Partnered With:

What will happen to CEX reserve certificates as traditional auditors fade?

Read this article in 17 Minutes

From third-party audits that rely on law to independent audits based on encryption technology.

Original title: "What Will Happen to CEX Reserve Certification When Traditional Auditors Leave?"

Original article by Qin Xiaofeng, Odaily Planet

With FTX The centralised platform, and CEX's asset reserves in particular, are in the spotlight. Several trading platforms have also published the addresses of their accounts, revealing the status of their reserves, as previously reported by Odaily Planet. (Read "Which of the seven major Exchanges reveals Potential Risks?" ).

However, reserves are only the first step towards transparency and do not really show the solvency of the trading platform. A full "proof of reserves" should also be issued considering the liabilities of the trading platform (i.e. the amount of deposits deposited by users). For CEX, "proof of reserves" is also an important step in reassuring users and giving them a better understanding of how the platform manages its assets.

In the past few weeks, Binance, Crypto.com, Kucoin and others have released "certificate of reserves" issued by third-party auditors. However with the development of nbsp; Mazars, Armanino and other organizations have canceled the encryption audit service, encryption users have doubts, CEX trust once again sparked discussion.

In this paper, we will discuss why traditional auditing institutions avoid the audit of cryptographic reserve proof. In the absence of traditional audit, what is the path to transparency of CEX? Can the reserve proof based on Merke tree be an effective way for industry to save itself?

First, why audit firms abandon encryption enterprises?

What is the proof of Reserve (PoR)? It's a way of verifying that an encryption platform really does provide for the digital assets it holds on behalf of its customers. 1 Supported methods. In short, if the reserve in the wallet address of the encrypted platform is greater than or equal to the user deposit, it can prove that the platform has sufficient funds and can make rigid redemption.

Usually, the encryption platform will seek a third-party audit firm with reputation to conduct an audit and issue a certificate of reserve. Earlier this month, Binance, Crypto.com and Kucoin all hired Mazars Group, a global audit, accounting and consulting firm founded in 1945, to provide "proof of reserve". Year, serving more than 90 countries worldwide).

But the Mazars Group report has also attracted more controversy. The Wall Street Journal commented that the Mazars report was actually a five-page letter rather than a proper audit report because it did not address the effectiveness of internal financial reporting controls. In the end, Mazars Group, under pressure from multiple sources, removed the audit report from its website, completely stopped Mazars Veritas, an audit tool used for cryptocurrency trading platforms, and announced that it would stop any work with cryptocurrency companies and no longer issue proof of reserves reports.

Similarly, Armanino, the accounting firm that audited FTX USA (FTx.US), plans to end its crypto audit business, as well as its financial statement audit and proof of reserves reporting services to crypto companies. In addition, the Wall Street Journal reports that accounting firm BDO also plans to suspend auditing services for cryptocurrency clients. Currently, none of the Big Four accounting firms (Deloitte, Ernst & Young, KPMG and Pricewaterhousecoopers) have plans to offer proof-of-reserve auditing services to private cryptocurrency companies.

Why do audit firms shy away from crypto proof of reserves? The core reasons are as follows:

From the perspective of audit companies themselves, encryption is still a brand new field, auditors are not familiar with the chain of business, professional ability is not qualified, can only learn by doing. Binance Founder Zhao Changpeng commented that most accounting firms do not know how to audit cryptocurrency trading platforms. It is not easy for crypto companies to fool "white elephant" auditors in their familiar territory.

Moreover, when auditing firms serve encryption enterprises, they can only carry out their work according to the specific requirements of enterprises, and their autonomy is not enough. The reliability of the final report is also compromised by auditing only the proof of reserves, not the internal control audit and financial position. For example, a platform user deposits. BTC, there are 9000 BTC in the wallet address, but this does not mean that the trading platform has 100% solvency, because there may be 3000 BTC obtained by the platform from the third party, but the audit company does not know. (Note: Audit firms usually only audit the internal control and financial condition of public companies, but not private companies, which is also a contradiction.)

From the actual results, the audit company will also cause lawsuits for the audit (platform) of the encryption company, the reputation is greatly reduced, affecting the development of non-encryption business. Recently, with Two accounting firms that FTX worked with, Armanino and Prager Metis CPAs LLC, were both sued by FTX users, accused of racketeering conspiracy. The Wall Street Journal commented that both accounting firms were cheerleaders for the FTX, rather than sceptical auditors. Other non-crypto clients of the audit firms, worried that the reputational risk to the firm would discredit their reports, put pressure on the auditors.

Finally, as a result of FTX, the Securities and Exchange Commission is tightening its oversight of auditors, forcing them to drop encrypted clients. A senior SEC official said the regulator was stepping up its scrutiny of auditors' work for cryptocurrency companies amid concerns that investors could get a false sense of peace of mind from their reports.

Second, Merkle tree reserve certificate to ensure transparency

Due to the absence of third-party auditors, more crypto trading platforms are committed to having their own proof of reserves and to using more cryptographic native methods to prove asset reserves.

Binance's Merkle Tree proof of reserves has gotten a lot of attention, and OKX, Bitget, and ByBit all follow a similar approach, with details varying from platform to platform. Over the past few weeks, a number of platforms, including OKX, have used the program to conduct audits and posted them on their websites.

传统审计方退场，CEX 储备证明将何去何从？

Eg. Eg. Reserve announcement)

What is the principle of reserve proof based on Merke tree?

Merkle tree is a cryptographic technology that can compress data. By using Merkle tree, multiple data can be merged into one data, and large-scale data summary results can be stored. At the same time, it can be proved by means of cryptography that the corresponding data is compressed in the summary results. The leaf portion of the Merkle tree consists of the hash value of each data in the data set. Specifically, the leaf section is constructed by concatenating two adjacent hashes, packaging them into a block and hashing them again to produce the parent hash. The hashes that end up at the top are called Merkle roots. The hash value of Merkle root contains the hash characteristics of all data. The node where the data is tampered will present completely different values.

In simple terms, a Merkle tree is a hash binary tree capable of detecting any manipulation or data tampering. If the user asset changes, it will be reflected in the root data and will present a completely different value. This mechanism ensures that the Malke tree data is immutable.

For example, the trading platform takes a snapshot of all trading account assets of a user and summarizes them into the total assets of each user, and then assigns a unique and anonymous user hash ID to each user. The total assets of each user will be stored in the Merkle tree as the information of leaf nodes, and the assets of all users will be summarized into a Merkle root. As long as each user's asset information is included in the leaf node of the Myrkel tree, it can be proved that their assets are included in the total user assets. To help users verify, each platform has released its own open-source validation tool called "Merkle Validator " , users can enter information such as their hash value and user code to verify that their assets are included in the Merkle tree snapshot.

There are, of course, some drawbacks to the Merck-based reserve proof.

First, the reserve certificate is only a snapshot of the user's assets at the time of audit, and any asset transactions after the snapshot and assets not covered in the audit will not be included in the audit result. The platform can completely transfer funds into the audit day through the Merck tree audit, and transfer funds out after the asset snapshot. The solution is for trading platforms to increase the frequency of audit announcements (currently OKX and Binance publish PoR reports monthly) from monthly to weekly, or even to real-time certification in the future. In addition, third-party monitoring agencies can also monitor wallet addresses published by trading platforms to see if large amounts of money flow in and out around the audit date.

Second, like the traditional audit, the reserve certificate based on Merck tree is also difficult to reflect the internal financial status of the company such as liability relationship and related transactions, which makes the reliability of the isolated reserve audit reduced.

Third, front-end fraud. The Merkle tree data is stored in the trading platform's own server. The front-end page of user interaction with the trading platform is controlled by the trading platform, and the trading platform may completely return a fake page to deceive users, which leads to the possibility of front-end fraud. Given user inertia, users are less likely and less likely to self-verify through the platform's open source verification tools.

The solution is to use a third-party PoR service to increase reporting reliability. For example, Chainlink Labs provides an out-of-the-box solution. Specifically, the service uses a Chainlink node connected to the trading platform API and its vault address; These nodes are then connected to a reserve proof smart contract, which can be queried by any account on the network to determine whether the trading platform's assets equal its liabilities.

Fourth, the reserve certificate only covers part of the assets and cannot fully reflect the fund status of the trading platform. Take Binance as an example, the first phase of the certificate of reserve only involves BTC assets, while the second phase of the certificate extends to BTC, ETH, BNB, LTC, USDC, USDT, XRP, BUSD and LINK, a total of 9 assets. The current reports of OKX and Bitget only involve BTC, ETH and USDT -- Nansen The data shows that the three assets account for 92.63% and 63.2% respectively in OKX and Bitget reserves at present. ; Bybit reserve proof report involves BTC, ETH, USDT and TRX Four assets, accounting for 81.13% of its wallet reserves. USDC (6.16% ) is not involved. And BIT (5.96% ) . As a result, trading platforms need to work hard to expand more currency verification next, otherwise so-called maintain 1. The reserve of 1 will be reduced to an empty phrase.

Iii. Summary

"The reserve certification is neither a comprehensive accounting of the company's assets and liabilities nor does it comply with the segregation of customer funds required under the securities laws." SEC Chairman Gary Gensler said regulators remain focused on the financial records of crypto companies, "which they should do by complying with time-tested escrow, segregation of customer funds and accounting rules."

Although the SEC and other regulators do not look up to the reserve certificate, but in the absence of third-party audit, the reserve certificate based on the Merck tree can be an effective attempt to save the industry. The crypto market needs more open and transparent information, and crypto platforms are doing their part to rebuild user confidence. Of course, on-chain verification of reserves is a brand new field and still has a long way to go.