Discreet Log Contracts (DLCs) allow participants to create on-chain contracts with predetermined payouts based on real-world events attested to by third-party oracles.
DLCs offer several advantages over traditional multisignature escrow contracts. However, their security properties, particularly the risks posed by dishonest oracles, are sometimes overstated.
A common claim is that a DLC oracle has little incentive to act dishonestly. Unlike a multisignature escrow agent, the oracle is not directly involved in the contract and cannot redirect its funds because the payout addresses are committed in advance.
This argument overlooks the possibility of an atomic bribe. A participant who expects to lose a DLC can create a second contract that rewards the oracle for issuing a false attestation. Both the original payout and the bribe are unlocked by the same dishonest attestation, removing the need for either party to trust the other.
Suppose Alice and Bob enter into a DLC using Olivia as the oracle. Alice and Bob each contribute 1 BTC:
- If the BTC/USD price closes above $100,000 at the end of the month, Alice receives the full 2 BTC.
- If it closes below $100,000, Bob receives the full 2 BTC.
Near the end of the month, the price is well above $100,000 and Bob expects to lose. Bob therefore approaches Olivia and asks her to falsely attest that the price closed below $100,000.
Olivia would not ordinarily benefit from doing this because the contract pays directly to Bob. Bob can, however, create a second DLC with Olivia based on the same oracle event. He commits an additional 0.5 BTC that will be paid to Olivia if she attests that the price closed below $100,000.
Olivia can now earn 0.5 BTC by publishing the false attestation. The same attestation simultaneously allows Bob to claim the 2 BTC from his contract with Alice and Olivia to claim the 0.5 BTC bribe.
The result is an atomic exchange: Olivia receives the bribe if and only if her attestation enables Bob to claim the original contract. Neither party needs to trust the other. After paying the bribe, Bob retains 1.5 BTC, leaving him 0.5 BTC above his original stake, while Olivia earns 0.5 BTC for publishing the dishonest attestation. Alice, despite being the rightful winner, receives nothing and loses her entire 1 BTC stake.