Can we allow Bob to claim the XMR by leaking the secret as part of Alice punishing?

[thomaseizinger]

As per title, I am wondering if the incentive structure can be made such that Alice leaks the requires secret to claim Monero if she punishes Bob?

[thomaseizinger]

I guess the main reason why this doesn't work is because it opens up a race condition.

At the time when Alice can punish, Bob can still refund. Hence, if punish would leak the XMR secret, Bob could race Alice by claiming the XMR and simultaneously refund BTC, ending up claiming both.

[luckysori]

You might be able to do it with two transactions:

• One that spends from the lock output to a new joint output, only publishable after the original punish_timelock.
• Another one which spends the new output to Alice's address on the condition that she uses a signature which would leak s_A to Bob.

But it's more expensive to punish than before.

[rishflab]

But it's more expensive to punish than before.
Don't think it is worth it in that case. I think it should be expensive for bob to troll alice, otherwise ASB providers could attack competitors by triggering the punish path causing locked up funds and 2x fees to punish.

[MONT3M]

Apologies for my ignorance, but I am just spitballing here:

Would it be possible for the locked XMR's multi-sig keys to be made available to Bob via the CLI, after a set number of blocks, similar to the punish_timelock, starting once Alice has punished? Thus negating the "race condition" between Bob and Alice to claim the funds.
Thus allowing Alice ample time to claim control of the BTC funds after punishing, and still giving Bob the ability to claim XMR after being punished?

[thomaseizinger]

We could do that, that is essentially what #693 is suggesting. I would have probably implemented it as an explicit command with no automation around it because it should be very seldomly used in practice.