Would you trust a proof of reserves that doesn’t reveal any addresses?

[Antidote47k]

While reading about recent work on bitcoin privacy, I came across a proof of concept called zkPoH(Zero Knowledge Proof of HODL) and how it could potentially influence how proof of reserves are confirmed.
Proof of reserve is a way a custodian proves it actually holds the bitcoin it claims to hold on behalf of customers, so normally this is done by publishing its reserve addresses where any can look it up on the blockchain and verify that they really contain them. Now publishing these addresses exposes wallet balance, structure and transaction history, The advantage of this approach is that anyone can independently verify the reserve addresses on-chain without relying on the exchange’s word, this is where zkPoH comes in, it aims to let someone prove they control a certain amount of bitcoin without necessarily revealing UTXOs and addresses they belong to.
This is an interesting concept but the downside is that currently it does not yet prove ownership I.e it can currently prove that a qualifying UTXO does exist in the snapshot but can’t prove that said coins belongs to a particular person basically it’s still in development.

That brings us to my question, bitcoin has always valued transparency cause everything is publicly verifiable so if a cryptographic proof could provide the same assurance without revealing addresses, would that be enough for you or do you still believe that for trust, reserves should be visible on chain?

[Ambatman]

This has been suggested to Saylor for years to prove the Bitcoin they holding
Since he normally argues and try to protect their funds privacy.

bitcoin has always valued transparency cause everything is publicly verifiable so if a cryptographic proof could provide the same assurance without revealing addresses, would that be enough for you or do you still believe that for trust, reserves should be visible on chain?

If it can evolve towards showing proof of ownership and prevent double counting while making it possible that anybody can independently verify the proof
Then yes it would be enough for me.

Bitcoin isn't just about transparency or making things public
It's that information or claim are verifiable without requiring trust.

Brings to Verify. Don't trust. So I believe verification over visibility since privacy here is a feature.

[hmbdofficial]

That brings us to my question, bitcoin has always valued transparency cause everything is publicly verifiable so if a cryptographic proof could provide the same assurance without revealing addresses, would that be enough for you or do you still believe that for trust, reserves should be visible on chain?

For me I would prefer cryptographic proof over publicly visible addresses, in as far as it proofs the right thing. The thing is that proving that an exchange controls a certain amount of bitcoin is not the same as as proving it is solvent. A stronger system would actually prove both control of sufficient BTC and coverage for costumer liabilities without exposing addresses UTXO’s or users balances.
Bitcoin’s transparency is valuable because claims can be independently verify not because everyone must see the underlying data. So I think the ideal future should be like;
Don’t show me everything, just give me a proof I can independently verify that can actually provide both privacy and verifiability.

[BALIK]

Hmm, I also find this concept of ​​zkPoH very impressive.
But, replacement for Proof of Reserve? no way.
At most OK, I see it as an extra layer.

Cause, you know, main purpose of Proof of Reserve is to show actual control over asset, not just the existence of the UTXO.

Another thing is that Proof of Reserve was never enough on its own. After FTX, you may have noticed exchange have many liabilities, offchain debt, collateralized loan or other financial obligation are hidden. So, showing reserve does not prove its solvency. So, yes zkPoH could protect privacy but user can still be misled if those liabilities remain undisclosed.

[thesebassv]

That brings us to my question, bitcoin has always valued transparency cause everything is publicly verifiable so if a cryptographic proof could provide the same assurance without revealing addresses, would that be enough for you or do you still believe that for trust, reserves should be visible on chain?

Yes, totally. And I do not agree that reserves should be visible on chain, that can become a huge risk. But having a proof of reserve is more than enough to increase trust. Actually a lot of exchanges and projects already use ZKP-based proof of solvency or proof of reserve, like Binance, OKX, and Aave. Because they understand that having some level of proof benefits them, and I believe that once zkpoh is already tested and completely running, most of them will implement that to increase that trust

[PX-Z]

The advantage of a zero knowledge approach like zkPoH is that it can prove ownership or control of a certain amount of bitcoin without revealing wallet addresses or balances. That significantly improves privacy and reduces the risk of exposing an organization's entire treasury.

However, a proof that reveals no addresses requires trust, and it's contradicting how cryptography principle "Don't trust, verify"

Issue is, that proof of reserves alone has never been enough. Even if zkPoH proves an exchange controls say, 100,000 BTC, it says nothing about liabilities. An exchange could still owe customers 150,000 BTC and remain insolvent.

[Smack That Ace]

Well, best solution in this issue could be using hybrid system. Exchanges could use zkPoH to keep customer privacy and wallet structure secret if they want. But same time they will also need to have cryptographic proof of ownership. So, they also need to ensure liability verification and regular independent audit. You know, many Proof of Reserve implementation now use Merkle trees and zkPoH, but they are not full solution. Cause exchange could theoretically borrow UTXOs from somebody else before taking snapshot and still emerge fully reserved.

That brings us to my question, bitcoin has always valued transparency cause everything is publicly verifiable so if a cryptographic proof could provide the same assurance without revealing addresses, would that be enough for you or do you still believe that for trust, reserves should be visible on chain?

no, only cryptographic proof is not enough for me. Dont get me wrong, I am for privacy, but privacy should not diminish accountability, right?
I dont want to trust anyone, i want to verify.
If any significant part of verification become opaque then we will start relying on trust again.

[PrivacyG]

That brings us to my question, bitcoin has always valued transparency cause everything is publicly verifiable so if a cryptographic proof could provide the same assurance without revealing addresses, would that be enough for you or do you still believe that for trust, reserves should be visible on chain?

You call it proof your self.  It would be hard coded and impossible to forge I assume.  So.  What is the point in asking for more than cryptographic proof of someone holding a particular amount of Bitcoin?

More over.  Another Privacy feature is another step forward for Bitcoin I would say.  If you need to see the numbers, the address strings, balances et cetera with your own eyes to consider it proof then wait until you hear about Monero!

[RoseAPT]

At this point, KPMG, or any big 4 auditor, are way more reputable than hardware wallet makers

[Lida93]

. You know, many Proof of Reserve implementation now use Merkle trees and zkPoH, but they are not full solution. Cause exchange could theoretically borrow UTXOs from somebody else before taking snapshot and still emerge fully reserved.

A  possible scenario to be wary of which I totally agree with you because a situation of trust is rather created, which opens room for exploit by bad actors in the ecosystem. The zkPoH rather brings back trust instead of taken it off. Scammer exchanges could take ill advantage of this to scam customers along as they can easily return their borrowed money after sometime of gaining the public trust they need.

[d5000]

That brings us to my question, bitcoin has always valued transparency cause everything is publicly verifiable so if a cryptographic proof could provide the same assurance without revealing addresses, would that be enough for you or do you still believe that for trust, reserves should be visible on chain?

If the method really proves the ownership then it would be enough for me.

This would involve some signature work for the prover. For example we could imagine a simplified version of that problem: We have a set of 10 UTXOs, each worth 1 BTC, and all exist in the current state of the blockchain. The prover then could perhaps issue a proof that he can sign at least 1 UTXOs of those, and thus he can prove that he owns at least 1 BTC.

But yes, we're not there yet.

Here's the Delving Bitcoin thread with the prototype which - doesn't prove really anything useful, but they consider it a possible building block.

In the Delving Bitcoin thread I also stumbled upon this interesting method to announce a Lightning channel, proving that you own the UTXO you claim, but without revealing the UTXO itself. I guess that's the same problem and the development of that solution seems to be more advanced (that thread is from last year).
 

[dansus021]

Well in theory Would I trust a Proof of Reserves that doesn’t reveal addresses? Yes, if they provided the ZK verifier code that is fully open-source, reproducible locally, and verifies key ownership. But it would be great if I could see the address and check it manually on blockchain explorer.

and always remember the bitcoin mantra "Dont Trust Verify"

[Regbon134]

While reading about recent work on bitcoin privacy, I came across a proof of concept called zkPoH(Zero Knowledge Proof of HODL) and how it could potentially influence how proof of reserves are confirmed.
Proof of reserve is a way a custodian proves it actually holds the bitcoin it claims to hold on behalf of customers, so normally this is done by publishing its reserve addresses where any can look it up on the blockchain and verify that they really contain them. Now publishing these addresses exposes wallet balance, structure and transaction history, The advantage of this approach is that anyone can independently verify the reserve addresses on-chain without relying on the exchange’s word, this is where zkPoH comes in, it aims to let someone prove they control a certain amount of bitcoin without necessarily revealing UTXOs and addresses they belong to.
This is an interesting concept but the downside is that currently it does not yet prove ownership I.e it can currently prove that a qualifying UTXO does exist in the snapshot but can’t prove that said coins belongs to a particular person basically it’s still in development.

That brings us to my question, bitcoin has always valued transparency cause everything is publicly verifiable so if a cryptographic proof could provide the same assurance without revealing addresses, would that be enough for you or do you still believe that for trust, reserves should be visible on chain?

In my opinion, the answer is yes, but conditionally.

Technology like zkPoH is a great initiative for privacy. No one should reveal their entire wallet address, balance and transaction history. This increases the risk of being targeted by hackers. So if the cryptographic evidence mathematically confirms that the money is in their possession, then it is trustworthy.

But I'm still not completely satisfied. The reason:
1. This proof simply says "I have money," but does not say "I owe less than money." Suppose, someone has 100 bitcoins, but owes 150 bitcoins to customers - then they are bankrupt! That's what the collapse of FTX taught us.
2. Another loophole is that they can borrow bitcoins from someone just before they show the proof, and then return it later.

So my suggestion: there should be hybrid system. Use zkPoH for privacy, but it must be accompanied by an annual independent audit (third-party auditor) and a transparent accounting of liabilities. "Bitcoin's motto is" "" "Don't Trust, Verify" "" "- as long as I can't fully verify myself, I won't be superstitious."

[thesebassv]

2. Another loophole is that they can borrow bitcoins from someone just before they show the proof, and then return it later.

Actually it would be done in intervals. Some exchanges do it daily or monthly with ZK-SNARK or ZK-STARK, so I believe all serious projects would implement some thing like this to avoid what you just said. Of course is not checking the balance live, but at least with a daily interval it would avoid someone cheating.

So my suggestion: there should be hybrid system. Use zkPoH for privacy, but it must be accompanied by an annual independent audit (third-party auditor) and a transparent accounting of liabilities. "Bitcoin's motto is" "" "Don't Trust, Verify" "" "- as long as I can't fully verify myself, I won't be superstitious."

Yeah totally agree with this. The more evidence they have the better

[Ucy]

The problem with revealing exchange addresses is that their owners anonymity is broken, so things become less secure for both the assets and the exchange owners.
Zkp can be a suitable alternative if the verifies (bots or AI) do not reveal the data to central AI system (more like  AI head, or the most powerful AI that controls everything) or other things for that matter, which could be used for the interest of the system or against the data owners. Then what you effectively hide from humans become accessible to the most powerful and evil AI, and in the end defeats the purpose of zkp.

[Regbon134]

2. Another loophole is that they can borrow bitcoins from someone just before they show the proof, and then return it later.

Actually it would be done in intervals. Some exchanges do it daily or monthly with ZK-SNARK or ZK-STARK, so I believe all serious projects would implement some thing like this to avoid what you just said. Of course is not checking the balance live, but at least with a daily interval it would avoid someone cheating.

So my suggestion: there should be hybrid system. Use zkPoH for privacy, but it must be accompanied by an annual independent audit (third-party auditor) and a transparent accounting of liabilities. "Bitcoin's motto is" "" "Don't Trust, Verify" "" "- as long as I can't fully verify myself, I won't be superstitious."

Yeah totally agree with this. The more evidence they have the better

Very well said, especially in the intermission. Giving evidence on a regular basis (such as daily) suddenly makes it really difficult to borrow and cheat.

But I have an additional thought - what happens if the proof of reserve is repeated? If their liabilities are always higher than the reserve, they will be insolvent even if they show proof 10 times a day. So, I agree with you, once again, independent audit and disclosure of liabilities is most important. Only then will there be true transparency.

[d5000]

The more I think about this mechanism, the more interesting it looks for me There could be much more applications for this than a "Proof of Reserves" for exchanges and other service providers.

For example, you could imagine a company implementing that as an anti-spam mechanism to access a free tier of a non-KYC web service (say something like Github or email providers). It is currently already possible to tie membership to a traditional proof of hodl - so the user has to move Bitcoins around if they wanted to create several instances of that service, which involves hassle and fees. But that would expose your privacy if the service provider was hacked.

With zk-PoH you could have to demonstrate that you hold a certain (small) amount of Bitcoins. The only problem is that you could try to use the same UTXO for several of these proofs using a different snapshot including the same UTXO. But in this case, the UTXO snapshot could be checked against, i.e. you would have to use snapshots without overlapping UTXOs if you wanted two or more instances.

[Antidote47k]

~snip

Honestly, that’s an approach I hadn’t really thought about, and it’s a rather useful and practical one. I was wondering whether using different snapshots alone would be enough to stop someone from repeatedly proving ownership over time. Would something like a nullifier or possibly a one time proof mechanism eventually be needed to prevent the same UTXO from being reused?

[iBaba]

~~~

I find the idea very interesting because it tries to solve one of the biggest trade offs in bitcoin, transparency and privacy. If zero knowledge proof can provide the same level of confidence without exposing wallet addresses and balances, I think it is a step in the right direction. I would not be comfortable relying on it until the technology is mature. One thing I have learnt or observed over the years is that bitcoin users tend to trust systems that are simple and independently verifiable and being able to see reserve addresses on chain gives people confidence because they don’t have to rely on assumptions or unproven cryptography.

If zkPoH eventually proves both the existence of the funds and ownership without compromising privacy, I would gladly support it. Until then, I think visible on chain reserves remain the more trustworthy option, especially for exchanges that are asking users to trust them with large amounts of bitcoin.

[Numan467]

I do not think it is aquestion of openness vs secret keeping, but who needs to check the reserves? A typical user will not normally look at reserve addresses themselves, but will look at the work of researchers, developers and separate checkers.
I do not see the need to show all of the reserve addresses forever if it is possible for a zero knowledge proof to be publicly checkable, independently repeatable and inspectable without need to trust the holder. It should be the duty to make the proof checkable, not to reveal more information than is necessary. Otherwise, we are asking exchanges to give up privacy in exchange for some openness that cryptography might be able to offer in a better manner in the future.