisualization 2: The Lifetime vs. Capacity Trade-off

Conceptual question: Timelocks aren't free — what do we trade away?

The total headroom $\Delta$ (in blocks) is fixed when the channel opens. It limits both how long the channel can live and how many commitments it can hold. Explore how the decrement $d$ splits these costs.

⚙ interactive visualization — coming to this page format soon

Notice: shrinking the decrement $d$ toward 1 maximizes the number of commitments — but a 1-block interval forces both parties to watch the chain constantly and broadcast the instant they need to. That is a serious operational and security burden, not a free win.

Reflect: This is exactly why decrementing timelocks were only the first crude tool. Spillman channels remove per-commitment timelocks entirely using signature asymmetry, and the road from there leads to Lightning.

IVVisualization 3: Cooperative vs. Unilateral Close

Conceptual question: Why is cooperation the natural equilibrium?

A cooperative close rebuilds the latest balance as a settlement transaction with no timelock — funds are immediate. A unilateral close broadcasts the latest commitment, which carries a timelock, so the broadcaster must wait. Adjust the remaining timelock to see who pays the cost.

⚙ interactive visualization — coming to this page format soon

Notice: refusing to cooperate forces both sides to wait out the timelock — the petty party hurts themselves just as much. Since both get paid faster by agreeing, cooperation is the equilibrium.

VQuiz Questions

Test your understanding. Select an answer to reveal feedback and a worked solution.

Question 1

A channel uses a refund/commitment-1 height of $H_{base} = 4320$ and a decrement of $d = 1$ block per commitment.

At what block height does commitment #600 become spendable?

Formula: $H_n = H_{base} - (n-1)\cdot d$

✅ Correct! $4320 - 599 = 3721$ .

❌ Not quite. Watch the off-by-one: the exponent is $(n-1) = 599$ , not 600.

❌ Not quite. Use $H_n = H_{base} - (n-1)\,d$ with $n = 600$ , $d = 1$ .

Show solution

Solution:

Apply the decrementing-timelock formula with $H_{base} = 4320$ , $d = 1$ , $n = 600$ :

$H_{600} = 4320 - (600 - 1)\cdot 1 = 4320 - 599 = 3721$

So commitment #600 matures at height 3721, which is 599 blocks before commitment #1. (A common slip is forgetting the $(n-1)$ and computing $4320 - 600 = 3720$ .)

Question 2

True or False: The pre-signed refund transaction lets Emma reclaim her money from the channel at any time she wishes, overriding the agreed balances.

✅ Correct! The refund only becomes valid after its timelock expires.

❌ Not quite. The refund is dormant until its timelock height — it cannot be used early.

Show solution

Solution:

False. The refund carries an absolute timelock (e.g. +4,320 blocks). It is dormant and invalid until that height arrives. During normal operation the channel keeps updating its agreed balances, and the refund can never override them. The refund is purely a fallback for the worst case — Fabian going silent the moment funding confirms — in which Emma waits the full ~30 days. The wait is the price of safety, not a license to steal funds back anytime.

Question 3

In the decrementing-timelock scheme, what is the enforcement mechanism that makes commitments #1 through #599 worthless once commitment #600 confirms?

✅ Correct! The latest state matures first and spends the funding output; the rest are double-spends.

❌ Not quite. There is no third party — enforcement comes purely from Bitcoin's own consensus rules.

Show solution

Solution:

Two Bitcoin consensus rules do all the work — no third party:

Timelock rule: a transaction cannot confirm before its timelock height. Because commitment #600 has the lowest maturity height, it becomes valid first.
Double-spend rule: a spent output cannot be spent twice. Once #600 spends the funding output, commitments #1–#599 reference an already-spent output and are worthless.

No arbitrator, no court, no manual cancellation — Bitcoin enforces it.

Question 4

Spillman-style channels drop per-commitment timelocks entirely by using signature asymmetry. Which statement best describes how this keeps Emma from cheating?

(Recall: for each new commitment Emma sends Fabian her signature, but Fabian never sends his back.)

✅ Correct! Signature asymmetry means only Fabian can broadcast, and he prefers the latest state.

❌ Not quite. The key is that only Fabian ever holds both signatures, removing the need for timelocks.

Show solution

Solution:

Because Emma sends her signature but Fabian never returns his, only Fabian holds both signatures for any state — so only Fabian can broadcast. He cannot be forced to broadcast an old, lower-paying state, and being rational he will broadcast the highest-paying state, which is the latest one. No decrementing ladder is needed.

One caveat: this is only safe with SegWit (2017), which fixes transaction malleability. Before SegWit, a transaction's ID could be altered after signing, breaking the chain of pre-signed transactions that Spillman depends on.

Summary

We took two attacks — lockout and cheating — and defeated both with one idea: using Bitcoin's time dimension to enforce a contract off-chain.

A pre-signed refund guarantees Emma's escape.
Decrementing timelocks guarantee the latest state wins the race.
Signature asymmetry (Spillman) removes the timelock burden for one-way payments.

This is the essence of state channels: parties update a shared balance privately, and the blockchain only ever sees the final word. The limits of crude timelocks — fixed lifetime, fixed commitment count, constant vigilance — directly motivated what came next: the Lightning Network.

Solved: 0 / 4