Good day everybody,

Welcome to CryptoGod-1's blog on all things crypto. In today's post I will be looking at a a recent post by Vitalik Buterin in relation to the effects of the major centralized exchange blowing up. Posted by him on hackmd.io it also mentions special thanks to Balaji Srinivasan, and Coinbase, Kraken and Binance staff for discussion. Within the post it explains how cryptographic techniques can or cannot be used to solve the problems which have arisen of late, such as not relying solely on “fiat” methods like government licenses, auditors and corporate governance. Instead cryptographic proofs could be created and used to show the amount of funds on the chain are enough to prove the exchange can cover their liabilities to their users. Along with that Buterin discusses how an exchange could build a system where it can’t withdraw a depositor’s funds at all without their consent. It is all the aspirations of how we as a society can move forward and potentially create a system where exchanges one or two steps closer to trustlessness, the limitations of these techniques, and some of the more powerful advanced technologies available. I have broken down the post into somewhat simpler terms below, but you can find the original here: https://hackmd.io/@vbuterin/proof_of_solvency

The Old School Attempts

The generally accepted method previously had been Merkle Trees by exchanges in their earliest attempts to try to cryptographically prove that they are not cheating their users. This became the norm after the issues of Mt. Gox and a need to prove solvency without disclosing exactly who has what deposited in a list. Instead of risking privacy of users balances, the Merkle tree technique consists of putting the table of customers’ balances into a Merkle Sum Tree. The base layer contains the username hashes of individual customers, with each rise layer showing the balance of two sums below it. The exchange would send each user a Merkle sum proof of their balance. The user would then have a guarantee that their balance is correctly included as part of the total. Privacy leakage in this design is much lower than with a fully public list, and it can be decreased further by shuffling the branches each time a root is published, although it is still possible. Another issue is the possibility of an exchange creating a "fake account" with a negative sum of crypto within it, using this to help create an overall total sum greater than the amount they possess, although this is stopped by using a Merkle Tree Sum and not just a basic Merkle Tree.  To get away with the theft, the exchange would have to hope that nobody in the entire right half of the tree checks their balance proof which would be unlikely, although still possible. There is also the possibility that an exchange can exclude certain users to ensure the sum does not overshadow their overall balance, hence, the Merkle tree technique is basically as good as a proof-of-liabilities scheme can be, if only achieving a proof of liabilities is the goal. But its privacy properties are still not ideal.

ZK-SNARKs

Thankfully there are more modern techniques and attempts at solving the issue, known as ZK-SNARKs. These are a powerful technology which can completely steamroll a whole bunch of application-specific techniques for a whole bunch of problems that were developed in the decades prior. By putting all users’ deposits into a Merkle tree we can use a ZK-SNARK to prove that all balances in the tree are non-negative and add up to some claimed value. The application can add a layer of hashing for privacy and then it would reveal nothing about the balance of any other user. As Vitalik Buterin lays out, in the longer-term future this kind of ZK proof of liabilities could perhaps be used not just for customer deposits at exchanges, but for lending more broadly. Anyone taking out a loan would put a record into a polynomial or a tree containing that loan, and the root of that structure would get published on-chain. This would let anyone seeking a loan ZK-prove to the lender that they have not yet taken out too many other loans. The applications of advanced technology can be unending in a decentralized society.

Proof of Assets

The point of proof of assets is to prove that you hold X coins and is done so by move X coins around at some pre-agreed time or in a transaction where the data field contains the words “these funds belong to this exchange”. The biggest issue with this method is:

• Dealing with cold storage

Generally for safety reasons the majority of exchanges will keep their customer funds in “cold storage”: an offline computer(s) where transactions need to be signed and carried over onto the internet manually. There are many options exchanges can take, some of which could include generating a few addresses, publish a proof of each address once to prove ownership, and then use those addresses repeatedly. Another option is for the exchange to have a protocol where from time to time a few address get randomly selected and must be “opened” to prove ownership. 

• Collateral dual-use

There is always the possibility of exchanges sending funds back and forth between each other, allowing both exchanges to make use of the same coins for "proof of assets." Ideally, proof of solvency would be done in real time, with a proof that updates after every block. If this is impractical, the next best thing would be to coordinate on a fixed schedule between the different exchanges, eg. proving reserves at 1400 UTC every Tuesday.

The final issue Vitalik Buterin brings up is how do exchanges do proof of assets on FIAT, as they don’t just hold cryptocurrency, they also hold fiat currency within the banking system. The only real options would be the bank itself attesting to balances, auditors can attest to balance sheets, etc. Given that fiat is not cryptographically verifiable, this is the best that can be done within that framework.

Making CEX's non-custodial

Going even further, how can it be done to ensure not only the exchanges have a user's funds, but that they are unable to steal those funds. Plasma, a scaling solution, works by splitting up the balance into a set of individual “coins”, where each coin is assigned an index and lives in a particular position in the Merkle tree of a Plasma block. Making a valid transfer of a coin requires putting a transaction into the correct position of a tree whose root gets published on-chain. This led to OmiseGo attempting to create a decentralized exchange based on this protocol, but since then they have pivoted to other ideas. The more modern version of the Plasma idea is what Starkware calls a validium: basically the same as a ZK-rollup, except where data is held off-chain. This construction could be used for a lot of use cases, conceivably anything where a centralized server needs to run some code and prove that it’s executing code correctly. While these are ways of ensuring that exchanges cannot steal a users coins, there is an unavoidable trade-off which we all require.

Often people lost access to their accounts. Once this happens either password recovery or proof of KYC can help the exchange return access to the account, but in order to have the ability to recover user accounts’ funds for good reasons, exchanges need to have power that could also be used to steal user accounts’ funds for bad reasons. This leaves us with two clear alternatives that have clearly distinct costs and benefits:

Conclusions

For now there are two clear types of exchanges, custodial exchanges and non-custodial exchanges. The latter are DEX's such as Uniswap, while down the line in the future we may encounter cryptographically “constrained” CEX's where user funds are held in something like a validium smart contract. There may also be variations where we see half-custodial exchanges where we trust them with fiat but not cryptocurrency.

A proof of reserve is required while both these types of exchanges exist, which will consists of a combination of proof of assets and proof of liabilities. While there are technical challenges in making good protocols for both, we can and should go as far as possible to make headway in both, and open-source the software and processes as much as possible so that all exchanges can benefit.

Vitalik Buterin hopes that in the long term future society can move towards all exchanges being non-custodial, in terms of crypto at the very least. In terms of wallet recovery, this could be addressed in the wallet layer rather than within the exchange itself. On the fiat side, movement between the traditional banking system and the crypto ecosystem could be done via cash in / cash out processes native to asset-backed stable,coins such as USDC. However, he notes it will still take a while before we can fully get there.

All in all it is a very interesting read if you are similar to me and enjoy this sort of thing. If it is a bit too much for you or you're more interested in the results instead of the technical mumbo jumbo then I hope I have somehow broken it down into more simpler terms. Either way it is good to see those at the top have ideas and aims of how to improve things for us all, even if the longer term aim will take a lot of work to implement.

Have a great day.

Peace. CryptoGod-1.

Referral links:

Publish0x - https://www.publish0x.com/?a=olejZqrzej

Splinterlands - https://splinterlands.com?ref=rnabc1

Upland - r.upland.me/NQAH

Binance - https://accounts.binance.com/en/register?ref=143611368

NFT Market Sales

Opensea - https://opensea.io/RNabc

Follow Me :)

Twitter - @RNabc123