On Thursday (29 December 2022), Coin Metrics Co-Founder Nic Carter looked at how various major centralized exchanges are doing in terms of providing Proof of Reserves (PoR).
Here is how Carter, who has long been a strong proponent of custodial service providers in the crypto space having a Proof of Reserves program, explains this concept:
“Proof of Reserves is the idea that custodial businesses holding cryptocurrency should create public facing attestations as to their reserves, matched up with a proof of user balances (liabilities). The equation is simple (in theory):
“Proof of Reserves + Proof of Liability = Proof of Solvency
“The idea is to prove to the general public, and in particular your depositors, that your cryptocurrency held on deposit matches up with user balances. Of course, in practice, this isn’t quite so simple. Proving that you control some funds on chain is trivial, but you could always borrow those funds on a short term basis. This is why point-in-time attestations mean relatively little. And additionally, exchanges can have hidden liabilities or have creditors claim seniority to depositors, especially if they don’t legally segregate client assets on the platform. This is why policy like Wyoming’s SPDI law clarifying the legal status of depositors relative to custodial institutions is so important.
“Proving liabilities is tricky, and generally requires an auditor to engage in a full assessment. For instance, exchanges can omit certain liabilities to ‘cheat’ a PoR attestation. This is why I recommend both a user-facing PoR protocol, allowing users to obtain ‘herd immunity’ by collectively verifying their individual balances, and an auditor-facing PoR protocol, to prove that the claimed liabilities are faithful to reality.
“Another issue is that exchanges could have unaccounted-for liabilities that a mere cash flow analysis might not capture. For instance, given that many exchanges exist under muddy regulatory regimes and legal contexts, it’s not guaranteed that depositors would be senior to creditors in the case of bankruptcy. This means that it’s possible that large debts could consist of a hidden liability that would weaken depositor claims on reserves in a worst case scenario. This is why I recommend including an auditor in a PoR process, so these more complex liabilities (and an assessment of the seniority of depositors) can be understood. More generally, exchanges should adopt a legal policy in which depositors are absolutely privileged and senior to all creditors.“
As for those people who say Proof of Reserves is meaningless without Proof of Liabilities, Carter has this to say:
“Ideally a PoR would be paired with a full accounting of liabilities, known and hidden, and stronger solvency assurances would be obtained… PoR is a term of art that refers to the attestation whereby both the assets held on deposit and the user liabilities are compared. Under standard PoR, liability holders have the ability to determine that they were included in the liability set (that’s what the merkle tree is for). The “hard part” is the liabilities – proof of assets on chain is normally trivial. So PoR is not “underpowered” or “incomplete”. A proper PoR really does give you assurances that the exchange is solvent at least in the narrow context of on-platform balances.“
In the wake of the recent collapse of crypto exchange FTX and a lot of crypto leaving crypto exchanges due to concerns about them getting hacked or going bankrupt, most major centralized exchanges have been racing to provide PoR reports to assure the public that customers’ crypto funds are really there and that no “fractional reserve banking” is going on.
On 29 December 2022, Carter published a blog post (itled “The Status of Proof of Reserve as of Year End 2022”)., in which he summarized “PoR efforts to date” and introduced “a simple framework through which to judge their effectiveness.”
With regard to the #1 and #2 highest ranked exchanges, i.e. BitMEX and Kraken, he had this to say:
“Kraken employed Armanino LLP in their attestation, which gives clients a good level of confidence that they aren’t hiding liabilities, publishing negative or undercounted balances in the merkle leaves, or engaging in window-dressing (aka borrowing funds on a short term basis to pass the attestation).
“Kraken also did PoRs for BTC, ETH, USDT, USDC, XRP, ADA, and DOT, representing the majority of platform funds. They even covered staked funds for ETH, ADA, and DOT. Right now they are doing PoRs every six months, although I hope that becomes more frequent with time. In this post, they are realistic about PoR shortcomings, and do not represent it as a panacea for exchange issues.
“BitMEX’s approach also deserves praise. They are not relying on an auditor, choosing instead a highly transparent model. On the asset side, they list all BTC balances held by the exchange and the execution scripts for these UTXOs which prove that they are spendable by the BitMEX multisig.
“On the liabilities side, they publish the Merkle tree of user balances in full. This is different from the standard Maxwell approach whereby users are only exposed to their leaf in the merkle tree (and path to the stem) in the interests of preserving privacy. This means that there are no issues with excluded or negative balances since anyone can vet the liability set in full.
“To deal with the privacy leakage, they randomly split user balances into two, so specific balances can’t be tracked over time. And impressively, BitMEX now publishes PoR attestations twice a week, a more frequent cadence than most other exchanges.“
Image Credit
Featured Image via Pixabay
