15 ms·

Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

114 points by sillysaurus2 13y ago

deleted 13y ago
[deleted]
sillysaurus2 13y ago
The developer is Gregory Maxwell, aka nullc. Here's a very interesting thread in which he proposes that the bitcoin community should demand that every bitcoin exchange (and every other type of service which can hold bitcoin on your behalf, like webwallets) continually prove that they are not fractional reserve. In other words, proof that if every user of the service simultaneously tries to withdraw all of their bitcoin, then the service would be able to honor all withdraw requests: http://www.reddit.com/r/Bitcoin/comments/1yj5b5/unverified_pastebin_gmaxwell_irc_log_mtgox_was/cfkze3p?context=1 http://www.reddit.com/r/Bitcoin/comments/1yj5b5/unverified_p... "I think that as a community we should start demanding these services continually prove that they are not fractional reserve. We cannot effectively eliminate the need for trust in these sorts of services, but we can certainly confine the exposure and eliminate a lot of this drama. With Bitcoin it's technically possible to prove an entity controls enough coin to cover its obligations— and even to do so in ways that don't leak other business information, and so we should. But this isn't something specific about MTGox, it's something we should demand from all services holding large amounts of third party Bitcoins. I wouldn't even suggest MTGox should do it first, rather— it sounds like a great move for their competition to differentiate themselves." Here's the takeaway: "This would leak the total holdings, and some small amount of data about the number of accounts and distribution of their funds, but far far less than all the account balances. Importantly, though— it could be implemented in a few hundred lines of python." In case anyone from Coinbase is reading: you have a unique opportunity to be the first webwallet service to implement this, and thereby make the entire bitcoin community instantly fall in love with you. It would also set a minimum standard of quality for webwallet services in general, which would add a lot of value to the bitcoin ecosystem. It seems like this might be a pretty big business opportunity.
- mjn 13y ago
  > The developer is Gregory Maxwell, aka nullc. This guy seems to be everywhere! He's a prolific Wikipedia contributor (administrator + many thousands of edits), and was also the guy behind the dump of a ton of pre-1923 JSTOR documents to the Pirate Bay, which in part helped pressure JSTOR to un-paywall its old/PD articles (http://arstechnica.com/tech-policy/2011/07/swartz-supporter-dumps-18592-jstor-docs-on-the-pirate-bay/ http://arstechnica.com/tech-policy/2011/07/swartz-supporter-...).
  - chris_wot 13y ago
    The guy was amazing on Wikipedia.
patcon 13y ago
Not to discredit the very capable developers discussing this, but in the interest for giving credit where credit is due, didn't Peter Todd suggest this back in his Bitcoin 2013 presentation on off-chain transactions? I seem to remember him explaining something similar on a rooftop patio in Toronto last spring after a Bitcoin Toronto meetup. EDIT: http://www.youtube.com/watch?v=4d3LA8KpdMQ#t=6m45s http://www.youtube.com/watch?v=4d3LA8KpdMQ#t=6m45s
- nullc 13y ago
  I believe this was most extensively discussed as part of a long chat that Peter Todd was a part of, so no surprise that you've seen him talk about it. Off-chain banks stuff has been a long term pet interest of his. In that discussion we applied a merkel-sum tree data-structure— a pet datastructure that I'd previously proposed for making compact proofs of blockchain invalidity in Bitcoin (in order to make a future bitcoin world where no one runs full nodes safe from inflation and theft by miners)— to PT's bank fraud proofing application. You may find the log interesting: https://people.xiph.org/~greg/bitcoin-wizards-fraud-proof.log.txt https://people.xiph.org/~greg/bitcoin-wizards-fraud-proof.lo... Search for "auditable off-chain transactions" and "Merkle-sum-tree" (I left in a lot of unrelated stuff since it makes the meandering conversation make a bit more sense. Though a lot of this continues a long running dialog about cryptographic-wankery that has been going on for years) Ultimately these schemes require the use of a jamming free broadcast network of some kind... otherwise they run into the same problems certificate transparency has where you can substitute the commitment on the fly. Fortunately, Bitcoin provides a global consensus mechanism which could be used to directly attach the commitment to the coins being spoken for.
- petertodd 13y ago
  I'm pretty sure I remember either Gregory Maxwell or Andrew Miller suggesting it to me first, and I think it might be the latter's idea originally. (at least in the Bitcoin space) Andrew has done a lot of work on "merkelizing" data structures: http://www.cs.umd.edu/~amiller/gpads/ http://www.cs.umd.edu/~amiller/gpads/
higherpurpose 13y ago
Fractional reserve? I don't like that. It's like building a house of cards or a ponzi scheme. You shouldn't be able to say you have 10x of the value you actually have.
- jeremyjh 13y ago
  And that is the entire purpose of the proposal.
- minimax 13y ago
  Right? Banks making loans? It's preposterous.
  - waterlesscloud 13y ago
    Fractional reserve is sort of a misappropriated term as applied to bitcoin exchanges. Such exchanges aren't making loans, so where would the money be going? There's no good reason for them not to have 100% of the funds in reserve.
    - pmorici 13y ago
      Some of them offer margin trading which is a loan.
      - nullc 13y ago
        This proposal doesn't prevent loans and fractional reserve or whatever schemes people may want. What it does is makes it much harder to fail to disclose the truth of the matter. What kinds of terms people choose to transact under is their own business— but all the better when we can be more confident those terms are being followed.
  - dmm 13y ago
    Full reserve banks are possible. You just have to maturity match everything, meaning every loan of term t has a matching deposit with a maturity of t. Deposits in demand accounts could not be lended. I have no idea whether this is a good idea or if it would work as a business.
infruset 13y ago
At first I was worried of what would happen if the exchange introduced fake nodes with negative balances at the bottom of the tree, but there would be no way for them to hide that without the first real customer up to the root finding out (there would have to be a negative node that he/she could see). This sounds like a great idea!
- nullc 13y ago
  Unless the negative valued customer and the surrounding customers never logged in... But thats a limitation of the scheme that can't be avoided. If a user never logs in you could just steal just their balance (and correctly set it to zero). You also must make sure that all customers are seeing the same root, and that you can't do funny business like constantly update it to swap out which customers you're robbing. (e.g. it should be a daily or weekly updated thing).
  - infruset 13y ago
    You've got a point, the root of the tree could be made available to the main charting sites.. or even weekly written into the blockchain. As for the negative values, I wasn't thinking of robbing anyone, but just pretending you are solvent when really you're not. I'm not sure I see what you mean by "swap out which customers you're robbing", could you expand?
    - nullc 13y ago
      E.g. say you have two customers with a balance of 100. You report the total is 100— so 100 BTC has gone missing. When customer A logs in you give them one root and show them their balance (and B has a balance of 0). When customer B logs in— oops balances just update— you show them a new root, and in that one B has a balance of 100. So you need to pin the commitments strongly enough so that the prover can't swap them out at will.
      - infruset 13y ago
        Thanks, I get it now. Hadn't thought of that. Of course, if many people were connected at the same time, this would quickly become perilous gymnastics for the exchange.
minimax 13y ago
This doesn't give you a way to validate your dollar deposits. In other words a dishonest exchange operator could misappropriate your dollar deposits and this scheme wouldn't tell you anything about it.
- teraflop 13y ago
  The hash-tree scheme described here would work equally well for non-Bitcoin currencies, if I'm understanding it correctly. The only thing missing is the ability to prove ownership of the actual funds backing that tree. So what you're really complaining about is that there are no banks that offer digitally-signed attestation of account balances.
  - jnbiche 13y ago
    >no banks that offer digitally-signed attestation of account balances. Why is this? Seriously, that alone could prevent so much fraud and misuse of funds. Every public company could have a digitally-signed bank balance, updated in real time.
    - vbuterin 13y ago
      Because then any guy with a laptop and coding skills could use the API to set up almost any kind of fiat currency-based money services or currency exchange business, and we can't have people doing that without million-dollar MSB/MT licenses!
- nullc 13y ago
  Yup. This is an example of how Bitcoin is superior to USD— USD is not so readily subject to cryptographic proof. :) You could use it to show that USD obligations jive with third party audits, insurance, or accounts in a bank if you could get the bank to produce signed attestations... though the trust isn't eliminated there, just shuffled around.
pedrohrcunha 13y ago
sweet! already pleading it to brazilian exchanges.
kumarski 13y ago
What bitcoin exchanges do HN readers trust? I've been using http://coinmkt.com http://coinmkt.com I regrettably used MtGox.com. I'm kicking myself now.
- pmorici 13y ago
  If you want to buy coins to use I'd go with Coinbase at least to get started. If you want to day trade Kraken looks really promising if they are supported in your jurisdiction. Bitstamp has a decent track record though their local give me pause. Coinsetter is also pretty well put together if all you want to do is pair trade but you can't do true exchange on there. I've tried coinmkt but I don't like it. Their fees aren't great their deposit and withdrawal methods are limited and there are fees on deposits and withdrawals at least there were when I gave it a try.
  - jnbiche 13y ago
    >Bitstamp has a decent track record though their local[e] give me pause. I'd say Bitstamp has a very good track record, and what's wrong with Slovenia? It's probably about on the level of the Czech Republic in terms of economic freedom, development, level of corruption (relatively low), output, business practices, etc. Would doing business with a Czech company make you nervous? In business culture, Slovenia looks toward Germany more than toward the former Eastern Block (of which it was never a part). I mean, Bitstamp's owners are public people. I feel pretty confident that they're not going to run off with their depositors money. Is there something else that you're concerned about? But I agree, if you want to just buy coins, Coinbase is a good start. And Kraken is looking very good, too, particularly if you're a serious trader (that's who they appear to target).
    - pmorici 13y ago
      I don't disagree my reservation is more about having to do an international wire transfer to get money in and out of Bitstmap. Also since they are outside of the US you are going to have to submit FBAR paperwork to the US government if your account with them ever gets over 10k at any time during the year. In the unlikely chance something did go wrong legal remedies would be more difficult since they are outside the US.
jrockway 13y ago
It turns out that MtGox used all the deposits to buy Magic cards. They now have the world's most excellent cube. We all should have seen this coming.
M4v3R 13y ago
Or, just use a system like we use on Bitalo, where fractional reserves are impossible because of use of multi-signature Bitcoin addresses, which means funds are specifically tied to user wallets and exchange operators cannot use them without user's signing all transactions by himself.
- nullc 13y ago
  This requires one transaction per trade, effectively. While systems like that have many applications— and should be used where they can, they aren't a replacement for large scale markets like MTGox or for ultra-low-cost instant payment systems.
- stingraycharles 13y ago
  Exactly, this is specifically where that feature is designed for: it makes you your own arbiter of what an exchange wants to do with your money.
- wmf 13y ago
  It's not clear that day traders are willing to pay the fees to put their transactions on the blockchain.
  - M4v3R 13y ago
    They are paying much higher fees for trading on "normal" exchanges. Transaction fee is only 0.0001 BTC, normally you pay WAY more for trading on Mt. Gox/Bitstamp.
- gnaritas 13y ago
  The blockchain can't handle the transaction volume of currency exchanges; that just won't work.
  - mynewwork 13y ago
    Wait, the blockchain can't handle the transaction volume of the trades happening today? What happens as businesses (overstock, etc) start accepting bitcoin? Will bitcoin never be able to handle to volume of an amazon or walmart?
snake_plissken 13y ago
Can't all of this information be found in the block chain if you know the addresses the exchanges are using?
- nullc 13y ago
  No. In theory if you know all the addresses you know how many coins they have— but to know the exchange is not fractional you must also know something about its obligations.
aston 13y ago
Say you were a shady Bitcoin banker with 5000 BTC in deposits, and you wanted to steal 1000 while still looking like you're on the up-and-up by implementing this idea. First, you announce that you only have 4000 BTC in deposits. Then you build this tree, and at the very bottom layer you add a node with a -1000 balance. You pair that node with your (or a conspirator's) real node holding more than 1000 so that any node above yours (read: everyone else) sees a positive balance at every point in the tree. Everyone can verify they're in the tree, the numbers add up to what you claimed publicly, but you're now successfully running a fractional reserve! And the only way to uncover such a scheme would be to publish all of the balances for every account. Am I missing something? Edit for clarity: the node you pair with is your own, so that no real user sees the negative sum.
- tlrobinson 13y ago
  Discussed here: https://news.ycombinator.com/item?id=7278325 https://news.ycombinator.com/item?id=7278325
- deleted 13y ago
  [deleted]
- vbuterin 13y ago
  Suppose the balance sheet is: [ -1000, 1000, 2000, 2000 ] The Merkle tree is: [ -1000, 1000, 2000, 2000 ] [ 0, 4000 ] [ 4000 ] You actually owe 5000 BTC, but it seems like you owe 4000 BTC. Seems so far so good. The problem is, what happens if you try to take advantage of this opportunity. Case 1: other people withdraw first. [ -1000, 1000, 0, 0 ] [ 0, 0 ] [ 0 ] Nobody knows that anything nefarious has gone on. However, everyone else has successfully gotten their money out so you've actually defrauded no one. Case 2: you withdraw first. [ -1000, 0, 2000, 2000 ] [ -1000, 4000 ] [ 3000 ] Now, the other 2 users actually can see that something is wrong, because the Merkle branch will have a -1000 BTC node sticking out. So in theory, as long as there exist users who don't check their Merkle branches, and those users are identifiable, it probably is possible to run a slight fractional reserve undetected. So the protocol is suboptimal. But it's not really "broken". I do wonder if it can be improved though, perhaps with some kind of ZKP protocol.
tlrobinson 13y ago
The big problem with this is convincing businesses to publicize their total customer deposits, which is extremely interesting information to competitors. Though it could be a good way for new/small exchanges to differentiate themselves and gain trust of the community, which could force larger and larger exchanges to do the same until it's common practice (as mentioned has happened with provably-fair gambling sites)
Sambdala 13y ago
If anyone is interesting in helping, I'm going to spend my evening trying to implement this here: https://github.com/ConceptPending/proveit https://github.com/ConceptPending/proveit My email is in my profile, and I'm happy to Skype chat with anyone who wants to help.
- Sambdala 13y ago
  The basic implementation is now complete. I'll flesh it out a bit better tomorrow.

114 points by sillysaurus2 13y ago

deleted 13y ago

[deleted]

The developer is Gregory Maxwell, aka nullc. Here's a very interesting thread in which he proposes that the bitcoin community should demand that every bitcoin exchange (and every other type of service which can hold bitcoin on your behalf, like webwallets) continually prove that they are not fractional reserve. In other words, proof that if every user of the service simultaneously tries to withdraw all of their bitcoin, then the service would be able to honor all withdraw requests: http://www.reddit.com/r/Bitcoin/comments/1yj5b5/unverified_pastebin_gmaxwell_irc_log_mtgox_was/cfkze3p?context=1 http://www.reddit.com/r/Bitcoin/comments/1yj5b5/unverified_p... "I think that as a community we should start demanding these services continually prove that they are not fractional reserve. We cannot effectively eliminate the need for trust in these sorts of services, but we can certainly confine the exposure and eliminate a lot of this drama. With Bitcoin it's technically possible to prove an entity controls enough coin to cover its obligations— and even to do so in ways that don't leak other business information, and so we should. But this isn't something specific about MTGox, it's something we should demand from all services holding large amounts of third party Bitcoins. I wouldn't even suggest MTGox should do it first, rather— it sounds like a great move for their competition to differentiate themselves." Here's the takeaway: "This would leak the total holdings, and some small amount of data about the number of accounts and distribution of their funds, but far far less than all the account balances. Importantly, though— it could be implemented in a few hundred lines of python." In case anyone from Coinbase is reading: you have a unique opportunity to be the first webwallet service to implement this, and thereby make the entire bitcoin community instantly fall in love with you. It would also set a minimum standard of quality for webwallet services in general, which would add a lot of value to the bitcoin ecosystem. It seems like this might be a pretty big business opportunity.

mjn 13y ago
> The developer is Gregory Maxwell, aka nullc. This guy seems to be everywhere! He's a prolific Wikipedia contributor (administrator + many thousands of edits), and was also the guy behind the dump of a ton of pre-1923 JSTOR documents to the Pirate Bay, which in part helped pressure JSTOR to un-paywall its old/PD articles (http://arstechnica.com/tech-policy/2011/07/swartz-supporter-dumps-18592-jstor-docs-on-the-pirate-bay/ http://arstechnica.com/tech-policy/2011/07/swartz-supporter-...).
- chris_wot 13y ago
  The guy was amazing on Wikipedia.

patcon 13y ago

Not to discredit the very capable developers discussing this, but in the interest for giving credit where credit is due, didn't Peter Todd suggest this back in his Bitcoin 2013 presentation on off-chain transactions? I seem to remember him explaining something similar on a rooftop patio in Toronto last spring after a Bitcoin Toronto meetup. EDIT: http://www.youtube.com/watch?v=4d3LA8KpdMQ#t=6m45s http://www.youtube.com/watch?v=4d3LA8KpdMQ#t=6m45s

nullc 13y ago
I believe this was most extensively discussed as part of a long chat that Peter Todd was a part of, so no surprise that you've seen him talk about it. Off-chain banks stuff has been a long term pet interest of his. In that discussion we applied a merkel-sum tree data-structure— a pet datastructure that I'd previously proposed for making compact proofs of blockchain invalidity in Bitcoin (in order to make a future bitcoin world where no one runs full nodes safe from inflation and theft by miners)— to PT's bank fraud proofing application. You may find the log interesting: https://people.xiph.org/~greg/bitcoin-wizards-fraud-proof.log.txt https://people.xiph.org/~greg/bitcoin-wizards-fraud-proof.lo... Search for "auditable off-chain transactions" and "Merkle-sum-tree" (I left in a lot of unrelated stuff since it makes the meandering conversation make a bit more sense. Though a lot of this continues a long running dialog about cryptographic-wankery that has been going on for years) Ultimately these schemes require the use of a jamming free broadcast network of some kind... otherwise they run into the same problems certificate transparency has where you can substitute the commitment on the fly. Fortunately, Bitcoin provides a global consensus mechanism which could be used to directly attach the commitment to the coins being spoken for.
petertodd 13y ago
I'm pretty sure I remember either Gregory Maxwell or Andrew Miller suggesting it to me first, and I think it might be the latter's idea originally. (at least in the Bitcoin space) Andrew has done a lot of work on "merkelizing" data structures: http://www.cs.umd.edu/~amiller/gpads/ http://www.cs.umd.edu/~amiller/gpads/

higherpurpose 13y ago

Fractional reserve? I don't like that. It's like building a house of cards or a ponzi scheme. You shouldn't be able to say you have 10x of the value you actually have.

jeremyjh 13y ago
And that is the entire purpose of the proposal.
minimax 13y ago
Right? Banks making loans? It's preposterous.
- waterlesscloud 13y ago
  Fractional reserve is sort of a misappropriated term as applied to bitcoin exchanges. Such exchanges aren't making loans, so where would the money be going? There's no good reason for them not to have 100% of the funds in reserve.
  - pmorici 13y ago
    Some of them offer margin trading which is a loan.
    - nullc 13y ago
      This proposal doesn't prevent loans and fractional reserve or whatever schemes people may want. What it does is makes it much harder to fail to disclose the truth of the matter. What kinds of terms people choose to transact under is their own business— but all the better when we can be more confident those terms are being followed.
- dmm 13y ago
  Full reserve banks are possible. You just have to maturity match everything, meaning every loan of term t has a matching deposit with a maturity of t. Deposits in demand accounts could not be lended. I have no idea whether this is a good idea or if it would work as a business.

infruset 13y ago

At first I was worried of what would happen if the exchange introduced fake nodes with negative balances at the bottom of the tree, but there would be no way for them to hide that without the first real customer up to the root finding out (there would have to be a negative node that he/she could see). This sounds like a great idea!

nullc 13y ago
Unless the negative valued customer and the surrounding customers never logged in... But thats a limitation of the scheme that can't be avoided. If a user never logs in you could just steal just their balance (and correctly set it to zero). You also must make sure that all customers are seeing the same root, and that you can't do funny business like constantly update it to swap out which customers you're robbing. (e.g. it should be a daily or weekly updated thing).
- infruset 13y ago
  You've got a point, the root of the tree could be made available to the main charting sites.. or even weekly written into the blockchain. As for the negative values, I wasn't thinking of robbing anyone, but just pretending you are solvent when really you're not. I'm not sure I see what you mean by "swap out which customers you're robbing", could you expand?
  - nullc 13y ago
    E.g. say you have two customers with a balance of 100. You report the total is 100— so 100 BTC has gone missing. When customer A logs in you give them one root and show them their balance (and B has a balance of 0). When customer B logs in— oops balances just update— you show them a new root, and in that one B has a balance of 100. So you need to pin the commitments strongly enough so that the prover can't swap them out at will.
    - infruset 13y ago
      Thanks, I get it now. Hadn't thought of that. Of course, if many people were connected at the same time, this would quickly become perilous gymnastics for the exchange.

minimax 13y ago

This doesn't give you a way to validate your dollar deposits. In other words a dishonest exchange operator could misappropriate your dollar deposits and this scheme wouldn't tell you anything about it.

teraflop 13y ago
The hash-tree scheme described here would work equally well for non-Bitcoin currencies, if I'm understanding it correctly. The only thing missing is the ability to prove ownership of the actual funds backing that tree. So what you're really complaining about is that there are no banks that offer digitally-signed attestation of account balances.
- jnbiche 13y ago
  >no banks that offer digitally-signed attestation of account balances. Why is this? Seriously, that alone could prevent so much fraud and misuse of funds. Every public company could have a digitally-signed bank balance, updated in real time.
  - vbuterin 13y ago
    Because then any guy with a laptop and coding skills could use the API to set up almost any kind of fiat currency-based money services or currency exchange business, and we can't have people doing that without million-dollar MSB/MT licenses!
nullc 13y ago
Yup. This is an example of how Bitcoin is superior to USD— USD is not so readily subject to cryptographic proof. :) You could use it to show that USD obligations jive with third party audits, insurance, or accounts in a bank if you could get the bank to produce signed attestations... though the trust isn't eliminated there, just shuffled around.

pedrohrcunha 13y ago

sweet! already pleading it to brazilian exchanges.

kumarski 13y ago

What bitcoin exchanges do HN readers trust? I've been using http://coinmkt.com http://coinmkt.com I regrettably used MtGox.com. I'm kicking myself now.

pmorici 13y ago
If you want to buy coins to use I'd go with Coinbase at least to get started. If you want to day trade Kraken looks really promising if they are supported in your jurisdiction. Bitstamp has a decent track record though their local give me pause. Coinsetter is also pretty well put together if all you want to do is pair trade but you can't do true exchange on there. I've tried coinmkt but I don't like it. Their fees aren't great their deposit and withdrawal methods are limited and there are fees on deposits and withdrawals at least there were when I gave it a try.
- jnbiche 13y ago
  >Bitstamp has a decent track record though their local[e] give me pause. I'd say Bitstamp has a very good track record, and what's wrong with Slovenia? It's probably about on the level of the Czech Republic in terms of economic freedom, development, level of corruption (relatively low), output, business practices, etc. Would doing business with a Czech company make you nervous? In business culture, Slovenia looks toward Germany more than toward the former Eastern Block (of which it was never a part). I mean, Bitstamp's owners are public people. I feel pretty confident that they're not going to run off with their depositors money. Is there something else that you're concerned about? But I agree, if you want to just buy coins, Coinbase is a good start. And Kraken is looking very good, too, particularly if you're a serious trader (that's who they appear to target).
  - pmorici 13y ago
    I don't disagree my reservation is more about having to do an international wire transfer to get money in and out of Bitstmap. Also since they are outside of the US you are going to have to submit FBAR paperwork to the US government if your account with them ever gets over 10k at any time during the year. In the unlikely chance something did go wrong legal remedies would be more difficult since they are outside the US.

jrockway 13y ago

It turns out that MtGox used all the deposits to buy Magic cards. They now have the world's most excellent cube. We all should have seen this coming.

M4v3R 13y ago

Or, just use a system like we use on Bitalo, where fractional reserves are impossible because of use of multi-signature Bitcoin addresses, which means funds are specifically tied to user wallets and exchange operators cannot use them without user's signing all transactions by himself.

nullc 13y ago
This requires one transaction per trade, effectively. While systems like that have many applications— and should be used where they can, they aren't a replacement for large scale markets like MTGox or for ultra-low-cost instant payment systems.
stingraycharles 13y ago
Exactly, this is specifically where that feature is designed for: it makes you your own arbiter of what an exchange wants to do with your money.
wmf 13y ago
It's not clear that day traders are willing to pay the fees to put their transactions on the blockchain.
- M4v3R 13y ago
  They are paying much higher fees for trading on "normal" exchanges. Transaction fee is only 0.0001 BTC, normally you pay WAY more for trading on Mt. Gox/Bitstamp.
gnaritas 13y ago
The blockchain can't handle the transaction volume of currency exchanges; that just won't work.
- mynewwork 13y ago
  Wait, the blockchain can't handle the transaction volume of the trades happening today? What happens as businesses (overstock, etc) start accepting bitcoin? Will bitcoin never be able to handle to volume of an amazon or walmart?

snake_plissken 13y ago

Can't all of this information be found in the block chain if you know the addresses the exchanges are using?

nullc 13y ago
No. In theory if you know all the addresses you know how many coins they have— but to know the exchange is not fractional you must also know something about its obligations.

aston 13y ago

Say you were a shady Bitcoin banker with 5000 BTC in deposits, and you wanted to steal 1000 while still looking like you're on the up-and-up by implementing this idea. First, you announce that you only have 4000 BTC in deposits. Then you build this tree, and at the very bottom layer you add a node with a -1000 balance. You pair that node with your (or a conspirator's) real node holding more than 1000 so that any node above yours (read: everyone else) sees a positive balance at every point in the tree. Everyone can verify they're in the tree, the numbers add up to what you claimed publicly, but you're now successfully running a fractional reserve! And the only way to uncover such a scheme would be to publish all of the balances for every account. Am I missing something? Edit for clarity: the node you pair with is your own, so that no real user sees the negative sum.

tlrobinson 13y ago
Discussed here: https://news.ycombinator.com/item?id=7278325 https://news.ycombinator.com/item?id=7278325
deleted 13y ago
[deleted]
vbuterin 13y ago
Suppose the balance sheet is: [ -1000, 1000, 2000, 2000 ] The Merkle tree is: [ -1000, 1000, 2000, 2000 ] [ 0, 4000 ] [ 4000 ] You actually owe 5000 BTC, but it seems like you owe 4000 BTC. Seems so far so good. The problem is, what happens if you try to take advantage of this opportunity. Case 1: other people withdraw first. [ -1000, 1000, 0, 0 ] [ 0, 0 ] [ 0 ] Nobody knows that anything nefarious has gone on. However, everyone else has successfully gotten their money out so you've actually defrauded no one. Case 2: you withdraw first. [ -1000, 0, 2000, 2000 ] [ -1000, 4000 ] [ 3000 ] Now, the other 2 users actually can see that something is wrong, because the Merkle branch will have a -1000 BTC node sticking out. So in theory, as long as there exist users who don't check their Merkle branches, and those users are identifiable, it probably is possible to run a slight fractional reserve undetected. So the protocol is suboptimal. But it's not really "broken". I do wonder if it can be improved though, perhaps with some kind of ZKP protocol.

tlrobinson 13y ago

The big problem with this is convincing businesses to publicize their total customer deposits, which is extremely interesting information to competitors. Though it could be a good way for new/small exchanges to differentiate themselves and gain trust of the community, which could force larger and larger exchanges to do the same until it's common practice (as mentioned has happened with provably-fair gambling sites)

Sambdala 13y ago

If anyone is interesting in helping, I'm going to spend my evening trying to implement this here: https://github.com/ConceptPending/proveit https://github.com/ConceptPending/proveit My email is in my profile, and I'm happy to Skype chat with anyone who wants to help.

Sambdala 13y ago
The basic implementation is now complete. I'll flesh it out a bit better tomorrow.