On looking (slightly) closer, Haskoin seems to be SPV; harder to tell with Purecoin; and besides, "full" is ill-defined so I guess it doesn't matter too much.

Anyway, it's interesting to see another functional approach; I like the brevity and your walkthrough especially.  Thanks for sharing!

Did Haskoin and Purecoin not reach full node status?  (Genuinely asking, never looked.)

To be clear, by listing those issues above I'm not accusing them of summing incorrectly; I'm just saying there are obvious simple issues that undermine the implementation.  Even once those are addressed, the Merkle approach is not magic crypto fairy dust; it's always been down to the customers to verify their inclusion; but provided they do fix these issues and you do check, you can at least check your data and be certain you're represented.  Even if they'd included other balances in the tree and a sum at the top, you'd have no way to verify any amount anywhere except your own.


It could be summed up as "you can verify for yourself that you're included in what I audited [bar caveats above], then decide for yourself whether you trust me".

I should add to the caveats above: exchanges should investigate ways to deliver partial trees to customers without knowing whether they've been read.  Otherwise an evil exchange has a better chance of identifying accounts which never check, either through being lazy or being dormant; that would let them hide negating balances as neighbours and reduce their liability declaration.  It's not obvious to me from the screenshot and I'm not a Kraken customer, but if clicking "audit" generates a page fetch or anything other traffic to Kraken, that's the worst case.  Ideally you want trees made available to all customers with zero detectable traffic regardless of whether they log in, although besides e-mailing trees out to customers in a monthly zip or something, I haven't really given much thought to the best way to do that.  (E-mailing trees wouldn't be a privacy issue^[1], because a fully stripped-down tree contains nothing but your nonce for your leaf; you add your balance and e-mail/other user-chosen info before hashing.)

To quote Kraken's audit page: "To date, audits produced by the Bitcoin industry have been opaque, superficial" --- I agree (beats the crap out of BTC-e and Bitstamp); their approach isn't ideal (I really wish they'd either make asset proofs independently verifiable or markedly improve their auditing) but it's potentially a significant step forward.  They seem to recognise it's just the start; they do say "We hope to receive feedback from the community that will help us and others to improve this process for future audits."  I think they should be given credit for aiming to make somewhat open, independently verifiable claims, describing some shortcomings and --- provided they actually consider and respond to it --- for soliciting feedback.

[1] Well, unless your mail provider is evil and is actively guessing your balance and probing by hashing all possibilities, but then they're also probably seeing your password reset e-mails and withdrawal confirmations.

They made the decision that an auditor was to be the one to check assets against the liability sum.  Since you can't see their asset sum, their liability sum is not useful to you; only your inclusion in that number (and the elimination of other foul play) matters.  That means their trees and verifier need only hash your sum, not feed it up the tree as all five other implementations do.

However, olalonde and I decided to look more closely at what freedoms the existing code might give them...

Let's assume the auditor checked a fresh copy of the code out of GitHub and built it himself on a known-good machine (we have to assume, because unfortunately he doesn't say).  Fix:state explicitly that you checked hashes, built from source and ran on your own machine.

They've openly made a choice to include accounts with negative balances.  As discussed in the issue I've raised, I think this is a bad idea.  To summarise the points:

• genuine negative balances may often never be repaid, just as a customer who walks out of a bar after getting too much change from a 50 may never come back, so negative balances don't reduce your liabilities
• negative balances may be used for foul play, and it should be made as hard as possible for foul play to go undetected, so negative balances must not become a normal thing (much better to hear from your exchange "our assets only cover 99.8% of our liabilities" than enable cheating)
• users can't distinguish genuine negative balances from real ones, so including them gives no useful information

So while their tool appears to list negative balances explicitly while building the tree from accounts data, we'll also have to assume (because unfortunately, he doesn't say) that any listed negative balances were justified by Kraken and proven to be real users expected to make good, not fake accounts inserted to falsely lower liabilities.  Fix: disallow negative liabilities, as described, specified in a draft standard and implemented elsewhere.  Alternatively, explicitly state what the sum of negative liabilities was and that you were given satisfactory proof that those accounts belonged to real people.

No unique user-chosen information was included in the Merkle tree leaf hash.  That means their tool could group all users with the same balance, give them all the same nonce (which they call the "Submission code" in their documentation), and convince them all that a single entry in the tree represented every one of them.  The subversion possible this way depends on how many customers have identical balances, or balances close enough to not notice.  Because the exchange can deliver nonces after the audit, this is possible even if the auditor is running the exact code published and it's working as expected.  Fix: inclusion of unique user-chosen info (such as e-mail address) in the hash, as described, specified in a draft standard and implemented elsewhere.  (If it's a requirement that auditors don't see this, hash it with the nonce first.)

Edit: linkify "leaf hash"

Edit: add "Because the exchange can deliver nonces after the audit,"

If Kraken's devs care to join in with developing/implementing a standard, then Olivier Lalonde already has one in development.

You can encourage them to join in by commenting on the github issue.

Edit: remove superfluous "already" from "already has one already in development"

Techniques for doing that exist, but are quite a way off and probably quite a burden for exchanges today (and perhaps always).  So we settle for the best we can get in the meantime, which is: let any customer who cares to check, do so.  If they notice discrepancy they can at least make an informed decision to trade elsewhere.  While they can't provide independently verifiable evidence of what their balance was meant to be (without advanced techniques it comes down to customer's word against exchange's), I suspect if enough users got cheated they'd kick up a stink and a cheating exchange would get called out.

Ultimately, until those advanced techniques are openly available and tested, the burden lies with you, the customer, to actually:

• perform checks regularly
• protest loudly and publicly about discrepancies
• vote with your feet by moving to exchanges which offer this
• vote with your feet by ditching exchanges which implement this incorrectly

It's excellent news that Kraken have provided an independently verifiable declaration of liabilities, using the Merkle technique, and provided open source tools to do it.  Let's hope they also progress to independently verifiable proof of assets and adapt their tool to emerging standards, because then they can just automate the whole process and prove reserves daily, and customers can choose any interoperable verifier.

Also to consider: does this qualify for comboy's offer of free promotion at bitcoinity?  Technically I think CryptX.io and peat.io had implementations first, but AFAIK both were pre-launch at the time.

The two more embarrassing nuPlay posts seem to have left Google's cache.  Google doesn't say why; might have expired, might have received a removal request.  Since the nuPlay forum is still "currently in the midst of an upgrade to allow for software integration"[1] here are copies I took with WebCite, plus snapshots-of-Google-cache which I took with archive.is immediately after the originals disappeared:

• "Raspberry Pi?" (archive.is via Google cache; alternate: WebCite)
• "Disappointed" (archive.is via Google cache; alternate: WebCite)
• "Download links are coming" (archive.is via Google cache; no WebCite copy of this one, sorry)
• "Updates? Installer? Anything?" (archive.is via Google cache; alternate: WebCite)

[1] To an outsider, the three weeks of forum downtime while Lemon (Ryan) has been ill might suggest nobody else in nuPlay's team is pulling their weight --- no wonder he's been so busy and unhealthy!  The mind boggles as to how team member "Simon" whose role is nominally "Getting people to actually converse on the forums" has been earning his keep at nuPlay.

*sigh* Straw man.  Nobody is suggesting you give out login credentials; if they were, why bother driving you anywhere?



"menacing" must refer to: collecting your fantasy claims and quoting them back, pointing out your slimy evasive habits and asking you difficult questions.  I don't think the word means what you think it does, which makes me question (for the first time, which is a bit embarrassing for me) whether you ever got harassed, at all, by anyone, unless by "harassed" you mean "they continually asked me for their money back, like so many others have".  Sounds like an imagined crime (and an equally imaginary of pursuit of justice) which you've created to make readers conclude that anyone with a bad word to say about you might be a perpetrator.  Naturally, there's no way to falsify/verify a word of it.  *yawn*.



Uh-huh.  Incredible bad luck with electronic communications: check.  Driving enquiries off public forums so that it's your creditors' word against yours: check.  San1ty openly requests and later openly asks for confirmation of receipt of his refund request, but of course, you've stopped reading this thread so can't confirm anything in a verifiable way.



Sure, because your director and two silent partners couldn't have handled that in the past month; it had to be you.  To quote myself, is that perhaps because crypto.pm was
only ever just you, sitting alone in your flat in your underwear?



Really?  'cause I've counted jim667, BigBitz asking for their loans back, both of which you confirmed you owed; San1ty, FaradayC, Rawted asking for their crypto.pm investments back, at least San1ty's confirmed by you, and Azelphur asking for promised paperwork.  Let's be charitable and ignore the nuPlay thing you seem to have promised to a bunch of people, so I'm not claiming you owe me or them anything.  By my maths that's two people (FaradayC, Rawted) making claims the public can't verify.  You seem to have let your guard down momentarily and made a claim about communications in a medium that's verifiable/falsifiable.  Sloppy.

But fear not: while those claimants could probably sign challenges using the Bitcoin addresses they sent from (I believe someone has a record of your "investment" addresses) verifiably proving beyond reasonable doubt that they did business with you, you're always free to belatedly create GPG-signed agreements; you could easily conjure up e-mails whether you sent them or not, and they can't prove a negative (non-receipt).  Phew!  E-mail to the rescue.

Are you suggesting Lemon basically lifted a scam idea from an episode of Only Fools & Horses?




..., ninja/black belt in everything, US army trained, designed and built the UK faster payment system, was the first man on the moon, has met absolutely any important person or celebrity you might care to name, etc, etc...

For 27, quite a list of accomplishments.  For those of you inspired by Lemon's successes in life and wanting to be more like him, remember that you can't change overnight; set yourself some more modest goals, or you'll only disappoint yourself.  May I suggest you would-be Lemons:

• finish something you've solicited money for (alternatively: promise somebody a refund, and then actually pay it --- even to just one person)
• deliver on an ambitious target or promise (alternatively: fail to deliver, but be honest about why; certainly don't fabricate car accidents, car trouble, family problems, illness, muggings, unexpected visits from in-laws, inexplicable-yet-repeated communications outages or any other dog-ate-my-homework-type patheticness)
• repay someone, anyone, some money you borrowed from them (alternatively: be honest and communicative and say you're not going to be able to, and/or repay what you can)
• be modest about your achievements (alternatively: make barely credible claims matching your amazing achievements, but back them up with something falsifiable/verifiable)
• watch Shattered Glass to see what happens to, and how the rest of the world sees, the types of people who fail to achieve any of these things
• be honest enough with yourself to accept that you may have a problem and seek help for it

The link to the nuPlay forum was working when I made that post (although I can't prove that, so it'd be handy if anyone who followed my link would confirm it), but has since gone offline.  I don't imagine for a moment that Lemon is attempting to hide the past from his hospital bed; I'd speculate that another member of the "nuPlay team" took it down as part of routine maintenance, and that the timing of its disappearance just after I posted potentially embarrassing links to it here is pure coincidence[1][2].  Doncha just hate link rot?  Google to the rescue; cached copies of the four most recent threads can (for now, at least) be found at:

• Raspberry Pi?
• Disappointed
• Download links are coming
• Updates? Installer? Anything?

[1] Please note that my speculative explanation, while plausible, is neither verifiable nor falsifiable on its own.
[2] I won't answer any difficult questions about my theories on this public forum; for more information please e-mail me@difficultquestio.ns, but note that there's a very good chance I may disappoint you later by explaining that I never got your e-mail (and I may take weeks to reply if I ever do confirm getting it) because I have amazingly bad luck when it comes to technical problems with my e-mail.


EDIT 2013-07-12 to add: as posted separately, a couple of the cache links above broke, and the forum is still down as of this writing; alternative sources are:

• "Raspberry Pi?" (archive.is via Google cache; alternate: WebCite)
• "Disappointed" (archive.is via Google cache; alternate: WebCite)
• "Download links are coming" (archive.is via Google cache; no WebCite copy of this one, sorry)
• "Updates? Installer? Anything?" (archive.is via Google cache; alternate: WebCite)

As this thread seems to be a collection of Lemon-related stuff, not just loans, I should probably mention that I still haven't received any nuPlay prototype unit, nor any firm date when I should expect it to be shipped, and nor has anyone else I've spoken to about it (although I have had two or three erratic updates over the past couple of months saying it'll be soon).  There was very brief discussion on IRC of not sending the device since Lemon wanted to send it to someone who he felt would use it as he had intended, but that discussion concluded with sticking to the original plan of sending me a unit and my returning it once I'd seen it existed.

That being said, his offer of a nuPlay prototype unit was always a freebie with no deadline; on paper Lemon owes me nothing, ever, and I mention it only for its possible relevance to Lemon keeping his word.

Those are the facts; since others have offered opinions, I'll veer away from fact towards speculation and gut feeling now.

Some forlorn posts over on the nuPlay forum seem to be asking for hardware, software or updates on when either will appear, so it appears I'm not alone, but it's impossible to verify or falsify Lemon's claims that there are customers that have received units.

I considered investing in crypto.pm, and looked carefully into Lemon's background and past projects.  For reasons I'm unable to disclose for fear of litigation, when I asked him the first of the questions my research raised for me, I asked them publicly.  It seemed important for all to be able to see whether his replies were timely and to be able to prove he said something should it be necessary.  From the ensuing questions and responses, two things made me very uneasy: first, while his answers were always plausible they were never satisfactory for me personally since I never felt he gave any enough information on any question to make his answer either verifiable or falsifiable; second, I felt he tended to prefer to divert questions away from public forums towards e-mail (making assessment of timely response and whether e-mail ever got replied to much more difficult).

I have many other more specific doubts, but since (1) I'm not sure I'd get any reply, (2) I don't expect any answers that I'd consider verifiable/falsifiable and (3) Lemon has indicated a readiness to employ litigation (I don't know whether he would or could, but if so it'd be prohibitively costly to defend whatever the outcome), suffice it to say I'd strongly advise anyone considering dealing with Lemon to perform very thorough research on him and his past projects first.  I feel obliged to add that the same is true of any stranger on the Internet you're considering sending money to.

Oh, and for what it's worth: I find Lemon's explanation for why he couldn't make it to meet up in Bath perfectly plausible.

OK, I won't drag the thread off-topic with this any more, except to help satisfy Lemon's detractors by saying that:

• Lemon has my shipping address
• I can only accept the device shipped (not in person)
• being given a tracking number with reasonable notice would greatly help to ensure I'm available to receive the package
• I'm obviously happy to reimburse him for shipping costs upon receipt of a device broadly matching the description (it's a freebie after all!)
• for the benefit of readers of this thread I promise to post briefly both here and over on the nuPlay forum as soon as something is in my hands (or, in the case that things go wrong at nuPlay, as soon as it transpires that I won't ever be receiving one)

Now you've got me slightly confused.  For the record, is hello@citrus.pw read by you, the MD, or both?  (To make things clear for readers: I e-mailed Lemon 'To' me@lemon.sx as published on his OTC GPG key and 'CC' ryan@citrus.pw which he gave out publicly on IRC as the contact e-mail for begging for nuPlay prototypes as freebies.)

It might help to say which OTC moderator.


For the record, we did not meet today (Monday).  Lemon indicated on Sunday night that he wasn't sure he could make it, but that he would let me know as early as possible on Monday.  alaricsp and I were planning to meet anyway as we had an outstanding GPG keysigning geek-date, and Bath is lovely in the sunshine, especially with ice cream I hadn't heard from Lemon by 11:30 Monday and he wasn't on IRC so I e-mailed him letting him know how to contact me to find us in Bath.

I next heard from Lemon at 20:30 Monday by e-mail, by which point alaricsp and I had both left Bath; he explained why he couldn't meet during Monday day and offered other times when he'd likely next be available to meet (right then --- Monday evening --- or towards the end of the week).  I won't be taking him up on those offers.

For avoidance of doubt, questions posed and opinions expressed here and in my past and any future posts on this thread are my own, and do not necessarily represent those of any other person or group of people.  I certainly do not claim to represent any of the ops on any of the Bitcoin IRC channels on Freenode except myself.


Personally, I do not find the answers given thus far to form a satisfactory answer to the questions posed.

If you choose not to provide further elaboration here, so be it, but I will not be using e-mail for this enquiry; I respectfully decline your invitation to take the questions to a medium in which the content, and the absence of a reply by either party, couldn't be independently verified by others.  Since you've invited me on IRC to "post a summary of the conversations" anyway if one were to be held by e-mail, I don't understand your reluctance to address it here.  It'd only take one post to answer the questions to a level that would satisfy anyone interested, presently or in future.  You could even edit the one you already made to save on post-noise.

Observation: There's a good reason people often qualify what they say with "I Am Not a Lawyer" on the Internet, and it's not hard to see why someone would be reluctant to be seen as one even if they were paralegals or did any other legal work.  You don't seem to share that reluctance, in my opinion.  People who are qualified are usually, understandably, quite proud and open about the fact that they are qualified, and how they came to be qualified.  I'm neither inferring nor implying that you're therefore not qualified; merely observing that your reaction to this line of enquiry seems uncharacteristic of those qualified people I've known.

To stray a little from the specifics of the question, so that it's clear why I ask at all, and why I ask here: reputation in the Bitcoin world has historically been earned and justified in the open[1].  Some who might work with you, invest in you or entrust money to your escrow service or completed exchange might require more reputation than you have yet earned in the ~18 days you've been here (as of this posting).  Therefore it might be to your (business's) benefit to provide more evidence of what reputation you've earned prior to your Bitcoin involvement, or under what other names you've participated in the Bitcoin community previously if you have.  As I'm sure you'll point out, those who might work with you/entrust money to you are free to take you or leave you, but you might encourage more to take you by making at least some of your previous successful accomplishments, qualifications, business relationships, and your identity, more open.  You're doubtless aware that you're entering a market in which ~45% of entrants have so far failed[2], and therefore of how important this stuff is to your potential customers.


It's true that this thread is posted under "Project Development", but you seem happy to "derail" it yourself to reply to other non-development questions, including:

• to say you're "working with a legal firm" on KYC/AML compliance (yet confusingly you also say that "Having a lawyer on the team has allowed us to avoid those pesky legal fees")
• what currencies and deposits you're going to be working with, and with what banks
• where your servers are located
• your fees/business model for generating profit/financial projections
• your sources of funding
• choice of domain names/branding
• interactions with regulatory bodies
• shares remaining for potential investors

[1] I'm not claiming to have any substantial reputation in the community myself in the mere ~69 days I've been interested in Bitcoin, but then I'm also not asking anyone in that community to trust me with their money, save for isolated individual counterparties in the minimal number of OTC and escrowed BitBargain trades I've participated in.

[2] I've not checked whether that paper includes Bitfloor, Bitcoin-24 and Bitcoin Central, none of which are currently executing trades, so the 45% figure may be out of date already.

A number of those questions remain unaddressed in your reply, but as you've pointed out they're largely a matter for your potential investors, depositors and escrow users to investigate as part of their own due diligence so I won't push you on them.  There's one exception; specifically, I'd be interested to see an answer to:


I'd like to break it down a little.  It's all really part of the same question, but I'd like to be sure specific parts are asked:

• Are you currently a UK solicitor?
• If not, were you in the past, and at what time?
• Either way, what exact qualification do you hold, from what institution in what country?
• More generally: have you stated that you are a lawyer (as in, used the word "lawyer" to describe yourself, as opposed to "solicitor")?
• If so, what qualification do you hold that you believe merits the title "laywer"?
• If not, why?

I'm making no assertions or claims about you here, and I'm certainly not asserting or claiming that you're not a lawyer or not a solicitor; I'm just asking questions.  In the UK, for the protection of consumers, "solicitor" is a protected title.  Anyone using that term first needs to be granted a Practising Certificate; to make that claim or use that title in the UK without such a certificate is a criminal offence in its own right.  Such certificates are a matter of public record for the protection of consumers.  There is one exception: from the page linked above: "the only genuine ones not on there are those who have requested their removal from the database".  Please be clear about whether this applies to you, and if so we can cross that bridge next.

In the UK at least, this is not a question on which people are allowed to be cagey or unclear.  I'm not implying any right on my part to obtain an answer to this on an Internet forum; just saying that the entire UK can be partitioned into two non-overlapping sets: those who legally have to say they're not a solicitor when asked, and those who legally have to say they are when asked, for whom it's easily verified with public records.

If you tip a glass of water into the ocean, the level in the ocean goes up, the level in your glass goes down.  Bitcoin is no different to, say, gold in the respect of being outside the fiat currencies.


I'd imagine that if "the major players" know anything at all about Bitcoin right now, it's that it has properties that make it useful for black market dealings.  That's pretty much the first thing people seem to hear, unfortunately.



That throws out the baby with the bathwater, doesn't it?  Admittedly a large proportion of your tax goes on defence and military spending, but you're also paying to have your rubbish collected, have your community centres maintained, have the courts run...

I think it was reasonable for me to assume that we were discussing mining with one's own electricity, seeing as you mentioned "your electricity cost".

Sure, but it's faith that has proved itself historically to be a) far more reliable over the ages, b) far more globally agreed upon than faith in fiat currencies.

It's a necessary property of money that people have faith in it.  It's not a necessary property that it be intrinsically valuable.

If promissory notes could still be redeemed for gold, you and I would take the banks up on the offer.