Proof-of-Reserves: an emerging trust standard for centralised exchanges

The recent FTX meltdown highlighted a need for the digital asset industry to mature and improve standards, specifically in relation to transparency. To this end, centralised exchanges have tentatively adopted a cryptographic ‘Proof-of-Reserves’ (PoR) standard to confirm possession of sufficient assets to cover liabilities.

The PoR standard is not a panacea, but a step in the right direction towards a more stable decentralised financial world. 

So far, entities which have conducted a PoR attestation as of December 2022 include BitMEX, Kraken, Deribit, Binance, Bitfinex and many others to varying degrees of diligence. While the quality of these attestations is up for individual scrutiny, the industry-wide effort is noteworthy. 

Since actions speak louder than words, crypto exchanges are setting these standards to prove solvency. In an ideal world, exchanges wouldn’t have this issue if they did not practice fractional reserve banking – a fiat phenomenon. Still, the voluntary effort is an attempt to regain public trust, bolstering an exchange’s potential to retain a leading edge in the industry.

Proof-of-Reserves

Proof-of-Reserves is a method by which custodial exchanges share public information and evidence of their on-chain exchange reserves. The idea is to demonstrate that the assets held on deposits match up with user balances, indicating that the exchange is solvent.

To match on-chain assets with liabilities, exchanges rely on a simple system which adds client balances and publishes data anonymously through ‘Merkle proofs’. Merkle proofs are used extensively in most blockchains to prove data inclusivity in large datasets. They are established by hashing a hash’s corresponding hash together and climbing up the tree until you obtain the root hash which can be publicly known. This is effectively a form of digital signature as no two hashes can be the same.

Using this method, users verify that their account balance is included in the exchange’s liabilities data set. The Merkle tree technique essentially publishes balance data while avoiding privacy leakage.

That said, there are accounting tricks exchanges can play which ought to be a red flag for any user. For instance, as noted by Kraken CEO Jesse Powell, Binance’s customer liability report does not differentiate between BTC, BTCB, and BBTC (bitcoin synthetics running on Binance smart chain). In other words, there’s an attempt at proving collateral rather than reserves. 

Experts, accountants and regulators (potentially), will take a scalpel to these attestations in order to guarantee both the solvency and credibility of an exchange. In an ideal scenario, exchanges have multiple ongoing attestations with the supervision of an on-chain auditor. Of course, auditors are centralized and wide open to corruption. As such, the question as to ‘who will monitor the monitors?’ remains unanswered, for now (save for the fact that the info. is public).

Still, an auditor would take a snapshot of the exchange balances and include them in a Merkle root tree. The next step would be to verify every user’s balances against information in the Merkle tree via a corresponding transaction hash.

Auditing crypto assets

Ethereum founder Vitalik Buterin recently wrote an in-depth article about how exchanges could prove their solvency using Merkle trees. In the writeup, Buterin underlines an approach to proof of assets and liabilities, with the longer-term goal being that all exchanges become non-custodial.

Per the illustration, account holders could verify their balances against the sum of all liabilities on an exchange. In the above case, sourced from BitMEX, account 001 would only need data inside the red area to ascertain his balance is part of an exchange’s liabilities (1,400). 

As noted, this model is far from perfect since it requires trust in a third-party auditor. However, it ensures a certain degree of privacy as different parts of the tree are revealed to users. Most importantly, the more depositors verify their balances via a Merkle tree structure, the higher the odds that the exchange will not play tricks by hiding liabilities.

A solvency standard

While the utter devastation wrought by the FTX scandal is a stain on the sector, every cloud has a silver lining. The downfall of these fraudulent actors in crypto is resulting in an emergent and collaborative proof-of-reserves standard. By taking this approach, all custodian exchanges will benefit from increased transparency, regardless of regulatory oversight.

Another positive consequence will be that any up and coming bad player will have to prove their solvency or be left on the side-lines. This is something that will be seen as a sign of maturity, potentially loosening regulatory scrutiny as we head deeper into 2023.

That being said, improving exchange security and transparency shouldn’t come at the cost of self-custody. After all, for users who have no intention of regularly exchanging assets, self-custody is the holy grail of asset security. As such, eliminating third party risk through crypto education such as private-key management is essential too. 

At the end of the day what is the point of cryptography if you don’t control your own crypto?