An interactive deep-dive into the most dangerous denial-of-service vector on the Lightning Network — how attackers exploit HTLC slot limits, and how the community is fighting back.
The attacker floods the target channel with maximum-volume HTLC spam. By sending 483 tiny HTLCs simultaneously, all HTLC slots are exhausted instantly — even if the liquidity is barely touched. The channel becomes completely unusable for legitimate traffic.
Cost is near-zero: the attacker only needs the base fee multiplied by the number of hops for each wave. Without upfront fees, this approaches 0 sats total cost per attack cycle.
Fewer HTLCs, but each carries a maximum CLTV timeout (up to 2016 blocks ≈ 14 days). The attacker locks up large amounts of liquidity for extended periods. Even 10–50 HTLCs can render a channel economically useless by consuming its routing capacity.
The economics are devastating: holding 1 BTC of liquidity hostage for two weeks costs the attacker roughly $0 in fees (no upfront fee mechanism exists today), while the victim loses all routing revenue.
| Property | Fast Jamming | Slow Jamming |
|---|---|---|
| Resource exhausted | HTLC slots (483 limit) | Channel liquidity |
| HTLCs needed | 483 (maximum) | 10–50 sufficient |
| Duration per wave | Seconds to minutes | Up to 14 days |
| Attacker cost (no upfront fee) | ~0 sats | ~0 sats |
| Detectability | Obvious (slot exhaustion) | Hard (looks like stuck payments) |
| Main defense vector | Rate limiting, endorsement | Hold fees, reputation |
Attacker sends HTLC waves at maximum rate. Each red block is a pending HTLC held hostage. Within seconds, all 483 slots fill and Bob's channel becomes unusable. The attacker resets after timeout and repeats indefinitely.
Endorsement is a local reputation signal carried as a 1-bit flag in the update_add_htlc message. When a peer endorses an HTLC, they stake their local reputation on it. Nodes allocate the majority of their HTLC slots only to endorsed HTLCs.
Reference: Unjamming Lightning (Bastien Teinturier et al.) — BOLT #1045 draft
The core asymmetry of jamming is that failure is free. Upfront fees force the attacker to pay regardless of payment outcome — turning the attack from free into costly. There are two components:
Without hold fees: slow jamming is free. With 0.1 sat/block hold fee: 14-day attack costs 201,600 sats per HTLC — making slow jamming prohibitively expensive.
Rate limiting at the peer level can detect and throttle suspicious HTLC floods before they exhaust slot capacity. This is the most immediately actionable defense — some implementations already deploy it.
--max-pending-channels, --max-htlcs per channel flagsLimitation: sophisticated attackers can stay below rate limits while still causing significant damage by targeting multiple channels simultaneously. Rate limiting alone is not a complete solution.
Each node maintains a local reputation score for each direct peer, based on historical payment forwarding behavior. High-reputation peers get more HTLC slots; low-reputation or new peers are rate-limited.
Bootstrap Problem: New legitimate nodes have zero reputation and get limited slots — creating a catch-22. Solutions under research include staked reputation (pay-to-build) and cross-node reputation attestation (requires trust).
Reference: Routing Bitcoin: Congestion and Stability — Avarikioti et al.; Unjamming Lightning reputation model
| Attacker Strategy ↓ Defender Strategy → |
No Defense | Endorsement Only | Upfront Fee Only | Combined Defense |
|---|---|---|---|---|
| No Attack |
0
0
|
0
−c
|
0
−c
|
0
−2c
|
| Fast Jamming |
+10
−10
|
+3
−3
|
−2
−1
|
−5
0
|
| Slow Jamming |
+8
−8
|
+7
−7
|
−3
−2
|
−6
0
|
| Combined Attack |
+12
−12
|
+4
−5
|
−2
−3
|
−8
−1
|
Reading the matrix: Top number = attacker payoff (green = profitable, red = loss). Bottom number = defender payoff/loss.
NE = Nash Equilibrium cell. Payoffs are normalized utility units, not literal sats.
Key result: Without any defense, fast jamming dominates (payoff +10). With combined endorsement + upfront fees, all attack strategies become unprofitable (negative payoff) while defense cost is small (−1 to −2c). This shifts the Nash Equilibrium to "No Attack + Combined Defense."