Audit of the cryptocurrency exchange Proof-of-Reserves: What it is and how it works

To save their cryptocurrency assets, users  various options are available – self-storage, exchange wallets and third-party custodians. Custodial services are designed to provide protection by storing the client's private key, preventing the possibility of unauthorized access to assets. But such an event as the collapse of FTX became a shock for the entire crypto industry. This made customers doubt the integrity of crypto companies.

To restore customer confidence, among the rest of the exchanges, the trend towards Proof-of-Reserves (PoR) has firmly entered into force, as proof that a business is solvent and liquid enough to continue operating with it.

What is Proof-of-Reserves

Traditionally, reserves – it is the company's income that is kept for emergency use. In the crypto space, a reserve check is essentially an independent third-party audit. by the party in order to check the reserves regarding their sufficiency to maintain the investment balance.

For bona fide exchanges, a PoR audit is an important step. The audit assures investors that the custodial platform is sufficiently liquid and solvent, and clients have the opportunity to monetize their assets at any time.

How Proof-of-Reserves is conducted

The purpose of the audit is to assess the solvency of the exchange, so there can be only two results:

• A solvent exchange - if its assets exceed its liabilities.
• Insolvent in all other cases.

But most often this approach turns out to be insufficient, for example, when the exchange shows its reserves only partially.

The verification procedure can be conditionally divided into three stages:

Commitment Check

Liabilities of the exchange – outstanding cryptocurrency balances to be paid to investors on their first demand. The sum of all funds on customer accounts is used for calculation. It is then compared with the total reserves. Commitment verification includes steps such as a Merkle tree using a cryptographic hash of the client ID.

Check availability of reserves

Cryptocurrencies that the exchange stores on the blockchain, controlling the private keys, are called reserves. During the check, all balances on crypto addresses are added up. An exchange can provide proof of ownership by providing the public key associated with the address and signing it with the private key.

Work with confirmation of reserves

The auditor does not need to analyze the entire blockchain; a collection of publicly available data is used. Given the same input values, a deterministic function will always produce the same results. This is a fundamental criterion for any blockchain, as it is difficult to achieve consensus if transactions do not produce the same result every time they are executed, regardless of who initiates them.

The results of the audit, as well as its attestation, that is, confirmation of the reliability of the software – these are two key components of proving the solvency of a cryptocurrency exchange.

How PoR is conducted

The process includes the following stages:

• The external auditor takes an anonymized snapshot of the exchange balances, organizes these balances in the form of a Merkle tree, which has several branches that are authenticated using hash codes.
• The auditor collects individual user balances using the unique signatures of each account holder.
• It remains to compare these data regarding the fact that the first are at least equal to the second.

Some platforms provide users with the opportunity to check their own assets in their personal account and verify with the help of the Merkle tree that they are really secured with cryptocurrency on the exchange.

Advantages and disadvantages of proof of reserves

The verification of assets proves that the cryptocurrency in the exchange meets the obligations to users. In particular, one can check whether wrapped tokens such as Wrapped Bitcoin (WBTC) are actually backed by real bitcoins – in general, there are many suitable situations. DeFi applications receive the information they need to audit WBTC reserves from the Chainlink network of oracles that check the custodian's BTC balance on the blockchain every 10 minutes.

In addition, Proof-of-Reserves engages regulatory authorities, which is consistent with a broad industry strategy. The introduction of the product is also facilitated by such a goal as eliminating the lack of trust. Users begin to trust custodians again, which helps the latter retain customers.

Proof-of-Reserves also has some disadvantages that should not be forgotten. A critical problem is that the correctness of the verification depends on the competence of the auditor. In addition, there is a risk that the results will be tampered with in cooperation with the exchange. Let us remind you that the collapsed FTX was also audited, but it did not help.