Federated Sidechains: $8M in BTC Stuck in Limbo, Analyst Says Action ‘Violates Liquid’s Security Model’

Liquid, the sidechain network developed by the company Blockstream, saw 870 bitcoins ($8 million) frozen in moderation queue due to a seizure from a number of the network’s functionaries. The founder of the Summa project, James Prestwich, explained on Twitter that the emergency 2-of-3 controlled 870 bitcoin “violates Liquid’s security model.”

During the last year, the crypto firm Blockstream has been promoting its Liquid sidechain as “trustless,” even though many cryptocurrency proponents have criticized the federation of exchanges who call the network’s shots. For instance, the infamous Cobra, owner of bitcoin.org tweeted back in February: “Blockstream is busy pumping “trustless” centralized Liquid because ‘Lightning doesn’t scale;’ who even takes these ‘influencers’ seriously anymore?”

“Liquid is a sidechain, it’s just not a trustless (or, more precisely, trust-minimized) sidechain,” another critic tweeted in January. Taking it further, a number of individuals have said that Liquid is no different than the likes of Paypal or Ripple. The original ‘Sidechains’ paper sold the idea of a ‘trustless 2-way peg,’” software developer Rhett Creighton explained.

“The [Liquid] paper was used to raise $21M for Blockstream never delivered on the ‘trustless 2-way peg’ (maybe it’s impossible). So we get Liquid which is based on a federated model, which is basically Paypal,” the developer added.

Liquid’s so-called trustless model was exposed in real-time just recently, according to a tweet published by the Summa project cofounder James Prestwich.

“Looks like the liquid emergency 2-of-3 operators can steal 870 Bitcoin because this TXO has aged 2015 blocks?” Prestwich asked the Twitter account @notgrubles, and associate that works with Blockstream. “For just under an hour, the emergency 2-of-3 controlled 870 Bitcoin. This violates liquid’s security model [and] we know about this because Liquid holds bitcoin.”

Prestwich also exposed that the Liquid Federation is a closed business model. Prestwich stated:

We don’t know what caused it because liquid federation behavior is trusted and closed.

Prestwich further explained that when he pinged a Blockstream employee, they didn’t even verify his findings before arguing with him first.

“I felt comfortable disclosing publicly because no one but the trusted operators could exploit the issue, and the issue would not interfere with normal operation. When pinged, a Blockstream employee didn’t bother to check before mistakenly trying to correct me. It’s very hard to operate systems with mandatory rotation. This problem is conceptually similar to forgetting to mail your rent. OP_CTV aims to address rotation requirements directly, and would be a great addition to Liquid’s Federation script,” Prestwich wrote.

The CEO of Blockstream did defend Liquid in Prestwich’s Twitter thread, and blamed fixing the issue on Covid-19. “This is a known issue,” Back tweeted. “The coins are auto-swept forward as part of the HSM peg process. funds are safe as keys are offline and geo-distributed. we were planning to address via HSM upgrade, which is a manual hands-on process for security, but [Covid-19] lock-downs made that difficult.”

The discussion about Liquid’s trust model continues to rage on Twitter, ever since Prestwich disclosed the security vulnerability. Prestwich is also collaborating on a synthetic bitcoin project called tBTC, a project invoked by software developer Matt Luongo.

The project Prestwich is involved in that leverages tBTC and it is called “Keep.” “A keep is an off-chain container for private data. Keeps help contracts harness the full power of the public blockchain — enabling deep interactivity with private data,” explains the website keep.network.

Prestwich also detailed that no one knows if the Liquid BTC (LBTC) seizure has happened before. It’s likely, however, many crypto advocates will be watching for vulnerabilities in the Liquid network, especially with 2,160 BTC or $19.7M sitting in Blockstream’s Liquid TVL (total value locked).

Nevertheless and despite the haters and ongoing trust model debates, Ethereum is BTC’s default sidechain by order of TVL and value moved.

What do you think about the 870 bitcoins ($8 million) frozen in Liquid’s moderation queue? Let us know what you think about this subject in the comments below.

The post Federated Sidechains: $8M in BTC Stuck in Limbo, Analyst Says Action ‘Violates Liquid’s Security Model’ appeared first on Bitcoin News.

via Jamie Redman