Tornado Cash Fallout: Can Ethereum Be Censored?

With the sanctioning of Tornado Cash last week, the cryptoverse has been rife with speculation about how far protocols and companies will go to comply with government regulations.

Underneath this debate, a key question is being tested: Can Ethereum be censored? The answer isn’t as simple as “yes” or ”no,” and it requires differentiating Ethereum the protocol from the many apps and services built atop it.

This article originally appeared in Valid Points, CoinDesk’s weekly newsletter breaking down Ethereum’s evolution and its impact on crypto markets. Subscribe to get it in your inbox every Wednesday.

Services can be censored. Ethereum infrastructure providers like Infura and Alchemy have already restricted access to data on Tornado Cash smart contracts. Circle, the company that powers the USDC stablecoin, has begun denying service to accounts that have interacted with Tornado-linked addresses.

But it’s not all doom and gloom. The Ethereum protocol – the technology dictating whether transactions get propagated out to the rest of the network – has (thus far) not been censored. If a U.S. citizen wants to shuffle money through Tornado Cash, miners will still add the transactions to blocks and propagate them out to the wider network.

Read more: Are Crypto Mixers Legal?

But as a series of Twitter think-threads have pointed out this week, this doesn’t mean that the protocol is completely immune.

Testing the limits of Tornado Cash

Whatever your opinion on the Tornado Cash debacle, the fact that so many companies have jumped to comply with the sanctions by the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) should not be surprising. As CoinDesk’s Daniel Kuhn opined earlier this week, “It is perfectly reasonable, and possibly preferable, for Ethereum blockchain-based apps to block users with exposure to Tornado Cash, following the sanction of that anonymizing service last week. The alternative would likely open large parts of the Ethereum network to criminal liability. And that would include founding teams who are building the nascent, alternative economy of decentralized finance (DeFi).”

The founder of Tornado Cash has already been taken into federal custody. For Ethereum app builders and exchanges to flaunt sanctions on principle, they risk jeopardizing everything they’ve been building toward. At scale, this could imperil the entire ecosystem.

Industry think tank Coin Center has argued that the U.S. government’s dictate surrounding Tornado Cash is overbroad: “How can it be proper to add to the sanctions list not a person, or a person’s property, but instead an automated protocol not under anyone’s control?”

As Coin Center indicated, one could theoretically just clone Tornado Cash’s smart contracts (though this would still be extremely risky).

But this broadness applies in other ways.

In an act of protest (and comedy), Ethereum users have been testing how far the sanctions extend by sending money to public figures via Tornado Cash. Because Jimmy Fallon, for example, has received a bit of ETH from a Tornado address, he will presumably lose access to services that flag Tornado-linked wallets – all through no action on his part.

For the pranksters, this proves these sanctions were clumsily defined and therefore difficult to apply practically. But it also demonstrates how interpreting the sanctions requires one to get a bit technical.

Should a person lose access to apps even if they can’t actively “accept” a Tornado Cash transfer? What does it even mean to “use” Tornado Cash?

This is where things get interesting on a protocol level.

Read more: Decentralized Mixer Tornado Cash Makes Its User Interface Open-Source

Recall that the Ethereum network, like other blockchains, relies on a community of miners – or validators, in the upcoming proof-of-stake system – to assemble blocks and issue them out to the network. When you initiate a transaction on Ethereum as a user, it is added to the mempool – a big pile of transactions that have yet to get confirmed. Validators and miners assemble blocks by selecting transactions from the mempool and placing them in some order. They then propose those blocks to the broader network so they may be confirmed by others and added to the chain.

Now let’s look back at the Tornado Cash situation. If a validator adds a Tornado Cash transaction to a block, would they be running afoul of sanctions? While unlikely, the answer to this question isn’t so clear.

This has left room for speculation as to whether the Ethereum network is, at its very core, at risk of censorship. It has also kicked off a conversation on Twitter around how the Ethereum community would respond should validators take it upon themselves to no longer accept Tornado Cash transactions.

OFAC compliance in a ‘decentralized’ ecosystem

As we’ve discussed in past editions of this newsletter, centralization on Ethereum’s upcoming proof-of-stake (PoS) network is becoming increasingly difficult to ignore.

Twitter user elonyverse kicked off a debate Monday by predicting that over 66% of Beacon Chain validators – those who “stake” ether and operate the nodes that run Ethereum’s proof-of-state network – will adhere to OFAC regulations.

Thus far there’s no evidence from these validators that they will, indeed, censor transactions. It’s not even clear that governments would require them to do so. However, elonyverse’s tweet raises important questions about the influence that states could theoretically have over a blockchain the more centralized its validator set.

Jon Charbonneau, a research analyst at Delphi Digital, explained to CoinDesk that only one-third of validators would need to collude with one another in order to pose a nuisance to the network. If these many validators decide they don’t like Tornado Cash transactions, they could theoretically meddle with the network by preventing transactions from being finalized.

The validators would have even more sway over the network if they managed to amass 51% of staked ether. And should two-thirds of validators decide they want to completely censor certain transactions, Charbonneau says there’s not much that the rest of the network would be able to do in order to stop them, short of forking to a new blockchain.

The censors can wait

There hasn’t been any indication as yet from validators (or miners) indicating that they’ve altered their activity pursuant with the U.S. Treasury’s Tornado Cash mandate. Moreover, it’s not clear that validators would censor the chain even if required.

Lido – the largest Ethereum staking pool – divides its stake among several different validators. If Lido’s community decides sanctions bar them from processing Tornado Cash transactions, they’d need to get all of their validators on board or find new ones.

Luke Youngblood, who founded the Polkadot-based Moonwell protocol after previously helping to build Coinbase’s Ethereum staking product, told CoinDesk he thinks it is incredibly unlikely that the validators staked by Coinbase would ever censor transactions.

For one thing, says Youngblood, all of Coinbase’s staking infrastructure was set up outside of the United States. Even if it wasn’t, Youngblood thinks the company would sooner shut down its staking service than censor transactions (and risk losing part of its staked ether as a penalty).

Charbonneau explained to CoinDesk that there are additional layers of nuance around whether validators are proposing or building a block.

Eventually, in order to tackle the so-called miner extractable value problem (MEV), Ethereum will separate the parties that build blocks from those who propose them out to the wider network. While full proposer-builder separation (PBS) seems like it may be a couple of years out, an interim feature called MEV-boost, which is set to accompany the Ethereum Merge in September, will allow validators to propose pre-built blocks from central “relayers” rather than build blocks themselves.

In messages with CoinDesk, Delphi General Counsel Gabriel Shapiro speculated that proposers and builders could possibly be viewed differently from a legal perspective.

“The legal conception of ‘facilitation’ or ‘aiding/abetting’ can be very broad,” Shapiro wrote in a message to CoinDesk. “Validators who do not propose a block containing a sanctioned [transaction], but nevertheless sign an attestation for that block as part of the sequence of events leading to that block becoming finalized, might be guilty of facilitating or aiding/abetting the sanctioned [transaction], and thus might be violating sanctions laws (or other laws, as applicable).”

The Ethereum community responds

Youngblood thinks this whole debate around whether validators will censor transactions is silly. “It's just good engagement farming to spread FUD [fear, uncertainty and doubt] about companies, whether true or not. It gets a lot of likes/retweets,” he wrote in a message to CoinDesk.

FUD or not, the risk of protocol-level censorship is being taken seriously on Twitter, where prominent crypto investor Eric Wall polled the Ethereum community on how it would respond should validators begin censoring transactions.

So far, 61% of users have selected Option X: “Consider the censorship an attack on Ethereum and burn their stake via social consensus.”

This would mean forking to a brand new blockchain, where the offending validator’s stake is eliminated or reduced.

Among the majority in favor of punishing censors was Ethereum co-founder Vitalik Buterin, tweeting simply: “fwiw I voted X in your above poll.”

Pulse check

The following is an overview of network activity on the Ethereum Beacon Chain over the past week. For more information about the metrics featured in this section, check out our 101 explainer on Eth 2.0 metrics.

Disclaimer: All profits made from CoinDesk’s Eth 2.0 staking venture will be donated to a charity of the company’s choosing once transfers are enabled on the network.

Validated takes

Celsius appears to be in even worse financial straits than previously thought.

• WHY IT MATTERS: A new court filing Monday from Kirkland & Ellis, a law firm the crypto lender hired to lead its restructuring efforts, included financial projections that Celsius Network will run out of cash by October. The filing also showed that Celsius’ liabilities in crypto to customers suurpasses $6.6 billion while the lender only holds $3.3 billion of digital coins,for a $2.8 billion difference as of July 29.Read more here.

DeFi platform Acala’s stablecoin came close to regaining its peg to the U.S. dollar.

• WHY IT MATTERS: Polkadot-based decentralized finance (DeFi) platform Acala’s native stablecoin, aUSD, depegged on Sunday, falling 99% after hackers exploited a bug in a newly deployed liquidity pool to issue 1.28 billion tokens. In response, the platform burned over 1.2 billion aUSD tokens. Even though the price of aUSD plunged from roughly $1.03 per token to $0.009 after the attack, the peg was nearly regained Tuesday following the token burns, reaching 93 cents. Read more here.

Research firm FSInsight says ETH might eclipse BTC’s market capitalization in the next year.

• WHY IT MATTERS: Ether (ETH) has a good chance of surpassing bitcoin (BTC) in market cap over the next 12 months because the Ethereum blockchain’s switch to proof-of-stake (PoS) mechanism will reduce both the production of the tokens and selling pressure from miners, research firm FSInsight said. Bitcoin has a market cap of about $461 billion, CoinDesk data shows, compared with Ethereum’s $226 billion. Read more here.

Monero successfully completed a hard fork upgrade.

• WHY IT MATTERS: The change to Monero’s privacy-focused protocol was implemented Saturday at block 2,688,888. The upgrade brings about new privacy-preserving features including fee changes that will minimize fee volatility, improvements to multisignature functionality and a better Bulletproofs algorithm that increases transaction speed. Overall performance is expected to improve by 5%-7%. Read more here.

Ethereum-based lending and borrowing platforms Yearn Finance, Iron Bank and Homora joined Optimism, the layer 2 network.

• WHY IT MATTERS: The DeFi firms joined Optimism to improve cross-chain interoperability, security and capital efficiency for their users. Optimism users will now be able to borrow against their crypto assets while benefiting from competitive gas fees, attractive rewards and yield options. “By launching on Optimism, we aim to make DeFi more accessible, scalable and reliable as the protocol-to-protocol liquidity backbone,” said Puff, the lead contributor to Iron Bank. Read more here.

Factoid of the week

Open comms

Valid Points incorporates information and data about CoinDesk’s own Ethereum validator in weekly analysis. All profits made from this staking venture will be donated to a charity of our choosing once transfers are enabled on the network. For a full overview of the project, check out our announcement post.

You can verify the activity of the CoinDesk Eth 2.0 validator in real time through our public validator key, which is:

0xad7fef3b2350d220de3ae360c70d7f488926b6117e5f785a8995487c46d323ddad0f574fdcc50eeefec34ed9d2039ecb.

Search for it on any Eth 2.0 block explorer site.

UPDATE (Aug. 17, 2022, 15:00 UTC): Corrects the spelling of Jon Charbonneau. Clarifies that 1/3 of Ethereum proof-of-stake validators can prevent blocks from finalizing, but cannot "halt" the chain as originally stated.