Limbo Exits / Operator Griefing by Block Withholding

[gakonst]

So currently there is 1 thing which is an issue in all Plasma constructions that want to work without confirmation signatures, and involves 'in-flight' transactions:

1. Alice broadcasts a transaction to Bob. That transaction is included in a block but is withheld. Alice notices the block withholding and tries to exit (submits a security deposit).
2. The operator challenges the exit by revealing proof of inclusion of the transaction at a latter block. This slashes Alice's deposit and cancels the exit
3. The transaction is now revealed and as a result Bob can accept it (note that bob can be colluding with the operator too).
4. As a result, the tx was actually confirmed, but the operator was able to 'rob' alice of her security deposit.

This can be solved by confirmation signatures, i.e. in order for a tx to be considered valid, the receiver has to sign on it and give the sig back to the sender, like a handshake. Alternatively, hash preimages can be used, which is a similar technique but requires less data (https://ethresear.ch/t/plasma-cash-plasma-with-much-less-per-user-data-checking/1298/28). This has UX issues, the receiver can withhold the sig etc. A possible solution is whats' being coined as 'limbo exits' (https://ethresear.ch/t/resolving-limbo-transactions-via-exit-priority-modification/2127) and is being further developed in https://ethresear.ch/t/more-viable-plasma/2160, for Plasma MVP. I'm looking further into that currently.

Additional info: https://ethresear.ch/t/limbo-exits-and-challenging-fraudulent-exits/2015