<p dir="ltr">When a big centralized exchange fails, a recurrent concern is if we can utilize cryptographic approaches to remedy the problem. Rather than relying solely on "fiat" methods such as government licenses, auditors, and investigating corporate governance, exchanges could generate cryptographic proofs demonstrating that the funds held on-chain are sufficient to cover their liabilities to their users. These proofs are often referred to as Proof of Reserve.&nbsp;</p><h2>Chainlink Proof of Reserve</h2><p dir="ltr">When it comes to robustness, transparency, and security, Chainlink is regarded as the industry standard. Their solution uses trustless smart contracts to deliver accurate data. By using a decentralized oracle network, or DON, to combine data from many feeds or nodes and provide a real value, it does this. The data is then sent on-chain by the smart contract and used for things like price feeds, weather reports, and other things. Verifiable Random Feature, also a product from them, is a solution for genuine tamper-proof randomness that may be utilized in lotteries, games, character or NFT constructions, qualities, etc.</p><p class="prosemirror-p-center"><img src="https://cdn.builder.news/news/11ed71667c110a6ba8e6023f659fee92.jpg" alt="Chainlink offlink proof of reserve" title="Chainlink offlink proof of reserve" width="600" height="240" class="lykafe0"></p><p class="prosemirror-p-center"><em>Source: Chainlink</em></p><p dir="ltr">Numerous chains and hundreds of DApps already have Chainlink fully integrated.</p><p dir="ltr">Their Proof of Reserve offering offers on-chain assets and reserves real-time reconciliation. Smart contracts have completely automated it. It may set off a "circuit breaker" to stop the creation of new on-chain assets until the reserve on the off-chain is equal to the asset's value or exceeds it.</p><p dir="ltr">Trust in the cryptocurrency industry is currently declining. How can we be certain that we will be able to access our money on Coinbase or whichever huge CeFi exchange comes next? How can we be sure that these CEX will have enough liquidity to go around if a large group of users or a customer institution wants to withdraw money all at once?</p><p dir="ltr">The Chainlink Proof of Reserve product "PROOF" that a financial institution has sufficient reserves to support what is claimed to be on-chain. By doing this, imbalances in the leverage limits for trading, lending, and borrowing would have been recognized, at least to the corporation.</p><p class="prosemirror-p-center"><img src="https://cdn.builder.news/news/11ed71667c111209a8e6023f659fee92.jpg" alt="Chainlink automated audit" title="Chainlink automated audit" width="600" height="411" class="lykafe1"></p><p class="prosemirror-p-center"><em>Source: Chainlink</em></p><h2>How Chainlink Proof of Reserve alert CEX insolvency</h2><h3>The case of FTX</h3><p dir="ltr">Chainlink's proof of reserve is a real-time, automated smart contract that reflects genuine liquidity to a cryptocurrency. If the liquidity causes a situation of under-collateralization, or a threshold of such, the smart contract can block the minting of on-chain assets. The smart contract can then let minting resume if either the pace of emissions or the deposits of new collateral reduces.</p><p dir="ltr">We use the word "threshold" because FTX and its trading business Alameda Research, for instance, were engaged in leveraged trading. So there would have been some degree of margin trading that was presumably judged "within normal boundaries."</p><p dir="ltr">The FTT token was the catalyst for FTX's public collapse (which probably occurred earlier inside).&nbsp; Alameda incurred millions, if not billions, of dollars in trading losses and risk exposure to Terra and 3AC in September 2022. FTX tried to fund Alameda's $4 billion loss with the FTT token. When Binance opted to abandon this connected risk to FTT in November, there was insufficient off-chain collateral to address the liquidity constraint, leaving the CEX in a negative cashflow condition. As a result of the large effort to exit risk, individual investors put kerosene on the fire and sought to depart as well.</p><p dir="ltr">The answer may have been caught (or perhaps was) with FTX/Alameda Research risk exposure to Terra and 3AC. This sharp and unexpected decline in liquidity should have served as a warning to allow reserves to catch up to liquidity. The Proof of Reserve product would have accomplished this, and perhaps even prevented the liquidity issue from growing from millions to billions.</p><h3>Other use cases</h3><p dir="ltr">As Proof of Reserve may give transparency, confidence in the final tokenization of nearly any asset can be re-established, even if such assets are normally illiquid in traditional markets: precious metals, derivatives, autos, real estate, mortgages, debt pools, and so on. Smart contracts may (and are) being developed to offer not just real-time evidence of reserve assets, but also fees for the transfer or storage of such assets or private equities. Big organizations used to dealing with macro assets may find this confidence in fully or over-collateralized tokenized commodities appealing.</p><p dir="ltr">It can, for example, minimize attack vectors and safeguard on-chain assets from being massively de-pegged from off-chain reserves, hence avoiding infinite minting. The native coin may degrade based on circulating volume if a blockchain emits without a reserve feedback loop.</p><p dir="ltr">Stablecoin, for example, is now being used for liquidity on- and off-ramps due to its 1:1 redemption. Current collateralized stablecoins can give rise to new forms of stablecoins with built-in safeguards such as paused withdrawals, on-chain communications, digital signatures for accountability, or a halt in minting in the case of a liquidity mismatch.</p><p dir="ltr">Centralized exchanges are vulnerable to bankruptcy or insolvency. These exchanges can demonstrate that they have the assets to cover all customer money by providing proof of reserve. The Proof of Reserve architecture facilitates compliance and regulation for present and future centralized and decentralized exchanges. This will assist to preserve client assets and provide investors with peace of mind. Proof of reserve can also assist to build confidence in centralized exchanges, leading to more people utilizing them.</p><h2>ZK SNARK and its implementation on Binance</h2><p dir="ltr"><strong>Previous implementations</strong></p><p dir="ltr">The first attempts by exchanges to cryptographically establish that they are not defrauding their consumers date back quite some time. MtGox, the then-largest Bitcoin exchange, demonstrated its finances in 2011 by sending a transaction that sent 424242 BTC to a pre-announced address. Discussions on how to tackle the opposite side of the problem, establishing the total quantity of clients' deposits, began in 2013. If you can demonstrate that customers' deposits equal X ("proof of liabilities") and that you control the private keys to X coins ("proof of assets"), you have proof of solvency: you've demonstrated that the exchange has the funds to repay all of its depositors.</p><p dir="ltr">The Merkle tree approach is the following invention, motivated by the need to protect anonymity. The Merkle tree method entails creating a Merkle sum tree from the database of customer balances. Each node in a Merkle sum tree is a (balance, hash) pair. Individual customers' balances and salted name hashes are represented by the leaf nodes in the bottom layer. The balance and hash of each higher-layer node are equal to the total of the two balances and hashes below it. A Merkle sum proof is a "branch" of the tree, like a Merkle proof, made up of the sister nodes that line the path from a leaf to the root.</p><p dir="ltr">Each user would receive a Merkle sum verification of their balance from the exchange. The user would then be certain that their balance is accurately reflected in the total.</p><h2>ZK-SNARKs technology</h2><h3>Shiny tech</h3><p dir="ltr">ZK-SNARKs are an extremely strong technology. ZK-SNARKs may become a general-purpose technology so strong that it will entirely steamroll a slew of application-specific solutions devised decades ago for a slew of issues. So, of course, ZK-SNARKs may be used to dramatically simplify and increase privacy in proof-of-liabilities protocols.</p><p dir="ltr">We can use a ZK-SNARK to verify that all balances in the tree are non-negative and sum up to some stated amount by putting all users' deposits into a Merkle tree (or, even easier, a KZG commitment).&nbsp;</p><p dir="ltr">We may use a special-purpose ZK-SNARK to verify the sum and non-negativity of balances in the aforementioned KZG. Constraint systems like this may be modified to more complicated scenarios with just a few new equations. Individual users with negative balances, for example, are permitted in a leverage trading system if they have enough other assets to cover the money with sufficient collateralization margin. A SNARK might be used to demonstrate this more complex limitation, guaranteeing consumers that the exchange is not putting their assets at risk by surreptitiously exempting other users from the regulations.</p><p dir="ltr">In the long run, this type of ZK proof of liabilities might be employed not just for client deposits at exchanges, but also for lending in general. Anyone who takes out a loan would add a record to a polynomial or tree holding that debt, and the root of that structure would be broadcast on-chain. This would allow anybody looking for a loan ZK to demonstrate to the lender that they have not taken out too many previous loans. Legal innovation may eventually make loans that have been pledged in this manner more valuable than ones that have not.</p><h3>The problems and solutions</h3><p dir="ltr">This basic proof-of-assets approach has two practical issues:</p><ul><li><p dir="ltr">Managing Cold Storage</p></li><li><p dir="ltr">Collateral dual-use</p></li></ul><p dir="ltr">For security concerns, most exchanges retain the vast bulk of user money in "cold storage": on offline computers where transactions must be manually signed and sent to the internet.</p><p dir="ltr">Because of the huge stakes, the security methods employed by exchanges are even crazier, frequently involving the utilization of multi-party computation across numerous computers to further decrease the possibility of an attack against a single system compromising a key. Making even a single additional message to prove control of an address is a costly process with this sort of setup.</p><p dir="ltr">An exchange can take one of several paths:</p><ul><li><p dir="ltr">Keep a few public addresses for long-term use. The exchange would produce a few addresses, publish a proof of ownership for each address once, and then utilize those addresses again. This is by far the easiest solution, however, it does impose certain limitations on how security and privacy may be maintained.</p></li><li><p dir="ltr">Have a lot of addresses, and prove a few at random. The exchange would contain multiple addresses, with each address perhaps being used just once and then retired after a single transaction. In this situation, the exchange may have a system in place where a few addresses are randomly chosen and must be "opened" to verify ownership. Some exchanges now do something similar with an auditor, but in theory, this process might be totally automated.</p></li><li><p dir="ltr">ZKP choices that are more sophisticated: For example, an exchange may configure all of its addresses to be 1-of-2 multisigs, with one key unique to each address and the other a blinded version of some "grand" emergency backup key kept in some convoluted but extremely secure manner, such as a 12-of-16 multisig. To maintain anonymity and avoid disclosing the whole set of its addresses, the exchange might even execute a zero-knowledge proof across the blockchain, proving the total balance of all addresses with this format on the chain.</p></li></ul><p dir="ltr">One more question: can you conduct proof-of-assets on fiat? Exchanges hold both cryptocurrency and fiat currencies within the banking system. Yes, but such a method would necessarily rely on "fiat" trust models: the bank can certify to balances, auditors may attest to balance sheets, and so on. Since fiat is not cryptographically traceable, this is the most that can be done within the constraints of the system, but it is still worthwhile.</p><p dir="ltr">.An alternate method would be to clearly distinguish between the organization that manages the exchange and deals with asset-backed stablecoins like USDC and the entity that handles the process of transferring money between the cryptocurrency and conventional banking systems (USDC itself).</p><h2>New idea: Can CEX become non-custodial?</h2><p dir="ltr">Assume we want to take a step further: we don't only want to show that the exchange has the finances to repay its users. Rather, we aim to stop the exchange from entirely taking users' funds.</p><p dir="ltr">Plasma, a scaling solution popular in Ethereum research circles in 2017 and 2018, was the first major effort at this. Plasma operates by dividing the balance into separate "coins," each of which is allocated an index and resides in a specific place in the Merkle tree of a Plasma block. Making a successful coin transfer necessitates inserting a transaction into the right place of a tree, the root of which is broadcast on-chain.</p><p class="prosemirror-p-center"><img src="https://cdn.builder.news/news/11ed71667c1116a7a8e6023f659fee92.jpg" alt="Plasma merchanism" title="Plasma merchanism" width="600" height="252" class="lykafe2"></p><p class="prosemirror-p-center"><em>Source: Vitalik</em></p><p dir="ltr">OmiseGo sought to create a decentralized exchange based on this protocol, however, they have subsequently switched to new concepts, as has Plasma Group, which now runs the optimistic rollup project Optimism.</p><p dir="ltr">It's not worth seeing the technological constraints of Plasma as planned in 2018 (for example, establishing coin defragmentation) as a morality story about the entire notion. Since the apex of the Plasma debate in 2018, ZK-SNARKs have become considerably more practical for scaling-related use cases, and as previously said, ZK-SNARKs alter everything.</p><p dir="ltr">The more contemporary form of the Plasma concept is what Starkware refers to as a validium: essentially the same as a ZK-rollup, but with data kept off-chain. This design might be used for a variety of applications, including anything where a centralized server has to run code and certify that it is doing so correctly. In a validium, the operator has no method of stealing funds, yet depending on the implementation specifics, some user funds may become trapped if the operator vanishes.</p><p dir="ltr">This is all very good: rather than a binary choice between CEX and DEX, it turns out that there is a wide range of options, including different forms of hybrid centralization in which you gain some benefits like efficiency while still having a lot of cryptographic safety barriers preventing the centralized agent from engaging in most kinds of abuse.</p><h2>Conclusion</h2><p dir="ltr">There are two distinct "classes" of exchanges in the near term: custodial exchanges and non-custodial exchanges. Today, only DEXes like Uniswap fall into this category, but in the future, we may see cryptographically "constrained" CEXes where user money is kept in something like a validium smart contract. We may even see half-custodial exchanges, in which we trust them with cash but not with cryptocurrencies.</p><p dir="ltr">Both types of exchanges will continue to exist, and adding proof of reserve is the simplest backward-compatible approach to increase the safety of custodial exchanges. This includes proof of assets as well as proof of obligations. There are technical obstacles in developing effective protocols for both, but we should go as far as we can in both, open-sourcing the software and procedures as much as feasible so that all exchanges benefit.</p><div class="pr-block-special"><strong>Disclaimer:</strong><br>This article is intended for and only to be used for reference purposes only. No such information provided constitutes advice or a recommendation that any investment or trading strategy is suitable for any specific name.</div>

Many are demanding that exchanges demonstrate they have enough assets in reserve to cover any unpaid liabilities in the wake of FTX's shocking meltdown. Let's discover detail about the Proof of Reserve protocol!

Proof of Reserve: What technologies can prevent FTX catastrophe?