Showing posts with label BitShares. Show all posts
Showing posts with label BitShares. Show all posts

Tuesday, November 17, 2015

Sample bankchain feature set

Sample bankchain feature set

In the recent months, many banks and other financial institutions started looking into the blockchain technology as a potential improvement on their current architecture. Below is a sample feature set of the cryptocurrency technologies that can be used to reimplement and possibly improve upon the banking system as it is today.

Transactions


In all cryptocurrency systems, transactions are the most basic building block of the value transfer network. They have a few important features, including:

  • Atomic nature - a transaction can either succeed fully, or fail completely. There is no middle-ground that wasn’t specified beforehand (for example, Ripple’s partial payment flag). It is even possible to have complex transactions that hop across multiple currencies that are still atomic. 
  • Self-contained - a transaction in most cases provides all the information that is needed to verify whether it is valid or not. It specifies exactly which money it is spending, quite often how much money is left, as well as contains a digital signature authorizing the move of funds. 
  • Undisputable ordering - once transactions are included in a block, their ordering is undisputable. This allows everyone to be able to verify exactly what state the system was before and after the transaction was applied. There is no data discrepancy between the participating institutions as to what happened without the need to resort to a centralized authority. 
  • Cryptographic authorization - in the crypto world, there is never a doubt whether someone is authorized to spend the money. Either they own the private keys and can authorize the payments, or they don’t. Moreover, each signature is only valid for a given transaction, so a few authorization problems are mitigated (replay attack, man-in-the-middle, etc.). 
  • Easy multi-party escrow - also known as multisig. This allows money to be held by multiple parties in such a way so as to only be spendable when a minimum threshold of parties agrees to spend them. 

Currencies


In the cryptocurrency space, there are essentially three types of currencies.

The most prevalent is a native crypto currency or a digital token. Those are currencies issued by decentralized autonomous organizations, either in the form of complete crypto-networks (like Bitcoin, Litecoin, etc.), or autonomous smart contracts. Those tokens are usually perfectly, mathematically scarce, have a predictable minting schedule and a clear set of rules on how to transact in them. However, due to their decentralized nature, they don’t represent real-world assets very well.

The second kind are derivative currencies (such as BitUSD), which are still created and maintained in a decentralized fashion (without a central or collective counterparty), but through known financial contracts (futures, contracts for difference) can track the value of real-world assets and currencies. Their counterparty risk takes the form of the financial derivative market.

The third kind are IOUs, digital currencies issued by centralized or collective parties usually backed by real-world assets and currencies (such as SnapSwap.USD, BitStamp.BTC, etc). While they are subject to counterparty risk, they have an advantage over the derivative currencies by most often being easily redeemable in kind from the issuer.

Different cryptographic systems have different requirements when it comes to those currencies. A decentralized network will have to have at least the native digital token to avoid spam attacks at the very least. Having that currency, they can also incorporate the remaining two as needed (see BitShares and Ripple for an example). Permissioned blockchains don’t need a native digital token, as the network participants are known entities and can be made liable in case they intentionally disrupt the network. As such, it makes a lot more sense for those networks to mainly feature digital IOUs.

IOU issuers


IOUs in a cryptocurrency network can be a powerful tool. They are useful for not only tracking the value of real-world assets, but also for tracking the trust associated with the currency issuer. If 1 USD from Bank A trades for 1.02 USD from Bank B, we can infer that A is more trusted than B.

When talking about IOUs, there are generally two models that can arise in a system - a web-of-trust or a gateway model (with the real-world examples usually being a mix of the two). In the first model all parties trust one or more parties in the web and money flow is rippling through the system between parties (this is a basis for old version of Ripple). In the gateway model, we have a few central authorities everyone relies on to securely issue and redeem the IOUs everyone else uses (this is a basis for the new version of Ripple). The latter approach might be more useful when there are different classes of peers on the network (governments vs big banks vs small banks vs credit unions, etc.), but the former is useful compliment for smaller-value settlement between the same classes of peers.

IOUs inherently track debt between parties (if you have 1USD IOU from me, it means I owe you 1 USD). In systems like Ripple it is also paired with another variable - trust. Trust limits the amount of IOUs / debt one is willing to take from another individual. This can be especially useful if say, two banks established a mutual trust between one another to simplify payments or reduce their costs. They might agree for example to extend $1M line of credit between one another and use that channel for settlement for any payments made between their accounts. If the credit limit is ever reached, they can still settle with potentially more expensive IOUs from a gateway (say, a government), or settle the debt in some other way and resume operating with the cheaper IOUs.

Decentralized exchange


Having a number of currencies issued on a decentralized network opens up a lot of possibilities. Most useful one perhaps being a decentralized exchange allowing trading between any currency pair. With an open market accessible to all peers, one could expect to drive the spread for performing FX trades to spot, even for small value transactions. Having that, one could expect to start seeing the Singularity of Money going into effect, where the currency you own would not matter as much as the value of that currency. Multi-currency hops would allow one to route money through the most efficient market in the web of value allowing for easy bootstrapping of new remittance platforms and applications.

KYC


An important aspect to consider while designing a crypto network is how it can comply with KYC regulations. While decentralized networks such as Bitcoin are focused on fostering strong pseudonimity, permissioned blockchain users in most cases would be interested in dealing only with known parties. This can be achieved by either having all entities in the system known and explicitly recognized, or having a more open system but with each peer being responsible for doing their own KYC.

The first is a model that seems the most popular with private permissioned blockchains such as MultiChain, where the creators of the system explicitly have to grant read and write permissions to every network participant (thus giving them an opportunity and potentially a responsibility to perform the KYC on everyone).

The latter model is more popular on public blockchains that allow permissioned access, such as Ripple. There, every gateway can explicitly either blacklist addresses to prevent them from using the IOUs they created, or create a whitelist of only the addresses that can send and receive the IOUs.

Block encapsulation


One of the more important differences between a database-based approach and a blockchain-based approach for processing transaction is the idea of encapsulating transactions in blocks. A blockchain, whether it is permissioned or public, has a few key advantages:
  • Order of transactions is strict - there is no doubt which transaction is to be applied first and at what time. This addresses the problem of race conditions and can be used to address the problem of frontrunning in a system without a central authority. 
  • History is immutable - since all blocks in a blockchain refer to a previous block’s hash, it is impossible to alter any record of what blocks and transactions took place in the past without rewriting it entirely. Paired with real-time anchoring of block hashes into a public immutable ledger such as Bitcoin ensures that any block forks would be evident and would have to be accounted for. 
  • Provable auditability - knowing only the latest block hash (which is a small digest in comparison to the actual size of the blockchain), one can not only audit the entire history of the blockchain, but the auditee can probably for the first time in history provide a positive proof that they disclosed all the data for the audit. Any records that are missing or have been altered will come up in a proper audit. 
  • Everyone can be sure they have all the data - if one is at the blockchain head, they know they have or can fetch all historical data. There is no doubt whether some chunk of data is missing or not. 

That being said, blockchains are not a silver bullet. They come with their own weaknesses:

  • Blocks are slower than individual transactions - while a transaction can be committed to a database within a few read/write cycles, a block takes awhile to be created and propagated. The fastest blockchains out there achieve about a block per 1-5 seconds. While each block can contain many transactions to possibly reach the required throughput, those transactions can only come in discrete quantas, not a constant stream (as they say, “Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway.”). 
  • Performance-wise, a blockchain will probably have a higher transaction overhead than an optimized database. There are a few possible reasons for this - the fact that in the end transactions from a block will have to be committed to a database anyway, the overhead of synchronizing the network and resolving forks, or the relative age of Bitcoin technology (7 years) vs say, SQL (about 40 years). 
  • Currently, there are many blockchain-based cryptocurrency solutions out there, but there are also cryptocurrency networks out there that don’t rely on blockchains, such as Open Transactions. The latter relies on having a few notaries verifying transactions in real time and providing cryptographic receipts for those transactions. It is an interesting approach that allows anyone to prove their balance by merely presenting the last receipt without having to hold onto any prior history.

Tiered blockchains and bandwidth reduction


As it became evident in the Bitcoin world, blockchains can become vulnerable with increased network activity. As such, a modern blockchain solution for high-transaction-volume environment should be prepared to address the bandwidth issue before it might become a problem.

There are a few possible approaches one can take - settle transactions off-blockchain (like the Lightning Network), create a separate permissioned blockchain (like Liquid), or create sidechains (like Credits or what Blocksteam initially wanted to create). Out of those three, sidechains appear to be the more ideal solution - allowing one to move value on and off the main blockchain, transact on that blockchain with the transactions being cryptographically linkable to the main chain (through anchors), and not rely on more centralized third parties.

As such, it might be feasible to construct a tiered blockchain that would be able to offload a good amount of transaction volume off the main chain while still allowing settlement between tiers. At the top of the chain we would perhaps have a public blockchain where the highest-tier peers would issue their IOUs - governments, biggest banks, etc. Below that, we would have sidechains maintained by various banks and other financial institutions. This would allow them to perform more internal transaction without cluttering up the main chain. If needed, more sub-sidechains could also be introduced to further increase transaction throughput. One could also perform sidechain-to-sidechain transactions through a dedicated protocol (such as what Interledger is proposing).

It would be useful for the top of the chain to be a public blockchain as it would allow more institutions and possibly even governments to join and integrate directly with it.

Sample network graph of a tiered blockchain:








Proof of Solvency


One very interesting concept that emerged from the Bitcoin world is so called “proof of solvency”. It allows institutions such as exchanges or gateways create a positive proof that they own a certain amount of currency and that their liabilities are no greater than their currency reserves. Depending on the system in question, the proofs can be either be complete (proving beyond a shadow of a doubt both the assets and the liabilities) or disprovable (one can present undeniable evidence that the institution is lying).

The first scenario is mainly applicable for completely open ledgers - in most cases, only cryptocurrencies and Crypto 2.0s. For example, BTC2Ripple can prove both that they own a certain amount of bitcoins AND the level of their outstanding liabilities on the Ripple network. Since both networks are open, the transaction can be verified to be true or false at any given time.

The second scenario applies whenever we’re dealing with either closed networks, or networks that don’t provide cryptographically signed proofs. This includes exchange’s private databases and bank statements (barring something like TLSNotary). In this case, we either have to rely on some signed documents or PDFs supplied by the banks about the account balances, or generate a merkle tree of all account balances on an exchange. An exchange cannot prove that the information is complete, but anyone can prove the data is invalid if they find their account balance either omitted or altered.

As such, Proof of Solvency can be an important tool for financial audits, allowing them to be performed at any time without disrupting the normal business operations. Some institutions might even opt for continuous proof - updating the required information in real time to bolster confidence in their business.

Proof of Solvency might be fairly straightforward in the above proposed tiered blockchain. Any balance in a sidechain should equal to the amount of assets held at the higher-level chain. The top-level chain would have clear balances of who has how many assets and liabilities.

Voting Pools and auditing competitors


Voting Pools are an interesting idea for keeping everyone honest. In this approach, we have multiple parties vouching for one another’s solvability and being liable for bailouts in case one of the parties goes under. For example, we could have multiple exchanges forming a voting pool and keeping their bitcoins in multisig addresses such that even if one of them turned rogue, they couldn’t defraud their customers nor turn insolvent. This is made possible with continuous proof of solvency, as explained above.

Voting Pools could also be useful for having multiple institutions creating IOUs backed by all of them. These could include:

  • The Euro currency, issued by the joint agreement between multiple EU countries 
  • International Special Drawing Rights issued by the International Monetary Fund 
  • Fiat IOUs backed by multiple banks 

While Voting Pools are the most efficient in a network based on native cryptocurrencies such as Bitcoin, the concept might also be used in permissioned blockchains.

Smart contracts


The final catch-all solution for everything one couldn’t predict while designing the system. Smart contracts are flexible programs that live on the blockchain and can execute commands based on the state of the network. Coupled with smart oracles, the contracts allow for creation of such projects like a decentralized prediction market.

Conclusions



There are many practical applications of the blockchain technology for banks and other financial institutions. Failing to embrace the new technology might make the old network obsolete. The above are only some of the examples of what can be achieved and it is very likely we will see a lot more innovation in the following years. Even from those building blocks we can construct innovative technologies (such as self-regulating universal basic income).

Monday, October 26, 2015

The Money Protocols - Bitcoin, blockchain and others

The Money Protocols - Bitcoin, blockchain and others

I was recently sent a link to an article discussing the development of "the money protocol". The idea has been around for awhile - we have standardized protocols for communicating between computers in form of TCP/IP and others, so it would similarly make sense to develop protocols for moving money around on the Internet just like now we move information around it. However, we will likely have more one new protocol created from Bitcoin and related technologies...

Accounting for all payments


In an ideal world, we would have everyone using the same currency on the same network. However, there are many reasons why this probably won't happen. Instead of hoping everyone will start using Bitcoin in the near future, we should assume that we will be dealing with many different currencies, both cryptographic, fiat and otherwise. We will need a protocol that can handle:

  • Native cryptographic currencies like Bitcoin
  • IOUs, assets and debt, like what we see on Ripple
  • Financial derivatives, like BitUSD on BitShares
  • Private currencies on permissioned blockchains
  • Legacy banking systems
  • Credit, debit and gift cards
  • Other currencies created / tracked by private companies (perhaps shares, digital commodities, etc.)

Moreover, the protocol would also need to cover:

  • Sending payments across networks (bank->Bitcoin, altcoin to sidechain, etc.)
  • Finding an optimal payment path between the start and end of the payment
  • Atomically trading between multiple currencies at the same time
  • Locking in / confirming trades and money transfers
  • Providing digital receipts for the payment

All of those would need to be included in the same "money protocol". Once we figure out how to convey the information of who is sending the money, who is the receiver, which type of money is being spent and received (more on how this could look), we can finally start to connect different networks together. Whether it would be through W3C's Web Payments Community Group, something like Interledger or some other forms of bridges, we could finally be able to easily send money around (hopefully).

What's left?


When dealing with crypto as they say, money is the least interesting application. We also have smart contracts, proof of existence, etc. A lot of those applications of crypto will probably also warrant their own protocol - they don't exactly fall under "money protocol". I do believe the following will eventually become their own protocol on par with TCP/IP:

Proof of existence. As we all know, the Bitcoin blockchain is the most secure, inalterable record of history currently available due to the amount of computing effort put into it. Anything embedded in the blockchain can be forever referenced as the latest date some file could've been created. This functionality, perhaps expanded with protocols like Factom, can be a useful protocol for creating timestamped receipts and other applications.

Smart contracts / smart oracles / proof of execution. With Ethereum being released, we can expect to see more use of smart contracts for business applications. Smart oracles, such as the ones proposed by Codius. would compliment them to interface between the crypto and the real world. All in all, we could bundle those up into "proof of execution" - a protocol dictating what code needs to be run, at what time and by how many independent parties (some of them in form of computers, some in form of autonomous contracts), as well as what was the result of the execution. This could enable, for example, to build autonomous financial derivatives or contracts ("code is law").

Conclusions


It is very likely in the future we will see a "money protocol" similar to TCP/IP for money. It will have to encompass more than a single currency and network however. We are also likely to see more blockchain-based protocols emerge from the non-monetary applications of crypto.

Monday, October 19, 2015

Gaming Proof of Stake

While working on a draft for a paper for the upcoming Ledger academic journal I came across the concept of "stake grinding". After considering this problem for awhile, I think I came up with a neat solution to it under some specific conditions. Lets discuss...

Proof of Stake and Stake Grinding


Proof of Stake is an alternative block generation algorithm to Proof of Work. In it, blocks are not generated by mining pools roughly in proportion to the computing power they hold, but by block producers / minters / notaries or however you want to call them roughly in proportion to the amount of coins they own / stake.

In PoW, blocks are created at random whenever a solution is found, making the network block creation time somewhat random and unpredictable.

In PoS, the blocks can be generated on a more fixed schedule since once a block is created there is no randomness as to who should create the next block - the minter is picked using the randomness inherent in block creation and the balances in the network.

However, if we use a naive implementation of PoS, we open ourselves to the block minters grinding the block to ensure they are also the creators of the next block or some other block in the future (say, if you use a scheme where a block minter is selected by an entropy from 100 blocks back). If you have only one attacker grinding the blocks, they will eventually become the only entity creating the blocks no matter how small their balance is. Since honest minters would select them to mine the blocks every now and then and the attacker would make sure their blocks nominate them to be the minters with 100% certainty, they will be minting more and more blocks.

From what I could find (see section 6.4), stake grinding has been used on a few systems like NXT or Peercoin with success, forcing the networks to abandon the naive approach.

Potential solutions


There are a few solutions to stake grinding. Peercoin appears to have adopted a hybrid PoS-PoW model to make grinding less trivial. BitShares used a Delegated Proof of Stake where the block minters each get to create one block before the order is reshuffled and everyone gets another turn - an interesting approach, but it treats a minter with 50% of support the same as one with 10% of support.

Now, there might be a way to implement Proof of Stake in such a way as to avoid the grinding problem altogether and reward all minters in proportion to their stake / support. It is inspired by CGP Grey's video on Mixed-Member Proportional Representation voting system (a part of his very interesting series "Politics in the Animal Kingdom"):




In the new scheme, we would need to create a list of all minters that want to participate in the block creation process and figure out their weight based on the amount of stake / support / votes they represent. The list would have to be locked in for a certain minting period, similarly to BitShares' implementation. Given this information, we can start creating blocks in a deterministic fashion. Each block minter would be chosen based on who is the most underrepresented in a given minting period. They would be chosen to be the next block minter. After a new block is created, the representation is updated and the next minter is chosen in the same fashion. You could also deterministically break up large chains of blocks being created by the same minter to prevent 51% attacks, or implement a punishment algorithm for creating forks.

This approach would both eliminate grinding and give fairer rewards than DPoS.

Sunday, May 31, 2015

BitShares - probably the first self-sustaining DAO

BitShares - probably the first self-sustaining DAO

For over a year, the Bitcoin world has been intrigued with the concept of Decentralized Autonomous Organizations - quasi-corporations following known and predictable set of business rules dictated by the software itself. While in the future we might have AIs running everything, for now human involvement in software development and other functions necessary for the DAOs to sustain themselves.

Vitalik Buterin's Quadrant Chart for Classifying DAOs

While most cryptocurrencies do form a quasi-DAO, to the best of my knowledge BitShares appears to be the first system to be a fully self-sustaining DAO. Lets explore why this might be the case.

What does a DAO need?


While there are a lot of characteristics a DAO has, we should figure out what a DAO, or any decentralized software-based system wants and needs.

While some might see this as anthropomorphizing a non-living piece of software, we can probably agree that any DAO-like system wants to first of all fulfil the role it was created to perform (in the case of cryptocurrencies - to facilitate transfer of wealth between individuals), and secondly - the system would want to accomplish anything to allow it to continue its first role as long as it is needed.

To accomplish the latter goal, the software needs to be updated, new blocks need to be created, and the system itself needs to become more ubiquitous.

Now, how can a DAO fulfil its needs? Well, it can reward the people that work on the system. If we're talking about cyrptocurrency systems, money is usually a good motivator.

Examining the incentives


We already discussed the problem some systems have with incentives in a previous post. Here, I would like to discuss how various examples of cryptocurrency systems reward its participants.

Bitcoin is probably the most notable early example of a quasi-DAO. It rewards its miners with a block reward and transaction fees, ensuring new blocks are created for years to come. Bitcoin however does not create a direct incentive for software developers to update its software, or for businesses to offer new products on the platform. Sure, there are plenty of non-direct incentives - anyone holding BTC is incentivized to make the value of BTC appreciate so they stand to profit, but that happens external to the Bitcoin software itself.

In a system like Ripple, where the fees are burned and there is no token creation, only the XRP holders are indirectly incentivized to keep the system going - the validators are not paid, nor are the developers.

When looking at a proof-of-stake systems like Peercoin, we have the coin holders that are incentivized to create new blocks, but again, no other direct rewards go to anyone else.

Now, when we look at BitShares and its Delegated Proof of Stake, we see something different. While it's still the block "miners" / delegates that get the reward, who gets to be that delegate is a different story. Unlike proof-of-work or proof-of-stake, anyone that the BitShares coin holders elect can become a delegate and be rewarded for it. If the software needs updating - the core developers will be voted in and paid for their work. If the system needs evangelists - the right people for the job will get the rewards, etc. As it stands, it looks like the system can be fully self-sufficient using this simple reward system.

So while the DPoS implementation in BitShares might not be without its flaws, the concept does lend itself to solving a lot of the problems a cryptocurrency system might have in a simple fashion.

Lastly, this process is no longer unique to BitShares. Stellar introduced a similar method for distributing its token inflation.

Conclusions


While there are a lot of systems out there that act like a quasi-DAO, BitShares seems to be the first one to become fully self-sustaining due to its Delegated Proof of Stake.

Thursday, May 28, 2015

Mining versus Consensus algorithms in Crypto 2.0 systems

Mining versus Consensus algorithms in Crypto 2.0 systems

Recently, I had the pleasure of talking with David Schwartz, Chief Cryptographer at Ripple Labs about a topic that I haven't heard covered before - the implications of using a Consensus algorithm for ledger creation rather than a Mining approach, such as the one used in Bitcoin. This seemingly insignificant difference can affect the long-term viability of a Crypto 2.0 system as it turns out. But first, some theory...

Mining algorithms


As pretty much everyone knows, new Bitcoin blocks are created through a process called mining. Every miner on the network competes to produce the next Bitcoin block by the use of Proof of Work algorithm. If you find the solution first, you have successfully created the next block and thus get the block reward plus fees for included transactions - pretty simple.

There have been a lot of tweaks made to this simple algorithm in many altcoins out there. A number of different coins use different hashing functions for their Proof of Work, some networks introduce Proof of Stake or Distributed Proof of Stake and so on. What all of those algorithms have in common is that every block is created by a single entity - it might be a lone miner, or perhaps a mining pool aggregating a number of workers, but there is still a singular authority that dictates how a block looks.

Consensus algorithms


The Consensus algorithm as popularized by Ripple and also used in Stellar works on a different principle (some videos on this subject - 1, 2). Instead of performing any mining, a number of validators agree on which transactions should be included in the next ledger. Based on that agreement, every validator creates the same ledger.

While the way the validators are chosen can be a a difficult and important design decision, the result is similar - there is no single entity that creates the next ledger.

Malicious miners - what can they do?


While most people have heard about the dangers of a 51% attack and some are also aware of the Finney attack, today we would be talking about more benign things every miner can do to every block they create.

Any miner that creates a block can:

  • Control which transactions are part of the block, if any
    • They can prevent certain transactions from appearing in the block they mine
    • They can include any number of valid transactions into the block. Even if fees are forced for any such transactions, the miner will earn those fees back
    • If there are multiple conflicting transactions, the miners get to pick which are included in the block, thus invalidating their double-spend counterparts
  • Control the order the transactions are included in the block
  • Decide whether to release the block they created at all
  • Set the various block parameters within some limits (they control the nonce and timestamp)


In the Bitcoin world, pretty much all of those things don't really affect the network performance all that much. Sure, the miners can censor some transactions for a block, but provided the network as a whole is not compromised, those transactions should eventually make it into someone's block. They can also spam the block with any number of their own transactions for free, but in the grand scheme of things it's just an extra megabyte of data that needs to be stored. All in all, due to Bitcoin's straightforward transaction nature and the fact that we're dealing with only one currency, a malicious miner can't really do much.

Now, lets consider the same scenario on a more sophisticated Crypto 2.0 platform, such as Ripple, BitShares, Ethereum, Omni or the like. The network not only handles their native currency, but also offers a lot of other features - derivative contracts, decentralized exchanges, smart contracts and so on. Suddenly, whether a transaction is included in a given block or a block after can start to matter a lot more.

If a malicious miner sees a big buy order coming into the market that would move the price significantly, they can engage in front running - the buy order could be pushed to the back of the queue or even left out until the next block, while the miner buys up all of the current stock and re-lists it at a higher price to turn a profit. Alternatively, when they see there is a high market pressure coming in, especially in systems that are inefficient by design, they can buy the orders up one by one by using their power to include any number of their own transactions into a block for free, and similarly re-list them for people to buy up.

When we enter into the smart contract world, we have a few more exploits.

Perhaps the system in question is relying on the miners to be smart oracles and report some price data. The miners can misrepresent the price in their favour - perhaps not so blatantly as to report different orders of magnitude, but one could use data that is a bit stale or fudged on the second or third significant digit without it looking too suspicious.

The miners could also try to influence some time-sensitive contracts - maybe someone tried to make a bet on some lottery during the last possible minute, or some contract deadline is about to come up and the miner stalls the transaction by one block? That could change the outcome of the contract.

Lastly, if some smart contracts implement gambling on the blockchain with the random number generator being influenced by the mined blocks, the miners could cheat that system by only releasing blocks favourable to their bets. Say, if we have a virtual coin flip that is heads if the block hash is even and tails if the hash is odd, if the miner stands to gain more by winning the bet rather than creating the next block, they can withhold the blocks that aren't favourable to them. Provided their computing power share in the network is greater than the house edge in the game, the miners would turn a profit in the long run.

All in all, there is a lot more a malicious miner can skew in their favour in a Crypto 2.0 system than they could do in a traditional system like Bitcoin.

Validators


In comparison to the miner-based approach, the consensus model based on validators solves the listed issues in most cases. Provided the validators are not colluding with each other to overtake the network, most of the above listed attacks are reduced if not eliminated altogether.

While a malicious validator might try to do some front-running, their transactions aren't more likely to be included into the next ledger than the transactions anyone else submits. Having multiple validators act as smart oracles could allow one to average out the answer and limit the influence of one malicious report. Time-sensitive contracts could be slightly influenced by trying to stall the consensus mechanism or vote against some transactions being included in a ledger, but since the system is designed to be fault-tolerant, one malicious entity shouldn't be able to do much.

Influencing the ledger hash is possible to some degree - the validator can try predicting what the next ledger will look like and adding which transaction could influence that hash in their favour, but everyone else can do the same. Since all parties are just as likely to influence the ledger hash, the result of this influence could make the outcome just as random as it ought to be, or at least make it very hard to predict whose influence will win in the end.

All in all, a validator-based approach to ledger generation reduces the number of exploits that can be performed in a Crypto 2.0 system.

Conclusions


One could compare the mining approach to block generation to a short-term dictatorship, while the validator approach is more akin to democracy. While both systems can be exploited or used for good (the Roman Republic elected their dictators in times of need, while democracy can spiral into mob rule), the democracy of validators requires more parties to be malicious before the system becomes compromised.

While in the Crypto 1.0 world a malicious miner can't do much to harm the system, in a Crypto 2.0 world there are a lot more exploits that need to be addressed.

As this is a topic I haven't seen properly discussed before, I would love to hear the input from the developers of various Crypto 2.0 systems - Omni, Ethereum, Counterparty, NXT, BitShares and so on as to how they view this issue potentially affecting their networks.

Monday, May 25, 2015

BitUSD vs USD IOUs

Last Thursday at Decentral Vancouver we were discussing BitShares and BitUSD with Max Wright (I recommend his BitShares 101 series of videos for anyone that wishes to understand how BitShares works). During that hangout, we were comparing BitUSD to USD-denominated IOUs (BitShares calls them User Issued Assets, Ripple - IOUs). The topic is very interesting, so I would like to share my thoughts on it with you.

While we will be talking about BitUSD and USD IOUs, those currencies should only be viewed as a representative of their respective categories. There are many other currencies similar to them, but to keep things simple, we will be using them in this post.

This blog post can be seen as an expansion on "The rise of fiat-denominated cryptos". Other related posts - "Inert versus volatile currencies - pondering an attack on BitUSD", "Thoughts on Delegated Proof of Stake and Bitshares".

What is BitUSD?

BitUSD is a "market pegged asset" on the BitShares Crypto 2.0 platform. It is created as a derivative of the native bitshares currency. As such, it is a "counterparty-less fiat-denominated crypto". Its value is kept at around 1 USD by an open, decentralized market. BitUSDs are created as a derivative with a collateral of three times the current BitUSD value in bitshares.

What are USD IOUs?


An IOU in the sense used in Ripple is a representation of debt from a gateway to its users. It is created when users deposit funds into the Ripple system through the gateway, and extinguished when the funds are withdrawn. USD-denominated IOUs are pegged to the value of 1 USD each by the promise of the gateway to accept them at face value and exchange them for 1USD in cash, wire transfer or similar.

Who is the counterparty?


The first big difference between BitUSD and USD IOU lies in who is the counterparty that guarantees the value of the currency.

With USD IOUs, the matter is simple - the gateway that issues the IOU is the party that guarantees its value. The deposits might be guaranteed by third parties, for example by deposit insurance or perhaps even gateway's competitors in a Voting Pool-esque system, but in most cases at the present that is not the case. If a gateway is operational, like in case of BitStamp, the IOUs will hold value. If the gateway goes out of business, like in case of WeExchange, the IOUs will drop in value.

As for BitUSD, some argue that there is no counterparty, while others say the whole BitUSD derivatives system is the counterparty. The latter is probably more true - if the market becomes destabilized, either through malicious forcing of margin calls or by sudden drop in the value of the BitShares currency, the system as a whole might default. However, if the BitUSD market is working properly, there should be a lot of parties involved in it, and thus there won't be a centralized point of failure in the system.

The flexibility of currency supply


Due to how the currency is created, there is a difference in the flexibility of the currency supply for BitUSD and USD IOUs.

USD IOUs can be created by the gateways at a whim. If they decide they need a few million dollars more, they can create those funds in seconds. There is no limit to how much funds can be created - if someone approached SnapSwap for example with a sum of 1 billion dollars that they wanted to use on the Ripple system, they would be glad to have that business.

Similarly, when the funds are withdrawn, the underlying IOUs are extinguished and the market cap is reduced. The IOUs exist only when they are useful, and can be created and destroyed to adjust to the market.

USD market cap in Ripple

BitUSDs can be created by the market agreeing to enter into a derivatives contract. Provided there are people on both sides of the contract, the market can be expanded as needed. However, there might not be enough counterparties to secure a large expansion of the market cap, and the BitShares market cap itself might not be enough to handle the expansion either (for every BitUSD created, the system requires a collateral of 3USD worth of bitshares).


BitUSD market cap


At its peak, BitUSD had a market cap of 1.2M USD. Today, at the BitShares market cap of $15M, you could have at most about 5M BitUSD in the market. In order to handle more more BitUSD, the value of BitShares would have to increase.

When it comes to extinguishing BitUSD, the derivatives contract has to reach its maturity as well, meaning that for some time there might be more BitUSD in the market than are needed, driving their price down temporarily.

Exchange rate and convertibility


Both BitUSD and USD IOUs are aiming to become a stable currency tracking the value of a dollar as closely as possible.

For BitUSD, it is hard to find an objective resource on how closely it keeps its value. You can look at CoinMarketCap's BitUSD markets, currently reporting a price of $1.14-$1.21 per BitUSD. If you look at BTER's charts, you see the exchange rate of 0.94 BitUSD/USD (so about 1.06 USD / BitUSD). Moreover, BitUSD is convertible to BTS or BTC only on those markets, meaning one also has to convert those currencies into USD before they can withdraw.

For USD IOUs, the matter is simpler - unless a gateway goes out of business as described above, the "exchange rate" for an IOU is usually stable. SnapSwap for example charges a deposit / withdrawal fee of 0.99% with a cap of $5, and an in-Ripple transfer fee of 0.2%. The IOUs are convertible directly into the underlying currency, so they don't suffer from market fluctuation.

Fees


As with any distributed network, there are some fees one needs to pay in order to use the system and its underlying currencies to prevent network spam among other things.

For BitUSD, it looks like the only fees incurred directly by the people transacting in the currency are BitShares transaction fees. When it comes to creating the currency, it is mainly a free market. There are some interest rates expected by people entering the contracts to create those currencies, which are currently around 5%, and there are some penalties for the system executing a margin call (currently around 10%), but for people using the currency directly, those don't really come into effect.

For Ripple-based IOUs, there are likewise transaction fees dictated by the network. Beyond that, any gateway can set their own transfer fees and demurrage fees for using their currencies. The latter is rarely used, and the former is usually around 0.2% of the transfer amount. This creates incentive for gateways to make their IOUs as attractive as possible to use.

Funds' security


Security of one's funds is an important part of a successful currency.

Securing BitUSD largely falls into the hands of the users. Pretty much like Bitcoin - you are your own bank. You can make your BitUSD in your wallet as secure as you wish, but you have to go through the effort. Your funds cannot be seized, frozen, or taken away provided your private key doesn't get compromised. On the flip side, if you lose your private key or someone steals your money, you have no direct recourse. Due to the TITAN technology, it might be very hard or even impossible to track the stolen funds.

Security of USD IOUs are largely up to the gateway. It stored your deposits in a bank or a vault, while giving you an IOU to transact in. You are responsible for securing those IOUs in your wallet, similarly to BitUSD or Bitcoin.

If the gateway's private keys get compromised, an attacker can print any mount of IOUs and spend it on the network, possibly getting some other IOUs or XRP until the market is dry. However, the gateway can create a new account and re-issue the IOUs to the holders of the old IOUs in the same state the accounts were in before the attack took place.

The gateway also has the power to whitelist or blacklist accounts that can use their IOUs. This means that even if you hold the IOUs legitimately, your account might be frozen, able to only withdraw the IOUs into the gateway (not transfer them to anyone else). This can be used for both the good (following regulation, freezing stolen funds), and for bad reasons (shutting down arbitrary accounts).

If one's wallet gets compromised, they can take legal action with the gateway to hope to gain back one's money. The gateway can blacklist the account the funds were transferred to, and reimburse the account that lost the IOUs. This probably would only happen if there was a proper police report filed for the stolen funds, but at least there is some way to recover the funds.

All in all, BitUSD allows one to control the funds more directly, but also makes them responsible for their money. With USD IOUs, the gateway has significantly more say in the matter.

Anonymity and privacy


With BitUSD and BitShares in general, the TITAN technology allows the users of those currencies to remain anonymous and their balances secret.

The Ripple system is a lot less anonymous. While it uses addresses similar to Bitcoin, users of the system generally reuse the same address all the time. Moreover, since Ripple Labs is focusing on bringing more KYC onto the system and the general requirements of gateways to perform KYC on their customers, there is a lot of potential to link one's identity to that Ripple address and all the transaction history associated with it. As it stands, Ripple and the IOUs on it offer little to no anonymity or privacy.

Regulatory compliance


A long-term success of a system cannot be guaranteed if it goes against the laws of the land. While a decentralized system cannot be shut down per-se, it can certainly be hindered if its developers or users are persecuted.

As mentioned in the previous section, Ripple gateways are generally focused on being KYC compliant in their issuance of USD IOUs and similar. As such, they might be more appealing to customers that require to perform KYC on the people they are dealing with, such as currency exchangers, market makers and so on. With the recent Ripple Labs fines, we might see the Ripple system being pushed more to being regulatory compliant, for the better or worse.

BitUSD and BitShares at the moment don't appear to be dealing with regulatory compliance. Exchanges that convert BTS or BitUSD of course can perform their own KYC and other thigns required of them, but with the high anonymity of the system, the distributed exchange on BitShares might not be able to comply. Whether people creating BitUSD through the derivatives contracts or people trading those currencies for anything else on the system would fall under say, FinCEN regulations and be required to register as a money transmitter - that's still up to debate.

Universality


The more universally accepted the currency is, the better.

BitUSD is by definition derived from BitShares and thus is only usable on that platform. Anyone wishing to send BitUSD to another platform would either have to go through a gateway (a singular entity or perhaps a voting pool of gateways), or perhaps in the future through some cross-chains connected to BitShares.

USD IOUs from a given gateway can be put on any system that allows for creation of IOUs (currently - Ripple, Stellar, BitShares, Omni). In this fashion, say, SnapSwap USD IOUs can be more universally accepted than BitUSD, allowing users to easily convert from one network to another.

IOUs also tie nicely to the idea of bridges - easy way to send money from a system into another system (both Ripple and BitShares support the idea of bridges). For example, you can use BTC2Ripple to send BTC IOUs directly from a Ripple account into a Bitcoin account, and Ripple Union allows you to send Interacs into the Canadian banking network.

Flexibility


This one deals with how easy it is for a given system to adapt and start supporting new currencies.

BitShares' market pegged assets are hard-coded into the system. Currently, it looks like the system supports BitUSD, BitCNY, BitEUR, BitGold, BitSilver and BitBTC. If one wanted to create BitCAD, it would require the code to be changed. The currencies in the system are uniform and fungible.

When it comes to IOU-based systems like Ripple, one can easily create new currencies at a whim. There are gateways for about 14 different currencies (BRL, BTC, CAD, CNY, EUR, GBP, JPY, KRW, MXN, SGD, STR, USD, XAG, XAU), and there is nothing stopping people from creating one's own currency (like DYM, a currency backed by silver dimes). Moreover, since every gateway is different from the next (a USD from SnapSwap is not the same as USD from MtGox), every currency offered by every gateway is its own currency, distinct from everything else on the system.

Conclusions


BitUSD and USD IOUs are very different currencies tackling the same problem. BitUSD aims to create a system for transfer of value independent from the current banking world, while IOU-based systems like Ripple work best in conjunction with the banking world. Each have their own use cases, and ignoring the current maturities and adoption of their respective systems, they both stand a chance of carving out their own niche.

Saturday, May 23, 2015

Inert versus volatile currencies - pondering an attack on BitUSD

When thinking about a currency on a simple exchange as a fairly inert object. You can throw money at the market, swing it up or down, but without other actors taking an action by themselves, the market will remain the way you left it. You might cause a panic, or your order might be eaten up by traders with strong confidence in the current price.

Now, consider a derivatives market like BitUSD. While you may have the same market as in a simple exchange, there will also be a lot of collateral in that market waiting to be called upon if one would need to make a margin call. Depending on how the market is structured and how much money is potentially available for margin calls, someone wishing to exploit the market could have a powerful force multiplier waiting to be unleashed. You could call such currencies "volatile" - not in a sense of finances where the price fluctuates a lot, but more of a chemical sense - that there is a latent force in those currencies that could be unleashed for one's benefit.

BitUSD - quick recap


BitUSD is a "market pegged asset" on the BitShares Crypto 2.0 platform. It is created as a derivative of the native bitshares currency. As such, it is a "counterparty-less fiat-denominated crypto". Its value is kept at around 1 USD by an open, decentralized market. BitUSDs are created as a derivative with a collateral of three times the current BitUSD value in bitshares.

The snowball effect


Under normal conditions, the futures market should be stable. You might see some spikes every now and then and perhaps some margin calls being made on an infrequent basis, but the market should track the proper values.

However, it is also possible that a market might have a tipping point - a price at which a snowball effect might take place. Lets say the current market is like this:

  • The current price is 100 BTS per BitUSD
  • It takes:
    • 10k BTS to move the price from 100 to 200 BTS per BitUSD
    • 10k BTS to move the price from 200 to 300 BTS per BitUSD
    • 10k BTS to move the price from 300 to 400 BTS per BitUSD
  • When the price:
    • Reaches 200, 5k BTS will be used on margin calls
    • Reaches 300, 15k BTS will be used on margin calls
    • Reaches 400, 25k BTC will be used on margin calls
If we throw 5k BTS into the market, not much happens - we moved the price a bit. If we throw 10k BTS, we force the market to spend another 5k BTS. We moved the price by 100, and the margin calls moved it further, multiplying the strength of our move by 1.5.

If we throw 15k BTS into the market, we first force the 5k BTS to execute margin calls, adding to a total of 20k BTS. This is enough to trigger the next wave of margin calls - another 15k BTS is pushed through the market on margin calls. This in turn is more than enough to trigger a third wave of margin calls adding another 25k BTS into the market.

This way, our initial push of 15k BTS has forced the market to execute additional 45k of orders (60k in total), thus multiplying the strength of our move by a factor of 4.

A similar scenario was described by James Rickards in his book Currency Wars.

In a centralized world, you would expect the exchange facilitating such trades to trigger a trading curb, perhaps even reverse some trades if they suspect malicious intent. However, a decentralized, anonymous marketplace might have a problem trying to unwind what has happened.

How to benefit from such an attack?


There are several ways one can benefit from executing such an attack. Of course, some preparation is needed.

First of all, one could go to a separate exchange or a prediction market and bet on the price of BTS going down. If the market is well established and has enough participants with open positions, it might be easier or harder to earn some money this way.

Secondly, one could position the open trades on the BitShares market itself in such a way as to benefit the most from the margin calls. In our example, we could slowly build up the price of BTS in preparation for the attack, while also amassing a good portion of BitUSD and creating open sales at over 400 BTS per BitUSD. This way when the final wave of margin calls is executed, we will be able to sell our BitUSD for 4 times as many BTS as they were initially exchangeable for. The amount of BTS amassed could be then used to manipulate the delegate market.

Lastly, there is always a room for competitors to employ some malicious tactics against BitShares. At the current market cap of 12M USD, competing 2.0 platforms like for example Ripple might dwarf the market twice over with their Series A financing to strengthen their own position in the market. While I don't believe any of the Crypto 2.0 platforms would even plan to employ such tactics in the near future, there is nothing you can rule out.

Conclusions


While BitUSD is an innovative creation with a big potential, I would still like to see some practical analysis of how robust the market is. Does it have a tipping point, and if so - what is it? Since all transactions are public, the attackers wouldn't have a problem figuring it out.

In the end, this discussion brings to mind a field of mousetraps - they can be "diffused" or triggered safely in low concentrations, but if you have too many clustered in one place...