5 ms·

>Do they regularly publish independently-verifiable audits? Which exchange does this? I'm not talking about finding some mom and pop accounting shop to issue

>Do they regularly publish independently-verifiable audits? Which exchange does this? I'm not talking about finding some mom and pop accounting shop to issue a 1 page report stating they checked on a certain date and the reserves were there, where the majority of the 1 page was a disclaimer stating that this wasn't technically an "audit" and should not be relied upon as such.

throwup 4y ago
Kraken does at least. AIUI their auditor is given a snapshot of all account balances at a particular point in time, and builds a merkle tree. You can then reconstruct your expected merkle leaf and verify that your specific account was included in the tree. You can verify on the auditor's website, or you can do it by hand. Kraken's help page even has code snippets in Python/Go/etc to make it easy! More info: https://www.kraken.com/proof-of-reserves https://www.kraken.com/proof-of-reserves https://proof-of-reserves.trustexplorer.io/clients/kraken https://proof-of-reserves.trustexplorer.io/clients/kraken
- DebtDeflation 4y ago
  No, they do not. They only verify BTC and ETH, no other holdings, and they don't audit liabilities at all, meaning that they could be using your BTC as collateral for loans. Also, the audit they did last December was the second in 8 years and AKAIK they haven't done another since. Kraken is in no way "audited".
  - throwup 4y ago
    Full of misinformation. > They only verify BTC and ETH Click the link and you see this isn't true: "ADA ADA.S BTC BTC.M DOT DOT.S DOT.P etc etc" > they don't audit liabilities at all All liabilities were verified by the auditors and included in the merkle tree, and as mentioned, all users can independently verify that their specific liabilities are present. What more would you expect? > the audit they did last December was the second in 8 years Their most recent audit was end of Q2 this year. They do audits semi-annually.
    - karpierz 4y ago
      > All liabilities were verified by the auditors and included in the merkle tree, and as mentioned, all users can independently verify that their specific liabilities are present. What more would you expect? Where in the report do they verify off-chain liabilities?
      - throwup 4y ago
        I'm still not quite sure you're after, but I guess it would be this quote on page 3: > 14) Compare the total liabilities from the Client Liability Report extracted from Kraken’s production database as observed within Procedure 5 to the total assets controlled by the Kraken custodied addresses (the “In-Kind Assets”) as of the specified date and time of the assessment time and calculate the collateralization ratio based on the In-Kind Asset-to-Client Liability mapping provided by Kraken Management
        karpierz 4y ago
        That's measuring how much they owe clients (IE, deposits) against how much crypto they hold (IE, the crypto in wallets they hold). That doesn't at all capture the kinds of liabilities I'm asking about, which is debt external to the blockchain. Ex: I am Kraken. Someone deposits 1 BTC with me. I then sign a contract with someone else saying "You give me 1 BTC now, I will give you 1.2 BTC in a year". I then sell 1 BTC. In my wallet, I will have 1 BTC, exactly matching my client liabilities. But my total liability is 2.2 BTC. And if those contracts start calling in early (IE, margin calls), I'll end up in a liquidity crisis. Or more simply, what if Kraken just uses the BTC as collateral for normal loans from a bank? If they fail to pay them, then they'll fork over the client BTC.
        throwup 4y ago
        You're right, there is no way to cryptographically prove that there are no contracts external to the blockchain. The audit is from a purely "not your keys, not your coins" perspective. And there's no way to prove they won't go get some USD loans tomorrow either, since you can't cryptographically prove the future. Your defense against these tail risks is to remember, "not your keys, not your coins", and self-custody when you're not actively exchanging. In the end you do have to hope that the < 1 hour it takes you to exchange your coins and transfer them back to your own wallet doesn't overlap with the moment they decide to torpedo their 10+ year old business with no prior warning or red flags. But these are infinitesimally small tail risks.
- jcranmer 4y ago
  At the bottom of the proof-of-reserves page: > The procedure cannot identify any hidden encumbrances or prove that funds had not been borrowed for purposes of passing the audit. In other words, this is a fancier version of the kind of attestation that Tether makes, the ones that leave loopholes you can drive dump trucks through.
  - camgunz 4y ago
    > In other words, this is a fancier version of the kind of attestation that Tether makes, the ones that leave loopholes you can drive dump trucks through. 100% and this just drives me bonkers. I'm not entirely unsympathetic to wanting to avoid financial regulation, like while I disagree it's a good idea, I can understand wanting to build a system that is built on math and not people. Fine. But isn't the whole point of crypto radical transparency? As in: you know at all times where all the coins are and the details of every transaction that has ever occurred? Shouldn't this meet 100% of your auditing needs? Why are audits even useful? Well, they're really helpful if you want to run a shell game off chain, but still assure customers that you're not gambling with their money so they keep giving you more of it. Like, arguing in good faith here, this is just a worst of both worlds situation. You have an extremely slow financial transaction system that you still have to hand audit.
    - throwup 4y ago
      You're 100% right, and that bad feeling you have is a sign that you understand where both sides are coming from. This is why so many people say "not your keys, not your coin". Giving up control of your keys is never the best option, but if that's what you choose to do, audits might help you make the least bad choice out of those available.
    - pa7x1 4y ago
      You are absolutely right, but this highlights that what you are seeing these days with the failure of FTX and its associated fall-out is not a failure of cryptocurrencies or blockchain or any statement of its merits or demerits. It's a failure of traditional finance in an unregulated industry. This highlights how traditional finance is incredibly brittle and requires very strict regulation to have any semblance of resilience, when not failing anyway à la 2008.

throwup 4y ago

Kraken does at least. AIUI their auditor is given a snapshot of all account balances at a particular point in time, and builds a merkle tree. You can then reconstruct your expected merkle leaf and verify that your specific account was included in the tree. You can verify on the auditor's website, or you can do it by hand. Kraken's help page even has code snippets in Python/Go/etc to make it easy! More info: https://www.kraken.com/proof-of-reserves https://www.kraken.com/proof-of-reserves https://proof-of-reserves.trustexplorer.io/clients/kraken https://proof-of-reserves.trustexplorer.io/clients/kraken

DebtDeflation 4y ago
No, they do not. They only verify BTC and ETH, no other holdings, and they don't audit liabilities at all, meaning that they could be using your BTC as collateral for loans. Also, the audit they did last December was the second in 8 years and AKAIK they haven't done another since. Kraken is in no way "audited".
- throwup 4y ago
  Full of misinformation. > They only verify BTC and ETH Click the link and you see this isn't true: "ADA ADA.S BTC BTC.M DOT DOT.S DOT.P etc etc" > they don't audit liabilities at all All liabilities were verified by the auditors and included in the merkle tree, and as mentioned, all users can independently verify that their specific liabilities are present. What more would you expect? > the audit they did last December was the second in 8 years Their most recent audit was end of Q2 this year. They do audits semi-annually.
  - karpierz 4y ago
    > All liabilities were verified by the auditors and included in the merkle tree, and as mentioned, all users can independently verify that their specific liabilities are present. What more would you expect? Where in the report do they verify off-chain liabilities?
    - throwup 4y ago
      I'm still not quite sure you're after, but I guess it would be this quote on page 3: > 14) Compare the total liabilities from the Client Liability Report extracted from Kraken’s production database as observed within Procedure 5 to the total assets controlled by the Kraken custodied addresses (the “In-Kind Assets”) as of the specified date and time of the assessment time and calculate the collateralization ratio based on the In-Kind Asset-to-Client Liability mapping provided by Kraken Management
      - karpierz 4y ago
        That's measuring how much they owe clients (IE, deposits) against how much crypto they hold (IE, the crypto in wallets they hold). That doesn't at all capture the kinds of liabilities I'm asking about, which is debt external to the blockchain. Ex: I am Kraken. Someone deposits 1 BTC with me. I then sign a contract with someone else saying "You give me 1 BTC now, I will give you 1.2 BTC in a year". I then sell 1 BTC. In my wallet, I will have 1 BTC, exactly matching my client liabilities. But my total liability is 2.2 BTC. And if those contracts start calling in early (IE, margin calls), I'll end up in a liquidity crisis. Or more simply, what if Kraken just uses the BTC as collateral for normal loans from a bank? If they fail to pay them, then they'll fork over the client BTC.
        throwup 4y ago
        You're right, there is no way to cryptographically prove that there are no contracts external to the blockchain. The audit is from a purely "not your keys, not your coins" perspective. And there's no way to prove they won't go get some USD loans tomorrow either, since you can't cryptographically prove the future. Your defense against these tail risks is to remember, "not your keys, not your coins", and self-custody when you're not actively exchanging. In the end you do have to hope that the < 1 hour it takes you to exchange your coins and transfer them back to your own wallet doesn't overlap with the moment they decide to torpedo their 10+ year old business with no prior warning or red flags. But these are infinitesimally small tail risks.
jcranmer 4y ago
At the bottom of the proof-of-reserves page: > The procedure cannot identify any hidden encumbrances or prove that funds had not been borrowed for purposes of passing the audit. In other words, this is a fancier version of the kind of attestation that Tether makes, the ones that leave loopholes you can drive dump trucks through.
- camgunz 4y ago
  > In other words, this is a fancier version of the kind of attestation that Tether makes, the ones that leave loopholes you can drive dump trucks through. 100% and this just drives me bonkers. I'm not entirely unsympathetic to wanting to avoid financial regulation, like while I disagree it's a good idea, I can understand wanting to build a system that is built on math and not people. Fine. But isn't the whole point of crypto radical transparency? As in: you know at all times where all the coins are and the details of every transaction that has ever occurred? Shouldn't this meet 100% of your auditing needs? Why are audits even useful? Well, they're really helpful if you want to run a shell game off chain, but still assure customers that you're not gambling with their money so they keep giving you more of it. Like, arguing in good faith here, this is just a worst of both worlds situation. You have an extremely slow financial transaction system that you still have to hand audit.
  - throwup 4y ago
    You're 100% right, and that bad feeling you have is a sign that you understand where both sides are coming from. This is why so many people say "not your keys, not your coin". Giving up control of your keys is never the best option, but if that's what you choose to do, audits might help you make the least bad choice out of those available.
  - pa7x1 4y ago
    You are absolutely right, but this highlights that what you are seeing these days with the failure of FTX and its associated fall-out is not a failure of cryptocurrencies or blockchain or any statement of its merits or demerits. It's a failure of traditional finance in an unregulated industry. This highlights how traditional finance is incredibly brittle and requires very strict regulation to have any semblance of resilience, when not failing anyway à la 2008.