The Lightning Paper v0.5.9.2 says that CSV "would permit further abilities, including allowing a stop-gap solution before a more permanent solution for resolving transaction malleability. A future version of this paper will include proposed solutions."

This means that Thunder is still vulnerable to malleability attacks since it relies on CSV as a solution.

Since the Thunder readme does not mention malleability fixes as a TODO point, I guess the Thunder authors considers it fixed.

The cited Lightning draft is from January.

  • Transaction Malleability is fixed by Segregated Witness. – Murch May 30 '16 at 8:33

CSV is not a stop-gap solution. Before you can say that, you first need to define what the problem is.

CSV solves the problem that you can't use CLTV in contracts that need a spending delay where the output itself will not be broadcast for an unknown amount of time. This is a very abstract problem, but it does occur as a primitive inside more complex constructions.

However, the current Thunder implementation uses a stop-gap solution to transaction malleability, which just happens to rely on CSV.

Your Answer

