Chainlink ‘Proof of Reserve’ Proves Little Beyond Data Going In, Coming Out

Crypto infrastructure firm Chainlink claims its proof-of-reserves service – designed to help users verify that exchanges and asset managers have the backing they profess – “enables the reliable and timely monitoring of reserve assets using #ProofNotPromises.”

In reality, the system frequently relies on promises all the way down.

Chainlink Proof of Reserve is one of the only ways for crypto custodians to track real-world assets directly on blockchains, a service that unlocks a host of safety and transparency benefits for the end-users of decentralized finance (DeFi) products.

However, rather than help crypto users transact with more confidence and transparency, Chainlink’s reserve tech can also provide them with a false sense of security – adding a veneer of legitimacy and “decentralization” to the same inadequate accounting practices that were exposed by the collapse of the FTX exchange.

When it comes to integrating centralized data into decentralized protocols, a deep dive into Chainlink’s proof-of-reserves tech shows how “promises,” not “proof,” are often the best that one can realistically hope for.

This article is featured in the latest issue of The Protocol, our weekly newsletter exploring the tech behind crypto, one block at a time. Sign up here to get it in your inbox every Wednesday.

What is Chainlink Proof of Reserve?

Chainlink is the leading provider of crypto “oracles” – software modules that gather off-chain data – prices, weather info, whatever – and then feed that into blockchain-based applications. Chainlink’s main draw is that it can source information from a wide network of node operators, reducing the need for platforms to place their trust in centralized data sources.

Over the past couple of years, Chainlink has expanded its product suite to include proof-of-reserves accounting – a way for crypto custodians to prove that they hold as many assets as they claim to customers.

Proof-of-reserves has become a hot topic since last year’s crypto-market meltdown, which prompted questions over how investors might be able to verify if their exchanges can actually prove they are safely keeping customers’ assets, and where.

After the FTX exchange crashed and was accused of misappropriating user funds, leading exchanges like Binance, and stablecoin operators like Circle – companies that custody user funds or issue tokens representing assets in real-world banks – rushed to assure users that their reserve claims can be trusted.

Even as companies began publishing official proof-of-reserves reports, users demanded more than just third-party audits and attestations – like the ones FTX received – to back up their numbers.

Chainlink offered these companies an alternative – a way to transparently monitor and report their reserves in a manner that leveraged the “autonomous,” and “decentralized” properties provided by blockchains.

Looking under the hood, however, Chainlink’s tech may add more confusion than transparency in some cases. Its decentralized oracle network helps ensure the safe delivery of off-chain reserve data, but it doesn’t make that data any more credible than it would be otherwise.

Paxos and Self-Attestations

Chainlink explains its reserve-proving tech on its website: “Operated by a decentralized network of oracles, Chainlink Proof of Reserve enables the autonomous auditing of collateral in real-time, helping ensure user funds are protected from unforeseen fractional reserve practices and other fraudulent activity from off-chain custodians.”

As for what this unlocks, according to Chainlink, “rather than forcing users to trust paper guarantees made by custodians, Chainlink PoR can be deployed for automated on-chain audits that give users a superior guarantee of an asset’s underlying collateralization.”

Paxos, the stablecoin operator, uses Chainlink PoR for PAXG, its gold-backed stablecoin, and USDP, its U.S. dollar-pegged stablecoin.

On Twitter, Chainlink boasted that its partnership with Paxos would allow app developers “easily audit the off-chain gold reserves backing PAX Gold.” Paxos, in a press release, said the Chainlink oracles would enable people to “quickly verify on-chain that PAX tokens are fully backed 1:1 by U.S. dollars and PAXG tokens are fully backed by gold bars, both of which are held off-chain in Paxos’ custody.”

The terms “audit” and “verify” may be a stretch in this case, however.

Of the 16 third-party node operators that report on PAXG’s gold reserves, every single one of them gets its data from the same place: Paxos itself. It’s the same case for USDP: Chainlink’s “decentralized” network of 16 node operators each reports that the stablecoin is backed by $1.04 billion – the number handed to them by a Paxos API, meaning it’s a data feed that comes directly from the project.

Chainlink calls this reporting practice “self-attestation,” and it warns in its developer docs that “self-attested feeds carry additional risk.”

In a statement shared with CoinDesk, Chainlink said “Only a small minority of Chainlink PoR users are still self-attested,” adding that “Some users start here as a first step towards greater transparency.” Chainlink did not provide any examples of projects that have moved from self-attestations to other reserve-reporting methods.

Whatever the precise details on how Paxos calculates its reserve numbers (Paxos did not immediately respond to CoinDesk’s questions on the matter), the data that the company reports to Chainlink ultimately requires total trust in Paxos – not Chainlink’s third-party oracle network.

There are reasons why consumers might trust Paxos. For one thing, the stablecoin issuer uses a third-party accounting firm to conduct monthly attestations of its PAXG and USDP reserves, though the data that Paxos reports to Chainlink is updated more frequently than that – at least once per day.

Paxos is also a New York State-chartered trust company, meaning it is much more tightly regulated than most other stablecoin operators. However, Paxos was recently forced to stop minting Binance-linked BUSD stablecoins after New York State regulators charged the firm with violating “its obligation to conduct tailored, periodic risk assessments and due diligence refreshes.”

Paxos uses its Chainlink PoR feeds as a way to earn credibility with distrustful DeFi traders, but its “fully-backed” claims don’t become more credible just because they pass through Chainlink’s decentralized oracle network.

Using an extreme analogy – a stablecoin issuer “self-attesting” to its reserves via Chainlink would be like FTX emailing its financials to 16 people and asking them to disseminate the numbers on its behalf. Even if numbers are “audited” (as they often were, in the case of FTX), they would ultimately only be as trustworthy as that original email from FTX.

TrueUSD and Third-Party Attestations

Different companies use the “proof-of-reserves” moniker to describe different accounting systems, each of varying quality. Accordingly, Chainlink’s PoR partners all use their own methods to back up their reserve claims.

“Chainlink will do all kinds of different stuff and just call it ‘proof-of-reserve,’” explained Niklas Kunkel, formerly head of Oracles at MakerDAO. One decentralized app’s proof-of-reserves program “doesn't have the same trust or security guarantees as proof of reserve on another app.”

Archblock (previoustly TrustToken), the company behind the U.S. dollar-backed TrueUSD (TUSD) stablecoin, uses Chainlink to prove that each of its TUSD tokens is backed by a dollar in reserves. Instead of self-attesting to its reserves, it reports them to Chainlink’s oracles via The Network Firm, a third-party accountant.

In a blog post explaining its Chainlink partnership, Archblock explained that The Network Firm “aggregates all reserves data (U.S. dollars held at financial institutions) in real-time and serves that information on-chain through Chainlink’s industry-leading decentralized oracle network.”

The Network Firm boasts a robust, industry-first, real-time asset-tracking system. It says it sources reserve data directly from custodians and uses a cryptographic method called Merkle Trees to verify amounts.

However, Chainlink’s oracles aren’t doing any of this cryptography or accounting themselves. Instead, they’re linked up to The Network Firm’s in-house API, a computer system that reports the data to them.

Trusting TUSD’s Chainlink PoR feed means trusting The Network Firm’s attestations.

Troubles with TrueUSD

The Network Firm’s founders used to lead the crypto arm of Armanino – the U.S. accounting firm that shuttered its crypto division after facing ridicule for failing to find discrepancies with FTX’s U.S. division, which it was hired to audit.

Armanino has since defended its work for the collapsed exchange giant, but The Network Firm’s link with FTX’s auditor garnered renewed scrutiny last week when questions surfaced around TUSD’s reserve reports.

Archblock previously used Prime Trust, a large crypto custodian, to hold a portion of TUSD’s reserves and handle stablecoin-to-dollar redemptions. In late June, Nevada regulators ordered the custodian to shut down and accused it of losing $80 million worth of client funds.

Archblock initially stated it had “no exposure” to the Prime Trust debacle but eventually disclosed that it held a relatively small sum ($26,000) with the firm.

Archblock’s about-face came alongside rumors that some people were having issues redeeming TUSD tokens. At one point, the price of TUSD on Binance briefly dropped to 80 cents. All the events sparked (or were spurred on by) concerns with TUSD’s solvency.

It was a Network Firm disclosure that ultimately gets credit for flagging the ongoing relationship between TUSD and Prime Trust, but the incident underscored the limited transparency provided by The Network Firm’s reserve-reporting apparatus.

TrueUSD’s ownership and banking relationships have long been difficult for the public to discern, and The Network Firm does not name the banks that TUSD does business with in its attestations. (It referred to Prime Trust as “a U.S. depository institution which has communicated to customers that the institution has been ordered by state regulators to halt deposits and withdrawals for fiat and digital asset accounts.”) Reserve snapshots like those provided by The Network Firm (and most other attestation providers) also frequently lack a full picture of a company's total liabilities; even if money is in a bank account, that doesn’t mean it isn’t owed to someone else.

The numbers reported to Chainlink’s oracles, in other words, can’t possibly tell the full story.

Asked for clarity as to how it specifically tracks TUSD assets, The Network Firm said it was “limited in making public statements about specific clients for whom we are engaged to provide attest services.”

Regular attestations are better than no attestations at all, but with limited transparency come additional questions. For instance, what good is “proof” that reserves exist if a portion of them – however minuscule – are locked up with a collapsed financial institution?

TUSD has a “ripcord” system that works in conjunction with Chainlink’s PoR feeds to auto-pause minting and redemptions in the event of reserve discrepancies. A ripcord was briefly pulled around the time of The Network Firm’s Prime Trust disclosure, but according to a tweet from TrueUSD, this was only “due to a delay in one of the new banking partner's API interface, which prevented the auditor(TNF) from reading the bank's latest escrow balance.” The relationship between TUSD and a suspicious “U.S. depository institution” didn’t trigger the ripcord itself.

Chainlink Proof of Reserve in context

Chainlink is far from the only company with problem-laden proof-of-reserve promises; the issues with the firm’s PoR tech ultimately stem from limitations with reserve accounting in general.

The key thing is that Chainlink’s decentralized oracle network only serves to ensure that data from centralized entities is not tampered with before it makes it on-chain. It doesn’t make that original data any more (or less) credible.

Chainlink doesn’t hide these caveats. At the bottom of its proof-of-reserve dashboard, the oracle firm cautions that “feeds can vary in their configurations” and warns app-builders that they “are solely responsible for reviewing the quality of the data (e.g., a Proof of Reserve feed) that you integrate into your smart contracts.” While projects like Paxos self-attest to their data, most report their reserve data to Chainlink via auditors or directly from custodians.

But it's unclear how many end-users realize where they are placing their trust when it comes to Chainlink’s PoR oracles. Frequently, projects use the mere existence of the oracles as a way to bolster their credibility with users.

A Messari report commissioned by Chainlink showed that TUSD deposits dramatically increased after TUSD made its Chainlink PoR push. According to the report, “Within one month after Chainlink added TUSD PoR data feeds, the TUSD market cap increased by 121%,” an increase of over $1 billion. It’s difficult to say how much of this spike is attributable to TUSD’s Chainlink oracles, but the PoR feeds figure prominently in TUSD’s recent marketing.

In response to questions from CoinDesk, Chainlink made the case that its PoR technology – while imperfect – was still a step in the right direction for transparency within the broader crypto industry. The firm points out that it “requires the user to have an attestation method that is publicly disclosed by Chainlink” (emphasis Chainlink’s).

Also, even if reserve claims cannot be backed up with full guarantees, Chainlink notes that it is one of the only solutions for developers to bake them directly into the code of decentralized finance protocols. This can, in theory, unlock a number of safety and transparency benefits for users (e.g. TUSD’s ripcords).

The tech is also powerful for tracking cross-chain reserves – allowing blockchain-based projects on one network to easily prove that they have reserves on another network. Per Chainlink’s statement, “This method fully leverages the immutable and transparent characteristics of blockchains, but is only practical if all assets and related transactions are on-chain.”

In general, though, it’s still unclear whether these efforts at transparency are a step in the right direction, or are merely setting up an illusion of decentralization in a fundamentally trust-based system.