Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

iwilcox.me.uk

Post reply on HN
Print view View original

51–60 of 79 posts

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#51

Post by infruset »

nullc wrote: post #38
infruset wrote: post #6

At first I was worried of what would happen if the exchange introduced fake nodes with negative balances at the bottom of the tree, but there would be no way for them to hide that without the first real customer up to the root finding out (there would have to be a negative node that he/she could see). This sounds like a great idea!

Unless the negative valued customer and the surrounding customers never logged in... But thats a limitation of the scheme that can't be avoided. If a user never logs in you could just steal just their balance (and correctly set it to zero). You also must make sure that all customers are seeing the same root, and that you can't do funny business like constantly update it to swap out which customers you're robbing. (e.…

You've got a point, the root of the tree could be made available to the main charting sites.. or even weekly written into the blockchain.

As for the negative values, I wasn't thinking of robbing anyone, but just pretending you are solvent when really you're not. I'm not sure I see what you mean by "swap out which customers you're robbing", could you expand?

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#52

Post by vbuterin »

aston wrote: post #45

Say you were a shady Bitcoin banker with 5000 BTC in deposits, and you wanted to steal 1000 while still looking like you're on the up-and-up by implementing this idea. First, you announce that you only have 4000 BTC in deposits. Then you build this tree, and at the very bottom layer you add a node with a -1000 balance. You pair that node with your (or a conspirator's) real node holding more than 1000 so that any node…

Suppose the balance sheet is:

    [ -1000, 1000, 2000, 2000 ]
The Merkle tree is:

    [ -1000, 1000, 2000, 2000 ]
    [ 0, 4000 ]
    [ 4000 ]
You actually owe 5000 BTC, but it seems like you owe 4000 BTC. Seems so far so good. The problem is, what happens if you try to take advantage of this opportunity.

Case 1: other people withdraw first.

    [ -1000, 1000, 0, 0 ]
    [ 0, 0 ]
    [ 0 ]
Nobody knows that anything nefarious has gone on. However, everyone else has successfully gotten their money out so you've actually defrauded no one.

Case 2: you withdraw first.

    [ -1000, 0, 2000, 2000 ]
    [ -1000, 4000 ]
    [ 3000 ]
Now, the other 2 users actually can see that something is wrong, because the Merkle branch will have a -1000 BTC node sticking out.

So in theory, as long as there exist users who don't check their Merkle branches, and those users are identifiable, it probably is possible to run a slight fractional reserve undetected. So the protocol is suboptimal. But it's not really "broken". I do wonder if it can be improved though, perhaps with some kind of ZKP protocol.

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#53

Post by vbuterin »

jnbiche wrote: post #30
teraflop wrote: post #16

Earlier quoted context omitted.

The hash-tree scheme described here would work equally well for non-Bitcoin currencies, if I'm understanding it correctly. The only thing missing is the ability to prove ownership of the actual funds backing that tree. So what you're really complaining about is that there are no banks that offer digitally-signed attestation of account balances.

>no banks that offer digitally-signed attestation of account balances. Why is this? Seriously, that alone could prevent so much fraud and misuse of funds. Every public company could have a digitally-signed bank balance, updated in real time.

Because then any guy with a laptop and coding skills could use the API to set up almost any kind of fiat currency-based money services or currency exchange business, and we can't have people doing that without million-dollar MSB/MT licenses!

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#54

Post by pmorici »

slg wrote: post #41
pmorici wrote: post #15

Earlier quoted context omitted.

If you want to buy coins to use I'd go with Coinbase at least to get started. If you want to day trade Kraken looks really promising if they are supported in your jurisdiction. Bitstamp has a decent track record though their local give me pause. Coinsetter is also pretty well put together if all you want to do is pair trade but you can't do true exchange on there. I've tried coinmkt but I don't like it. Their fees ar…

I would be a little cautious with Coinbase. There was a recent post on HN[1] in which someone had a 5 figure transaction be approved on the site, but never received his funds. The slow response from Coinbase wasn't too encouraging, but the more troubling issue is that a large sum of money like that can just appear in the system without anyone noticing. It indicates that their level of accounting and auditing isn't up…

I've never had a problem with them and it looks like that customers issue was resolved. All exchanges have problems esp with the huge growth in customer base they are experiencing. The thing that sets them apart is how they deal with them.

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#56

Post by boon »

minimax wrote: post #40
ef4 wrote: post #21

Earlier quoted context omitted.

Sigh. It's a fallacy that making loans implies fractional reserves as normally understood. Banks can still make loans simply by offering certificates of deposit. This is the above-board way of loaning out people's money -- you make it absolutely clear that taking it out early has a cost, because the money is locked up in (hopefully) profitable ventures. Would that be less profitable for the banks? Not really -- they…

What you are saying is that you would replace interest bearing savings accounts with fee charging "idle money" accounts, and that if you want to earn any interest on your savings you have to lock it up for a fixed term. That doesn't really sound like a better alternative.

Traditional paradigms of banking might have to change when each person can be his or her own bank.

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#57

Post by jnbiche »

pmorici wrote: post #48
jnbiche wrote: post #25

Earlier quoted context omitted.

>Bitstamp has a decent track record though their local[e] give me pause. I'd say Bitstamp has a very good track record, and what's wrong with Slovenia? It's probably about on the level of the Czech Republic in terms of economic freedom, development, level of corruption (relatively low), output, business practices, etc. Would doing business with a Czech company make you nervous? In business culture, Slovenia looks tow…

I don't disagree my reservation is more about having to do an international wire transfer to get money in and out of Bitstmap. Also since they are outside of the US you are going to have to submit FBAR paperwork to the US government if your account with them ever gets over 10k at any time during the year. In the unlikely chance something did go wrong legal remedies would be more difficult since they are outside the U…

Ah, ok. So it's more because they're outside of the U.S. (your jurisdiction). That makes reasonable.

I thought the "locale" comment was about Slovenia, a country that not many people are informed about and unfairly associate with former Eastern Block crime syndicates.

And yes, the international wire fees do add up. Do any U.S. exchanges currency offer ACH?

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#58

Post by nullc »

vbuterin wrote: post #52
aston wrote: post #45

Say you were a shady Bitcoin banker with 5000 BTC in deposits, and you wanted to steal 1000 while still looking like you're on the up-and-up by implementing this idea. First, you announce that you only have 4000 BTC in deposits. Then you build this tree, and at the very bottom layer you add a node with a -1000 balance. You pair that node with your (or a conspirator's) real node holding more than 1000 so that any node…

Suppose the balance sheet is: [ -1000, 1000, 2000, 2000 ] The Merkle tree is: [ -1000, 1000, 2000, 2000 ] [ 0, 4000 ] [ 4000 ] You actually owe 5000 BTC, but it seems like you owe 4000 BTC. Seems so far so good. The problem is, what happens if you try to take advantage of this opportunity. Case 1: other people withdraw first. [ -1000, 1000, 0, 0 ] [ 0, 0 ] [ 0 ] Nobody knows that anything nefarious has gone on. Howev…

Oh sure, you can sum and compare the balances under ZKP and even hide the total amount. But the problem is that as soon as you invoke a ZKP for general computation you take into the realm of barely practical moon math.

... And you still don't fix the problem that balances which are unchecked can be diverted.

In the IRC log I posted I went on to suggest that a service could have a rule that _permitted_ them to take your balance if you don't check it periodically— e.g. they could just withdraw it into their own pocket. You could prove you checked it (or that you tried and they wouldn't let you). By doing so you'd actually create a real incentive for people to check, though I suspect boobytrapped balances wouldn't be very welcome.

Regardless— it still confines the extent of fraud that is possible.

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#59

Post by nullc »

pmorici wrote: post #24
waterlesscloud wrote: post #11

Earlier quoted context omitted.

Fractional reserve is sort of a misappropriated term as applied to bitcoin exchanges. Such exchanges aren't making loans, so where would the money be going? There's no good reason for them not to have 100% of the funds in reserve.

Some of them offer margin trading which is a loan.

This proposal doesn't prevent loans and fractional reserve or whatever schemes people may want. What it does is makes it much harder to fail to disclose the truth of the matter.

What kinds of terms people choose to transact under is their own business— but all the better when we can be more confident those terms are being followed.

Re: Gmaxwell's “prove how (non)-fractional your Bitcoin reserves are” scheme

#60

Post by jnbiche »

smacktoward wrote: post #43
jnbiche wrote: post #39

Earlier quoted context omitted.

Correlation does not equal causation. And arguably, the invention of dual-entry accounting in the early Renaissance -- a self-auditing system similar in many ways to nullc's proposal -- played a much bigger part in the beginning of modern economic development than did fractional reserve banking.

This is the exact same answer you used to get in the old days, back when real communists actually existed, and you'd ask one of them why there were no communist countries with anything like a functional economy. "Correlation does not equal causation, comrade! Just because those troubled countries are all communist does not mean that it is communism that is the cause of their troubles." I'm just sayin', theory is nice…

Your argument against correlation doesn't equal causation is...communism? That's quite a red herring. For the record, and it shouldn't matter, but I learned about correlation doesn't equal causation in an epidemiology class, and I've always associated it with rational thought.

>and you've got an argument more compelling than a chapter from a textbook of Austrian economics.

Another ad hominem.

And you didn't even address my point about double-entry accounting, which shares a striking similarity in some ways to this proposal. Way to mount an effective argument.

Post reply on HN