Semada’s Analysis of the Reserve Stable Currency Protocol

A Review by Craig Calcaterra

Thanks to the @Reserveprotocol team for being open to criticism, and for clarifying some of the design plans that were not included in the first draft of their white paper.

The Reserve team came to prominence by offering some of the most cogent criticism of previous stable coin projects that have currently been published.¹ Thus, expectations were high from the recent release of their whitepaper.² Despite a laudable adherence to basic economic principles in the broad strokes of their plan, we are disappointed that specific details reveal fundamental flaws.

We believe stable cryptocurrencies are crucial to the long-term success of the decentralized economy. Therefore, the analysis contained below is meant to benefit the Reserve team and the crypto-community at large, in the hopes that the protocols will be improved before launch.

Fundamental Flaws: Governance and Vault Design

Two fundamental flaws will cripple the Reserve platform until resolved: 1) the lack of any semblance of an effective governance structure, and 2) the lack of a process for tokenizing their reserve assets and creating a decentralized liquid market for their currency.

Governance

First, and most importantly, Reserve’s governance process is fundamentally flawed. The need for nimble, efficient, and properly incentivized governance is at the heart of why Bitcoin is not advancing technologically.³ Reacting to market changes at least as efficiently as the US Federal Reserve, is crucial for any decentralized cryptocurrency competitor, which is why governance is the single most important design consideration — especially for a long-term stable coin project.

In Reserve, the governance process will begin with the development team holding all the power for the first two years. After that, the team promises to relinquish power. For the sake of argument, let us assume this is true, and they find some mechanism that forces them to comply, and they do not secretly hold onto their power once the currency becomes extremely valuable.

After the initial two years, anyone who buys Reserve Shares on the open market has the power, because governance on every issue will then be determined by on-chain majority token votes. Then, according to an unspecified mechanism, when “maturity” is achieved, they will switch power to favor currency holders — by an unspecified amount — for voting power.

Either way, once the dev team relinquishes control, users with more money in the system will have more power. This leaves the system completely vulnerable to a 51% attack. Since 51% of the currency or shares are always theoretically available at market, you know exactly how expensive it is to take control — with an immediate transparent attack or a surreptitious long-term assault.

Even more fundamentally troubling is that the system is plainly an oligarchy, which is certainly not a stable and healthy governance structure. If power is determined by wealth, and if the token is truly valuable, then concentration of power is inevitable due to economy of scale considerations. With that concentration of power, the platform is no longer decentralized, so it is not secure, and the stable coin is no longer stable. A malevolent dictator of a country would have less power over their currency than the Reserve oligarchs would have over an algorithmic, code-is-law cryptocurrency.

Reserve’s white paper details an insultingly basic governance mechanism: fast and slow votes using money as power, a $500 stake to make a proposal,⁴ and a 70% quorum. There is also no other incentive design for basic platform function such as improvement, policing, or performing the reporter/auctioneer/reserve manager/vault manager functions.

This lack of incentive design will be fatal if not addressed. As the most obvious example, consider how excess Vault holdings are given to the shareholders using their dividend strategy.⁵ If the Vault ratio is controlled by shareholders, their short term goal is to liquidate the vault completely in order to gain the immediate reward of the dividends, then liquidate their shares on the market before the long-term effect on stability is realized. Put more simply, if the price of 51% of the shares is less than the total reserves (which is planned to be diligently maintained at 300% of the outstanding currency tokens, initially), then when the shareholders gain power in 2 years, a 51% attacker will liquidate the vault. Unless the value of shares is worth more than 3 times the value of the entire outstanding currency (which is not practically possible once the platform reaches maturity), a 51% attack will certainly occur without making significant changes to their governance mechanism.

The stipulation of Reserve’s quorum initially set to 70% is also extremely unrealistic. Ethereum’s early experiments with on-chain governance had a mere 4.5% participation rate on the very important proposal to fork the entire blockchain to fix the DAO hack.⁶ Firstly, a 4.5% participation rate means you can buy influence on the platform for much less than the cost of a 51% attack. Secondly, and less importantly, under Reserve’s specified mechanism, their quorum starting at 70% would be dropped by 10% each time a quorum is not met on a proposal; and with their timeout of 1 month, the expected time to their first decision on a proposal is 26 months. This (admittedly petty) example reveals how little attention was paid to governance design.

This fundamental flaw is not unique to Reserve. In fact, it is universal in cryptocurrency platforms. However, fixing this fatal flaw is absolutely crucial to any hope for the long-term success of decentralized business. We suggest they consider implementing a system of governance along the lines of the Semada proposal,⁷ which distributes power according to reputation instead of money — reputation that is earned by measurably improving the platform, which incentivizes constant improvement and policing. Secondly, such reputation should grow securely with the value of the platform, from the beginning. Most crypto projects avoid the complicated question of how governance will work, assuming it will take care of itself. The failure of Bitcoin and Ethereum to achieve effective decentralized governance conclusively proves this is not a reasonable assumption, and that governance structures should be baked in from the beginning.

Vault Design

Reserve’s foreign reserve is called the “Vault”. The whitepaper concludes that any stable coin plan requires a foreign reserve Vault, and that their Vault must satisfy the following three properties: 1) All currency must be backed with foreign reserves with an absolute minimum of 100% collateralization. 2) The reserves must be composed of off-chain assets. 3) The reserves need to be diversified in type and location.

In the short term, we do not necessarily disagree with these conclusions, due to the extreme volatility in the current cryptocurrency markets. In the long term, however, we believe Reserve should have a plan for improving their design significantly. More importantly, Reserve has not convinced us they have specific short-term solutions for achieving these requirements.

Let us analyze their proposed implementation of these properties.

1. All currency must be backed with foreign reserves at an absolute minimum of 100%. This backing will be initially set to 300% in the currently volatile cryptocurrency market. The ratio will drop to 100% when the assets are of sufficient quality and diversity. How and when will this ratio be adjusted? Shareholders will make proposals and vote on them. As discussed above, this is completely inadequate to prevent shareholders from liquidating the reserves to gain their dividends.
   
   Assuming Reserve solves the governance problem, there is another obvious flaw: how expensive is it to back a currency 100% (much less 300%)? No government on earth backs their currency 100%. China holds the largest foreign reserves at roughly $3 trillion, for an economy with total banking sector assets at nearly $40 trillion. The rough IMF recommendation for standard risk aversion for emerging markets is that 10% of GDP should be held as reserves.⁸ Cryptocurrencies do not have the same fundamental value as national currencies (which, at a minimum, is that citizens can pay their taxes in the native currency). This fact and the extreme volatility that has characterized cryptocurrencies’ nascent state leads us to agree with the Reserve team: 100% backing may be necessary at the moment given the extreme volatility of the current cryptocurrency market. Until the genuine economic activity of predictably regular and diverse currency transfers and commitments in banking significantly outweighs speculative hot money, such backing may be the most efficient way to ensure stability.

However, the Reserve team’s zealous adherence to the 100% minimum ignores the expense users will bear from the inefficiency of holding unnecessary foreign reserves once the platform achieves true maturity. How is it worthwhile for a user to participate in a system that will create enormous inflation to maintain a 100% Vault? Only while the demand is increasing will the inflation be hidden from consumers, during which time shareholders and arbitrageurs profit. When demand stabilizes (or decreases) the maintenance of the Vault’s holdings will be paid for by currency holders through inflation, or by currency users through transfer fees, or by shareholders through dilution. The true cost of using the Reserve currency is the interest rate forgone by not investing their holdings to keep the Vault liquid, plus the inflation of the vaults’ foreign currency holdings, plus the maintenance costs of managing the vault and other aspects of the network — the cost of running nodes (which likely won’t maintain the ledger for free), the cost for the reporter/auctioneer/reserve manager/vault manager functions, and the cost of continually improving the protocol.

Therefore, users pay much more to use the Reserve cryptocurrency than they do to use the native fiat currency held in the Vault. This price may be worth the cost if there is no other alternative which has the advantageous features of a stable cryptocurrency. But a more efficient system would not overcapitalize beyond what is necessary for practical security.

Estimating authentic economic behavior is possible for cryptocurrencies which have unprecedented public access to transaction statistics. This allows us to securely use a partial reserve if it is supported by sophisticated protocols with proper incentive design for when and how to back the peg in response to market behavior.

2. The reserves must be composed of off-chain assets because currently, crypto assets are not trustworthy stores of value. 3. These reserve assets need to be diversified in type (initially “tokenized real estate, tokenized debt, and tokenized investment companies” page 19) and diversified in location, so any single government won’t be able to seize all of the assets to influence the currency.

Reserve says they will use the 0x protocol⁹ if it is sufficiently robust when they are ready to deploy. They do not detail what specific 0x relayer they will use, if they will create the relayer themselves or leave it up to the free market, or what the relayers protocols and governance will be. Possibly, shareholders will make proposals and vote on them.

What mechanism will determine which types of reserves the vault will hold, where will they be located, and in what quantity will they be bought? Apparently, shareholders will make proposals and vote on them. This trivial governance process is claimed to be sufficient to make decisions in anticipation and response to constantly changing markets and arbitrageurs who have all the public information of Reserve’s trading algorithm and governance process. In such a system where anyone can buy influence at any time and make a proposal, the potential for corruption is enormous. As a very simple example of how to game their system, shareholders can influence the Vault manager to buy their own tokenized real estate. So I might tokenize my tool shed for $1M USD and sell it to the Vault.

There is one interesting and useful mechanism in the Reserve plan that I have not seen in other plans: if the Vault is under-collateralized, the Reserve Manager will only defend the peg at that “Vault ratio”. E.g., if the Vault holdings unexpectedly drop in value to 95% of outstanding currency tokens in USD (.95 = Vault ratio), then Reserve will only defend the peg at $0.95USD. This prevents the system from collapsing entirely due to a speculative attack (thinking of Soros breaking the Bank of England¹⁰), or a run on the bank in the case that the Vault assets unexpectedly drop in value. The upper bound is also raised, in this example to 105%, so that arbitrageurs willing to short the currency while it is low, must also take on greater risk. More importantly, if the Vault’s value recovers, then the peg can be re-asserted without ever having risked collapse. If the Vault’s value does not recover in the long term, presumably it could be necessary to readjust the peg.

Of course, this protocol of setting the lower bound for backing the currency at the Vault ratio is overly cautious for most circumstances. Even if the reserve drops below 100%, if there is no run on the bank or Soros attack, then it is unnecessary to abandon the peg. Once the currency is more mature, meaning there is a large ratio of genuine transactional and investment use of the currency compared to hot money, then a more sophisticated protocol should implement a choice to abandon the peg, based on more information than solely the Vault ratio. Cryptocurrencies have a great deal of transparency: we can observe a great deal of the volume of transactions and investment commitments, and statistically measure their diversification. Without effective governance however, Reserve is forced into a less efficient protocol to maintain security, since they will cannot nimbly change their protocols in response to the market. (As Bitcoin has demonstrated, such complicated new protocols may never be implemented effectively in the future without effective governance built-in from the beginning.)

Implicit Assumptions

Several of Reserve’s choices betray implicit design assumptions that have not yet been discussed in print by the Reserve team. This may be because they were unaware of these choices (which would be bad); that they were aware, but chose not to discuss them because they are protecting themselves from criticisms (which would be bad, since it violates their second stated ethical principle¹¹ and signals that their governance mechanism will not be maximally transparent, seeking input and discussion from the greatest range of input throughout the network of token holders); or that the white paper is not intended to be exhaustive and they intend to quickly publish a more expansive discussion of the consequences of their design (which would be good, so we will assume this is the case).

Some of Reserve’s implicit design assumptions include:

1. Pegging to the USD commits to an inflation target¹² of 2% annually.

a) Why? Who benefits and who pays for this mechanism? The answer is, the shareholders (and arbitrageurs to the extent that the functioning of the platform is inefficient) benefit from any inflation, while the currency holders pay.

b) Who has the power to adjust this parameter? Maybe the shareholders, maybe the currency holders, depending on the platform’s state in their timeline. Active shareholders will be incentivized to raise this rate at every opportunity since their goal is short term gain. This is a clear design flaw that will threaten the viability of the currency.

2. There will be transfer fees (initially set to 0, page 17) which each user will pay whenever money changes hands.

a) Why? Who benefits and who pays for this mechanism? The answer is most likely that these fees will be implemented if demand for the currency stops growing at a sufficient rate to maintain the platform. The shareholders (and arbitrageurs to the extent that the functioning of the platform is inefficient) benefit from every transaction fee.

b) Who has the power to adjust this parameter? Maybe the shareholders, maybe the currency holders, depending on the platform’s state in their timeline. The shareholders will be incentivized to raise transfer fees at every opportunity since their goal is short term gain. This is a clear design flaw that will threaten the viability of the currency.

Conclusion

Reserve’s attention to the basic laws of economics is laudable, and their broad-stroke plan is relatively clear and well thought out. But the details are quite fuzzy on who pays for the maintenance of the token and the Vault. Their lack of explicit solutions to tokenizing off-chain assets and creating a liquid and decentralized market for their currency (besides referencing the 0x protocol) is much less impressive than MakerDAO, which also insists on backing their currency by (roughly) 300%. Reserve’s lack of explicit solutions for decentralized governance are crippling gaps for their plan; this is something they share with every cryptocurrency platform, but Reserve’s plan relies on many active choices to maintain stability. Hopefully, they will develop and share explicit solutions to these problems before launch.

Given our esteem for the Reserve team, we hope that these basic design criticisms illustrate the inescapable fact that any complicated real-world algorithm will contain exploitable flaws¹³ and that it is therefore absolutely crucial to design a very nimble and efficient governance mechanism that can anticipate and react to changes in the market.

If the Reserve team fails to solve these problems before launching, there is a real possibility that the coin could gain enough adoption by ordinary users to do real harm, before the problems we’ve detailed above bring the platform crashing down due to a weakness in their governance or tokenization. This is due to two factors: 1) Stability is easier to maintain when demand is increasing, but once demand stabilizes, the hidden costs become more obvious. 2) Once the currency is sufficiently valuable it becomes inevitable that any weaknesses will be exploited.¹⁴

Like Reserve, we are concerned about the threat to:

“Ordinary people. Unlike investors or speculators, they will be neither aware nor prepared to handle the risks involved in holding unstable assets. A stablecoin at this point in the game will be held in large part by people in the developing world, who put their life’s savings in stablecoins to avoid the problems of inflationary currencies.”¹⁵

Certainly, the Reserve team is as concerned as we are about the need to protect their users. So we are looking forward to reading about their solutions to these important problems.

As a final conciliatory note, I would like to disclose that the Reserve team, especially their founder, Nevin Freeman, has behaved admirably in response to this direct criticism of their project. Mr. Freeman shared his time with me for a conversation and proved he was aware of many of the problems detailed above. Impressively, the Reserve team disclosed evidence that they were actively engaged in trying to solve these problems. Sharing their work with an active critic and competitor exemplifies the behavior necessary for nurturing the open source community. If these problems can be solved — and I certainly believe they can — then there is little reason to fear a team with the character displayed by Reserve would risk damaging their users by failing to address those problems before going to market.

¹ E.g., https://medium.com/reserve-currency/why-another-stablecoin-866f774afede Retrieved 1/3/2019.

² https://reserve.org/whitepaper.pdf Retrieved 1/3/2019.

³ EOS is another large platform with very public governance failures. Ethereum seems to be improving more than the other major platforms for the time being, arguably due to their benevolent dictator/founder and inertia; but neither is Ethereum blowing away peoples’ expectations by leveraging the power of “information at the edge” of a decentralized network.

⁴ https://reserve.org/whitepaper.pdf p. 26. Retrieved 1/3/2019.

⁵ https://reserve.org/whitepaper.pdf p. 21. Retrieved 1/3/2019.

⁶ https://vitalik.ca/general/2017/12/17/voting.html Retrieved 1/5/2019.

⁷ https://semada.gitbook.io/project/blockchain-governance Retrieved 1/5/2019.

⁸ https://www.imf.org/external/pubs/ft/wp/2006/wp06229.pdf (page 3)

⁹ https://0x.org/pdfs/0x_white_paper.pdf

¹⁰ https://en.wikipedia.org/wiki/Speculative_attack

¹¹ Ethical Principle #2. “Share knowledge of how to create stability, even when it enables competition.” https://reserve.org/ethics Retrieved 1/5/2019.

¹² https://www.federalreserve.gov/faqs/money_12848.htm Retrieved 1/5/2019.

¹³ The folk theorems of game theory give a mathematical proof of this fact under certain assumptions. Cf., https://en.wikipedia.org/wiki/Folk_theorem_(game_theory) Retrieved 1/5/2019.

¹⁴ For example, in the initial stages of the currency’s deployment, the value of the shares will be greater than the outstanding currency, so the basic 51% attack will be less enticing than it will be when the currency reaches maturity.

¹⁵ https://medium.com/reserve-currency/our-analysis-of-the-basis-protocol-cf1e0713b849 Retrieved 1/3/2019.