What’s wrong with Blockstack’s 1 mln verified users?
TL;DR Blockstack didn’t actually achieve the 1 mln verified users it needed in order to unlock $6.8 mln in investments. Data from the blockchain indicates that more than half of the total number of users as of January 31 were automatically generated. This conclusion is based on the abnormal characteristics of the new accounts, which share aspects of their names and seem to correspond to an automated creation pattern. While anyone can create accounts automatically, the company and its Advisory Board are responsible for verifying accounts as real users. In light of the facts, the company should check this disparity and address the situation and a meeting should be arranged in which the Advisory Board confirms the company’s failure to achieve the second milestone. Additionally, the SEC should look into Blockstack PBC’s false report.
Recently, blockchain startup Blockstack reported that it had reached a crucial milestone in its development which subsequently made a large amount of investment funds available to the company. Sensing that something was awry, the crypto community reacted to Blockstack’s announcement with skepticism. Blockstack responded to the questions posed by the community with a post in which they addressed the controversy. However, further independent analysis suggests that Blockstack’s response was likely an attempt to obfuscate.
In this article the facts of the case will be laid out in order to paint a clearer picture of what actually happened. It should be noted that some of the investments made in Blockstack were done under the protection of SEC regulations.
Blockstack is a protocol for creating dApps. In the Blockstack ecosystem, dApps operate as applications in which all data is kept secure and doesn’t belong to a single entity. The company has billed its platform as a place where apps “can’t be evil.” Developers with Blockstack have all the tools they need, including storage and authentication systems. The creation of this protocol requires significant financial backing. Investments were taken in the form of a Round A with a sale of convertible, preferred shares and a few token sales. The two private token sales held by the firm will be most relevant to the purposes of this article, as investments made therein will have to be returned should it be discovered that the company failed to reach its milestones.
Investments in Blockstack
Thus far the company has raised $75.8 mln and plans to raise a further $5–10 mln in the near future. A third of funds raised ($26.2 mln) came via the AI Fund and QP Fund in November, 2018. In accordance with an agreement made with the AI and QP funds, only 20% of the money raised was available immediately and non-refundable. Access to the remaining investment sums was dependent on Blockstack reaching performance milestones.
First milestone
The successful launch of the Stacks blockchain allowed the firm to unlock 40% of the remaining investment sum from AI and QP. This milestone was achieved on November 14, 2018. The Stacks blockchain v1, which uses the bitcoin blockchain, had a genesis block at height 54792. However, transactions with accounts registered to Blockstack first appeared at the end of 2015. It is not clear whether Blockstack included the number of accounts active before genesis in their overall account total but it is possible.
Second milestone
The second milestone was reached when the company claimed to have 1 mln verified users by the end of January, 2020. According to Blockstack, this milestone was met on January 16. As a result, the company was able to access the remaining 40% of the AI and QP funds. However, in the aftermath of Blockstack reaching its milestone, the question is: what is a “verified” user? While applying for Reg A+ with the SEC, a verified user was a user with an account that proved his human identity via social networks. In a report on the second milestone achievement, the definition was expanded to an account that goes through one of three verification processes:
- “Know Your Customer” verification process;
- Mobile telephone number confirmation process;
- Social media verification process.
However, it is worth pointing out that an inability to achieve the second milestone was identified as a risk in the Reg A+ offering.
OSINT
As far as open sources go, there are three documents, TheBlockstats (data-tracking website) and a chart on the official explorer website that reflect Blockstack’s growth over the period of time in question. However, the data-tracking website was no longer updated after December 8, 2019 because of the rapid growth size of the dataset. Also, the data from this website is in the core of the Binance project report which is mentioned below.
Preliminary agreement published in EDGAR 11.04.2019
Total number of registered accounts: 105,000
Total number of registered verified accounts: 16,000
Total number of registered, verified accounts with working social url proof: 9,500
Preliminary agreement published in EDGAR 10.07.2019
Total number of registered accounts: 115,780
Total number of registered verified accounts: 16,100
Total number of registered verified accounts with working social url proof: 9,555
Project report published in Binance Research 25.10.2019
Total number of registered accounts: 155,669
Total number of registered verified accounts: NA
Total number of registered verified accounts with working social url proof: NA
According to the available data from EDGAR, the total number of accounts went up by 10,000 from April to July while the number of verified accounts only increased by 100. From July till the end of October 40,000 accounts were added, of which an unknown number consisted of verified accounts. According to these statistics, the growth of verified users and the total number of accounts was very slow. Therefore it is almost impossible that they reached the second milestone successfully without the help of partnerships or marketing campaigns aimed at attracting new verified users/accounts.
An attempt to get the situation under control
In order to get the necessary amount of verified accounts before the deadline, Blockstack partnered with Blockchain.com on October 11. It was suggested that Blockstack would distribute its Stacks tokens (STX) to the nearly 40 mln Blockchain.com wallet owners. In fact, only 300,000 users decided to take the company’s offer of $10 in STX with a yearlong lock-up period. This airdrop was only available to Gold-verified users of Blockchain.com, who had gone through the site’s KYC procedure. However, given that Blockstack paid up to $3.85 mln to their partners, and there is no way to verify the KYC process with Blockchain.com, it’s possible that these users may be fake.
Additionally, Blockstack increased their rewards for developers of dApps to incentivize them. From August to November payoffs were doubled, and from December to January they rose five times higher than they were in July. App Mining was stopped on February 10, which is set to trigger an outflow of developers from the protocol. The incentivized effect from this program apparently was close to zero.
According to data concerning the incentivized programs, an exponential growth of accounts and verified users was not expected. However, the Advisory Board reported that the number of verified users surpassed one million and the total number of accounts reached 1.97 mln. What suddenly changed and paved the way for Blockstack to get an additional 1.6 mln accounts? Before this is addressed, a few crucial details should be highlighted.
Blockstack Naming Service
By registering with Blockstack a new account gets a bitcoin address to which a Blockstack ID is attached. Additionally, each address can control more than one ID. The number of addresses with more than one account is now 2342. An ID can have a suffix namespace of five characters, for instance, id.blockstack, or a subdomain deriving from the account ID with a namespace, ie, elonmusk.id.blockstack. This was proposed to make the authentication process easier but the results suggest that the system doesn’t work as it should. Hereinafter, the data used was collected through a Blockstack Core node.
The overwhelming majority of accounts are registered with the subdomain id.blockstack (elonmusk.id.blockstack). However, a few exceptions exist:
- Accounts with the subdomain “onename.id” (paolino.onename.id), the total amount of which is almost 60,000.
All these accounts were registered before the rebranding of Onename to Blockstack, which occurred in 2016. The exact number of verified users is unknown but one source reveals that the total amount was around 20,000 towards the end of 2014. This contradicts figures in the Reg A+ offering in 2019. All these users were transferred to the Blockstack in 2018 and, at the time, exceeded the number of existing users on the network. - Accounts with subdomains relying on CRUXPay and its partners, for instance edybologna.magnum_crux.id.
It was found that the process of creating an account with Magnum Wallet, one of the partners of CRUXPay, doesn’t require verification. Therefore these accounts cannot be considered verified users. Anyway, the growth of total accounts with these subdomains is low, as expected, so it is possible that they are real users of the network.
It is clear that the majority of accounts were created through the id.blockstack subdomain. So, the initial idea of the Blockstack Naming Service failed because the developers didn’t provide users with unique subdomains and most of the accounts are created directly through the Blockstack interface.
Exponential Account Growth
Blockstack Core provides block data that includes transactions that show the registration of each account. Using this data we can identify total account growth trends that occurred after TheBlockstats stopped getting updated.
- In the period from October 2015 (the start) till January 2018, the monthly growth of accounts ranged from 3 to 59. The only exception is September, 2015 which registered 958 new accounts.
- From February 2018 to June 2018, the growth ranged from 519 to 1,825 per month.
- In July 2018 the monthly growth charted at 62,025 which is due to the transferred accounts from the ”onename.id” subdomain.
- After December 2018 the growth per month increased significantly, which can be tied to the block genesis release. The rapid acceleration in account growth rate that has taken place since November of last year can be seen in the chart below:
During the account data analysis it was noticed that all account names can be split into 3 groups: names with the prefix “fc-,” names with the prefix “bc-” and names that don’t fit in to the previous 2 categories. In the subsequent charts below the first two categories will be indicated by the “Fake” and “Blockchain.com” labels, respectively. The argumentation behind this will be provided below. In addition, the “name” part of the ID (distinct from the prefix and subdomain) has been analyzed.
Regarding the prefix “bc-,” these are accounts created during the partnership with Blockchain.com. These numbers may be attributed to the fact that the period of account registration coincided with that of the partnership. Also, the total number of Blockchain.com accounts is 325,410 which matches with the public data available on the partnership. The “name” part of this category consists of a 64-bit hash which has prevented the extraction of any additional information.
Example: bc-a68f183843b9cce8.id.blockstack
The category “others” refers to accounts unadorned with a prefix hinting at the use of automatic tools during account registration. The largest daily increase of these accounts (33,052) came on December 2. While checking a random sample of accounts, many of their “names” match abandoned Instagram accounts, mainly from Southeast Asia and Latin America. The abnormal daily growth in account registrations was detected on 2 and 3 of December 2019 and after a while the growth of accounts in this group returned to normal. As the next wave of accounts with the common prefix popped up after this, presumably, Blockstack decided that it would be better to be able to distinguish at least some of their real users from the fake ones.
Example: nishagoyal.id.blockstack
The category with the “fc-’’ prefix accounts for more than 1.3 mln of the total amount of accounts. In addition to very high daily growth of account registrations (25k-70k) it is notable that on some days no accounts of this kind were created at all. Days with zero registrations were followed with sharp upticks until the final cessation occurred on January 13, just before January 16 — the date of the second milestone verification. Given that this category includes more than half of all existing accounts, at least some of these accounts would have to be verified in order for Blockstack to have achieved the second milestone. There is no public information regarding any other Blockstack partnerships at that time with anyone who could have provided such a significant increase in registrations.
Example: fc-cempedak.id.blockstack
It was also found that the “name” part of each account was not random. Firstly, at least after the appearance of this group, accounts were recorded on the blockchain not randomly but in an order similar to lexicographic with respect to the “name” part. For instance, accounts like “fc-_” were followed by something like “fc-1” and so on. In addition, another anomaly was noticed. At the very beginning lots of accounts starting with “a” were created.
Secondly, the “name” part was unique, which led to the hypothesis that they corresponded with nicknames from social networks. As it turns out, 9 out of the first 11 accounts from the group have a “name” that corresponds to a verified Twitter account. The account @___priestess___ is not verified and the other one @______h______o does not exist anymore, but there are tweets that mention it. Statistics 101 would say that the probability of this being a pure coincidence and not a reflection of automatically generated accounts designed to look like real users are extremely slim.
Additionally, a group of 1,000 accounts was selected randomly and tested for their presence on Twitter. 703 of them corresponded with accounts that exist now, 40 correspond to suspended accounts and 257 were not found. It is worth noting that despite the current absence of some the accounts on Twitter, that does not mean that these users have never existed. Additionally, 20 of the 1000 accounts were verified on Twitter. The results are available here.
The data analyzed here is enough at least for the Advisory Board to arrange a new meeting and revise the previous decision about achieving the second milestone. A significant chunk of accounts has to have been created artificially. If we remove this group from the total, Blockstack does not have 1 mln accounts. The SEC should take a look at the abnormally high growth in registrations, taking into account that three out of the seven participants on Blockstack’s advisory board are investors.
So what do we have?
- We’ve seen abnormally high user growth in the last 3 months, as the number of new accounts now is 10 times higher than it was before. In addition, the growth completely bottomed out after achieving the second milestone.
- 66% of the entire user base came from an unknown source. Without these accounts Blockstack would only have 657,761 accounts in total. It is still very possible that there are some fakes among that 657,761 and not all of them are verified. Consequently, the second milestone cannot be considered reached.
- The crucial part of that user base was most likely generated automatically, which is backed up by the fact that, initially, the accounts in question were created in lexicographical order, relative to the name of the account. The probability of the opposite being the case tends to zero. This is also highlighted by the fact that in the first four days of this period near one hundred of thousands of accounts were created that started with the letter “a.” After that, the first symbol became more diverse.
- The “names” from this user base are confusing. The overwhelming majority matches nicknames on Twitter (743 out of 1000), and almost all (9 out of 11) of the first accounts created correspond to verified personalities on Twitter.
Data and conclusions in this article warrant the attention of the crypto community and should incentivize the advisory board of the SEC to look into Blockstack’s improbable user count and false 1-U report.
At the same time, the data regarding real verified accounts and the use of applications in the Blockstack ecosystem can possibly serve as a pillar of support in the future as I will show in the second part of my investigation.
