# 3-phase commit to deter Denial of Service (DoS) attacks in multi-hop payments

2-phase commit systems in multi-hop payments can be built in two different ways, depending on if the timeout defaults to cancel or finish the payment. In either alternative there will only be a penalty on one of the phases, and the penalty will be on the opposite phase for either alternative (on the first phase for finish on timeout and on the second phase for cancel on timeout). To have a penalty on both phases, both variants of 2-phase commits have to be combined, with an intermediary phase to change the timeout action between the phases (this intermediary phase also informs all nodes that the first phase succeeded and that it can no longer be cancelled).

### 2-phase commits

@startuml
start
:Prepare;
note right: No penalty
note left: Cancel on timeout
:Commit;
note right: Penalty
end
@enduml

@startuml
start
:Prepare;
note right: Penalty
note left: Finish on timeout
if (All agree?) then ([Yes])
:Commit;
note right: No penalty
end
else ([No])
:Cancel;
note right: Penalty
stop
endif
@enduml

### 3-phase commit

@startuml
start
:Prepare;
note left: Finish on timeout
note right: Penalty
if (All agree?) then ([Yes])
:Pre-Commit;
note left: Cancel on timeout
note right: Penalty
:Commit;
note right: Penalty
end
else ([No])
:Cancel;
note right: Penalty
stop
endif
@enduml

## Chunked penalty 

With 3-phase commit, the penalty is what prevents DoS attacks rather than the time until the pending payment has been fully timed out. The pending payment can remain open as long as the penalty is actively deterring an attacker. This allows for a slow and gradual penalty, and this reduces the risk that a non-attacker is punished disproportionally.