Friday, August 30, 2019

The Algorithm That Would Have Reduced or Avoided Every Single Exchange Hack/Fraud to Date

In case you missed them, so far this year we've seen 3 large scale exchange events:

  • QuadrigaCX
  • EZ-BTC
  • Cryptopia

Each one represents massive losses for those involved - hundreds and thousands of affected lives. These are real people and families at the other ends, with hopes and dreams, who worked hard for their money.

In the case of QuadrigaCX, it took the freezing of the bank accounts, the death/disappearance of the CEO, and concerted legal action to even realize it was insolvent.

Exchanges can easily continue to operate for years with whatever level of reserves they like. Third party audits are riddled with holes like:

  • How can they possibly know the client list they're given is legitimate and fully inclusive?
  • How can you know the funds weren't borrowed for the audit purposes?
  • How old is the report? How can you trust the auditor?

On top of that - most exchange platforms still don't even bother to audit. Despite the warnings about storing funds on exchanges, people still do. And remember that many affected users weren't storing funds on Quadriga - they simply got stuck with no way to withdraw.

Proof of Reserves asks exchanges to:

  • Publish the wallet public keys so people can see that funds are fully backed. (A satoshi test can prove ownership of those wallets.)
  • Publish a hash tree to let each customer validate that their balance is included in the total.

What it doesn't prevent:

  • Same as presently, if funds are not secured in proper multi-sig wallets or multiple exchange operators are corrupt, the funds could still be taken, up to what's stored. However, this would be immediately known to everyone instead of revealed whenever admins felt like it (or never).
  • The balances of customers who never check the hash tree could be excluded by a dishonest exchange, which wouldn't be noticed until one of those customers decided to check.
  • A dishonest exchange could still dispute the balance of a customer or arbitrarily prevent withdrawals. In this case, the customer and exchange would have to sort that out.
  • A dishonest exchange could pretend to own wallets it doesn't. A satoshi test would help with this, where the exchange operators send a small amount at a specified time.
  • While it makes things safer, it's still not a good idea to store funds on the exchange.

What it does prevent:

  • The exchange owner can't spend funds of active customers, and still claim to hold them.
    • ie QuadrigaCX, EZ-BTC
  • The exchange owner can't conceal if funds are hacked or stolen. It becomes known immediately.
    • ie Mt. Gox, Cryptopia, Bitgrail
  • Anyone can see if the exchange is solvent before trading.
    • ie Anyone with "bad timing" using an insolvent exchange.

Check this link for more details on Proof of Reserves, including the full hash tree algorithm.

Despite the relative simplicity of publishing wallet keys, the vast selection of exchanges we have in Canada, and the many millions of dollars stored, not a single exchange has done so. The hash tree algorithm has existed since 2014. It's presently on one exchange (last audited in 2014).

Our Primary Exchange Partner

At Quadriga Initiative, we feel that Proof of Reserves is key to preventing future exchange collapses, which is why we are so pleased to have a primary exchange partner which will be implementing the full algorithm. While we can't control other exchanges, traders now have an option to use an exchange which proves full backing of all deposits and we hope this will encourage wider adoption and greater industry transparency.

Given the history with Quadriga, most affected users (including every member of our team) are legitimately concerned about anyone losing their funds again. This is the primary reason we've selected to work with TxQuick.

  • TxQuick is being developed by Ethan Burnside, who has demonstrated his integrity in 2012-2013 when he ran BTC Trading Corp. When it was shut down, he spent significant personal funds to keep it running so everyone could get their money out - likely the only time in history that an exchange shut down and everyone got their funds. You can learn more about him from his post here.
  • We've had extensive discussions on Telegram about security. Ethan is open, transparent, and extremely knowledgeable. He has invested heavily in developing a system of secure multi-sig wallets. His previous exchange was never successfully hacked. If you have any questions, Ethan is happy to answer them!
  • Ethan is strongly in favour of publishing wallet public keys. The exchange will feature a full transparency page to allow anyone to see that all funds are fully backed. In the future, a full proof of reserves will be deployed to assure all customers that their balances are represented.

Pushing for Proof of Reserves

If you'd like to be a part of our push for Proof of Reserves and receive information on the exchange launch, you can join our mailing list at https://www.quadrigainitiative.com/ (see that page for Email-Only Sign Up).

Our Token Recovery Program

The Quadriga Initiative token program provides affected users with free tokens, each representing $1 of their losses. This is part of an effort to eventually make affected users whole again.

The recovery comes out of the profit margin of businesses. Businesses normally sell a product or service at a profit over the cost of production. Instead, a business would sell the product or service at a discount (less profit), accepting tokens in place of the difference. We provide an easy way for businesses to give back and support affected users.

The linked diagram is a handy visualization of the initiative and how the various parties interact:

https://www.quadrigainitiative.com/Quadriga%20Initiative%20Diagram.pdf

The complete initiative is a full marketplace, enabling the beneficial (win win) interaction of all parties and the gradual recovery of losses over time. The token supply is finite, limited by the amount of losses we can verify, and all tokens eventually get cashed for $1 worth of products/services or primary exchange gross trading revenue as the program runs.

The full recovery is expected to take multiple years. There are plenty of ways it can fail, so results are not guaranteed. Nonetheless, we believe it is possible to eventually recover fully (cash all tokens)!

Token Uses on TxQuick

  • In addition to the token validation/verification function:
    • TxQuick will be the first platform to allow buying and selling of the tokens.
    • TxQuick proposes to accept the tokens at face value towards trading fees on the exchange. Affected users can use tokens to get free or discounted trading (50%+ off).
    • TxQuick will also handle a slow token payback, enabling tokens to be exchanged 1:1 for cash over time using 15% of gross trading revenue.
  • This proposal is subject to approval by the TxQuick board. It could be changed. There is a necessary interest level from the affected user community of at least 1,000 sign-ups.
  • While it might seem like Ethan is being super generous and giving a lot away for free, again this is mutually beneficial (win win). Here are some of the benefits to the primary exchange:
    • Lots of sign-ups from affected users and, later, interested consumers, many of whom will stay to use the platform. TxQuick desires to achieve a dominant position in the Canadian marketplace.
    • The token program provides an effective price segment, increasing revenue over time. (Low prices = lost profit, high prices = less customers, price segment = more profit and customers.)
    • Customers with recovered funds are likely to be more loyal and prefer the platform, and the profit share incentivizes spreading the word about the platform. (Interests are aligned.)
  • It is not required to use the primary exchange platform for trading or deposit any money. You are free to sign up, receive your free tokens, and continue trading on any other platform or just use the marketplace.

How to Join the Token Recovery Program

If you wish to participate, please sign up at https://www.quadrigainitiative.com/.

You can do a pre-claim to save your balance, or an email only sign up just to show interest and get the launch email.

  • We are a community initiative which is not connected with the bankruptcy process. Participation does not impact your bankruptcy claim. You can find the official bankruptcy information on the Miller Thompson website.
  • We have taken all reasonable measures to protect our website and stored data against SQL injection. The website back-end is simple, all input is sanitized, and all access passwords are 16+ character full random. (I have a background in web hosting.)
  • There is no cost to participate and the pre-claim process takes approximately 3 minutes.
  • Please be sure to keep a copy of your bankruptcy claim paperwork for later validation! We are still determining the full validation which will be done on claims.
  • The pre-claim depends on the E&Y user balance website. We don't know when that will go offline. It could even be August 31st.

Thanks so much for reading!


No comments:

Post a Comment