How ARPA Can Address The Growing Problem of Exchange Solvency
One of the most significant challenges facing the cryptocurrency industry is the trust issues surrounding exchanges drawing from a polarizing history littered with instances of insolvency, hacks, and fake trading volumes.
Recent events such as the bizarre case of QuadrigaCX and the ongoing Bitfinex and Tether quandary are the latest developments in a long line of problems encompassing a prevailing theme — solvency. How do you prove solvency?
For exchanges, solvency is often a balancing act between revealing their internal financial details and providing assurances to investors that they are not — at the very least — operating a fractional-reserve system. The goal is to make risk more transparent for investors, a theme that banks have historically hidden behind with layers of complexity.
Solutions such as proof-of-reserves (PoR) from Blockstream offered a promising start to standardizing a solvency mechanism among exchanges. However, it comes at the expense of exchange privacy — something that exchange operators clearly view is in their best interests among increasing competition.
For example, the PoR tool from Blockstream requires exchanges to reveal their entire UTXO set, which could expose too much about the financial operations of an exchange if published publicly. This occurs because of how the protocol works; an exchange constructs a transaction which spends all of its UTXOs, but an invalid input is added to the transaction so that the network will reject it.
Their reserves are consequently verifiable, but at the price of privacy.
ARPA and Proof-of-Solvency
Using multi-party computation and our privacy-preserving network, we have discovered a mechanism for exchanges to publicly verify their solvency without compromising the full set of sensitive financial details that would have adverse consequences on their business model.
We call it proof-of-solvency (PoS), and believe that within a cooperative of cryptocurrency exchanges, it can function as the standardized mechanism for unmasking the veil of transparency that both investors and regulators are looking for.
At a high level, ARPA’s PoS enables participating exchanges to calculate the mean solvency level of exchanges without the detriment of revealing a UTXO set or other sensitive financial information. The protocol relies on secure multi-party computation (sMPC), a subfield of cryptography where participating entities can compute a function with their corresponding inputs without revealing precisely what those inputs are.
Beginning as ‘two-party computation,’ sMPC has progressed significantly since its inception in the 1970s.
Our PoS relies on a combination of secret sharing during the initial multi-party computation phase among all parties involved (i.e., exchanges), with the secret only shareable once a specific threshold of shares is consolidated. Combined with MACs authenticating the verification algorithm, we can achieve the desired result without revealing any input information (i.e., financial reserves) for a participant.
Computational correctness is even verifiable under a malicious intent that comprises a majority of the participants.
For example, if Alice, Bob, and Charlie want to prove that they are holding a threshold (e.g., 10 BTC minimum) of BTC without revealing their precise holdings, they can leverage ARPA’s network to achieve the desired result. So, say they each secretly have the following holdings:
- Alice — 15 BTC
- Bob — 11 BTC
- Charlie — 21 BTC
Running their inputs and shared secret through the sMPC would confirm that all parties involved meet the specific threshold of 10 BTC without revealing that Alice has 15, Bob has 11, or Charlie has 21. All parties, and third-party observers, would only be aware that each party has at least 10 BTC.
If Alice and Bob colluded to corrupt the sMPC and reveal Charlie’s holdings, the information-theoretic property of MAC is such that security can hold for an unbounded adversary. This means that even with unlimited computing power, there is simply not enough information at hand for Alice and Bob to break the encryption of the input data and reveal Charlies’ holdings.
Scenarios, where sMPC can be applied, include everything from privacy-preserving medical diagnoses to identity authentication. With Arpa’s PoS, sMPC is applicable primarily to exchanges and their financial reserves. Should exchanges decide to join a consortium of self-regulation, PoS can become a standard practice on a fiscal quarterly basis, providing the long-awaited assurances that investors seek.
The idea is to unmask the risk of using exchanges for users. Rather than relying entirely on the maxim of ‘trusted third parties are security holes,’ we can produce more trust-minimized institutions where assurances are exposed to users upfront — rather than hidden by complexity.
Outside of proving solvency to investors or regulators without revealing sensitive financial information, ARPA’s PoS can operate as a useful mechanism for reducing the prevalence of wash trading also. Instead of exchanges relying on fake volumes to attract projects, and subsequently trading fees, transparency can become the new profitable standard.
Exchanges like Kraken have already made moves towards quarterly fiscal reserve proofs by third-party auditors. What we propose is a new standardized method for exchanges to self-regulate, pushing out exchanges that operate as fractional-reserve systems or forcing their hand in identifying their actual practices to investors — making risk transparent to users.
In an era of cryptocurrency exchanges plagued by endemic issues such as hacks, insolvency, and fake volumes, we strive to adhere to the demands of the broader cryptocurrency community with a simple tool — proof-of-solvency.
Stay in the loop with ARPA by following us on Telegram, Twitter and Medium.
Website: www.arpachain.io
Telegram: https://t.me/arpa_community
中文电报群： https://t.me/arpachinese
Medium: https://medium.com/@arpa
Twitter: https://twitter.com/arpaofficial
To get more information about ARPA, or email at about@arpachain.io
