Quote from: darosior on August 24, 2020, 01:38:37 PM

I don't think so, but i do think that it is an interesting thought because it comes to the blurry limits of what defines a Bitcoin payment.

Definitively. I have also had some thoughts about that. I think it depends mostly on the kind of payment which was made.

The use case I originally had in mind, as I wrote above, is an exchange or web wallet which would allow its users to "withdraw coins to a Lightning channel" with an onchain payment. Of course, if the exchange itself is connected to LN, and the channel of the user who wants this kind of payment is bidirectional, a direct LN payment is a better alternative. But there are cases where an on-chain payment could be preferrable:

- if the user wants to increase his LN capacity
- if he has only an unidirectional channel
- if the service provider (exchange, wallet etc.) isn't connected to LN, for example for regulatory reasons (I read this argument somewhen, but I dunno if it really realistic)

In these cases, for the service provider it doesn't matter to which address he pays, as long as the transaction is under control of the customer. The service provider simply "hands out control" of the used UTXOs to the customer and deducts the amount of them from the user's balance.

So in this case, if I interpret the SIGHASH variants right (according to the above linked article), I could imagine a combination of SIGHASH_ANYONECANPAY with SIGHASH_NONE (if a whole UTXO under control of the service provider is used, the service provider simply "hands it out" to the customer and deducts the amount from his balance once the tx is confirmed - no matter to what address) or SIGHASH_SINGLE (if a part of the coins has to be transferred to a change address of the service provider) could be used for this kind of withdrawals.

What I still not understand is which malleability attack could be arise from that combination. I interpret if the service provider agreed to SIGHASH_ANYONECANPAY and SIGHASH_NONE, then the custome would have complete control over the TXID. He could prepare the funding transaction, exchange commitment transactions with the "channel partner" and then broadcast it. Or am I understanding something wrong?