Scaling the transaction throughput on blockchain systems, such as Bitcoin  and Ethereum , is a fundamental problem and an active research direction . Many solutions have been proposed, in particular sharding [8, 10], sidechains  and channels [5, 13, 2, 9]. Channels seem to be the most promising solution since they allow transactions to occur securely off-chain, and use the blockchain only for resolving disputes.
We study the problem from the viewpoint of a Payment Service Provider (PSP). The PSP wants to establish an alternative payment network for customers to execute transactions. We assume a PSP can open a channel between two parties without acting as an intermediate node; this can be done using three-party channels. The two parties and the PSP join a three-party channel funded only by the PSP who then loans money to the other parties. We assume that the PSP will eventually get his money back in fiat currency as he provides a service similar to credit cards (the risk lies to the PSP). Furthermore, the PSP signs each new state if and only if the fees have the correct value. This way he enforces the fee assignment on the channels.
Initially, a PSP will compete with the blockchain: customers only prefer the alternative network if the total fees cost less than the blockchain. We introduce the network design problem for the PSP, whose goal is to decide the graph structure and the fee assignments in order to maximize its profit.
Our contributions are as follows. First, we provide a linear program formulation for the problem on trees when the PSP wants to facilitate all transactions, proving that this problem variation is in the complexity class P. Then, we show that the optimal fee assignment for any path has only 0/1 values on the fees, assuming is the cost of posting a transaction on the blockchain, and we present an efficient dynamic programming algorithm to compute the optimal fees. In addition, we prove that the star network is a near-optimal solution of the general network design problem, when we allow an additional node to be added as a payment hub and assume the optimal network is connected. This implies that a PSP can achieve almost maximum profit by creating a payment hub, the construction of which has already been studied in [6, 7].
2 Preliminaries and Notation
In this section, we define the Channels Network Design with Fees (CNDF)
problem. We assume the PSP can renew the channels and change the network structure in specific epochs to avoid timing attacks; hence, we only consider a limited set of transactions corresponding to an epoch. Now, given a set of transactions between a fixed number of participants, we wish to create a payment network and assign fees to its channels to maximize the profit for the PSP. To formally define the problem, we introduce the following notation.
We define a channel network as a graph with a set of vertices and a set of edges . Each node denotes one of participants wishing to use our network, hence . An edge between two nodes and represents an open channel , with . Thus, the set of edges represents the open channels of our network. For simplicity, we assume that all edges of the graph are undirected, as we assume the capacity of every channel to be infinite, in other words, the PSP has deep pockets and is able to fund channels with a significant amount of capital. Further, we define the cost of each edge in the network to be 1. This represents the cost of opening a channel by submitting a funding transaction to the blockchain as described in [5, 13].
Given a sequence of transactions for participants, we can define a transaction matrix . An entry denotes the number of transactions from to and back. Note that matrix is symmetric since the transactions’ direction do not matter. If there are no transactions for a pair of nodes, then the corresponding matrix entry is . Transactions where sender and receiver are identical are meaningless, thus the diagonal entries of the matrix are .
For each edge we can assign a fee . We require every fee to be non-negative. Moreover, we require the fees to be at most , which is the cost of any transaction on the blockchain. Allowing the fee on an edge to be more than is equivalent to deleting this edge from the network, since the customers will always prefer to use the blockchain where the transaction fee is . We denote by a fee assignment for the set of edges .
To measure the value of a network we introduce a profit function. The profit of a payment network depends on the structure of the underlying graph, the fee assignments and the transactions carried out between participants in the network. Given a transaction matrix , we define the profit of a graph as follows:
where denotes the set of edges of the shortest path (cheapest sum of fees on edges) from sender to receiver in the graph .
We include a pair of nodes in the profit calculation only if this sum of fees on the shortest path is at most . Finally, we subtract from the profit the number of edges , since each transaction that opens a channel costs in the blockchain.
Now, we formally define the problem as follows.
(CNDF) Given a transaction matrix , return a graph with , and fee assignments on edges , such that the profit function is maximized.
In the following two sections we study a relaxed version of the problem, where the network structure is given. Our goal is to calculate the optimal fee assignments. Specifically, in section 3 we examine trees; trees are very natural as they connect a set of nodes with a minimal number of edges, and opening each edge costs a blockchain transaction. In addition we want all customers to prefer the PSP network, thus all paths in a given tree must cost less than .
3 A Linear Program for Trees
In this section, we find a solution to CNDF restricted to trees. We assume that every transaction makes sense in the tree, i.e., the sum of the fees on the path of every transaction is at most . Therefore, by the model stated above, every user of the payment network will always use the network, and no transaction goes directly on the blockchain. It turns out this problem can be solved efficiently, as stated by the following result.
Given any tree and any transaction matrix, there exists a polynomial time algorithm to optimize the profit if every transaction can connect using the payment network.
To solve this variation of the problem, we can use linear programming to find the optimal profit along with an optimal assignment of fees. In order to do so for some given tree and a given transaction matrix , we need to first determine the objective function that we want to maximize. Moreover, we need to specify suitable inequality constraints.
We compute the objective function by analyzing how many times each transaction uses each edge in the network. This gives us an objective function
The argument of the objective function, a vectorwith components represents the fees of the edges that we wish to maximize, and denotes the number of times the edge is used by transactions. Then, to determine the inequality constraints which are imposed by the constraint that each transaction must have a total fee of at most , we define one inequality for every transaction :
where if edge was used for transaction , and 0 otherwise. Solving this linear program (in polynomial time) finds the optimal vector of fees. ∎
In the following section, we remove the additional assumption that all the transactions should be facilitated by the PSP’s network. The problem, now, is more complicated since the selection of transactions cannot be expressed as a linear program (but only as an ILP). Thus, we study the problem in more restricted graph structure: paths.
4 Dynamic Program for Paths
In this section we present Algorithm 1, a polynomial-time dynamic program that achieves optimal profit in chain networks. We prove that the optimal solution has only fees that are either or .
First we compute tensor , where is the profit from all transactions in the interval when the fee of edge is and every other fee is . Then, we compute matrix , the maximum entry of which is the optimal profit. denotes the maximum profit when setting the fee of the edge with index to (it is possible that more edges have a fee of before that, but is the last edge where this is the case) and only using the edges up to . denotes the profit from edges in the interval while the -th edge’s fee is . For some fixed we iterate over all possible profits of the preceding part of the graph, add it to the profit of the corresponding current interval and only consider the maximal profit (if larger that setting the -th edge’s fee to 1).
To retrieve a fee assignment that has optimal profit, we can do the following: We define an additional matrix , where the entries of each row are initialized with the number of the row. Now, every time we update an entry , we set . These denote the edges that are assigned a fee of 1 to attain the calculated profit. When the algorithm has ended, we read the entry , where are the indices of the maximum value in , and set the fee of the edge contained in to 1 in the optimal fee assignment.
Correctness and Runtime.
We prove the correctness of Algorithm 1 and analyze its time complexity. In Algorithm 1, an edge is either assigned a fee of or . The following lemma states that these are indeed the only two values we need to consider.
For every given path and for every set of transactions, the optimal profit can always be achieved by assigning edges a fee or .
Assume that we are given some optimal fee assignment on the path of length , and but this assignment may use other values, not only or . We show that only using and one also can reach the same (or even more) profit.
Based on the given fee assignment , we compute the set of all maximal intervals (i.e., there does not exist a pair of intervals and such that and ) where the sum of the fees on the edges in that interval is less or equal to . That is, an interval is in if and only if it satisfies that and (or ) and (or ). The optimal profit can be obtained by solving a linear program. It is well known that every linear program reaches its optimal at the vertex of the feasible region. Hence, we only need to show that every entry of every vertex of the feasible region defined above is either or . Equivalently, we show that every feasible solution is a convex combination of vectors with only and .
We prove this by induction on the length of the path. For the base case, when the length is , i.e., a single edge, it is trivial. Now assume that this result holds for paths of length smaller than , and we prove that it also holds for length equals to . The key observation is that, for any path, there always exists an assignment with only and such that for every , as follows:
Let for all .
For from to , consider all intervals in such that . If all such intervals satisfy , then let .
We define and let . Now we write as a convex combination Since for every , it follows that for every . By the definition of we know that there exists at least one index such that (). According to these two facts, can be considered as a feasible solution for the path of length , which by the induction hypothesis is also a convex combination of vectors with only and . The lemma is proved. ∎
The above lemma is useful in pruning search space, but it is still exponential () if we do a brute force search. Our dynamic programming method makes the search space polynomial in , which is shown in the following theorem.
Algorithm 1 returns the optimal solution and the time complexity of the algorithm is .
Let denote the profit of the sub-path from edge 1 up to and including edge where we set the fee of edge () to 1. We claim that fulfills the following recurrence:
If is equal to (Case 1), this means that we reach the maximum profit in the subgraph from edge to by only setting the fee of edge to in the entire subgraph. Consequently, every transaction, that only uses edges from this subgraph, can generate profit.
Otherwise, if happens to be (Case 2), we know that there are at least two edges with a fee of in the subgraph from edge to , namely on edge and on edge . Therefore, profit is generated by transactions in the first part of the subgraph, i.e. from edge 1 to , and at the same time in the second part, that is from to . However, no transactions, which use edges in both parts of the subgraph, can generate profit, as such a transaction would then cross both edges with a fee of 1.
Because of this, we can iterate over every possible sum of the profits of and and choose the maximum thereof. Note, that we do not necessarily choose the maximum for both terms, but instead pick the maximal sum or otherwise we might only obtain a locally optimal solution. This method can be used, since we were able to split the subgraph from 1 to in two parts as explained above. Moreover, we have already precomputed both terms: was computed at the very beginning of the algorithm and is always an entry of the table that was the result of a prior computation with exactly the same recurrence.
The tensor can be computed in time . The computation of the table can be accomplished in time , since we have loops that iterate over parts of the edge indices. Therefore, the complete algorithm can be implemented with runtime . ∎
5 Payment Hub: a Near-Optimal Solution
In this section, we present a near-optimal solution to the CNDF problem. Please note that the optimal solution is not always a tree. For example, if we consider three nodes with many transactions between every pair, the optimal payment network is the triangle with a fee of on each edge. A tree will connect the three nodes with a two-edge path, hence none of the trees achieve maximum profit. We show that if the optimal network is connected, then the star graph, where the center is an additional node acting as a payment hub, is a near optimal solution.
We denote the profit, the graph and the fee assignment of the optimal solution for a given transaction matrix . Moreover, we denote the star graph that includes all nodes and an additional one, , as the center of the star. We assign uniform fees to all the edges, .
If is connected, then .
If is one connected component, then . For the star graph , we have and . Furthermore, the sum of fees on all shortest path is equal to due to the uniform fees equal to and the star structure. The profit function maximizes its value when all transactions go through the graph with total fee equal to , hence
The last equality holds since the sum on every shortest path equals to . ∎
Discussion on network connectivity. In a monetary system we expect some nodes to be highly connected, representing big companies that transact with many nodes on the network. These highly connected nodes assist in connecting the entire network in one big connected component, as we initially assumed.
6 Related Work
The Lightning Network  for Bitcoin  and the Raiden Network  for Ethereum  are the most prominent implemented decentralized path-based transaction networks for payment channels, even though similar proposals existed earlier .
Recent work has mainly focused on designing routing algorithms for these networks. The goal of these algorithms is to efficiently find a route in the network that has enough capital to facilitate the current transaction. Prihodko et al. introduced Flare , a routing algorithm for the Lightning network. Flare can quickly discover routes but nodes need to collect information on the Lightning network topology. The IOU credit network SilentWhispers  utitizes landmark routing to discover multiple paths and then performs multiparty computation to decide how many funds to send along each path. A more recent work by Roos et al.  introduces SpeedyMurmurs, which uses embedding-based path discovery to find routes from sender to receiver. In all these algorithms, the task is to find a route to facilitate a customer’s transaction through the payment network. Routing very much is orthogonal to our goal of finding the right fees.
Heilman et al.  propose a Bitcoin-compatible construction of a payment hub for fast and anonymous off-chain transactions through an untrusted intermediary. Green et al. present Bolt  (Blind Off-chain Lightweight Transactions) for constructing privacy-preserving unlinkable and fast payment channels. Both protocols focus on constructing anonymous and private systems that can act as payment hubs. We show that constructing a payment hub is a near optimal strategy with respect to a PSP’s profit.
To the best of our knowledge, we are the first to introduce a framework for network design with fees on payment channels. We present algorithms that calculate the optimal fee assignments given a path or a tree as a graph structure. Furthermore, we prove the star is a near-optimal solution when we allow adding an extra node to act as an intermediary for the customers. This implies that the construction of payment hubs is an almost optimal strategy for a PSP.
-  Ethereum white paper https://github.com/ethereum/wiki/wiki/White-Paper
-  Raiden network (2017), http://raiden.network/
-  Back, A., Corallo, M., Dashjr, L., Friedenbach, M., Maxwell, G., Miller, A., Poelstra, A., Timón, J., Wuille, P.: Enabling blockchain innovations with pegged sidechains (2014), https://www.blockstream.com/sidechains.pdf
-  Croman, K., Decker, C., Eyal, I., Gencer, A.E., Juels, A., Kosba, A., Miller, A., Saxena, P., Shi, E., Gün Sirer, E., Song, D., Wattenhofer, R.: On scaling decentralized blockchains. In: Financial Cryptography and Data Security. pp. 106–125. Springer Berlin Heidelberg (2016)
-  Decker, C., Wattenhofer, R.: A fast and scalable payment network with bitcoin duplex micropayment channels. In: Pelc, A., Schwarzmann, A.A. (eds.) Stabilization, Safety, and Security of Distributed Systems. pp. 3–18. Springer International Publishing, Cham (2015)
-  Green, M., Miers, I.: Bolt: Anonymous payment channels for decentralized currencies. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. pp. 473–489. CCS ’17 (2017)
-  Heilman, E., Alshenibr, L., Baldimtsi, F., Scafuro, A., Goldberg, S.: Tumblebit: An untrusted bitcoin-compatible anonymous payment hub. In: Network and Distributed Systems Security Symposium 2017 (NDSS), February 2017
-  Kokoris-Kogias, E., Jovanovic, P., Gasser, L., Gailly, N., Syta, E., Ford, B.: Omniledger: A secure, scale-out, decentralized ledger via sharding (2017)
-  Lind, J., Eyal, I., Pietzuch, P., Sirer, E.G.: Teechan: Payment channels using trusted execution environments. arXiv preprint arXiv:1612.07766 (2016)
-  Luu, L., Narayanan, V., Zheng, C., Baweja, K., Gilbert, S., Saxena, P.: A secure sharding protocol for open blockchains. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. pp. 17–30. ACM (2016)
-  Malavolta, G., Moreno-Sanchez, P., Kate, A., Maffei, M.: Silentwhispers: Enforcing security and privacy in decentralized credit networks. In: Network and Distributed Systems Security Symposium 2017 (NDSS)
-  Nakamoto, S.: Bitcoin: A peer-to-peer electronic cash system (2008)
-  Poon, J., Dryja, T.: The bitcoin lightning network: Scalable off-chain instant payments (2015), https://lightning.network
-  Prihodko, P., Zhigulin, S., Sahno, M., Ostrovskiy, A., Osuntokun, O.: Flare: An approach to routing in lightning network (2016), https://bitfury.com/content/downloads/whitepaper_flare_an_approach_to_routing_in_lightning_network_7_7_2016.pdf
-  Roos, S., Moreno-Sanchez, P., Kate, A., Goldberg, I.: Settling payments fast and private: Efficient decentralized routing for path-based transactions. In: Network and Distributed Systems Security Symposium 2018 (NDSS)