{"id":"514a7c34-b1ee-4c8a-b4f6-53898f35639e","arxiv_id":"2606.12887","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"LNTest is the first reusable testbed for LN-based botnets, revealing that autonomous formation produces clustered chains with bridge nodes, command propagation scales linearly with size, and topology determines takedown resilience.","lead":"LNTest is a Docker-based testbed using Core Lightning nodes on a Bitcoin regtest chain to run controlled experiments on Lightning Network botnets with different overlay topologies. A smart generalist might read it to understand how cryptocurrency payment networks could be misused for covert botnet command channels and what experimental tools can reveal about their real-world behavior and defenses.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Regtest containerized testbed omits LN dynamics (churn, latency, fees, adversarial nodes) that could alter observed topology, scaling, and fragility.","rationale":"The reader's weakest_assumption correctly isolates the single assumption whose violation would invalidate transfer of the three empirical findings to the real Lightning Network. No deeper internal inconsistency is visible from the abstract; the load-bearing risk is external validity of the controlled environment.","tokens_in":1852,"tokens_out":352,"duration_ms":11609,"concrete_test":"Re-run the autonomous-formation experiment (Section on D-LNBot protocol) on a 50-node subset using the public testnet with injected 5-10% hourly churn and realistic fee schedules; compare the resulting bridge-node fraction and connected-component sizes against the regtest baseline. A >30% shift in either metric indicates the testbed topology is not representative.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The three headline findings (autonomous formation yields bridge-linked cliques rather than uniform chains; propagation is Θ(n) not O(m log n); topology dictates takedown resilience) are measured exclusively inside LNTest's Dockerized Core Lightning nodes on a shared regtest chain. This environment enforces static connectivity, zero churn, uniform low latency, and no external fee or routing competition. The autonomous peer-discovery protocol's clustering behavior, the linear scaling result, and the differential fragility of chain vs. scale-free vs. clustered graphs are therefore conditional on these idealizations. If real LN conditions (node churn, variable channel fees, geographic latency, or competing traffic) change the effective neighbor set or message delivery paths, the reported structures and scaling exponents need not hold.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper presents LNTest, the first reusable testbed for LN-based botnets, implemented with containerized Core Lightning nodes on a shared Bitcoin Core regtest chain and supporting deterministic chain, autonomous peer-discovery, and user-supplied graph topologies. Using the testbed, the authors report three empirical findings: D-LNBot's autonomous formation produces clustered chains linked by bridge nodes rather than uniform chains; command propagation scales linearly as Θ(n) independent of neighbor count, contradicting prior O(m log n) claims; and overlay topology governs takedown resilience, with the autonomous clustered topology being fragile under both targeted and random removals. The testbed and a reproduction script are released as open source.","tokens_in":2019,"tokens_out":544,"duration_ms":20809,"significance":"If the reported measurements hold under the testbed conditions, the work supplies the first controlled empirical data on LN botnet topology formation and resilience, directly challenging simulation-derived claims on propagation complexity. The open-source release with a script that reproduces all experiments is a clear strength, enabling future reproducible research on defenses.","major_comments":[{"comment":"Testbed setup (Section 3): The regtest containerized environment enforces static connectivity, zero churn, uniform low latency, and no fee/routing competition. This idealization is load-bearing for the first finding (bridge-linked cliques in autonomous mode) and the third finding (differential fragility), because real LN node churn, variable channel fees, and geographic latency could alter effective neighbor sets and message paths, potentially changing the observed clustering and scaling exponents.","section":"Section 3"},{"comment":"Propagation results (Section 5): The claim that command propagation scales as Θ(n) rather than O(m log n) and 'gains nothing from higher neighbor connectivity' rests on measurements whose statistical details (number of trials, variance, data exclusion rules) are not reported. Without these, it is not possible to determine whether the linear scaling is robust or an artifact of the idealized testbed conditions.","section":"Section 5"}],"minor_comments":[{"comment":"In the abstract, the notation O(m log n) is used without defining m (presumably the number of neighbors per node); this should be clarified on first use.","section":"Abstract"},{"comment":"Figure captions and axis labels for the scaling and fragmentation plots should explicitly state the number of independent runs and any error bars or confidence intervals.","section":null}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback and for recognizing the significance of LNTest. Below we respond point-by-point to the major comments.","responses":[{"response":"We agree that the testbed deliberately uses idealized conditions (static connectivity, zero churn, uniform latency) to enable controlled, reproducible experiments that isolate topology effects. This is a standard approach for establishing baseline empirical results. We will add a dedicated limitations paragraph in Section 3 explicitly discussing how real-world factors such as churn, variable fees, and latency could affect clustering and resilience, and we will note that LNTest is designed to be extensible for incorporating such dynamics in follow-on studies.","revision_made":"partial","referee_comment":"[Section 3] Testbed setup (Section 3): The regtest containerized environment enforces static connectivity, zero churn, uniform low latency, and no fee/routing competition. This idealization is load-bearing for the first finding (bridge-linked cliques in autonomous mode) and the third finding (differential fragility), because real LN node churn, variable channel fees, and geographic latency could alter effective neighbor sets and message paths, potentially changing the observed clustering and scaling exponents."},{"response":"We acknowledge that the statistical details of the propagation experiments were insufficiently reported. In the revised manuscript we will specify the number of independent trials per configuration, report means accompanied by standard deviations or error bars, and clarify any data exclusion or aggregation rules. These additions will allow readers to evaluate the robustness of the observed linear scaling.","revision_made":"yes","referee_comment":"[Section 5] Propagation results (Section 5): The claim that command propagation scales as Θ(n) rather than O(m log n) and 'gains nothing from higher neighbor connectivity' rests on measurements whose statistical details (number of trials, variance, data exclusion rules) are not reported. Without these, it is not possible to determine whether the linear scaling is robust or an artifact of the idealized testbed conditions."}],"tokens_in":1510,"tokens_out":437,"duration_ms":18388,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main takeaway is that this paper delivers a working, open-source testbed built on containerized Core Lightning nodes over regtest, plus three direct measurements from it: the autonomous protocol forms clustered chains linked by bridges rather than uniform chains, command propagation scales as Θ(n) with no gain from extra neighbors, and takedown success depends on the overlay type.\n\nThe testbed itself and the reproduction script are the clearest advance. Prior work stayed in simulation; here you can actually spin up the nodes, run the formation protocol, and measure propagation and fragmentation on real LN software. Releasing the code with a script that reproduces the experiments is the right move and makes the linear scaling result checkable.\n\nThe soft spot is the environment. All runs use fixed connectivity, zero churn, uniform low latency, and no fee or routing competition. The bridge-node fragility and the exact scaling exponent are therefore tied to those conditions. Real LN traffic, node turnover, or variable channel costs could alter neighbor sets and delivery paths enough to change the observed structures and resilience numbers. The paper states it is a controlled testbed, so this is not hidden, but it does limit how far the topology findings travel.\n\nThis is for people working on LN security or botnet C&C who want a platform to test ideas on actual nodes instead of models. A reader in that niche gets runnable code and concrete baselines. It deserves peer review because the testbed is new, the code is public, and the empirical correction to the complexity claim is straightforward even if generalization needs more work.","headline":"LNTest ships the first open testbed for running actual LN nodes in botnet experiments and corrects the prior O(m log n) propagation claim to linear, but all results sit inside a static regtest Docker cluster.","tokens_in":2551,"tokens_out":404,"would_cite":false,"duration_ms":14222,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"LNTest shows Lightning botnets form clustered chains with bridge nodes and spread commands linearly with size.","keywords":["lightning network","botnet","command and control","testbed","network topology","bitcoin","regtest","takdown"],"falsifier":"Running the same autonomous formation protocol on the live Lightning Network and observing either a uniform non-clustered chain or command propagation times that scale better than linearly would falsify the reported findings.","tokens_in":2756,"feed_emoji":"⚡","tokens_out":685,"duration_ms":21411,"temperature":0.7,"pith_summary":"The paper introduces LNTest, the first reusable testbed for Lightning Network botnets, built from containerized Core Lightning nodes on a shared regtest chain. It supports experiments with deterministic chains, autonomous peer discovery, and custom graphs to move beyond prior simulations. The testbed reveals that autonomous formation creates cliques connected by bridge nodes instead of the designed uniform chain. Command propagation scales linearly with botnet size and gains nothing from extra neighbors. Different topologies respond differently to node removals, with the clustered chain proving fragile under both targeted and random attacks.","feed_headline":"Lightning botnet commands spread linearly with size","feed_subtitle":"Testbed shows autonomous formation creates bridge-linked clusters rather than uniform chains, with topology shaping defense options.","key_machinery":"LNTest, a testbed of Docker-containerized Core Lightning nodes sharing a Bitcoin Core regtest chain that supports deterministic, autonomous, and user-supplied overlay topologies for botnet experiments.","core_discovery":"Using LNTest, we report three main findings. First, D-LNBot's autonomous formation protocol does not produce the uniform chain from its design; instead, it creates a clustered chain in which cliques are linked by bridge nodes whose removal fragments the network. Second, command propagation scales linearly with botnet size (Θ(n)), not the O(m log n) previously claimed. Third, the overlay topology determines the effectiveness of takedown strategies: uniform-degree chains resist targeted removal but fragment under random failure, scale-free topologies show the opposite pattern, and the autonomous clustered chain is fragile under both.","pith_inferences":["Monitoring for high-betweenness nodes in the Lightning Network could help identify potential botnet structures.","The open release of LNTest allows independent teams to test new defense mechanisms against LN-based command channels.","Adding real fee market dynamics and node churn to the testbed would test whether the linear scaling holds under more variable conditions."],"forward_implications":["Bridge nodes in the clustered chain can be removed to fragment the botnet.","Higher neighbor counts per bot do not shorten command propagation time.","Uniform chains resist targeted node removal but are vulnerable to random failures.","Scale-free topologies are resilient to random failures but weak against targeted removal.","The autonomous clustered chain is the most vulnerable to both targeted and random takedowns."],"fun_headline_variants":["LNTest shows botnet commands spread linearly with size","Autonomous LN botnets form bridge-linked cliques not chains","LN botnet takedown success depends on overlay topology","Command propagation scales linearly not O m log n in LN","LNTest finds clustered chains fragile to random and targeted failure"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The experiments rely on a controlled regtest environment with containerized nodes that may not capture real-world Lightning Network dynamics such as node churn, actual fee markets, network latency variation, or adversarial node behavior.","fun_headline_variants_meta":{"raw":{"variants":["LNTest shows botnet commands spread linearly with size","Autonomous LN botnets form bridge-linked cliques not chains","LN botnet takedown success depends on overlay topology","Command propagation scales linearly not O m log n in LN","LNTest finds clustered chains fragile to random and targeted failure"]},"model":"grok-4.3","cost_usd":0.004072,"raw_usage":{"total_tokens":2122,"prompt_tokens":771,"num_sources_used":0,"completion_tokens":79,"cost_in_usd_ticks":40724500,"prompt_tokens_details":{"text_tokens":771,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1272,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":771,"tokens_out":79,"duration_ms":8090,"temperature":1.0,"reasoning_tokens":1272,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-27T06:41:32.455492+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Running the same autonomous formation protocol on the live Lightning Network and observing either a uniform non-clustered chain or command propagation times that scale better than linearly would falsify the reported findings.","supporting_citations":[],"review_version":1}