A percolation model for the emergence of the Bitcoin Lightning Network

The Lightning Network is a so-called second-layer technology built on top of the Bitcoin blockchain to provide “off-chain” fast payment channels between users, which means that not all transactions are settled and stored on the main blockchain. In this paper, we model the emergence of the Lightning Network as a (bond) percolation process and we explore how the distributional properties of the volume and size of transactions per user may impact its feasibility. The agents are all able to reciprocally transfer Bitcoins using the main blockchain and also – if economically convenient – to open a channel on the Lightning Network and transact “off chain”. We base our approach on fitness-dependent network models: as in real life, a Lightning channel is opened with a probability that depends on the “fitness” of the concurring nodes, which in turn depends on wealth and volume of transactions. The emergence of a connected component is studied numerically and analytically as a function of the parameters, and the phase transition separating regions in the phase space where the Lightning Network is sustainable or not is elucidated. We characterize the phase diagram determining the minimal volume of transactions that would make the Lightning Network sustainable for a given level of fees or, alternatively, the maximal cost the Lightning ecosystem may impose for a given average volume of transactions. The model includes parameters that could be in principle estimated from publicly available data once the evolution of the Lighting Network will have reached a stationary operable state, and is fairly robust against different choices of the distributions of parameters and fitness kernels.

transaction will be eventually validated and stored on the main blockchain. If one party is malicious and does not correctly update the balance, the other can keep the collateral posted by the malicious party, as a form of insurance. Any two users can open a channel and all other participants can use one or more existing channels to route transactions off-chain upon payment of a fee to channel "owners". The scalability problem could be solved if a sufficient number of channels were opened, implying that the Lightning Network spans across the whole pool of users of the main blockchain.
The Lightning Network topology is, indeed, relevant to understand the resilience of the system to attacks or random failures and its robustness. Measures of the network structure based on empirical data -such as degree distribution, assortativity, shortest paths length -provide an indication of the efficiency of payments' routing and features of the system (i.e. average number of channels per user, clusters and communities, etc.) 7 . Experiments on random or targeted nodes removal from the network give information on the system resilience by monitoring when the original network is broken into multiple isolated clusters [8][9][10] . In the Lightning Network case, it has been shown that some types of targeted attacks -aimed at consuming, for instance, the channels' liquidity of specific nodes -may yield severe consequences for the resilience of the network in terms of average payment flow and reachability 11 .
The topology of the network is in turn driven by users' economic incentives to relay transactions "off-chain". Moreover, as the Lightning fees are set by channels' owners, an important question is how high such fees should be set in order to guarantee profits, while providing at the same time the right incentives for Bitcoin users to participate in the Lightning Network. In a recent work on simple network topologies (i.e. bidirectional channels and star graphs), the authors have estimated the demand for transactions on the main Bitcoin blockchain compared to the LN, the level of LN fees that would cover maintenance costs of the channel and their implication for the overall network security 12 . Indeed, transacting on the Lightning Network might impact the security of the main blockchain network by inducing a decrease in the amount of fees collected by the miners for the validation of blockchain transactions. Moreover, LN's transaction fees have been empirically studied using a traffic simulator 13 .
Fees on the main blockchain are used as incentives to miners (i.e. nodes capable of validating transactions and generating new blocks) to contribute to the security of the platform. The blockchain security is associated with the platform's decentralization, hence to the miners' total computing power 14,15 . Normally, users "compete" to set up the minimal fees that would ensure their transaction to be validated within a given timeframe, as miners try to maximize the total amount of fees per block. A strand of the literature has been investigating the Bitcoin fee set-up mechanisms, the miners' incentives and their potential correlation with risks of attacks and manipulation of the transaction history. In 16 the authors use a game-theoretic model to investigate the factors influencing the value of Bitcoin fees, while in 17 they also examine the interplay between fees and security of the platform, theoretically showing that the current fee model may not be sustainable in the long run. Alternative fee mechanisms have also been proposed, for instance based on auction models 16 , and compared with the existing one to highlight weaknesses and possible improvements.
The Bitcoin ecosystem has been already extensively investigated using approaches based on complex networks. The transactions network has been studied to understand latency issues and propagation mechanisms in peer-to-peer systems 18 and inefficiencies of the process of permanent inclusion of the transactions on the blockchain 19 . Global and local structural properties of the users' network in Bitcoin have also provided insights on boom-and-bust events 20 and Bitcoin price dynamics 21 . Moreover, data on users' behaviour and spending patterns have been used to understand the global state of the crypto-economy 22 and the drivers of the growth of the network 23 . More generally, our paper taps into the growing literature on quantitative investigations of the cryptocurrencies landscape, including models of pricing and adoption of tokens [24][25][26][27] , analysis of the market structure [28][29][30][31][32][33][34] , price prediction based on sentiment and social interactions [35][36][37][38][39][40][41][42][43] , dynamical analysis of informational efficiency 44 , and centralization of the Bitcoin economy 45 .
In this paper, we investigate under which conditions in terms of blockchain and Lightning fees, average wealth and volume of transactions per user, a Lightning Network that spans a sizeable fraction of Bitcoin users -thus solving the scalability problem -emerges. We model the emergence of the Lightning Network as a (bond) percolation process on a graph, exploring how different conditions may impact its feasibility 46 . In particular, we consider fitness-dependent network models [47][48][49][50] where the probability of creating a new edge depends on intrinsic node features collectively denoted node fitness. In the LN case, the node fitness will be defined in terms of the node wealth and activity (i.e. volume of transactions). The viability of the Lightning Network will be characterized in terms of the presence (or not) of a giant connected cluster of nodes: a non-fragmented network would, indeed, guarantee a smooth relay of payments and information between users and will incentivize off-chain transactions. Our model depends on parameters that can be all obtained -or at least estimated -from publicly available data, and is fairly robust against different choices of distributions of parameters and fitness kernels.
The paper is organized as follows. In the following section we provide a quick overview of the main Bitcoin blockchain and the main ideas behind LN. In Section "Model setup" we describe our model and provide the relevant theory, which is then applied to two specific wealth distributions (uniform and exponential) in the subsections "Uniform wealth distribution" and "Exponential wealth distribution", respectively. In the "Results" section, we discuss the results of numerical simulations, and we provide some conclusions and outlook in Section "Discussion". The Appendices are devoted to technical aspects of percolation theory on networks and are included to make the paper self-contained.
The Bitcoin blockchain and Lightning Network. In this section, we summarize the main features of the Bitcoin main blockchain and Lightning Network payment layer. The Bitcoin blockchain is a distributed, shared ledger that immutably records transactions among peers in the network 1,14 . Transactions are bundled in blocks and chained together via cryptographic primitives to ensure that any change at any point in the transaction history would invalidate the full record. Transactions are validated for correctness, temporarily stored in memory pools and then arranged in the blocks data structure by miners: multiple miners compete using computational power to validate the next block of the chain -and therefore earn the associated reward for the service and transactions' fees-according to the Proof-of-Work consensus algorithm. Depending on the usage of the network and due to limitations in block size, waiting times can peak around 30 minutes (while the typical range is around 6-8 minutes), while blockchain fees per transaction exhibit a broad range of variability, from a few cents to 40-50 USD (data taken from https://www.blockchain.com/charts).
The idea behind the creation of the Lightning Network 6 is, therefore, to devise a network for frequent and fast micro-transactions that can be performed at low transactions fees. The basic components of the Lightning Network are payment channels (schematically shown in Fig. 1, panel A), enabling trustless transfers between users. In the typical payment channel implementation, a theoretically unlimited amount of payments can be made, with only two transactions broadcast on the blockchain. In addition to a reduction of the number of blockchain transactions and associated costs, payment channels also offer the advantage of speed and, importantly, the ability of users to recover their funds if one of the parties is malicious.
A channel is established between two parties by locking an initial amount of funds, for instance m Bitcoins for each user, on the main blockchain, which represents the maximum amount of Bitcoins that can be transferred over the channel. Funds are locked on so-called 2-of-2 multisignature addresses 14 , which can be unlocked upon providing the signature of both interested parties. For instance, user A wishes to send r Bitcoins to user B: she signs a transaction, sends it to B, who will sign it and send it back to A. Only the first transaction is recorded on the main blockchain. At each time step in the lifetime of the channels, the users keep sending back and forth signed transactions that can be at any point consensually broadcast on the main blockchain to close the channel and redeem the net amount of funds. To prevent fraudulent behavior, for instance user B not acknowledging the receipt of a payment from A, a refund option is always included in any exchange. The refund option can be unilaterally unlocked and submitted to the blockchain after a certain amount of time t  has elapsed from the moment the channel was first established. Every new refund option is indeed signed by both parties, signaling therefore that they are in agreement with the terms of the refund, which may be exercised unilaterally at a later time. In the worst-case scenario, one party would simply submit the original refund transaction created contextually with the opening of the channel.
Payments can be relayed via the Lightning Network also if two parties are not directly connected via a Lightning channel, if there exists a path indirectly linking them via existing channels owned by third parties. Exploiting an existing path to route the payments may often prove more convenient as the two interested parties need not open a new channel, therefore saving the associated costs in blockchain fees. Channels' owners are indeed owed "routing fees" to allow payments through their channel, but at the moment those fees are very competitive (~4 orders of magnitude less than the Bitcoin blockchain, data taken from https://1ml.com/statistics and https://bitcoinfees.info). In Fig. 1, Panel B we show an example of an indirect routing path between user 1 and 4. One of the biggest issues of the Lightning Network is the limitation in liquidity. Payments are made by effectively having intermediaries forwarding collateral across multiple channels: this means that if party 1 is transferring ℓ Bitcoins to party 4, each relaying channel needs to have at least ℓ Bitcoins available in the direction of the payment.
To prevent dishonest behavior in the transfer from party 1 to 4 via party 2 and 3 (see Fig. 1, Panel B), Party 1 will lock the Bitcoins with a secret key known only by the receiver: when party 4 receives the Bitcoins from party 3, the secret is revealed and every player can collect their coins and fees 14 .

Model Setup
In this section, we model the emergence of the Lightning Network as a (bond) percolation process. We consider N agents, who are all able to reciprocally transfer Bitcoins using the main blockchain and -if economically convenient -to open a channel on the Lightning Network and transact "off chain". We introduce the node capacity (or wealth) w i of node i, a random variable extracted from a pdf Π(w), which is proportional to the maximum amount of Bitcoins that node i can lock in a Lightning channel it partakes in. We will consider two explicit examples for the wealth distribution (uniform and exponential) in the following, with qualitatively similar results.
Two nodes are more likely to open a Lightning channel if they expect to submit a large number of transactions over a given period of time. Therefore, we introduce for each node i a quantity ℓ i that represents its "activity" in terms of the average number of transactions node i sends through each channel in the network. The average number of transactions is also a random variable extracted from the discrete distribution Π ( ) over non-negative integers. We also include the costs associated with transacting over one of the two networks (main blockchain only or blockchain and Lightning). These costs can be fixed per transaction (base fee) or can be calculated as a percentage of the value transferred (fee rate).
• c, Lightning channel maintenance/usage base fee: Using the LN channel provided by an operator or other users to transfer coins carries an associated LN fee. Opening a channel has also maintenance costs (fee setup, market and nodes monitoring, connections) and costs related to locking Bitcoins and providing liquidity in the channel. • φ, main blockchain fee rate: We assume that a fraction φ of the value transferred in each transaction needs to be paid by the sender to have it included in blocks and validated by miners.
The probability of opening a new LN channel between two nodes p ij LN can be modeled as a function of (i) the costs associated with opening the LN channel (if the costs are significantly smaller than using the Bitcoin blockchain, there is an incentive for the users towards opening the channel), (ii) users' affinity (the more likely are users to transact over a period of time τ, the higher the benefits of opening a channel), (iii) the wealth of the nodes (nodes wishing to open a LN channel have to lock a minimal amount of Bitcoins on the main blockchain as collateral).
The growth of the Lightning Network can be modeled as a bond percolation process on a set of N nodes representing Bitcoin users. The edges then represent new Lightning channels being opened. In particular, we construct the bond percolation model considering fitness-dependent networks [47][48][49][50] . In fitness models, the network topology is determined by (i) an attachment kernel f(x, y), describing the probability that a node with fitness x will connect to a node with fitness y, and (ii) the distribution of fitness ρ(x) across nodes.
The network we consider has a fixed number of nodes N -corresponding to all Bitcoin users that may decide to switch to the LN -and is sparse, i.e. the number M of edges is M ≪ N 2 . If we consider node i and j having fitness x i and x j respectively, a LN channel, i.e. an edge between them, is added with probability The resulting network is undirected if f(x, y) = f(y, x), which is a sensible requirement: indeed, opening a LN channel between two nodes will require a "symmetric" commitment from both nodes to lock Bitcoins on the main blockchain. In our model, we will consider bond percolation only: number and "state" of the nodes (e.g. occupied/unoccupied or infected/susceptible) will not change.
In the context of the LN network, we define the fitness x i of node i as the simplest increasing function of both capacity and volume of transactions, i.e.
where w i represents the wealth of the node, and ℓ i + 1 ≥ 1 its "activity" in terms of number of transactions expected to be sent through the channel. Note that we assume that all nodes are potentially active, x i > 0 for all i. As in 48 , we consider the fitness to be defined in the interval [0, ∞). Given this definition of the node fitness, the fitness distribution can be calculated from the wealth and activity distributions, Π(w) and ( ) Π respectively, as If we imagine links are added one at a time at a given rate, from the kernel f(x, y) we can derive the probability that a node with fitness x increases its degree by one as 47 is the average degree of the network with N nodes, with ∞ ∞ x y x y f x y d d ( ) ( ) ( , ) We also define λ(x) = Nλ(x, N) and rewrite it as (2020) 10:4488 | https://doi.org/10.1038/s41598-020-61137-5 www.nature.com/scientificreports www.nature.com/scientificreports/ ∞ Note that λ(x) clearly satisfies the following normalization condition The degree distribution P(k) for large N is given by N , as shown in detail in Appendix A. In the following, we will assume that the activity distribution is Poisson with average n, n n ( ) exp( ) / ! Π = − , and that the connectivity kernel models the effects of blockchain and LN fees as follows where Θ(z) is the Heaviside step function. The interpretation of this kernel is as follows: agent i expects to interact with μ other agents, which we assume for simplicity to be chosen randomly. The probability of interacting with a given agent j is equal to μ/N for all j. Agent i wishes to transfer an amount w i (ℓ i + 1) (corresponding to ℓ i + 1 transactions of size w i ) to each of them, and is willing to open a Lightning channel if the cost of maintaining it (c) is lower than the cost of transferring the money through the blockchain (w i (ℓ i + 1)φ). The same considerations apply to its counterpart j.
We define i N i 1 the number of nodes with "high" fitness, for whom it is economically viable to engage in a LN. Note that N + is a random variable, which depends on the realization of the fitnesses. We define the average fraction The network constructed via the sequential deposition of links (as described above) may undergo a percolation transition 46,47,51,52 as a function of f + , such that -beyond a critical value of f + -a giant connected component of N C nodes emerges, whose fractional average size ⟨ ⟩ S N N / C = remains finite as N → ∞. We stress that in any fixed instance N C ≤ N + , since some high-fitness nodes may still not engage in LN (see Fig. 2). In our language, this connected component represents the set of nodes that not only do exploit Lightning channels to exchange wealth off-chain between nearest neighbors, but may also transfer wealth to any "distant node", routing the transaction via connected paths. It is therefore of paramount importance to understand under which conditions on the average wealth, average volume of transactions, and routing fees, this transition may happen, and what finite fraction of nodes will it involve.
With the choice of the kernel in (9), the topology of the resulting Lightning Network of N + nodes is that of an Erdős-Rényi (E-R) graph with average degree equal to f (1) μ +  . At odds with the standard model of E-R graphs, in our case the size of the graph N + is itself a random variable, which depends on the parameters of the model. In fact, once f + has been obtained, the model can be mapped onto a site percolation problem on random networks, where each node is occupied with probability f + , and the emergence of a viable Lightning Network corresponds to the emergence of a giant component of occupied nodes 53 . and above (right) the percolation threshold. Light blue triangles represent nodes whose fitness is smaller than c/φ, while dark blue circles represent "high-fitness" nodes with x > c/φ. N is the total number of Bitcoin users, N + is the fraction of "high-fitness nodes" (see Eq. (10)) and N C is the fraction of high-fitness nodes belonging to the giant connected component. (2020) 10:4488 | https://doi.org/10.1038/s41598-020-61137-5 www.nature.com/scientificreports www.nature.com/scientificreports/ The relevant percolation theory is summarized in Appendix B to make the paper self-contained.
Uniform wealth distribution. We now take Π(w) -the pdf of wealth across nodes -as uniform in the interval [0, w 0 ]. Hence, we have  , and ⌈ ⌉ z denotes the smallest integer larger than z. In this case, it follows from (6) and (9) that The interpretation of (17) is quite neat: on average, the network contains a fraction 1 − f + of isolated (low-fitness) nodes, and a fraction f + of high-fitness nodes that may (or may not) partake in the LN, establishing sparse random connections with an average of μf + other high-fitness nodes. Computing now the generating function (35) www.nature.com/scientificreports www.nature.com/scientificreports/ Exponential wealth distribution. We now take Π(w) to be the exponential pdf with mean w 0 . The fitness distribution now becomes

is the average fraction of high-fitness nodes and is given by
As in the uniform wealth case where this time f e ( )

Results
We present numerical simulations on networks of N = 5 ⋅ 10 4 nodes, generated by sequential deposition of links with probability as in Eq. (1), using the kernel in Eq. (9). In Fig. 3, where we use a uniform distribution of wealth with average w 0 = 1, 2, we plot the average size S (u) of the connected component as a function of n, the average volume of transactions to be deployed on the LN, for varying values of the fees ratio c/φ. Fixing a certain average fraction S (u) of nodes -which can reach each other via a connected LN path -and increasing the ratio c/φ between the LN and main-blockchain fees, we observe that a larger average volume of LN transactions is required to make the off-chain network financially sustainable. Increasing the average wealth w 0 would push the curves upwards: as more liquidity becomes available across nodes, more and more players may get involved in the LN for the same level of routing fees. In Fig. 4, the average size S (u) of the connected component is plotted instead as a function of , the fraction of high-fitness nodes, for different values of μ, showing that the transition value between S = 0 and S > 0 happens at 1/μ as predicted by the condition in Eq. (22). In Fig. 5, we observe qualitatively the same phenomenon, this time for an exponential distribution of wealth.
To find the size of the largest connected component, we use a breadth-first search algorithm 54 : starting from a source node s, we label it as belonging to cluster #1. We then explore its neighborhood and assign all nodes reachable from s to cluster #1 as well. The algorithm proceeds recursively until either the whole network has been labelled, or no unlabelled nodes can be further reached. In the latter case, we select another random source among the unlabelled nodes, assign it the label #2, and restart the procedure to find another cluster. At the end, all disjoint clusters have been identified, and their size recorded. In our plots, we monitor the size of the largest cluster. (2020) 10:4488 | https://doi.org/10.1038/s41598-020-61137-5 www.nature.com/scientificreports www.nature.com/scientificreports/ In Fig. 6, we plot the phase diagram in the (φ, c) plane for the uniform wealth distribution model (very similar results are obtained for the exponential wealth distribution, not shown). The colors from blue to yellow represent (from low to high) the values of  n , the minimal average volume of transactions that need to be deployed to make a LN financially viable for a given value of LN and main-blockchain fees, c and φ, respectively. We observe a transition between two regimes, signalled by the red line: one (region 1) where the LN fees are sufficiently low (compared to main-blockchain fees) that any volume of transactions (however low, n 0 =  strictly) can be transferred off-chain and still be financially viable, the other (region 2) where the LN fees are sufficiently high that agents may be discouraged from opening channels and transferring wealth off-chain unless there is a minimal volume of transactions to be deployed ( >  n 0 strictly). The higher the ratio c/φ, the less convenient it is to open LN channels for a fixed value of transactional activity. Simulations with kernel f(x, y) in Eq. (9) and uniform wealth distribution in the interval [0, w 0 ]. Numerical results (showed with symbols) have been obtained for a network of N = 5 ⋅ 10 4 nodes averaging over 5 independent instances, whereas the theoretical solid line corresponds to Eq. (21). Fixing a certain fraction S of nodes -connected via LN -and increasing the ratio c∕φ between the Lightning Network and main blockchain fees, we observe that a larger average volume of LN transactions is required to make the system financially sustainable. The transition between S = 0 and S > 0 happens at a value of n that we denote n  . Simulations with kernel f(x, y) in Eq. (9) and uniform wealth distribution with parameter w 0 . Numerical results (showed with symbols) have been obtained for a network of N = 5 ⋅ 10 4 nodes averaging over 5 independent instances, whereas the theoretical solid line corresponds to Eq. (21). The transition between S = 0 and S > 0 happens at 1/μ as correctly predicted by the condition in Eq. (22).

Discussion
In summary, we have presented a simple fitness-based network model for the emergence of a connected set of nodes exchanging wealth off-chain, whose average fractional size S remains finite as N → ∞. The percolation transition resulting from sequential deployment of edges is studied numerically and analytically as a function of a limited set of parameters that we predict will be in principle possible to infer from empirical or synthetic 13 data: w 0 (related to the average wealth jointly owned by the agents), n (the average volume of transactions that can be handled off-chain), c, φ (the fees associated with off-chain and on-chain transactions) and μ (the average number of channels per node). As a matter of fact, different platforms are currently being offered -but only at a test stage -where users can experience the Lighting Network services in a simulated environment. Already at this early Simulations with kernel f(x, y) in Eq. (9) and exponential wealth distribution with average w 0 . Numerical results (showed with symbols) have been obtained for a network of N = 5 ⋅ 10 4 nodes averaging over 5 independent instances, whereas the theoretical solid line corresponds to Eq. (28). Increasing w 0 for similar values of the ratio c/φ makes the nodes wealthier on average, and therefore more likely to engage in a LN: as a consequence, the average size of the LN-connected component increases for a given value of average volume of transactions. The transition between S = 0 and S > 0 happens at a value of n that we denote n  .  (9)). The granularity of the axes is as follows: for the φ-axis, 100 evenly spaced values, while for the c-axis, 1200 evenly spaced values. The colors from blue to yellow represent (from low to high) the values of the minimal average volume of transactions  n that need to be deployed to make a LN financially viable. In region (1) (low ratio between LN and main-blockchain fees),  = n 0 strictly, i.e. for any average volume of transactions, a LN connected component is sustainable. In region (2) (larger ratio between Lightning and main blockchain fees), > n 0  strictly, implying that a LN is not financially viable unless the volume of transactions is sufficiently high. The sharp transition between the two regimes (i.e. the line across which n  jumps from zero to nonzero values) is highlighted in red in the figure. Since only the ratio c/φ matters in our setting, the coloring of sub-regions in (2) is uniform along straight lines. Note also that the different scale between the axes is due to the different nature of the blockchain fees: c is a base fee ("absolute" value), while φ is a fee rate ("relative" value), as explained in section Model Setup. (2020) 10:4488 | https://doi.org/10.1038/s41598-020-61137-5 www.nature.com/scientificreports www.nature.com/scientificreports/ stage in the development of a fully operational payment system, some useful data can be gathered: for instance, the platform '1ML' (https://1ml.com/statistics) currently aggregates information about ~10000 nodes sharing ~30000 channels, with an average capacity per node of ~1000 USD, and a base fee per transaction of around 0.000072 USD. Similarly, for the Bitcoin blockchain we can gather an estimate of ~0.52 USD as base fee per transaction, as well as more accurate figures about number of transactions per day and average transaction values (data available at https://www.blockchain.com/en/charts).
The function f(x, y) in Eq. (9) has been selected as the simplest but nontrivial attachment kernel that favors a link (i.e. the opening of a Lightning channel) whenever the fitness of both concurring nodes (in terms of exchangeable wealth and volume of predicted activity) exceeds a financially viable threshold. We have checked that "smoothing" the 0/1-kernel in Eq. (9), e.g. by multiplying the thetas by xy/(1 + xy) or x y 1 exp( ( )) − − + , has negligible effects on the results, while making the analytical treatment unnecessarily more complicated. Similarly, the model is fairly insensitive to the details of the full probability distribution of wealth that is used (see however 23 for a data-driven analysis of Bitcoin wealth distribution), while being flexible enough to generate a desired degree distribution P(k) via a different choice of the attachment kernel f(x, y) 55 . A percolation transition separates a phase where no sustainable LN can be formed, from a phase where the fees being charged, the total available wealth and the average activity conspire to make off-chain payments a viable option for a finite fraction of the network in the limit N → ∞. The transition is elucidated analytically and numerically, with excellent agreement.
In the future, this investigation can be extended in the following ways: • A mechanism for the dynamical update of wealth as more channels are opened and funds are locked may be introduced to investigate the liquidity constraints of the network in more detail. Dynamically generated wealth inequalities and concentration may be detected by means of centrality measures. • The resilience of the network can be studied under different types of attacks and compared with available empirical results 7,11 . • Different choices of the kernel f(x, y) (e.g. non-factorized) may be also explored. This could lead to networks with heterogeneous (heavy-tailed) degree distribution, which seems to be in line with recent empirical studies 7 .
Once the development of the Lightning Network technology and implementation will have reached maturity, it will be possible to gather data to calibrate our model, which can serve as a driver for policy changes and as guidance for incentive mechanisms design.

Appendix A: Degree distribution P(k)
Following 47 , the probability p M,N (k|x) that a node in a large undirected graph with N nodes and M ≪ N 2 edges has degree k given that its fitness is x follows the recursion The interpretation is easy: the probability of having a node with degree k + 1 after an edge addition (M + 1) is equal to the probability that the node already had degree k + 1 times the probability that the new edge does not have any of its two terminal points attached to it ([1 − 2λ(x, N)]), plus the probability that the node had degree k times the probability that the new edge has one of its two terminal points connected to it (2λ(x, N)).
Multiplying both sides of Eq. (29) by s k and summing over k ≥ 0, we obtain the following equation for For large M, Eq. (30) can be rewritten as an ordinary differential equation of the form where we recall that we defined Nλ(x) = λ(x, N) and we used the initial condition F 0,N (s|x) = 1 that follows from the fact that in a network with zero edges, p 0,N (k|x) = δ k,0 . Taylor-expanding around s = 0 and noting that 2M∕N = Nκ, we obtain the degree distribution conditional on the fitness of the node x κλ − Marginalizing with respect to x, we eventually obtain the probability that a node has degree k (irrespective of its fitness) as

Appendix B: Giant component
The generating function of the probability that a node has degree k is denoted by ∑ = .
≥ G s P k s ( ) ( ) k k 0 0 We introduce the generating function G 1 (s) of the (normalized) probability that by following a randomly chosen edge we reach a node with degree k This is because the node we reach by following a randomly chosen edge has degree distribution kP(k)/Nκ rather than just P(k) -since a randomly chosen edge is more likely to lead to a node of higher degree. We also define the generating function of the number of nodes that can be reached following a randomly chosen edge and that belong to a connected component of size t with size distribution ψ(t) ≥ Moreover, we indicate with H 0 (x) the generating function of the probability that a randomly chosen node belongs to a connected component of size t More precisely Eq. (37) must be interpreted as where ψ(t, N) is the probability that -in a network with N nodes -by following a randomly chosen link, we reach a component of size t ≤ N, and similarly for H 0 (x) in Eq. (38). Assuming that the typical component sizes are finite and that the chances of a component containing a closed loop of edges are negligible for sufficiently large N, the distribution of components generated by H 1 (x) can be obtained as follows 47,51,52 . Let us denote by ζ(t|k) the probability that a node with degree k belongs to a component of size t where δ(a, b) is the Kronecker delta. Indeed, the sum of the sizes of the components that can be reached by following the k edges departing from the node must be equal to t − 1, and each of these sizes is drawn from the distribution ψ(t).
Marginalizing over the degree distribution, we obtain the probability Q(t) that a randomly chosen node belongs to a component of size t as  where we have used (35) and (37)