MASTERING-BITCOIN

The Onion That Hides Your Money

IKey Relationships

Relationship	Expression	Meaning
Forwarded amount	$A_{out} = A_{in} - \text{fee}$	Each intermediary keeps a fee, forwards the rest
Total routing fee	$F = \sum_{i} \text{fee}_i$	Sum of every intermediary's fee
Amount Alice sends	$A_0 = P + F$	Payment $P$ plus all hop fees
Onion packet size	$\text{real data} + \text{padding} = \text{const}$	Fixed size hides how many hops remain
Per-hop timelock	$\text{CLTV}_{i} = \text{CLTV}_{i+1} + \Delta$	Timelock grows toward the sender

IIVisualization 1: What Does Each Node Actually See?

A payment travels Alice → Bob → Carol → Diana → Eric. Because of nested onion encryption, every intermediary can only see its immediate previous hop and its immediate next hop — nothing more.

Select a node below to reveal exactly what that node learns.

⚙ interactive visualization — coming to this page format soon

Reflect: Notice that no matter which intermediary you pick, it sees only two neighbours. Carol never learns Alice is the source, and Bob never learns Eric is the destination. The blue node is "you"; orange nodes are the only ones you can identify; grey nodes are completely hidden.

IIIVisualization 2: Why the Packet Size Never Shrinks

A naive design would let the onion get smaller at every hop — an attacker could then count the layers and guess how far along the route a node sits. Sphinx prevents this: as each real layer is stripped off, fresh random padding fills the gap so the packet stays a fixed size.

Move the slider to peel layers and compare the two designs.

⚙ interactive visualization — coming to this page format soon

Notice: In the naive design the red bar shrinks at every hop — its length leaks position information. In Sphinx the green + grey bar always totals 1300 bytes. Only the final recipient discovers there is no next hop.

IVVisualization 3: How Fees Stack Up Along the Route

Each intermediary keeps a small fee for forwarding. To make sure Eric receives the full payment $P$ , Alice must send more into the first channel so there is enough left after every fee. Each upstream channel therefore carries a slightly larger amount.

Adjust the payment and the per-hop fee to see how much flows on each channel.

⚙ interactive visualization — coming to this page format soon

Reflect: The amount carried decreases by exactly one fee at each hop. The first channel carries the most because it must cover the payment plus every downstream fee. With 3 intermediaries each charging $f$ , Alice pays $P + 3f$ .

VQuiz Questions

Question 1

Alice pays Eric 100,000 sats, routed through 3 intermediaries (Bob, Carol, Diana), each charging a fee of 10 sats. Eric is the recipient and charges no fee.

How many sats must Alice send into the first channel (Alice → Bob)?

✅ Correct! Alice covers the payment plus all 3 fees: 100,000 + 30.

❌ Not quite. Remember Alice must cover the payment PLUS every intermediary's fee (3 × 10 = 30 sats).

Show solution

Solution:

Eric must receive the full payment, so $P = 100{,}000$ sats.

Three intermediaries each keep a fee of 10 sats, so the total routing fee is: $F = 3 \times 10 = 30 \text{ sats}$

Alice must fund the first channel with the payment plus all downstream fees: $A_0 = P + F = 100{,}000 + 30 = 100{,}030 \text{ sats}$

Question 2

Carol is a routing node on the path Alice → Bob → Carol → Diana → Eric.

Based on Sphinx onion routing, what does Carol learn about this payment?

✅ Correct! Each node sees only its immediate previous and next hop.

❌ Not quite. The nested onion lets Carol open only her own layer — she learns just the previous and next hop.

Show solution

Solution:

When Carol receives the onion, she decrypts only her own layer — the single layer encrypted with her public key. That layer tells her:

which neighbour the packet came from (Bob), and
which neighbour to forward the rest to (Diana).

The inner layers remain sealed; she cannot read them. She has no idea that Alice is the true sender or that Eric is the true recipient. Every intermediary sees exactly one hop back and one hop forward.

Question 3

A naive onion would shrink at each hop, letting an attacker count the remaining layers. How does Sphinx prevent the packet size from revealing how many hops remain?

✅ Correct! Fresh random padding refills the gap, keeping the size constant.

❌ Not quite. The trick is fixed-size padding: real data shrinks, but random padding grows to fill the gap.

Show solution

Solution:

Every Sphinx packet is padded to a fixed size (1300-byte payload). When a node strips its own layer, the freed space is immediately refilled with fresh random padding, so the onion leaving a node is exactly as long as the one that arrived.

$\text{real data} + \text{random padding} = \text{constant}$

As a result, every node sees the same thing: a next-hop instruction plus a fixed-length blob. Nobody can count the hops behind or ahead — only the final recipient discovers there is no next hop.

Question 4

True or False: Like Tor, the Lightning Network has exit nodes — a fixed point where payments surface into the open and can be monitored — and routine payments are recorded on the public blockchain.

✅ Correct! Lightning has no exit nodes and routine payments stay off-chain.

❌ Not quite. Lightning has no exit nodes, and routine payments update channel balances off-chain — they never touch the blockchain.

Show solution

Solution:

The statement is False on both counts:

No exit nodes. Unlike Tor, Lightning has no edge where traffic leaves for the open internet, so there is no single monitorable exit point.
No ledger footprint for routine payments. Nodes simply update their channel balances off-chain; routine transfers never touch the blockchain.

Both networks use onion routing, but Lightning's Sphinx variant leaves no public ledger footprint and offers no single point to watch.

Solved: 0 / 4