Play Attacks and possible mitigations

Original txs -

A -> B, K1
B -> C, K2

And B -> C “fails” for some reason such that Charlie convinces Bob to sign a new replacement transaction with a new kernel but reusing the same original B output.

So Charlie has in their possession both -

B -> C, K2
B -> C, K2'

The one with kernel K2' was broadcast, the original one “failed” and was never broadcast.
K2 and K2' have different excess commitments with corresponding different offsets.

So now Bob is at risk of a “replay attack” if A -> B, K1 were ever replayed.

But now Alice and Charlie can work together and “(re)play” the original failed, un-broadcast transaction - B -> C, K2

Kernel uniqueness at the consensus level will not help here.

Edit: With max_height on kernels the window for this attack succeeding would be small but it could not be prevented within the window.

1 Like