Can bitcoin exchanges and online wallets can be trusted to hold all the bitcoins they claim to? Well, it’s a contentious issue.
However, Chinese startup Bifubao claims it has solved this conundrum with its new user-verifiable wallet service.
Many bitcoiners will have faced the question: “If bitcoin transactions are public and secure, why didn’t anyone know Mt. Gox wasn’t really holding their funds?” The answer here is that Mt. Gox and many other online coin-keepers, including wallets and gambling sites, keep their transactions ‘off-chain’.
Once the money is sent to the company, it leaves the public bitcoin block chain and goes into that company’s proprietary transaction system, re-entering the full public chain when it is withdrawn – if it is still there to be withdrawn, that is.
Following Mt. Gox and other high-profile disappearing acts in bitcoin’s short history, users are demanding more accountability from their online services. Anyone holding any amount of your bitcoin in future will need to prove the funds are there.
Proof of reserves
Bifubao has implemented what it claims is a world-first ‘proof of reserves’ trust system – a verifiable guarantee that most or all bitcoins it holds are actually held in reserve. Bifubao’s system uses the ‘Merkle Tree’ technique originally proposed by bitcoin developer Greg Maxwell.
Bifubao users can also send and receive bitcoins with email addresses and mobile phone numbers. The system also includes support for merchant payment buttons and an API for application integration.
Bifubao’s CEO is Jack Wang, who referred to the importance of openness in regaining user trust in bitcoin services. He said:
“Even though this approach reveals some of our data, we think it is worth the trade-off for the additional transparency. We have also open-sourced our code so that the community can see our implementation.”
‘Merkle Tree’ approach
It does this by deploying a cryptographic technique named the Merkle Tree, or hash tree. Similar to bitcoin’s own block chain with some extra values, it is a method of quickly proving whether data or files in certain places are true. Hash trees have been used by various P2P networks over the years to verify file segments, including Gnutella and LimeWire.
Any bitcoin-keeping company could simply publish a flat, public list of all balances for users to check, but the Merkle Tree approach allows the company to obscure most of that information while allowing users to verify their funds have been counted as part of the company’s reserves.
The Merkle Tree approach allows users to verify that their exchange has enough funds to cover their balance, without actually knowing the total or amounts held by other users. Unlike the block chain, a tree structure means not every new addition needs to be connected to every other.
An exchange would publish a hash of the ‘root node’, or base of the tree, publicly. Upon logging in, a user would see their own account ‘node’ containing their balance, and encrypted hashes of everything between their balance and the tree’s base, proving that a user’s account is included in that original value.
Wang explained it further:
“The second half of the equation is proving assets equivalent to the amount shown at the root node of the tree. To that end, we provide links to two cold storage addresses. We’ve signed a message using the private key of each of those addresses to prove ownership.”
“Since these cold storage addresses won’t contain 100% of the bitcoins we hold, the number of bitcoins stored at these addresses will differ from the bitcoins shown at the root node. However, this should reassure users that we control at least the vast majority of those funds.”
Still relies on user checks
For the system to be effective, however, users (or enough of them) must actually check their information against the company’s from time to time.
Bifubao’s code can be found on GitHub. A full technical explanation of the system with code examples is on the company’s blog.
“Trust in bitcoin is directly related to trust in bitcoin companies. We hope this encourages other companies to follow suit,” added Kevin Pan, Bifubao’s CTO.
Fractional reserves
For those new to the ‘traditional’ banking system we have today, the term ‘fractional reserve’ means banks hold only a small (as low as 10%) amount of the total currency units their customers have entrusted to them. The rest is put to use elsewhere, usually in the form of investments or loans.
Should all customers decide to withdraw their funds at the same time, the bank has a problem. Or rather, you the customer have a problem. These ‘bank runs’ are not so rare, and have often happened in times of national emergency or even economic uncertainty, as was the case with the UK’s Northern Rock in 2007.
It’s fair to say those who believe in bitcoin due to ‘sound money’ principles have a problem with the current fractional-reserve banking system for this very reason. This makes claims of bitcoin storers running fractional reserve systems, without their customers’ knowledge, all the more outrageous.
While a tree technique like Bifubao’s does not prevent a fractional reserve system, it does force a company to be honest about exactly how much of a reserve it keeps.
Just as bitcoin itself uses cryptography to enforce transparency and honesty (at least as far as transactions are concerned) so too will cryptography build other structures to return user trust in the networked services they need to function in the modern world.
Tree branches image via Shutterstock