Builds on Jeremy Rubin · CSFS rekey ladder

Rekey ladder theory

An implementation of Jeremy Rubin and Rearden's CSFS rekey ladder, attacked in four stages to find where joint state binding holds and the exact condition that breaks it. Then the ladder on chain: a three-round eltoo state chain in two transactions, with only CSFS and CTV.

2026 · 04Inquisition signet✓ 2 tx confirmed

Code Delving Bitcoin

The question

In December 2024 Jeremy Rubin and Rearden described how CSFS plus CTV could support LN-Symmetry through re-keying and laddering: a root key hands authority to per-state keys, and each hop signs the next.

CSFS only answers whether a signature is valid for a message and a key. Does a construction built from several such checks actually bind a whole state package, or can valid pieces from different states be recombined?

What was built

E1, two independent CSFS checks: mixed packages from different states still pass. Pairwise validity is not joint binding.
E2, a unique rekey per state: recombination fails, and comes back as soon as a rekey is reused.
E3, a minimal key ladder: authorization holds hop by hop, and role confusion appears if the role gate is removed.
E4, state-indexed key derivation: key_n verifies only state_n, unless the derivation leaves out the state index.
On chain, a 42-byte tapscript of four CSFS checks and one CTV carries a three-hop ladder and settles a three-round state chain in two transactions.

How it works

<K_pub> CSFS VERIFY  CSFS VERIFY  CSFS VERIFY  CSFS VERIFY  CTV      # 42-byte leaf

K    signs R_0's pubkey          # rekey: the root hands authority to state 0
R_0  signs R_1's pubkey          # ladder hop
R_1  signs R_2's pubkey          # ladder hop
R_2  signs the CTV template hash # the final state is tied to its outputs
CTV  enforces the 3-output payout

All delegation happens off chain; only the final spend goes on chain, carrying the whole ladder proof in a 12-element, 512-byte witness.

On chain

Step	Transaction	Block	Note
Fund the ladder + CTV output (101,000 sats)	92efc475…da34	300000
Settlement of state 2	b96324da…82de	300000	Alice 40,000 / Bob 35,000 / Carol 25,000

Check it yourself

The repository re-checks every claim on this page (Python 3.10+ and secp256k1).

git clone https://github.com/aaron-recompile/rekey-ladder-theory
cd rekey-ladder-theory
python3 code/e1_naive_non_binding.py   # E1 to E4
each stage prints its attack scenarios and pass/fail

What it does not show

The four stages model the verification predicate; they are not a script-interpreter or consensus-level proof.
No proof of adaptor-signature equivalence.
No economic or security quantification for production Lightning deployments.

Sources

Technical record · facts.json

{
  "page": "https://bitcoincoding.dev/experiments/csfs-rekey-ladder/",
  "title": "Rekey ladder theory",
  "context": "Builds on Jeremy Rubin · CSFS rekey ladder",
  "author": "Aaron Zhang (Aaron Recompile)",
  "date": "2026-04-20",
  "network": "Bitcoin Inquisition signet",
  "summary": "An implementation of Jeremy Rubin and Rearden's CSFS rekey ladder, attacked in four stages to find where joint state binding holds and the exact condition that breaks it. Then the ladder on chain: a three-round eltoo state chain in two transactions, with only CSFS and CTV.",
  "transactions": [
    {
      "role": "Fund the ladder + CTV output (101,000 sats)",
      "txid": "92efc47554d25d74d9f567594d37375d8c8a1a2ea6bd1864600d5a49531fda34",
      "block": 300000,
      "explorer": "https://mempool.space/signet/tx/92efc47554d25d74d9f567594d37375d8c8a1a2ea6bd1864600d5a49531fda34"
    },
    {
      "role": "Settlement of state 2",
      "txid": "b96324da612950339f564fbc88fe1d5c5751070e57bf796d32ee7171238382de",
      "block": 300000,
      "explorer": "https://mempool.space/signet/tx/b96324da612950339f564fbc88fe1d5c5751070e57bf796d32ee7171238382de",
      "note": "Alice 40,000 / Bob 35,000 / Carol 25,000"
    }
  ],
  "verify": {
    "repository": "https://github.com/aaron-recompile/rekey-ladder-theory",
    "command": "python3 code/e1_naive_non_binding.py   # E1 to E4",
    "result": "each stage prints its attack scenarios and pass/fail",
    "needs": "Python 3.10+ and secp256k1"
  },
  "does_not_show": [
    "The four stages model the verification predicate; they are not a script-interpreter or consensus-level proof.",
    "No proof of adaptor-signature equivalence.",
    "No economic or security quantification for production Lightning deployments."
  ],
  "sources": [
    {
      "title": "Jeremy Rubin and Rearden · CSFS + CTV rekey and ladder for LN-Symmetry (December 2024)",
      "url": "https://rubin.io/bitcoin/2024/12/02/csfs-ctv-rekey-symmetry/"
    },
    {
      "title": "Delving Bitcoin · Eltoo State Chain on Signet Again: Three Rounds, Two Transactions (CSFS + CTV)",
      "url": "https://delvingbitcoin.org/t/2430"
    },
    {
      "title": "On-chain ladder code · btcaaron examples/eltoo",
      "url": "https://github.com/aaron-recompile/btcaaron/tree/main/examples/eltoo"
    }
  ]
}