By Second Docs
Payments within the Ark protocol are processed outside of rounds (hence the name “arkoor”), which enables:
- Instant payment at any time
- Offline payment function
- No liquidity requirements
During a payment, a user works with their Ark provider to spend their existing VTXO and create a new VTXO — a “spending VTXO.”
Payment security trade-offs
Processing payments outside of a round also has its own trade-offs: before the recipient can refresh their received balance, they must trust the sender and the Ark service provider not to traditionally double-spend the same funds. Once the VTXO is refreshed, the balance becomes completely trustless, ensuring the user's unilateral exit rights .
Users choose their preferred security mode
This mechanism allows users to choose a balance between cost and security:
- Refreshing earlier can improve the security of funds, but it will also increase the operating costs of the wallet.
- Refreshing later can save costs, but will weaken the security of funds for a period of time (no matter what, users must always refresh before the VTXO expires).
This adjusted security model is only temporary. When a user refreshes their spending VTXO, they receive a refresh VTXO, regaining all trustless properties. Because all VTXOs must be refreshed before expiration, users are only exposed to the adjusted security model for a limited period of time. Second's Ark implementation of VTXO expiration is expected to be 30 days, though this is subject to change.
Users can also spend their VTXO to eliminate this security concern, and can make re-payments through the Ark protocol, lightning payments, and cooperative exit transactions.
Incentives to combat double spending.
While spending VTXOs comes with an adjusted security model, several factors deter sender-receiver collusion:
- Inevitable Exposure : Double spends are inevitably discovered when multiple recipients attempt to refresh, exit, or unilaterally exit. Wallet software can immediately detect invalid duplicate signatures and even trigger automated alerts and remediation measures. Duplicate signatures are easily publicly verifiable.
- Irreversible reputational loss : An Ark service provider that engages in double-spending will lose its reputation and no longer generate revenue, as users will quickly leave or unilaterally exit to avoid the risk.
- Requires collusion between two parties : As long as one of the parties (either the sender or the service provider) is honest, double spending cannot occur. Even if both parties are malicious, they must collude closely for double spending to succeed.
- Mutual destruction : Attempting a unilateral exit from a double-spent VTXO triggers detection in the user’s wallet software, triggering a race to the bottom for unilateral exit transactions. The resulting fee race for confirmation priority can potentially consume the entire VTXO value (in the form of miner fees).
Expected user behavior
It's difficult to predict user behavior (the Ark protocol hasn't launched yet). At Second, we expect users to simply accept all incoming payments and renew their VTXOs as they near expiration. This is especially likely to happen on reputable Ark providers.
The rationale behind this is that fewer refreshes mean lower liquidity costs , which users will want to save. Furthermore, users may only hold a small amount (rather than all) of their Bitcoin in the Ark protocol, acting as a "checking account." Furthermore, only recently received payments will form a spending VTXO—the rest of the Ark balance remains a refreshing VTXO.
However, users may also prefer more complex refresh threshold and timing strategies, such as:
- Small payments: For daily payments, users will accept this temporary newcomer mode and refresh it when it is about to expire, which means that cost savings are more important than trustlessness.
- Large payments: For large amounts, users may refresh their accounts immediately after receiving the payment, putting security before cost savings.
In either case, the wallet's refresh strategy is passive and automatic, handled by the software based on the user's settings. Users are responsible for keeping an eye on each VTXO!
Payment chain
Payments can form a chain, where one user receives a spending VTXO and then pays it to another user. This creates an " arkoor chain ," where users must trust that no sender in the chain is colluding with the Ark service provider. Longer chains incur higher unilateral exit costs and increase the trust surface, so wallet applications may need to limit chain length based on user preferences.
Payment change processing
When initiating a payment, the payer will typically also receive change in the form of a spent VTXO . This change inherits the trust properties of the original VTXO. For example, if a user spends a refreshed VTXO, the change received inherits the properties of the refreshed VTXO (which is trustless), as the sender cannot collude with themselves to double-spend the change.
(over)
