Originally Published Here.

Introduction

Scroll in the UI of any banking or fintech app today – whether it be Bank of America or Revolut, Chase or SoFi – the interface feels almost interchangeable: Accounts, Pay & Transfer, Earn Yield. This design reveals an underlying commonality; banks are interfaces for four fundamental relationships we have with money:

1. Store: a place for us to hold our assets

2. Spend: a mechanism to transfer money for everyday spending

3. Grow: a set of tools to both passively and actively manage our wealth.

4. Borrow: a place to borrow capital from

Over the past decade, mobile technology has fueled the rise of “neobank” apps like SoFi, Revolut, and Wise that democratized financial services and redefined what it means to “go to the bank,” replacing physical branches with intuitive, always-on digital interfaces.

Today, as crypto enters its second decade, it offers a new blueprint for what comes next. From self-custodial wallets to stablecoins to onchain credit and yields, the permissionless and programmable nature of blockchains enables banking experiences that are global, instantaneous, and composable. If mobile gave us the neobank, crypto gives us the permissionless neobank: a unified, interoperable, and self-custody interface to store, spend, grow, and borrow money in the onchain economy.

A History of Fintech Neobanks

Just like crypto, neobanks rose to prominence in the aftermath of the 2008 financial crisis. Rather than copy the brick-and-mortar layout of a traditional bank, neobanks operate as tech platforms providing banking services through a mobile interface. Most neobanks work with partner banks behind the scenes to provide deposit insurance and compliance infrastructure, while maintaining the front-end customer relationship. With their fast onboarding, transparent fees, and digital-first designs, many neobanks have become the go-to interface for users to store, spend, and grow money [1].

A Brief Overview of FinTech Neobanks. Note: Market data from Yahoo Finance as of Dec. 10, 2025

Looking at the growth stories of all these multibillion-dollar neobank startups, we see that what they have in common is in owning the customer relationship through a unique digital offering (refinancing, early paycheck access, transparent FX rates), kickstarting a user-driven volume flywheel, before expanding their product suite to upcharge their users. To put in simple terms, fintech neobanks won by owning the customer interface for money, changing the medium users store, spend, grow, and borrow money.

Today, crypto is at a similar junction as neobanks were 5-10 years ago. Over the past decade of development, crypto has already produced its own wedges: censorship-resistant asset storage via self-custodial wallets, accessible digital dollars via stablecoins, permissionless credit markets on protocols like Aave, and 24/7 global capital markets that can turn Internet memes into wealth generators. Just as mobile infrastructure unlocked the neobank era, programmable blockchains now provide a permissionless financial substrate [2][3].

The natural next step is to combine those permissionless backends with the easy-access frontend of a neobank. While the first wave of neobanks moved the frontend of a bank from a physical store to a mobile interface while keeping the banking backend, today crypto neobanks are doing the opposite: keeping the convenient mobile frontend while changing how money moves from traditional banking rails to stablecoins and public blockchains. In other words, if neobanks rebuilt the frontend of banking on mobile rails, crypto now offers the chance to rebuild the backend on permissionless rails.

The Landscape of Crypto Neobanks

Landscape of Crypto Neobanks. Source: Original Content. {1}

Today, many different projects are converging towards a “crypto neobank” vision. We already see many banking primitives of storing, spending, growing, and borrowing money already being realized on permissionless crypto rails – we can self-custody using Ledger, spend with an Etherfi card or Bitget QR code, grow money by trading on Hyperliquid, and borrow money through Morpho. There are also numerous adjacent players supporting the underlying infrastructure, such as wallets as a service, stablecoin settlements, licensing, localized on-ramp and off-ramp partners, and orchestration routers [26].

Furthermore, in some cases, crypto exchanges like Binance and Coinbase have already made huge strides to become more like a fintech neobank, capturing more and more of an end user’s relationship with their assets. Binance Pay, for example, already powers over 20 million merchants worldwide [4], while Coinbase allows users to automatically earn up to 4% rewards just by holding USDC on platform.

So, with this complicated landscape of crypto neobanks, it is worth walking through this landscape carefully, looking at how different crypto platforms are vying to own the primary financial relationship with users, targeting how users store, spend, grow, and borrow money.

Storing Money with Crypto

To properly self-custody a crypto asset and interact with the blockchain, a user must have some sort of crypto wallet. Roughly speaking, we can categorize the crypto wallet landscape by two axes: a “security to accessibility” axis, and a “consumer application to enterprise infrastructure” axis. Each category has seen differentiated winners with huge distribution power: Ledger for secure, consumer-facing hardware wallets; Fireblocks and Anchorage for secure enterprise wallet infrastructure; Metamask, Phantom, and Privy being consumer-facing wallets focusing on improving accessibility and UX, while Turnkey and Coinbase Prime capturing more of the accessible, enterprise-grade infrastructure.

One of the key advantages of building a neobank from a wallet application as a beachhead is that wallet frontends – such as Metamask and Phantom – often own the entry point by which users interact with their crypto assets. This “fat wallet thesis” argues that the wallet layer captures most of the consumer-grade distribution and order flow, and that for an end consumer, wallets have an incredibly high switching cost [5]. Indeed, today an estimated 35% of Solana transaction volume flows just through Phantom wallet, an incredible moat established by superior mobile UX and user stickiness [6]. Moreover, as consumers (especially retail consumers) would often choose convenience over price, wallets such as Phantom and Metamask can have a take rate of 0.85% [7], whereas the swapping protocol, such as Uniswap, might only introduce a 0.3% fee for swapping tokens [8].

On the other hand, creating an entire neobank from just a single wallet platform is actually surprisingly difficult. This is because achieving profitable scale here requires users to not just store tokens, but actively use them inside of the wallet. Phantom, Metamask, and Ledger may be able to boast household recognition, but they’re not able to monetize if all the user is treating their crypto wallet like a cash shoebox underneath their bed. In other words, wallets must become active trading and transaction platforms to convert their distribution to revenue.

Both MetaMask and Phantom seem to be moving in this direction. MetaMask, for example, recently launched the MetaMask card as a way to upcharge their existing crypto-native demographic and become a default solution for “spending crypto.” Phantom has also followed suit with its Phantom Cash launch, and moving into the “grow money” sector by integrating with Hyperliquid’s builder codes to offer in-app perp trading. As Blockworks puts it, “though Drift or Jupiter might be [Solana] hometown favorites, Hyperliquid is where the money already is” [9]. This is a lesson universally applicable to companies in the wallet space – you must not only capture the user’s wallet, but also capture the volumes moving in and out of that wallet via spend, grow, and borrow.

Spending Money with Crypto

The second category of crypto neobank contenders are platforms that allow users to spend money with crypto. Just like in the case of “storing money with crypto,” we can categorize these crypto spending applications along two axes: from onchain transfers to offchain purchases (eg. buying a coffee), and from retail-facing applications to enterprise-focused infrastructure.

Interestingly, most of the newer “neobank” projects that have gained traction over the past few months, such as Kast, Tria, Tempo, and Stable all attempt to tackle this wedge of spending money with crypto. In particular, we have seen much of the buzz within the neobank trend has been happening in two areas of “spending crypto” – (1) retail consumer apps with stablecoin card integrations, such as Avici, Tria, Redotpay, and EtherFi, as well as (2) “stablecoin-focused chains” such as Stable, Plasma, and Tempo meant as infrastructure for enterprise use cases.

The first category of retail-centric “spending apps” fundamentally makes crypto apps much similar in their user experience and interface as traditional banking and neobank apps, with familiar tabs like “Home, Banking, Card, and Invest.”

As crypto card issuers like Rain and Reap have matured, along with Visa and Mastercard’s expanded stablecoin support, crypto cards are becoming a commoditized offering. The real differentiation comes from driving and retaining transaction volume – whether it be through novel cashback mechanisms, geographical “ground game”, and onboarding non-crypto natives onto these platforms. This trajectory echoes the rise of fintech neobanks, where success wasn’t about issuing a card or building an app, but about owning a particular customer segment – from students (SoFi) to low-income families (Chime) to international travelers (Wise and Revolut) – and scaling trust, loyalty, and volume from there. If done right, these payment-first neobanks could become a large adoption vector for crypto that fuels adoption of blockchain infrastructure.

Crypto neobanks could also guide users towards a next-generation system of payments that move beyond legacy card rails. Card-based spending could just be a temporary, transitional model still dependent on Visa and Mastercard’s rails and inherit their centralized constraints. Early signals of what’s next are already emerging: wallets like Bitget Wallet have already rolled out QR-based stablecoin payments with merchant pilots in Indonesia, Brazil, and Vietnam, pointing toward a future where crypto-native settlement could potentially bypass legacy issuers entirely.

The second class of recent “neobank” applications have been stablecoin infrastructure projects built for enterprises, including Stable, Plasma, Tempo, Arc, often dubbed “stablecoin chains”. A major reason for their rise may be the increased interest from institutional players – traditional banks, FinTechs like Stripe, incumbent payment networks – wanting more efficient rails to move money. Many of these “stablecoin chains” are designed to have similar features [10], such as stablecoin gas tokens, which stabilize gas fees by removing the price variable of a custom gas token, streamlined consensus mechanisms to “fast-track” simple, high-volume payments from A to B, better privacy for token transfers such as with Trusted Execution Environments (TEEs), and customization of data fields to better fit international payments standards such as ISO 20022 [11].

However, these technical improvements alone do not guarantee adoption. For payment chains, the moat is the merchant. It is a question of how many merchants and enterprises decide to move their business operations onto a particular chain. Tempo, for example, attempts to leverage Stripe’s massive merchant customer base and payments rails to drive volumes, adoption, and revenue [12], onboarding a completely new cohort of merchants onto crypto rails. Other chains, such as Plasma and Stable, aim to become “first-class-citizens” for Tether’s USDT to move the stablecoin between different institutions.

One of the most instructive case studies here is Tron, which processes 25-30% of global stablecoin transaction volume [13]. Tron’s rise can largely be attributed to its dominance in emerging markets, such as Nigeria, Argentina, Brazil, and Southeast Asia. Due to its low fees, fast finality, and global reach, Tron rose to become a common settlement layer for many merchant payments, remittances, and dollar-denominated savings accounts [14]. For all these newer payment chains, Tron is the incumbent that they must overcome. This requires a 10x improvement on an already cheap, fast chain with global reach – a task that requires a laser focus on merchant onboarding and network scale rather than on marginal technological improvements.

Growing Money with Crypto

The third relationship that a “crypto neobank” can have with its customer is the ability to “grow money.” This is the area of crypto that has had the highest degree of innovation, accelerating the growth of several 0 to 1 primitives from staking vaults to perps trading to token launchpads and prediction markets. As before, we can classify applications that help us to “grow money” along two different axes – from passive yield to active trading, as well as from frontend interface to backend liquidity.

The most classic example of how a “growing money” application gradually develops into an all-encompassing “neobank” is that of a centralized crypto exchange, such as Binance or Coinbase. CEXs started out as offering a simple but effective value proposition – “this is the place you go to trade crypto to grow your wealth”. As trading volumes gradually ramped up, exchanges became the quintessential venues to not only grow wealth, but also store and manage it [15]. Both Coinbase and Binance have launched their own blockchains, wallets, institutional offerings, and crypto cards, upcharging their core demographic through new products and network effects. Binance Pay, for example, has seen growing adoption as vendors use it to accept crypto payments for everyday goods.

The same playbook has been borne out for DeFi projects. EtherFi, for example, started out as a liquid staking protocol for Ethereum, offering passive yield for stakers as they restake ETH on EigenLayer [16]. Next, they began offering “Liquid,” a DeFi strategy vault that put users’ money to work within the DeFi ecosystem for higher yields and managed risk. Then, they expanded to EtherFi “Cash” product, which was a groundbreaking credit card product that allowed users to spend their EtherFi balance in real world settings. This expansion roadmap clearly resembles that of a fintech neobank – gain a foothold through a unique product offering (passive staking and yield), become seen as best-in-class in that category to capture volume, before expanding across the product suite to upcharge those customers (via the EtherFi card).

Crypto today has already delivered several 0 to 1 innovations that allow users to “grow money” [27] – perps trading platforms like Hyperliquid have become some of the most profitable crypto companies, while prediction markets like Polymarket have also broken into the mainstream. It is very plausible that the next step for these platforms too will be in upcharging via novel product offerings – allowing consumers to spend more and store more on these platforms while leveraging network scale.

One of the major advantages of starting out as a “growing money platform,” especially as an active trading platform, is that there are typically very high volumes and frequent transactions. Hyperliquid, for example, has processed 3 trillion USD in volume over the last 18 months [17]. This means that compared to “store money platforms” and “spend money platforms,” “grow money platforms” have a far more sticky user flywheel. This means that there is a larger captive customer base to translate and upcharge as they move across to other platforms. At the same time, these platforms are greatly market dependent, and have the reputation of being “financial casinos.” This could be a stigma that limits their ability to onboard a truly global retail audience. After all, people generally have a very different attitude towards a bank than they do with a casino.

Borrowing Money with Crypto

Just as in the case of traditional economies, the ability to borrow capital in crypto is a huge driver for the growth of the onchain economy. For crypto neobanks, borrowing is also one of the most important sustainable generators of yield. Whereas in the traditional world borrowing is a highly permissioned activity, mediated by KYC, credit profiles, and borrowing history, crypto borrowing systems have both permissioned and permissionless models, with different requirements for collateral capital.

The dominant model in crypto today is in permissionless, onchain systems with overcollateralization requirements. DeFi giants like Aave, Morpho, and Sky (fka. MakerDAO) embody the crypto ethos in operating on a code-is-law premise: because blockchains inherently don’t have access to users’ FICO scores or reputation, they demand solvency through overcollateralization [22], trading off capital efficiency for broader accessibility and security against defaults. Morpho, in particular, represents the next generation of evolution in this model [23], allowing for increased capital efficiency by introducing a more modular, permissionless system with more efficient risk-pricing.

On the other side of the spectrum is permissioned lending, which has gained adoption primarily as more institutional capital allocators begin interacting with DeFi, such as through market making. Protocols like Maple Finance, Goldfinch, and Clearpool all try to target this institutional audience, effectively building a traditional credit desk onchain. They allow for undercollateralized loans by having a permissioned system with strict KYC and offchain legal agreements with institutional borrowers [24]. Their moat is not just in liquidity (as is the case with permissionless pools), but also in the regulatory scaffolding and BD expertise that comes with selling a B2B product. Other protocols in the permissioned lending landscape, such as Figure Markets, Nexo, and Coinbase’s Lending product target a retail borrowing audience with a compliance-first approach. They require both the KYC of borrowers as well as overcollateralization of these assets, and sometimes “wrap” around protocols like Morpho, as in the case of Coinbase Lending [25]. In these cases, the main appeal may be the faster settlement and access of capital compared to traditional bank loans.

However, the “holy grail” unlock of crypto lending is undercollateralized consumer credit – the wedge that generational fintech products such as SoFi and Chime mastered to “bank the unbanked”. Crypto has yet to fully step up here, and replicate the “consumer credit flywheel” that fintech neobanks created. This is because crypto lacks a robust sybil-resistant identity layer and sufficient consequences for default. The only exception to this is “flash loans” – a purely crypto-native form of ephemeral uncollateralized lending from blockchain mechanism quirks, but these remain mostly a tool for arbitrage bots and sophisticated DeFi strategies rather than everyday consumers.

For the next generation of crypto neobanks, the race may be to move toward the center of this map, combining the speed and transparency of permissionless DeFi with the capital efficiency of traditional lending. The winner will likely be a platform that either solves decentralized identity layer or commoditizes it to unlock consumer credit, allowing crypto to effectively rebuild the mechanism of a consumer credit card. Until then, perhaps crypto neobanks will continue to rely on existing mechanisms of overcollateralized lending to power the yields of DeFi.

Making Money Move Faster

Fundamentally, the core value proposition of a crypto neobank is to make money move faster – just as Fintech neobanks like SoFi and Chime did via mobile apps in the decade before. Blockchain rails effectively “flatten” the distance between any two arbitrary accounts into just a single transfer, rather than needing to hop between international banks, SUIFT, and countless arcane systems.

While each relationship of money – storing, spending, growing, and borrowing – leverages this “blockchain flattening” differently, offering different tradeoffs and monetizing models, I believe that they ultimately form a pyramid defined by their “velocity of money.” At the top is “growing money,” where the velocity of money is the highest (eg. Hyperliquid trading fees), followed by lending (monetization via interest), spending (via interchange and FX spreads), and lastly storage (on/offramp charges and B2B integrations).

From this perspective, perhaps the easiest path to building a crypto neobank is to start at the growth and lending layer, where capital velocity and user engagement are highest. Protocols that first capture value in motion can later go down the pyramid to turn existing users into full-stack financial customers.

Opportunities for Neobanks

So, what might be next for crypto neobanks? What are the opportunities out there to build the next generation of permissionless neobanks? I believe that there are several (interconnected) directions that still need further exploration: (1) privacy and compliance parity, (2) real world composability, (3) leveraging permissionlessness, (4) localization vs. globalization, (5) undercollateralized lending and credit

1 - Privacy and Compliance Parity

Stablecoins and crypto rails allow for several advantages over traditional rails, especially around speed and ease of use. However, for crypto neobanks to directly compete with their fintech predecessors and incumbent banking rails, they must reach feature parity in two key dimensions: privacy and compliance.

While privacy may not seem to be a significant priority for retail consumer use cases and stablecoins have reached significant scale without guaranteed privacy, it becomes a critical factor as more enterprise applications – such as payroll, supply chain financing, and international settlement move onto onchain rails [18]. This is because public transactions for B2B transfers are likely to reveal trade secrets and other sensitive information. I believe this is part of the reason why many of the new stablecoin chains being released have emphasized privacy on their roadmaps.

On the flip side, crypto neobanks need to consider how their platforms can reach compliance parity as their predecessors. This includes gradually building up a global regulatory moat and licensing regime, and assuring both consumers and merchants that a crypto solution is just as compliant as a traditional one – perhaps through novel technical advances like zero knowledge proofs. It is only by addressing these dual concerns of enterprise-grade privacy and compliance that crypto neobanks can truly scale beyond their fintech predecessors.

2 - Real World Composability

Composability – through common standards, frameworks, and smart contracts – is often touted as a strength of crypto rails. But oftentimes this composability is restricted towards other components within the crypto sphere: with other DeFi primitives, yield protocols, and across (largely EVM) blockchains. The true challenge of composability is about bridging these blockchain standards with legacy real-world standards from various eras: international banking systems like SWIFT, merchant POS systems and standards like ISO 20022, and local money rails like ACH or Pix. With the proliferation of crypto cards and increased use of stablecoins in international payments, the space seems to be moving positively in this direction.

Moreover, today many crypto card products typically target crypto-native customers, serving as the offramp infrastructure for “crypto whales.” But the true challenge for crypto neobanks will be to expand beyond the crypto-native demographic, and onboard a net new cohort of customers on to these rails, through offering both real-world composability as well as fundamentally innovative primitives. Crypto neobanks that solve these problems of composability will have much better onramp and offramp UX, allowing them to better onboard user volume.

3 - Leveraging Permissionlessness

Fundamentally, crypto neobanks are about reinventing a more efficient standard for money – one that is designed to be instantaneous, have global liquidity, be infinitely programmable, and cannot be bottlenecked by single actors or governments. Anyone with a crypto wallet can currently trade on Hyperliquid, send a USDC transfer, or earn yield from an EtherFi vault, without being mediated by fiat authority. Crypto neobanks should leverage their fundamentally permissionless nature to accelerate the movement of money to create a more efficient system.

With crypto rails, global capital flows at the speed of the Internet, coordinated by incentives and game theory instead of fiat decree. The next generation of neobanks will leverage this permissionlessness of blockchain systems to quickly allow novel primitives – such as perps, prediction markets, staking, and token launchpads to compose with existing financial rails.

In addition, in economies where stablecoin adoption is high, there is also the opportunity to build a permissionless card network, similar to Visa or Mastercard. Such a system may act as an inverse of the existing crypto card flow. Instead of using fiat acquirers and offramping stablecoins at the point of sale, settlement would be onchain by default through a crypto-native acquirer. In order to maintain compatibility with traditional payment methods (such as fiat credit cards), these systems would onramp fiat payments into stablecoins.

Of course, permissionlessness does not just stop with human users – it also may enable the blossoming of a new, agentic economy. For an AI agent, it is far easier to get a crypto wallet than a bank account, and with stablecoins, AI agents can craft onchain transactions either with user signature permission or through pre-approved policies. I have written extensively about emerging agentic payments standards, such as Coinbase’s x402, and how they can unlock a new form of ecommerce. Permissionless neobanks are the substrate for that to happen, and the interface for the human-agent economy – AI agents can be autonomous wealth managers, shopping assistants, help you secure credit lines and more.

4 - Localization vs. Globalization

Crypto neobanks also face a strategic choice between depth and breadth. Some may follow the Nubank model, dominating a single region through deep localization, cultural fit, and regulatory expertise before expanding outward, such as through various remittance corridors (eg. US/EU/UAE and India/LatAm/SEA) and supply chains (eg. EU/US/LatAm with China/HK). Others may pursue a global-first model, launching permissionless products worldwide and doubling down where network effects emerge fastest. Both paths are viable: the former wins through local trust and distribution, the latter through scale and composability. Stablecoins may operate as the international payment highway, but crypto neobanks still need the “local exits”, with deep integrations with regional payment systems like Pix, UPI, Alipay, and VietQR to ensure local usability and merchant acceptance.

In particular, crypto-first neobanks have the unique opportunity to “bank the unbanked”, providing access to capital (both dollar and crypto denominated) in places where there is either a lack of financial infrastructure or weak local currencies, just as Argentina’s hyperinflation has catalyzed crypto adoption in the country [19]. Thus, the future may see regional “superapps” coexisting with borderless, globally composable neobanks, each leveraging the permissionless substrate in its own way.

5 - Undercollateralized Lending and Consumer Credit

Finally, undercollateralized lending and consumer credit is perhaps the “holy grail” of crypto neobanks. It combines many of the above challenges. First, on the compliance/KYC front, undercollateralized lending requires a robust identity and sybil resistant system, unlike existing overcollateralized lending platforms (eg. Aave, Morpho, MakerDAO). This robust identity mechanism could take shape in Worldcoin-style biometric verification, or through ZK-based methods such as DECO. Secondly, it requires a protocol to bridge an offchain credit profile with an onchain one (eg. via 3Jane), as well as let onchain defaults affect your offchain record. This difficulty is compounded by potential regional and geographical differences in credit models and credit profiles, and the need for compatibility with legacy systems. These difficulties may be the reason why undercollateralized lending in DeFi today has mainly revolved around institutional private credit (eg. Maple Finance, Goldfinch) rather than consumer credit, despite the latter being orders of magnitude larger in the TradFi world [20] [21].

Perhaps part of the answer could lie with unique mechanism design. Flash loans, for example, are an excellent example of a crypto-native uncollateralized (albeit brief) loan born from blockchain properties. Similarly, there is a large opportunity to build secured revolving credit lines against stablecoins and yield-bearing collateral (LSTs/LRTs), with real-time LTV management, automation liquidation buffers, auto-repayment from staking yield. These smarter collateral management techniques could all reduce the collateral requirements for onchain lending. Indeed, if successful, undercollateralized lending and credit onchain will accelerate the velocity of money onchain, provide a compelling reason for the unbanked to come onchain, and turbocharge the onchain economy – just as real-world undercollateralized lending drives economic growth.

Conclusion

Just like the rise of fintech neobanks a decade ago, today the rise of crypto neobanks aim to reinvent how we store, spend, grow and borrow money in the digital era. But while fintech neobanks primarily innovated on the frontend, partnering with FDIC banks to provide services on the backend while creating an intuitive, mobile frontend, crypto neobanks aim to update that banking backend – creating a global, composable, censorship-resistant method of sending money using stablecoins and public blockchains. In this way, a crypto neobank app is not just an interface, but a potential gateway to a new, programmable financial system.

Yet, the journey is only beginning. Building a full-stack “crypto neobank” means more than launching a crypto card or a simple wallet protocol with a UI. Like fintech neobanks, crypto neobanks need to consider what their wedge audience is – whether that is “banking the unbanked” or allowing for seamless stablecoin QR code payments to merchants in emerging economies – and rapidly scaling across the product suite. While each banking vertical – storing, spending, growing, and borrowing – has its own monetization model and set off tradeoffs, revenues come from taking advantage of value-in-motion. From this perspective, perhaps the largest opportunities for crypto neobanks may be first in the areas with a high velocity of money – in lending and borrowing – before moving down the “velocity of money pyramid” into spending and storage.

As neobanks continue tackling privacy and compliance, real world composability, leveraging permissionlessness, navigating regional differences, and providing undercollateralized consumer credit they have potential to evolve from niche gateways for digital assets into the default operating system for the global economy. Just as the first wave of neobanks changed the interface of banking by adopting mobile; this next wave is poised to rewrite the fundamental logic of money itself with crypto.

Many thanks to Ryan Barney from Pantera, Darshan Gandhi from Polaris Fund, Garrett Harper and Stepan Simkin from Squads, Ram Kakarlamundi from Avici, Vijit Katta from Tria, Aaron Lee from Redotpay, Yix Lee from Laguna, Noah Levine from Visa Crypto, Kofi Owusu from Cr3dentials, Sam Ruskin from Messari Research, and Lacie Zhang from Bitget Wallet for comments and suggestions.

References

[1] https://medhaa.medium.com/a-fintech-market-map-5662878aff3e

[2] https://panteracapital.com/blog-the-trillion-dollar-opportunity/

[3] https://messari.io/newsletter/unqualified-opinions/the-rise-of-crypto-neobanks

[4] https://www.binance.com/ar/blog/payments/3770220832170281311

[5] Fat wallet thesis: https://members.delphidigital.io/reports/the-fat-wallet-thesis#looking-ahead-8699

[6] Phantom Solana volume: https://coinlaw.io/phantom-wallet-statistics/

[7] Phantom swap fees: https://help.phantom.com/hc/en-us/articles/6048249796243-How-to-swap-crypto-in-Phantom

[8] Uniswap token swap fees: https://docs.uniswap.org/contracts/v2/concepts/advanced-topics/fees

[9] https://blockworks.co/news/phantom-hyperliquid-integration-winners

[10] https://www.coingecko.com/learn/what-are-stablecoin-chains

[11] https://eco.com/support/en/articles/12160492-what-is-tempo-blockchain-stripe-s-stablecoin-powered-enterprise-payment-network

[12] https://fortune.com/crypto/2025/09/04/stripe-paradigm-tempo-blockchain-stablecoins-matt-huang-payments/

[13]

https://visaonchainanalytics.com/

[14] https://blockeden.xyz/blog/2025/10/02/tron-s-evolution-from-blockchain-experiment-to-global-payment-infrastructure/

[15] https://decrypt.co/11327/the-inside-story-of-binance-explosive-rise-to-power

[16] https://etherfi.medium.com/staking-is-just-the-beginning-9640bac104df

[17] https://defillama.com/protocol/hyperliquid

[18] https://a16zcrypto.com/posts/article/state-of-crypto-report-2025/

[19] https://finance.yahoo.com/news/argentina-peso-crisis-fuels-crypto-073531217.html

[20] https://www.newyorkfed.org/microeconomics/hhdc

[21] https://www.mckinsey.com/industries/private-capital/our-insights/the-next-era-of-private-credit

[22] https://onekey.so/blog/learn/cdp-the-classical-aesthetics-of-stablecoins/

[23] https://docs.morpho.org/build/borrow/get-started

[24] https://docs.maple.finance/syrupusdc-usdt-for-lenders/lending

[25] https://www.coinbase.com/blog/earn-competitive-yields-by-lending-your-usdc

[26]

https://www.stablecoinsmap.com/

[27] https://messari.io/report/the-crypto-theses-2026

Footnotes and Important Disclosures

{1} All registered or unregistered service marks, trademarks and trade names referred to in this article are the property of their respective owners, and Pantera’s use herein does not imply an affiliation with or endorsement by the owners of these service marks, trademarks and trade names.

This document is made available by Pantera Capital Partners LP (“Pantera”) for informational and educational purposes only. It does not contain all information pertinent to an investment decision. Nothing in this document constitutes an investment recommendation or an offer of investment advisory services. This document cannot be relied upon in making an investment decision. Nothing contained herein constitutes an offer to sell, or a solicitation to buy, any securities. This document contains information believed to be reliable, and has been obtained from sources believed to be reliable, but no representation or warranty is made (express or implied) of any nature, nor is any responsibility or liability of any kind accepted, with respect to the fairness, accuracy, completeness, or reasonableness of the information or opinions contained herein. Forward-looking statements should not be relied upon. There is no guarantee that investments in any instrument described herein will be profitable – all investments carry the inherent risk of total loss. Analyses and opinions contained herein (including market commentary, statements or forecasts) reflect the judgment of the author as of the date this document was published, and may contain elements of subjectivity (including certain assumptions) or be based on incomplete information. There is no duty or obligation to update the contents of this document. This document is not intended to provide, and should not be relied on for accounting, legal, or tax advice, or investment recommendations. Pantera and its principals have made investments in some of the instruments discussed in this communication and may in the future make additional investments or trading decisions in connection with such instruments without further notice. This document solely reflects the opinion of the author, and does not reflect Pantera’s opinions.

By Jay Yu, Nihal Maunder

Original Article here.

We at Pantera are leading a $15M round for Surf to build the leading AI copilot for crypto.

The Problem

Today, we believe crypto faces a massive education challenge, from dense technical jargon to the industry’s unique subculture. Mainstream AI products often can’t keep up with crypto – even with tool-calling, many off-the-shelf agents, including GPT-5, Grok 4, and Claude Opus, can only provide rough project summaries, and have less than 70% accuracy when it comes to specific data questions, such as “Retrieve the block timestamp for Ethereum block 19,560,000” or “How many new stETH was minted on UTC 2024-12-31?”

Accuracy of mainstream AI models on the CAIA crypto query benchmark.

As a result, onchain research today can often be a fragmented, labor-intensive process requiring squinting at exchange charts, manually writing APIs, and crafting (potentially bug-filled) Dune queries – a process that cannot scale as crypto gains adoption.

Enter Surf

All this changes with Surf AI. With a familiar chatbot-style interface, any user can ask questions about any crypto project, whether it be price action, project fundamentals, tracking whale wallets or anything else, and receive a high-quality, in-depth research report on the topic.

Sample Research Report from Surf AI

Behind this deceptively simple product interface, Surf tackles many of the thorniest technical challenges of AI – how do we reduce model hallucination, verify data accuracy, and triangulate data sources, all in a high-stakes environment where a single token ticker may map to hundreds of distinct contract addresses, and one mistake could potentially cost millions of dollars in capital. Surf introduces a transparent, multi-agent reasoning system that combines social sentiment, technical analysis, and onchain tracking to “find alpha” in the high-noise, low-signal environment of crypto data, building a product that combines the intuitive workflow of mainstream AI chatbots with the accuracy of professional data tools such as Dune and Dexscreener.

Meet the Team

Ryan, Shiyu, Wilson, and Zhimao are serial entrepreneurs that have both a deep technical background from BitTorrent, Instagram, and Google, and the consumer instinct necessary to grow Surf as a product. Together, they’ve built and sold consumer companies like DLive, as well as Web3 companies like Cyber. They’re also backed by a deep bench of PhDs and AI engineers from leading labs, including National Olympiad medalists and researchers with award-winning work in computer vision and ZK Bridges.

Our Thesis

In the past few months that Surf has launched, it has surged in popularity, with over 80k registered users on the platform, ranging from institutional investors validating investment theses to grassroots communities trying to understand token markets. As we were testing and gathering user feedback on the product, we were blown away by the organic excitement that everyday users of the product held, describing how Surf has become a crucial part of their daily workflow.

Looking ahead, we believe that Surf will become the trusted interface for crypto intelligence – a place where investors, builders, and community members all gather to understand what’s really going on in the industry. By combining an intuitive user experience with verifiable data and delivering concise, actionable insights, Surf dramatically lowers the technical barriers needed to understand crypto, expanding the number of users that can meaningfully participate in the space.

At Pantera, we’ve always believed that better information leads to better decisions, and ultimately, better markets. Surf embodies that future, and we’re extremely excited to lead the $15M investment round to partner with them.

Let’s make crypto smarter – one prompt at a time.

Disclaimer: This blog is for informational purposes only and does not contain all information pertinent to an investment decision. Nothing in this blog constitutes an investment recommendation or an offer of investment advisory services. This blog cannot be relied upon in making an investment decision. Nothing contained herein constitutes an offer to sell, or a solicitation to buy, any securities. This blog contains information Pantera believes to be reliable, and has been obtained from sources believed to be reliable, but Pantera makes no representation or warranty (express or implied) of any nature, nor accepts any responsibility or liability of any kind, with respect to the fairness, accuracy, completeness, or reasonableness of the information or opinions contained herein. Analyses and opinions contained herein (including market commentary, statements or forecasts) reflect the judgment of Pantera as of the date this blog was published, and may contain elements of subjectivity (including certain assumptions) or be based on incomplete information.

Research published on Pantera’s crypto blog.

Introduction

The Internet was born with an “original sin” [1]: while HTTP became the universal language for moving information, it never embedded a native way to move money. Buried in the protocol was a placeholder status code – HTTP 402: Payment Required – meant to make payments as seamless as loading an image or a video. But 402 was left undefined, and instead of protocol-native micropayments, the web economy was forced down the path of advertising, walled gardens, and awkward credit card forms.

This piece will trace how that abandoned relic of the early web has returned as the foundation of an emerging agent-driven economy. We’ll explore why HTTP 402 languished during the first e-commerce era, how stablecoins and blockchain rails are reviving its original vision, and how new standards like x402 and h402 could finally absolve the Internet of its original sin by making payments as native and as invisible as information itself.

1 - The Forgotten Payment Code of the Web

HTTP – HyperText Transfer Protocol – is the backbone of the modern Internet. Within the HTTP standard, there are many “status codes,” which servers use to tell browsers what happened when they tried to load something. Some of the most famous HTTP status codes include:

1. HTTP 200 - OK: Everything worked, and the page is loaded successfully

2. HTTP 404 - Not Found: The resource doesn’t exist

3. HTTP 500 - Internal Server Error: Something on the server side broke down

However, apart from these well known and widely adopted codes, there are many others that exist in the standard but are rarely seen in everyday browsing – like HTTP 402 - Payment Required, which was a reserved status code but never standardized.

The 1990s vision for HTTP 402 was to enable web servers and browsers to negotiate payments for premium content using a standard part of the web protocol. The idea was that servers could return a 402 Payment Required response, and browsers could natively handle a <payment> tag, much like <img> or <video> tags. Clients would then send servers some sort of “digital cash” payment to the server to unlock premium content.

Behind HTTP 402 was an economic vision of the Internet that contained:

• Protocol-Native Payments: HTTP 402 envisioned a web where payments were as seamless as loading images or videos, using a hypothetical <payment> tag and browser-server negotiation.

• Micropayment Economy: The goal was to enable per-request or per-article payments, making small, frictionless transactions a core feature of the web.

• Alternative to Ads: By embedding money into HTTP itself, the internet could have avoided dependence on advertising-driven business models.
  
  

A hypothetical HTML tag for how payments might have been embedded at the protocol level with HTTP 402 server responses [2].

Yet, this grand vision of the <payment> tag never quite materialized. In 1994, when college student Dan Kohn made the first e-commerce transaction by selling a Sting CD on the Internet for $12.48, his NetMarket website relied on bolting credit card details onto the web via text boxes and basic encryption.

Despite tons of early experiments for “digital cash”, such as DigiCash, eCash, and Hashcash, HTTP 402’s original vision of Internet-native micropayments never materialized. The question of “what would happen after you clicked that buy button” remained a hard problem, with two major hurdles [1]:

1. Lack of Incumbent Interest - Incumbent payment networks like Visa and Mastercard lacked interest and technical chops in supporting micropayments at the cent-level scale

2. Enormous Processing Fees - for a cent level transaction, you could face dollar-level wiring fees. This meant that it made no economic sense for the Internet to adopt micropayments

This design flaw led to what has been dubbed as the “Internet’s Original Sin” [2] – that first-generation browsers like Netscape were never able to build payments natively as an operation in the HTTP spec [3]. This lack of a digitally native form of cash and payments directly influenced the economic model of the Internet. Instead of being able to charge users on a “pay per visit” model on premium content, sites were forced to adopt an advertising model to monetize, crowding out the core content of the web and denigrating not only the user experience, but also exposing unsuspecting users to phishing attacks, and other nasty security vulnerabilities.

Of course, eventually money did in fact catch up with the Internet. With the rise of ecommerce in the 2000s, online payments became ubiquitous – but not in the way HTTP 402’s creators envisioned. Instead of a native, protocol-level mechanism for transferring value, payment was redirected through centralized intermediaries like PayPal, Stripe, and later Shopify Checkout, using essentially the same method as Dan Kohn – bolting credit card details into encrypted text boxes.

These systems solved the problem of “how to move money online” by herding the users into their own “walled gardens” of APIs and integrations, bypassing HTTP entirely. When a user clicked “Buy” on a website, they would be redirected to a payment page or widget, where they entered card or Paypal credentials, and waited for confirmation while Paypal or another intermediary processed their transaction. While this approach enabled the explosion of e-commerce, it came with clear tradeoffs:

• Human-Driven: Every payment assumed a person at the keyboard, filling out forms and clicking “Pay Now.”

• Batch Settlement: Funds moved over legacy card and banking rails, often taking days to clear.

• Fee Floor: Card network interchange fees (~$0.30 + % cut) made micropayments impractical.

• Walled Gardens: Each payment processor controlled its own ecosystem, locking merchants and consumers into proprietary flows.

While these tradeoffs were fine for buying a $50 sweater or a $500 flight, they were fatal to 402’s dream of instant, per-request payments for digital content, API calls, or other fine-grained online services. In short, e-commerce thrived, but protocol-native payments died. In contrast to the simple <payment> tag command, this is what it would take to make the same purchase in PayPal, forcing clients into the “walled garden” of the Paypal SDK:

Example of Code integrating Paypal into an HTML page via their walled garden

And so, for over two decades, the 402 status code stayed dormant – a reserved but undefined relic in the HTTP specification, waiting for the dream of “internet native money” to catch up.

That infrastructure finally arrived with the stablecoin revolution.

2 - Stablecoins for AI Agents: Where Money Meets the Internet

What HTTP 402 envisioned was a world of Internet-scale micropayments: a peer-to-peer cash system as seamless as the peer-to-peer flow of information. Today, with the global rise of stablecoins and cheap, fast blockchain rails, that world may finally be here. Stablecoin supply has surged from under $2 billion in 2019 to over $246 billion in 2025 [4], with Circle’s USDC alone growing 29-fold in volume last year and going public on the NYSE [5]. Meanwhile, blockchain infrastructure has matured, with L1s and L2s offering sub-cent level fees – Solana averages just $0.0048 per transaction – making HTTP 402’s vision of instant, per-request payments feasible at last.

Today, AI assistants such as ChatGPT and Claude have seeped into every corner of our daily lives, and can provide product recommendations for a wide range of items. Yet when it comes to actually paying, today’s processors like PayPal and Stripe still assume a human at checkout. For example, while Stripe has been experimenting with issuing temporary “agent cards” these cards may be flagged as “high risk” by payment processors leading to rejections, and AI agent payments always seem to be just out of reach.

Stablecoins, by contrast, are natively programmable. An AI agent can craft an on-chain transaction, either asking the user to sign or executing directly under a pre-approved policy. In fact, Visa estimates that 90% of stablecoin volume already comes from programmatic transactions, rather than “organic” end users [7] – a testament to the potential and practicality of machine to machine payments. After all, it is far easier for an AI agent to get access to a private key than to a bank account.

Thus, we can easily see a world in which AI agents not only recommend what to buy, but also buy them on our behalf, using stablecoins like USDC as their execution layer. In this way, ERC20.transfer finally realizes the functionality that the <payment> tag originally envisioned – that of an open, peer-to-peer system of money, just as programmatic as the Internet itself. In other words, stablecoins moving over blockchain rails finally solve the question of “what happens after you click the buy button”?

3 - Technical Implementations of the HTTP 402 Standard

HTTP 402 Payment Flow. Source: Original Content

So how might HTTP 402’s modern makeover look like in an age of agentic payments? Today, several teams have proposed solutions, including Coinbase’s x402 standard, BitGPT’s h402 standard, and Radius Tech’s EVMAuth. At a high level, they all involve the following steps:

1. The user prompts an agent for an action, funding a policy with the transaction amount

2. The agent will send a transaction to a website, and get back a 402 response, also called a “challenge.”

   1. This challenge will include details such as the merchant wallet, accepted chains, assets, and value of the good or service.

3. Upon receiving this challenge, the agent will forward this to a “payment facilitator,” which can be the end user or a custodial wallet service. This “facilitator” will check the information in the challenge against a transaction policy (eg. is this <100 USDC, is this a whitelisted domain)

4. If the facilitator OK’s the transaction, then it will send the transaction to the merchant wallet, and the agent send proof of payment (eg. transaction hash) to the merchant using the same API.

5. The merchant confirms payment and ships the goods or service.

However, all of these frameworks differ on the specifics of their implementations, mostly in three aspects [10]:

1. Challenge schema – this is the “shape” of the HTTP 402 responses that they get in Step 2.

2. Facilitator Policy – the rules and restrictions that facilitators place on the payment method and policy.

3. Proof of Payment Form – the type of “receipt” they give back to the server

Importantly, it is not necessarily these standards themselves that monetize, as they are all open source. Rather, companies such as Coinbase, BitGPT, and Radius aim to monetize by running the “payment facilitators” that process flows in their HTTP 402 system. After all, the company that creates the universal standard will naturally have an edge in creating the dominant payment facilitator. This is similar to how HTTP is a public protocol but Chrome and Mozilla monetize by running web browsers that collect user traffic.

Moreover, these HTTP 402 standards are also composable with broader agentic communication frameworks. For example, Google recently announced their Agent-to-Agent (A2A) protocol, a system that allows AI agents to talk to one another and complete multi-task steps [19], in partnership with Coinbase’s x402 protocol. Whereas A2A provides a common interoperability layer for agents to share data and workflows, x402 plugs in as a payment extension within Google’s Agentic Payments Protocol (AP2). With x402 on top of Google’s A2A framework, users can buy a refrigerator from Lowes just by chatting with an AI agent [20], marking the beginning of a new era of ecommerce.

4 - The Future for HTTP 402 Adoption

From above, we see that with each of these implementations of the HTTP 402 standard, there exists a tradeoff between composability (types of chains and assets) and distribution (vendor integration). But what are the core ingredients needed for this to really take off and become the go-to standard for agentic payments? I believe that HTTP 402’s adoption lies in the further growth of four interlocking components: 1) client-side integrations, 2) vendor adoption, 3) facilitator providers, 4) underlying stablecoin rails.

Client-Side Integrations – what does UI for the end user look like?

Even though HTTP 402 positions itself as an “agent to agent” system, the end demand or intention has to come from somewhere. Going back to the case where I decide to buy a pair of jeans from Amazon, there has to be some interface (such as Claude’s chat UI) that captures what I need or want. These user interfaces can be instantiated in multiple ways. The most common is likely an MCP server (such as the x402 MCP server that CDP provides) with mainstream chatbot such as Claude or ChatGPT. Alternatively, this could take place as an AI-enhanced web browser, similar to The Browser Company’s Dia Browser, or perhaps a hardware interface, such as a smartwatch or AI-enhanced wearable. Openmind, for example, takes x402’s vision of agentic payments into the realm of robotics, allowing robots to pay each other for collaborative services [14].

Vendor Adoption – what can these HTTP 402-enabled agents actually buy?

This is perhaps one of the most difficult components to gain traction in, as for these payment agents to truly gain traction, they must be able to buy services from traditional ecommerce vendors, such as Amazon, or subscription content providers such as the New York Times. This requires a monumental amount of buy-in from legacy vendors that may be reluctant to quickly adopt crypto and agentic payment. In fact, many of the existing vendors integrated into x402 are crypto-adjacent companies, such as Pinata for IPFS upload/download, Heurist for deep agentic research, and Hyperbolic for LLM inference [15] [16]. Nonetheless, as crypto payments go mainstream, this list will likely expand as time goes on. x402 also has a “discovery page” noting many of the projects that are within the ecosystem, highlighting live integrations such as Prodia for image-gen, firecrawl for web crawl, and various community wrappers of LLMs, web search, and stock data.

Facilitator Providers – who controls the purse?

Facilitators play a key role in the HTTP 402 workflow, being able to decide if a payment request from an agent can be authorized. In fact, facilitators are arguably the most lucrative role, as they can monetize by (1) charging flat-rate service fees to users and agents to custody funds and maintain policy security, and (2) take a cut from transaction order flow. Given that fundamentally HTTP 402 is an open-source protocol, many of the companies behind the push driving its adoption, such as Coinbase, BitGPT, and Radius profit off this system by running the facilitator for these payments.

As this standard matures, we can see other players in the wallet-as-a-service and custodial space, such as Privy and Turnkey play a greater role in facilitating these systems, as well as AI native wallet systems such as Circuit AI, and academic systems such as Liquefaction. Interestingly, almost all of these policy engines rely on Trusted Execution Environments (TEEs) for key management and policy execution.

Underlying Stablecoin Rails – how is the payment processed?

As iterated throughout this article, stablecoins are essential to HTTP 402’s revival and further growth. Improvements in the underlying stablecoin rails and payment stack will undoubtedly accelerate HTTP 402’s adoption as a standard and catalyze further growth. Over the past few years, the stablecoin payments stack has matured enormously, with many players bridging the gap between traditional payment rails and stablecoins.

For example, Coinflow provides a one-click service for merchants to receive payment and payouts in stablecoins. BVNK, Bridge (acq. Stripe) and others facilitate the orchestration of payments between stablecoins and traditional financial systems. OpenFX allows for cross-border payments with real-time FX settlements. Circle’s Gateway and CCTP allows for USDC to move smoothly between the various blockchains it’s integrated with [17], and NEAR Intents also allows for cross-chain business logic for HTTP 402 workflows [18]. Improvements in all of these underlying rails will make stablecoin-powered HTTP 402 payments faster, cheaper, and more interoperable, ultimately lowering friction for both developers and end-users.

Conclusion

Over 30 years have passed since HTTP 402 was first proposed, during which the status code served as a placeholder for an Internet-native form of money that never quite arrived. But today, the pieces might finally be snapping into place: stablecoins providing programmable cash, AI agents becoming autonomous consumers of content, and new standards like x402 and h402 are stitching it all together.

So what might all this mean for the everyday user?

Imagine asking your Claude-powered assistant to compile a research report. It quietly pings ten different APIs – news databases, image generators, model inference endpoints – and pays each one a few cents using a policy wallet you’ve pre-approved. No checkout. No credit card forms. No cookies tracking you across the web. Just clean, programmatic intent, executed seamlessly.

Or picture an enterprise dev platform where apps are no longer billed monthly by seat, but dynamically per compute cycle or inference call. Agents meter usage and authorize payments on your behalf. Budgets become policies. Subscriptions become flows. Finance becomes code. In this world, HTTP 402 becomes a medium for agentic exchange, part of a broader workflow that empowers AI agents to not only create recommendations, but also transact real world value.

And one day, maybe your cousin will open a debugging dashboard and casually remark, “Oh yeah, my AI hit a 402 earlier and topped off the credits,” without thinking twice. Just like “404 Not Found,” “402 Payment Required” might finally enter the cultural lexicon, not as a relic of the early web, but as a native verb of the next one.

And perhaps that is the day when the Internet finally absolves itself of its “original sin.”

Many thanks to Mason Nystrom from Pantera, Daniel Lev from Coinflow, Lia Muller Pena from BitGPT, Lincoln Murr from Coinbase Developer Platform for comments and suggestions.

If you are building a next-generation payment network, please reach out to jay@panteracapital.com!

References

[1] https://hackernoon.com/the-resurgence-of-http-402-in-the-age-of-agentic-ai

[2]

E-conomy

Marc Andreessen's Original Sin

I. Before Marc Andreessen was the bald-headed titan of Venture Capital, he was the founder of Netscape, one of the earliest internet startups. Founded in 1994, Netscape offered the first commercial web browser, ushering the internet from a project mostly used by the government and academics to a mainstream phenomenon. In the process, Netscape invented Ja…

Read more

6 years ago · 6 likes · Noah Putnam

[3] https://a16zcrypto.com/posts/podcast/internet-past-crypto-future-crypto-regulatory-summit/

[4] Visa Stablecoin Dashboard:

https://visaonchainanalytics.com/

[5] https://www.theblock.co/post/360934/circles-usdc-yoy-growth-stablecoins-seize-institutional-otc-volume-finery

[6] Solana average transaction fee: https://tokenterminal.com/explorer/projects/solana/metrics/transaction-fee-average

[7] https://www.coindesk.com/opinion/2024/05/07/what-visas-organic-stablecoin-report-misses

[8] x402 Whitepaper: https://www.x402.org/x402-whitepaper.pdf

[9] h402 Whitepaper: https://cdn.h402.xyz/h402.pdf

[10] https://members.delphidigital.io/feed/agent-to-agent-payments-protocol-report

[11] EVMAuth: https://hackernoon.com/the-resurgence-of-http-402-in-the-age-of-agentic-ai

[12] https://docs.cdp.coinbase.com/x402/network-support

[13] https://shaunscovil.com/anatomy-of-evmauth-2c6624ac6f19

[14] https://docs.openmind.org/robotics/coinbase-x402

[15] x402 Ecosystem: https://www.x402.org/ecosystem

[16] https://github.com/HyperbolicLabs/hyperbolic-x402

[17] Circle Gateway: https://www.circle.com/blog/circle-gateway-redefining-crosschain-ux

[18] NEAR Intents: https://dev.near.org/newsletter?id=29be03db72

[19] https://developers.googleblog.com/en/a2a-a-new-era-of-agent-interoperability/

[20] https://www.coinbase.com/developer-platform/discover/launches/google_x402

Key Takeaways:

• TLS secures the Internet, but lacks exportable provenance: TLS protects data in transit, but can’t prove where it came from. zkTLS (as implemented in DECO) fixes that with verifiable, cryptographic proof without needing server changes.

• DECO combines MPC and ZKPs: DECO uses a three-party handshake to split TLS session keys via multi-party computation, preventing session forgery. It then adds zero-knowledge proofs so users can prove facts (“I'm over 21”) without exposing raw data.

• zkTLS is fast, private, and verifiable: Techniques like selective disclosure and context-aware parsing reduce ZK proof costs while maintaining semantic integrity. Hash-based MPC and 2PC optimizations keep protocol performance within practical bounds.

• DECO has inspired multiple practical instantiations of zkTLS: Opacity and Reclaim are leading implementations of zkTLS inspired by DECO with different architectures. Opacity uses MPC, TEEs, and slashing for stronger security. Reclaim trades that for speed, with faster attestations via proxy attestors.

• zkTLS powers real-world apps: Applications include decentralized KYC, credit-based DeFi lending (3Jane), automated background checks (TransCrypts), and loyalty credentialing (e.g., Reclaim + Marriott). zkTLS also unlocks new AI applications, by creating a pipeline for models to safely ingest private user data. It creates a new trust layer for the web, independent of APIs or server cooperation.

Introduction

Transport Layer Security (TLS) is the cryptographic backbone of the modern internet, securing billions of web sessions daily. It guarantees confidentiality and integrity between clients and servers, ensuring that users can safely exchange data with websites. However, TLS has a critical shortcoming: it does not enable users to cryptographically prove to third parties that the data they accessed genuinely came from a specific website. While data is encrypted and authenticated in transit, it lacks exportable provenance: a way to vouch for the authenticity of data after the session ends.

This limitation has stymied applications like private age verification, authenticated financial disclosures, or fair pricing enforcement, especially in contexts like blockchain smart contracts, which require verifiable, third-party data. Existing solutions like trusted hardware (e.g., Intel SGX) or server-side modifications break legacy compatibility or introduce new trust assumptions.

zkTLS, exemplified by DECO [1], solves this by allowing users to generate zero-knowledge proofs about data retrieved over TLS without modifying servers or relying on trusted hardware. In this article, we will first explore the cryptographic foundations of zkTLS, including TLS internals, secure multiparty computation, and zero-knowledge proofs. From there, we will provide a technical walkthrough of zkTLS as envisioned by the DECO protocol, and finally survey real-world use cases and practical deployments that demonstrate the transformative potential of zkTLS.

1 - A Crash Course on the Fundamentals of zkTLS

At its core, zkTLS (Zero-Knowledge TLS) aims to bridge the gap between secure data access and verifiable data provenance. While TLS ensures that communication between a client and server is secure, it does not leave behind cryptographic evidence that the data came from the claimed server. As a result, users are unable to export trustworthy, privacy-preserving attestations of online data, which is a major limitation in an era where data portability and trust minimization are paramount.

Imagine Alice wants to prove to Bob that she is over 18, based on a date of birth retrieved from a government portal. While Alice could show Bob a screenshot or forward the data, Bob cannot verify whether this information truly originated from the government’s website, since TLS protects data in transit but does not sign the content. The same challenge arises in proving financial solvency from a bank account or contesting discriminatory pricing. Screenshots can be forged, and server cooperation is often unavailable or insufficiently trustworthy. zkTLS, specifically through the DECO protocol, tackles this by enabling users to interact with any standard TLS-enabled website, extract data privately, and prove statements about that data to a verifier, all without altering the website or involving trusted execution environments (TEEs).

TLS Protocol [2]

Before we examine the protocol details, it is prudent to first understand TLS as it currently exists, along with some other important cryptographic primitives. TLS is a cryptographic protocol that ensures confidentiality and authenticity during web communications [2]. It consists of two main phases, one of them being a handshake protocol to establish a secure session using asymmetric cryptography and performs key exchange (e.g., via ephemeral Diffie-Hellman). The second main phase is the record protocol, which uses the shared symmetric keys derived from the handshake to encrypt and authenticate subsequent data transmissions. While TLS ensures that Alice receives data from the server securely, it does not provide her with a way to prove to Bob that the data truly originated from the server. Both Alice and the server possess the same symmetric keys, which means Alice can forge TLS messages after the fact, thereby breaking any notion of post hoc authenticity.

Prior approaches to TLS provenance typically fall into two categories: Trusted Hardware Solutions (e.g., Town Crier relies on Intel SGX to sign TLS data) [3], or Server-Side Modifications, where TLS is modified to include signatures on data or enable verifiable logging. The problem with the former solution is that SGX (and TEEs in general) introduce new trust and security risks (e.g., side-channel attacks), whereas the issue with the latter solution is that it requires changes to the server software stack, which greatly limits deployability. DECO, and zkTLS generally, distinguishes itself by being legacy compatible, operating with any TLS server without cooperation or modification.

One of the cryptographic primitives that allows for DECO to function on legacy systems is Multiparty Computation (MPC). Secure Multiparty Computation (MPC) allows two or more parties to jointly compute a function over their inputs without revealing them. In the context of zkTLS, MPC is used to establish shared secrets (specifically, the session keys used in the TLS protocol such that neither party has access to the complete key, and the client (i.e., the prover) cannot forge or tamper with TLS records. DECO achieves this through a three-party handshake in which the prover (Alice) and the verifier (Bob) cooperate to jointly act as a TLS client. They run a two-party protocol to split the session keys between them. For instance, Alice and Bob compute additive shares of the MAC key such that neither knows the full key, but together they enable a valid TLS session. This ensures Alice cannot forge valid TLS traffic after the fact.

Zero-Knowledge Proofs (ZKPs).

Zero-knowledge proofs, another critical cryptographic primitive used in DECO, allow one party (the prover) to convince another (the verifier) that a certain statement is true, without revealing why it’s true or leaking any other information. In DECO, once Alice (the prover) has obtained a response from the server, she generates a cryptographic commitment to the session data. She then uses a zero-knowledge proof to prove the data she received satisfies a desired predicate (e.g., “I am over 18”) without revealing the underlying data (e.g., her birthdate). This allows for privacy-preserving attestations of sensitive information, a fundamental breakthrough for applications like identity verification or decentralized finance.

zkTLS combines these elements as follows:

1. Three-Party Handshake (TLS + MPC): Alice and Bob engage in a handshake with the server, producing shared keys such that Alice alone cannot forge session data. This maintains TLS compatibility.

2. Query Execution and Commitment (TLS + MPC): Alice constructs a TLS query (e.g., an HTTP request) using her private data (like a login credential), and sends it to the server. She commits to the resulting session transcript.

3. Proof Generation (ZKPs): Alice proves in zero knowledge that the session data satisfies a predicate (e.g., account balance > $1000), and that it was obtained from the correct source via a proper TLS session.

This architecture avoids the need for trusted hardware, works with existing web infrastructure, and enables selective disclosure, for instance, revealing that a condition is met without disclosing the underlying data.

The next section of the article will dive deeper into how these components are technically realized in DECO’s protocol, including the construction of the three-party handshake, optimized MPC protocols for query execution, and efficient techniques for generating zero-knowledge proofs on TLS transcripts.

2 - A Technical Deep Dive into the DECO Protocol for zkTLS

At the heart of DECO’s architecture is a clever synthesis of classic TLS security with modern cryptographic techniques such as secure multiparty computation (MPC) and zero-knowledge proofs (ZKPs). This section unpacks each of DECO’s core protocol phases in detail, examining how cryptographic primitives are tailored to preserve data provenance while maintaining compatibility with the existing TLS ecosystem.

A fundamental innovation of DECO is the three-party handshake between the prover (Alice), the verifier (Bob), and an unmodified TLS server. This handshake allows Alice and Bob to jointly participate in a TLS connection to a server such that neither party knows the full cryptographic keys used to authenticate the session. This eliminates the ability of Alice to forge or manipulate TLS session data after the fact, the key foundation for proving provenance.

Source: Original Content

TLS typically establishes a symmetric session key via an ephemeral Diffie-Hellman key exchange. In DECO, this handshake is modified such that the session key — specifically the MAC key (k_MAC) — is additively shared between Alice and Bob:

Here, k_P​ and k_V​ are shares held respectively by Alice (the prover) and Bob (the verifier), with the server S receiving the full key k_MAC​ for encryption and authentication. The process involves two major steps:

1. Ephemeral Diffie-Hellman Key Exchange (ECDHE): Alice and Bob contribute public keys to derive a common secret g^x, without either party learning the full exponent. The server contributes its own ephemeral key g^s, completing the key exchange.
   
   

2. Key Derivation via MPC: Since TLS session keys are derived via a pseudorandom function (PRF) over the Diffie-Hellman output, DECO uses two-party computation (2PC) to compute this derivation jointly. This is a non-trivial task because TLS-PRF is hash-based and lacks algebraic structure, requiring MPC to handle bitwise operations securely.

By ensuring neither party has full control over the MAC key until the session is cryptographically committed, the handshake defends against forgery: Alice cannot modify session content post-hoc without breaking the MAC.

Once the handshake is complete, Alice must construct a valid query to the server and receive the response, all under TLS. The key challenge is that the session keys are now split between Alice and Bob. Hence, even basic TLS operations like MAC generation (in CBC-HMAC) or authenticated encryption (in AES-GCM) must be computed via secure 2PC protocols. For cipher suites using CBC-HMAC (common in TLS 1.2), the record protocol operates by first computing a MAC over the plaintext and then encrypting the message plus MAC. To generate the MAC securely, Alice and Bob compute the inner hash locally on Alice’s side, enabled by giving her a hash of the padded MAC key (i.e., H(k⊕ipad)), which does not leak the key itself due to the one way properties of cryptographic hash functions. They then perform 2PC only for the outer hash, which is short. This reduces the MPC burden significantly, as without this optimization computing HMAC over a large query in MPC would be prohibitively expensive.

For AES-GCM mode, encryption and authentication are combined into a single operation. However, unlike CBC-HMAC, it lacks a commitment property, the ciphertext does not bind to a unique plaintext, which complicates provenance guarantees. DECO supports AES-GCM by using optimized 2PC protocols for AES encryption and polynomial evaluation in Galois fields (for GCM authentication tags).

For performance-critical deployments, DECO also introduces a proxy mode, which is particularly useful for GCM. In this mode, Bob acts as a passive network proxy who relays and logs the traffic between Alice and the server. This simplifies provenance, as Bob witnesses the session directly. However, the security guarantees differ, it shifts trust toward the verifier's honest behavior and is best suited to settings where Bob is semi-trusted.

For the proof generation phase of the protocol that occurs after the server respond to Alice, she wishes to prove to Bob that the data:

1. Came from the server (provenance)

2. Satisfies a desired predicate (e.g., over 18)

3. Without revealing the data itself (privacy)

This is where zero-knowledge proofs (zkPs) come into play. Alice commits to the TLS transcript and proves a statement of the form:

Where:

• k_Enc​ is the encryption key,

• X is the decrypted TLS record,

• Verify ensures MAC correctness,

• Stmt(X) evaluates the predicate.

Generating such proofs over entire transcripts could be computationally prohibitive. DECO addresses this with two optimizations: Selective opening, and two-stage parsing for context integrity. Selective opening means the following: instead of revealing or proving over full session data, Alice can reveal substrings of the TLS response, or redact portions of the message to preserve privacy. For example, she might reveal only a checking account balance, not the full bank statement. This selective opening is proven in zero knowledge using optimized circuits that process only the revealed parts, reducing proof size and cost. However, selective disclosure introduces a risk: Alice could quote a snippet out of context (e.g., showing a $5000 value from a message to customer service rather than the actual bank balance) and therefore prove faulty statements. To prevent such context integrity attacks, DECO introduces two-stage parsing:Local parsing and zero-knowledge proof. In local parsing, Alice parses the full session response to identify where her substring appears within a structured format (e.g., JSON). As for the zero-knowledge proof portion, she proves in ZK that the substring came from the correct structural location in the original document. This is formalized by reasoning over the structure using context-free grammars (the same way in which a compiler reasons if some piece of Python or C code is actually valid code), ensuring that any disclosed fragment is bound to the intended semantic structure.

While the main DECO protocol is ZKP-based, the original paper and interview also discuss a variant based on Trusted Execution Environments (TEEs) like Intel SGX (as was briefly mentioned in Section 1). In this mode, a TLS client runs entirely inside the TEE so as to guarantee that the prover has no access to the session keys. Provenance is thus established by logging or signing the session inside the enclave. This approach benefits from lower computational overhead (only 10–20% slower than native TLS) compared to the orders-of-magnitude cost of ZK proofs. However, it introduces reliance on hardware trust, including vulnerability to side-channel attacks, as well as vendor trust, including firmware, microcode, and remote attestation. While not mutually exclusive, the choice between ZKP-based and TEE-based deployments reflects a tradeoff between performance and trust minimization.

Now that we have a detailed understanding of how DECO functions, it is critical to analyze performance bottlenecks and potential optimizations. Despite the elegance of the construction, DECO’s most significant cost comes during proof generation, especially for complex predicates or long transcripts. The authors of the original paper report 2.85 seconds for the three-party handshake, 2.52 seconds for query execution (2PC), 3-13 seconds for ZKP generation (depending on complexity). As discussed in the interview, DECO uses several clever tricks to keep performance practical. For example, in hash-based MPC, the system doesn’t re-evaluate entire hash chains. Instead, it computes the final compression step and verifies its correctness, saving computation while preserving security. Further improvements may come from faster proof systems (e.g., STARKs, zk-SNARKs with pre-processing), as well as hardware acceleration for the 2PC steps.

3 - Implementations and Applications of zkTLS

DECO Sandbox by Chainlink [4]

The DECO protocol provided us with a foundational architecture for zkTLS. Since then, zkTLS has quickly become a popular concept with many real world applications. At its core, zkTLS enables users to prove facts about their interactions with websites over HTTPS without revealing the full content of the interaction and without server cooperation. For developers, this unlocks a new design space of privacy-preserving authentication, decentralized identity, and verifiable web data extraction. In this section, we explore how zkTLS is currently being deployed, what the developer experience looks like, and how two of the leading providers of zkTLS, Opacity and Reclaim, differ in architecture and trust assumptions, as well as take a look at some of the user-facing applications using zkTLS under the hood.

The original architecture proposed in DECO has been licensed by Chainlink, which has since made a developer sandbox interface for the protocol [4]. This sandbox provides developers with the ability to experiment with DECO-style TLS transcript proofs and witness how multiparty computation and zero-knowledge proofs interact in the context of real HTTPS sessions. Today, a developer interested in building on top of DECO can work with lower-level cryptographic libraries and frameworks such as:

• Rust and C++ for performance-critical MPC operations

• zk-SNARK/STARK systems (like libsnark, circom, or R1CS toolchains) for proving validity over TLS data

• WebAssembly or trusted runtime containers for deployment on consumer devices or smart contract VMs

The long-term vision is to abstract away much of this complexity via SDKs that expose simple APIs like prove_from_website(url, predicate) or verify_proof(proof). While still early, progress is being made toward streamlining these interactions, particularly in industry deployments.

As for practical, commercial implementations, one prominent example is the Opacity Network [5]. Opacity represents one of the most robust and comprehensive deployments of a zkTLS architecture in the wild, as it builds upon the TLSNotary framework and significantly enhances it with a blend of cryptographic techniques [6], including garbled circuits, oblivious transfer, proof by committee, and on-chain verification and slashing mechanisms. Opacity focuses primarily on web2 account attestations, enabling users to prove ownership over accounts on platforms like LinkedIn, Twitter, or a traditional bank, and linking these to a web3 identity, such as an Ethereum wallet. The user doesn’t need the cooperation of the web2 service to do this. Instead, the Opacity network conducts a verifiable TLS session using secure MPC between the user and a notary node. The result is a signed transcript, which is then verified by smart contracts onchain. To mitigate the risk of collusion between a user and a notary, Opacity employs several layers of defense:

• Commit-and-reveal: Users must commit to the value (e.g., account balance) before a notary is assigned.

• Proof by committee: Multiple notaries independently compute identical proofs.

• On-chain logging: Every attempt to prove a value is logged publicly, discouraging manipulation.

• TEE isolation: All notaries must run within Intel SGX secure enclaves.

• Restaking and slashing: Notaries are economically incentivized to behave correctly via Eigenlayer’s AVS, which slashes misbehaving nodes in real time.

• Whistleblowing: Any user who can prove a notary misbehaved gets a share of their slashed stake.

This layered architecture makes Opacity one of the most secure zkTLS systems currently deployed. It excels in environments where users need to prove private attributes from private accounts — for example, demonstrating that they are a verified university student, without revealing their name or email.

However, Opacity's heavy reliance on TEEs introduces some caveats. While SGX helps reduce computational overhead, its side-channel vulnerability remains a known concern. Opacity mitigates this by not solely depending on SGX — instead, SGX is used in tandem with cryptographic and economic safeguards.

Reclaim, another prominent implementation of zkTLS, takes a different approach. Rather than relying on MPC between notaries and users, it leverages a proxy witness model [7]. The core idea is to insert an attestor node as a passive observer during a user’s TLS session. This attestor conducts the TLS handshake on the user’s behalf and then signs a verifiable statement about the session's content, with the result being a portable claim that can be presented to third parties.

Whereas Opacity prioritizes complex multi-party MPC and TEEs, Reclaim’s architecture emphasizes lightweight performance and fast attestations [7]. This makes it especially attractive for verifying public-facing web data (e.g., whether a page includes a particular element), Fast KYC workflows where a single attestor's word is sufficient, and applications where the attestor is semi-trusted (e.g., a government authority or major exchange). To avoid giving the attestor full access to sensitive content like session tokens, Reclaim uses a key-upgrade mechanism where:

1. The user discloses temporary TLS keys to the attestor (without revealing cookies or long-term credentials)

2. The attestor reconstructs the transcript and issues a signed claim

3. The proof is bounded to this ephemeral session and doesn’t grant replay or access

Reclaim acknowledges that collusion between user and attestor is a risk, if they cooperate, they can forge transcripts. To mitigate this, Reclaim suggests the use of subset sampling, where a random group of attestors must validate a claim. However, unlike Opacity, Reclaim does not rely on economic slashing or proof-by-committee by default.

One operational challenge for Reclaim lies in IP-based attestor identification: since servers may notice repeated connections from known attestor IPs, they could rate-limit or block these addresses. This limits the scale at which Reclaim can operate in adversarial environments.

Nonetheless, Reclaim's simplicity and ease of integration make it a compelling zkTLS solution in controlled settings, particularly when the attestor is not adversarial, for instance, a court officer validating a digital document or a bank verifying a certificate of funds.

While Opacity and Reclaim differ in architecture and trust assumptions, they both exemplify the power of zkTLS to turn private TLS sessions into verifiable public claims. Opacity favors a maximalist security model, layering cryptography, TEEs, economic incentives, and redundant computation. Reclaim emphasizes fast attestations, minimal overhead, and real-world pragmatism. Both platforms share the same philosophical foundation: to liberate user data from platform lock-in, empower self-sovereign identity, and eliminate the need for APIs and server-side cooperation.

Reclaim’s Verifiable Loyalty Platform [8]

Today, zkTLS enables a new generation of verifiable, consumer-focused applications ranging from custom-built loyalty programs, on-chain credit scores, to identity verification and automated background checks. Reclaim, for example, has created a prototype demo of how zkTLS can be used to create verifiable loyalty programs. For example, suppose Marriott wants to give a special discount voucher for Star Alliance Gold members. By using Reclaim’s loyalty toolkit [8], users can log into their airline account, and Reclaim will use zkTLS to automatically confirm their membership status, frequent flyer points, and more, and attach these attributes as credentials to the user’s Marriott account. This process thus allows Marriott to verify that users are Star Alliance Gold members and in turn give more targeted discounts.

3Jane Protocol using zkTLS for credit scores [9]

Another use case is using zkTLS to “export” traditional credit scores into the world of DeFi. By default, when a user wants to use an on-chain lending platform such as Aave or Morpho, these loans need to be over-collateralized, as there is no way of knowing ahead of time if the actual user is honest or not. 3Jane, however, creates a credit-based lending platform that pulls a user’s real-world credit score (such as a FICO score) to create undercollateralized loans based on credit, just like a traditional bank loan [9]. Under the hood, 3Jane leverages Reclaim’s zkTLS system to export credit scores, income statements, and bank assets via a Plaid authentication.

Similarly, we can use zkTLS to automate identity verification and background checks. TransCrypts, for example, uses zkTLS to automate the background check process by aggregating information from many different sources into a single platform, accelerating the hiring process without compromising user privacy. With zkTLS, TransCrypts can verify attributes like employment history, educational credentials, or legal clearances by establishing TLS sessions with official data providers (e.g., payroll services, universities, or government databases) and generating attestations without requiring direct API access or data dumps.

With its lightweight yet versatile protocol design, zkTLS can also be integrated with social media platforms. Fan Zhang’s zkLabeler tool provides a lightweight way to add custom, verifiable labels to Bluesky handles [11]. This process can power rich credentialing frameworks, connecting an ORCID ID to a decentralized social media handle, proving voting eligibility without doxxing your address, or verifying financial solvency without exposing transaction history.

Finally, zkTLS can also be used in “protected pipelines” (props) for private data for LLMs and machine learning. A privacy preserving oracle such as DECO can be used to export sensitive personal data – such as electronic health records and financial data – into private models for a more personalized experience [12]. In the “props” framework, zkTLS serves as the secure data sourcing mechanism, allowing ML training and inference pipelines to ingest sensitive deep-web datasets with both privacy and authenticity guarantees, mitigating the risks of fabricated inputs, adversarial manipulation, and direct exposure of personal information.

Conclusion

Throughout this article, we’ve presented an in-depth dive into the conceptual innovations behind zkTLS, the instantiation of the DECO protocol, as well as its wider influence on production-grade zkTLS systems and applications we see today. DECO’s architecture exemplifies a new generation of cryptographic protocols that combine usability, legacy compatibility, and privacy. Through layered security, MPC for integrity, ZKP for privacy, and optionally TEEs for performance, DECO provides a blueprint for authenticated, privacy-preserving data portability across the web.

Fundamentally, zkTLS as pioneered by the DECO protocol provides a simple, intuitive, and versatile way for “exporting” data from one website or application or another. By leveraging the in-built cryptographic security and pervasive adoption of the TLS standard, zkTLS provides a framework to free the Internet from isolated data silos and convoluted APIs, ultimately building a unified access layer for our digital data.

References

[1]

https://www.deco.works/

[2] https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/tls.html

[3] Town Crier: https://eprint.iacr.org/2016/168.pdf

[4] https://deco.chain.link/sandbox

[5]

https://www.opacity.network/

[6] Opacity Network: Trust but Verify | by Vinayak Kurup | Medium

[7] Reclaim_Whitepaper_v2-12.pdf

[8] https://reclaimprotocol.org/loyalty

[9] https://www.3jane.xyz/pdf/whitepaper.pdf

[10]

https://www.transcrypts.com/

[11] zkLabeler: https://x.com/0xFanZhang/status/1942307590899167609

[12] https://arxiv.org/pdf/2410.20522

About the Interviewees

Fan Zhang

Fan Zhang is an Assistant Professor at Yale CS and runs the Decentralized Systems Group. He is broadly interested in computer security and applied cryptography, especially problems in blockchains and smart contracts, user authentication, anonymity, and hardware-assisted trusted execution environments. Fan received his Ph.D. in Computer Science from Cornell University, advised by Prof. Ari Juels, and his bachelor’s degree from Tsinghua University. Fan is also a faculty affiliate of IC3.

Yavor Litchev

Yavor is an undergrad at Stanford pursuing a degree in computer science with a focus on cybersecurity and cryptography. He has previously engaged in research projects relating to secure machine learning and digital signatures with more flexible access structures at MIT PRIMES. More recently, he is researching secure systems and program execution using software fault isolation through the CURIS program. He is currently the cryptography research lead and Financial Officer for the Stanford Blockchain Club.

Jay Yu

Jay is a Junior Partner at Pantera focusing on investments and research, and a Research Advisor to IC3. Previously, he served as President of the Stanford Blockchain Club, and founded the Stanford Blockchain Review. He conducted research on DAOs and trusted execution environments (TEEs) with faculty from Stanford Law and IC3, and was a delegate for Uniswap DAO. Jay graduated from Stanford with a double major in Computer Science and Philosophy, and a minor in French.

Read announcement here

I’m thrilled to announce that I’m joining Pantera for research and investments at this crucial moment in blockchain’s development – a moment where grassroots innovation gets turbocharged by institutional adoption.

Over the past decade, Dan Morehead, Paul Veradittakit and Pantera’s venture team has played a foundational and consistent role in supporting the primitives for a new on-chain economy. From Coinbase to Alchemy, from Circle to Ondo, from Arbitrum to Morpho, Pantera has consistently backed winners across the crypto landscape.

Looking ahead, I see the current market shaped by one-third bottom-up innovation and two-thirds top-down distribution. The meteoric rise of Hyperliquid, pump.fun, Polymarket showcase the revolutionary power of grassroots innovations, while increased regulatory clarity has allowed broader integration of blockchains with both TradFi (ETFs, stablecoins, RWAs) and broader tech trends (FinTechs, AI, robotics). This convergence between protocol innovation and institutional adoption excites me as blockchains revolutionize the financial world.

I discovered crypto as a Stanford freshman in the spring of 2022. As a double major in Computer Science and Philosophy, I was enthralled by NFTs, DAOs, and the idea of a new creator economy. But just six months later, crypto entered a deep winter, just as ChatGPT started dominating the headlines. As all my classmates pivoted towards AI, I doubled down on crypto, believing the philosophical principles of blockchains – trustlessness, permanence, and voluntariness – were worth fighting for. During the bear market, I rebuilt the Stanford Blockchain Club and grew membership from less than 5 students to 150+ as President. Meanwhile, I dug deeper into DAOs, served as a Uniswap DAO delegate, and researched on-chain governance mechanisms like contestable auctions, quadratic voting, and RetroPGF.

As a researcher, I drew upon my interdisciplinary background to work across Stanford’s Law and Engineering schools, teaching “CS 352B/LAW 1078: Blockchain Governance” with Prof. David Mazieres and Prof. Jeff Strnad. I also worked with Prof. Ari Juels’ group at IC3 to publish peer-reviewed academic papers on DAOs and Trusted Execution Environments (TEEs) for USENIX and IEEE S&P, and my CS capstone was designing a multi-user TEE wallet with Prof. Dan Boneh.

This academic background allowed me to understand the crucial role that research breakthroughs play in catalyzing innovation in the blockchain industry. As an investor at Pantera, my “north star” is to help researchers, students, and bold innovators with the wildest ideas – whether it’s in bottom-up mechanism innovations like futarchy-based governance, novel perps platforms, and AI-managed DeFi vaults; whether it’s the acceleration of frontier technologies like TEEs, ZKPs, MPC, FHE; whether it’s driving institutional adoption through stablecoin rails and real world assets.

I joined Pantera for its founder-friendly history, star-studded team, and time-proven conviction in the blockchain frontier, and I hope that you too will join me on this journey to “bring blockchains everywhere.”

Please don’t hesitate to reach out to me at jay@panteracapital.com.

Introduction

Zero Knowledge Proofs (ZKPs) are an area of cryptography which have seen a recent explosion of growth and adoption within the blockchain space. One of the most interesting applications of ZKPs is in building ZK Virtual Machines (ZKVMs), or computers that can prove that they correctly executed code on some secret input without revealing the inputs themselves.

RISC Zero is one of the leading companies within the ZKVM space, building provable computers based on the open-source RISC-V architecture. Within this article, we will first provide a primer on ZKVMs and RISC Zero’s overarching goal, before diving into the architectural design of RISC Zero’s 0STARK prover and the various architectural choices that they have made, and finally discussing some of the real-world use cases that RISC Zero unlocks, both in the blockchain space and beyond.

Thanks for reading Stanford Blockchain Review! Subscribe for free to receive new posts and support our work.

1 - An Introduction to ZKVMs and RISC Zero’s Prover

Imagine a computer that could print out a receipt, proving that you spent money at a coffee shop, without revealing what items you actually bought. This is the operating principle of a ZKVM, or a Zero Knowledge Virtual Machine.

ZKVMs are a virtual machine that runs trusted code and generates proofs. Developers can write arbitrary code in a language like Rust, have the code compile down to binary, and send it to the ZKVM to both execute the code and verify its execution [1]. The verification of the executable relies on Zero Knowledge Proofs, which allow for the cryptographic proof of a statement without revealing what the statement actually is. Let’s suppose I’m at a bar, and want to issue a proof to the bartender that I am over 21 without revealing what my actual age is. I can first “commit” my age (a secret number) by putting it inside of a cryptographically sealed envelope. The bartender will then challenge me to prove that the number is greater than 21, without actually opening the envelope itself. I provide some cryptographic proof using a “Prover” algorithm, and send this proof along to the bartender. The bartender will then run a “Verifier” algorithm, and either accept or reject the proof.

This is a classic example of a zero knowledge proof between a “Prover” and a “Verifier.” ZKVMs such as RISC Zero do something similar to this, but for arbitrary computation. Instead of creating zero knowledge proofs of simple statements, such as whether my age is greater than 21, ZKVMs use zero knowledge proofs to prove the correct execution of some “guest code” that the user provides it. To do this, they essentially compile down programs to polynomials (which are a mathematical object that can contain an unbounded amount of information) and then run proofs over all of these polynomials. Compiling arbitrary programs down to polynomials is a challenging and computationally expensive operation, as even the most trivial program needs to be represented as an “arithmetic circuits” [2], a nested tree-structure where each intermediary node is either an addition or a multiplication operation, and each leaf node is an input to the program (and the constant 1).

Many early projects in the space have sought to optimize for performance and stay close to the mathematical circuit layer. Circom, for example, is an early domain specific language used to define arithmetic circuits [3]. This, however, requires a high-level of expertise on the part of the developer, as developing in Circom can feel like developing in a low-level assembly language, optimized for performance but without any abstraction features or pre-built elements. Other projects, such as Aztec’s Noir language and Starkware’s Cairo language, seek to use a higher-level Domain Specific Language (DSL) to aid developers to easily create arithmetic circuits with a better developer experience. However, introducing a completely new programming language optimized for proving may hinder developer adoption, especially in an era of AI-assisted coding, as there is far less tooling, documentation, and existing repositories available to reference.

RISC Zero, however, takes a different approach. As its name suggests, one of the company’s defining choices was to based their ZKVM on the open-source RISC-V instruction set architecture (ISA), rather than create their own DSL [1]. RISC-V is a simple, minimal, and modern ISA that is much easier to arithmetic compared to other standard instruction sets such as x86 or MIPS. At the same time, it is a standard target for the LLVM compiler, so many mainstream languages, such as Rust and Go, can run directly in RISC Zero’s ZKVM and developers do not need to learn a new language from scratch. Furthermore, because RISC-V is an open ISA, it comes with a complete set of conformance tests and a formal model of the ISA [4]. RISC Zero could leverage these to ensure their ZKVM implementation exactly matches the RISC-V spec – crucial for security (no hidden undefined behaviors) and determinism. In fact, RISC Zero is working with formal verification tools (like Veridise’s Picus) to mathematically prove their ZKVM’s correctness against the RISC-V spec [4].

Thus, RISC-V represents the perfect balance between the compiler maturity, ZK performance, and semantic security. Developers can thus write code in familiar languages such as Rust, and enjoy existing infrastructure, tooling, and language support, while also leveraging the RISC Zero ZKVM to create secure, provable programs.

From a developer perspective, at a high level, RISC Zero’s ZKVM works as follows [1]:

1. A developer writes a “guest program” in Rust, that gets compiled down to a standard ELF binary

2. The executor executes the binary, and produces an execution trace of the “session”, or a complete record of the computation

3. The prover will take in session, and use that to generate a ZK proof as a receipt.

Under the hood, RISC Zero’s prover splits the process into several steps [5]:

1. Execution. The program is executed, generating a number of “segments.”

2. RISC-V Proving. Each segment is proven separately using FRI-based 0STARK Prover

3. Aggregation Proving. All the segment proofs are aggregated into a single proof, using a FRI-based 0STARK Prover

4. STARK-to-SNARK Proving. In order to output a proof that’s small enough to verify on-chain, the last step in the proving system relies on an elliptic-curve based Groth16 prover for a smaller on-chain footprint

As we can see, the majority of the proving, including the individual proving of the segments and the aggregation of these segment proofs relies on RISC Zero’s own proof system, the FRI-based 0STARK Prover. In Section 2, we will dive deeper into how this 0STARK Prover works, and the different architectural choices that the 0STARK system makes, and in Section 3, we’ll talk about what developers may be able to build using this system.

2 - A Technical Deep Dive into 0STARK Prover Architecture

The 0STARK Prover’s goal is to couple a RISC-V execution engine and session trace with a transparent, post-quantum secure STARK-based proof system. In this section, we will first dive into the reasoning for RISC Zero’s choice of STARKs, before discussing the three key parts to the 0STARK prover system: (1) randomized AIR arithmetization, (2) DEEP-ALI + FRI STARK instantiation for RISC-V proving, and (3) Merkle-based trace commitment scheme [6].

The 0STARK prover system relies on a zk-STARK foundation, eschewing SNARK-based architectures like Plonk or Marlin for several reasons. Firstly, STARKs allow working over small base fields without requiring trusted setups, and their polynomial IOPs naturally express repeated state‐transition constraints in hardware-inspired traces [6]. Secondly, STARKs scale nearly linearly with execution size and avoid pairing‐based cryptography, making them well-suited for VMs with millions of clock‐cycles. Moreover, unlike SNARKs, STARKs require no trusted setup, which simplifies tooling for developers and reduces operational risk. Verification remains efficient, on the order of milliseconds, even for large traces.

Nonetheless, the final step of the RISC Zero process relies on a “STARK to SNARK” process, where RISC Zero wraps the STARK transcript in a Groth 16-style succinct SNARK, yielding short on-chain proofs. This hybrid approach balances the efficient, transparent prover properties of STARKs with the minimal proof sizes enabled by Groth16 SNARKs.

Thus, this architecture is designed for recursive proofs, where one ZKVM proof can be verified inside another. While the current system uses a sequential (non-recursive) composition, RISC Zero engineers are exploring witness folding and proof‐system modularity to eventually enable on-chain recursive rollups without compromising the core AIR structure.

Now that we have discussed why RISC Zero chose to use STARKs over SNARKs as the foundation for its 0STARK system, we can now describe the interlocking components to the 0STARK system: a randomized AIR arithmetization, a DEEP-ALI + FRI STARK instantiation for RISC-V proving, and a Merkle-based trace commitment scheme. At a high level, the 0STARK protocol runs as follows [6]:

1. Setup: Public parameters –trace size, tapset definitions, AIR constraints – are derived from the RISC-V binary

2. Randomized Preprocessing: The prover executes the program, records control and data columns, encodes them via Reed-Solomon, and commits to Merkle caps. A verifier-randomness seeds the generation of memory and byte accumulators, which are also committed

3. Main Phase (DEEP-ALI + FRI): All constraints are linked into a combined constraint polynomial. The prover computes the validity witness, commits its low-degree segments, and responds to a DEEP query point. A batched FRI then checks proximity of the mixed R ap witness to the RS code, with query rounds verifying the integrity of the split and mix operations across multiple cosets

4. Verification: The verifier recomputes the combined constraint at the DEEP point, checks DEEPAnswerSequence consistency, and validates the FRI queries – all in polylogarithmic time relative to trace size

Throughout this model, 0STARK makes several cryptographic design decisions including [6]:

• AIR over R1CS or CCS – In the setup process, Arithmetic Intermediate Representation (AIR) was chosen over R1CS or CCS because AIR naturally captures the time‐sequential, repeating structure of a CPU trace. Each AIR constraint enforces a low-degree polynomial relation between taps (field evaluations of registers or memory at nearby cycles). This leads to fewer and simpler constraints than an R1CS encoding, which would require auxiliary variables and more complex gate wiring for each instruction. While R1CS is more general, AIR yields better prover performance for deterministic, cycle-based computations, and directly leverages fast FFT and FRI operations. RISC Zero is also experimenting with the M³ arithmetization from the Irreducible team for further efficiency gains.

• Handling large programs – Long execution traces from large programs can, in theory, lower the soundness margin if all cycles were checked naively. RISC Zero mitigates this by segmenting programs into smaller chunks, generating partial witnesses for each segment, and then composing them in a final DEEP-ALI step. This segmentation bounds the length of individual AIR checks, preventing an attacker from easily sampling invalid witnesses in a huge trace. The segments are merged using the same mixing and quotienting techniques present in the main STARK loop, ensuring end-to-end integrity.

• Randomized Preprocessing and Constraint Batching Innovations – RISC Zero’s soundness analysis diverges from ethSTARK primarily in its use of randomized preprocessing to instantiate PLONK-style permutation and PLOOKUP-based range arguments for memory consistency. In this phase, accumulators for memory and byte-lookup are computed and committed alongside the trace, enabling a single AIR to enforce both permutation and lookup in one shot.
  
  During DEEP-ALI, all AIR constraints are batched parametrically into a single combined polynomial using powers of a single random field element, rather than multiple independent randomness values. This parametric batching reduces round-trip complexity and improved prover efficiency compared to affine batching in ethSTARK. Similarly, the batched FRI protocol compresses multiple FRI instances into one using a single random challenge, further streamlining proof generation.

• Optimizing Validity Polynomials – Standard STARK constructions yield separate FRI checks for the trace and for the validity polynomial. 0STARK moves beyond this by splitting the high-degree validity quotient into four low-degree “segment” polynomials, each of which is folded into the main FRI invocation. This degree reduction both lowers FRI complexity and unifies the FRI checks into a single proximity argument, tightening the overall soundness bound.

Through its combination of STARK transparency, parametric batching, AIR efficiency, and FRI folding, RISC Zero delivers a high-throughput, developer-friendly ZKVM capable of proving arbitrary Rust programs compiled to RISC-V. This architecture balances practical prover performance with small, fast proofs, and lays the groundwork for recursive proof composition and integration with broader cryptographic protocols.

RISC Zero’s ZKVM is inherently generic: any computation expressible in RISC-V can be proven. This opens the door to running operations on data encrypted via Fully Homomorphic Encryption (FHE), yielding proofs of correct decryption or transformation without revealing secrets. Similarly, ZKVMs can host multi-party computations by encoding MPC protocols as RISC-V code. Many in the community are exploring MPC + ZKVM hybrids, where parties jointly compute on secret data and produce a single succinct proof of correctness. RISC Zero’s flexible proof architecture is well positioned to serve as the trustless foundation for these advanced cryptographic stacks.

3 - Performance and Applications of RISC Zero in Practice

RISC Zero’s ZKVM is not just an academic exercise. In this section, we survey the RISC Zero ZKVM’s performance and its potential applications and developer tooling ecosystem.

There are many methods of benchmarking the performance of a system, however one important metric is quite simply the execution speed of the system. While traditional VMs are measured in billions of instructions per second, zkVMs report throughput in megahertz of proof‐checked execution. RISC Zero currently sustains around 60 MHz of effective execution throughput on a single GPU-enabled prover, meaning it can validate 60 million RISC-V clock cycles per second in zero knowledge, around the computation speed of a 1990s computer [7].

While this may be much less performant than modern CPUs in isolation, the computational cost of ZK proving is already orders of magnitude cheaper than execution on the Ethereum L1. The proof-generation process can be highly parallelizable: by distributing AIR constraint evaluations and FRI folds across multiple GPUs, provers can proportionally increase throughput.

Moreover, just as Moore’s Law once captured the rapid scaling of transistor density, we’re witnessing a ZK Moore’s Law in cryptographic proof systems, where the growth is rapidly accelerating thanks to several simultaneous scaling laws [8]. These include optimizations in arithmetization logic, such as AIR batching, FFT implementations, as well as GPU-friendly FRI algorithms that are delivering year-over-year prover speed improvements that outpace hardware transistor scaling. There have also been proposals for the development of SNARK proving ASICs [9] and other hardware level acceleration tactics for ZK. Similar to the early days of deep learning, where algorithmic advances and parallel hardware yielded exponential gains, ZKVM performance is hyperscaling, with practical prover throughput doubling (or better) each cycle. Over the next few years, ZKVM prover speed is expected to converge towards native RISC-V speeds, closing the gap between proof-checked and regular code execution.

Having ZKVMs available to provide this verifiable computation unlocks many different use cases both within the blockchain world and beyond. In the blockchain world, ZKVMs enhance scaling and privacy by shifting heavy computation off-chain and verifying results with succinct proofs – an idea known as ZK Coprocessors. ZKVMs can also work with components of the existing blockchain scaling stack. For example, RISC Zero has worked with Optimism to add ZK fraud proofs to their optimistic rollup using the Kailua ecosystem, improving finality delays in the optimistic rollup process and reducing rollup collateral costs [10]. Furthermore, RISC Zero also allows for the proving of an entire Ethereum block, including verifying transaction signatures, account and state storage, applying transactions, and updating the state root by taking existing Rust implementations of the Ethereum such as revm and running RISC Zero’s prover [11].

On the application layer, RISC Zero’s ZKVM has also enabled many innovative use-cases. For example, an early demo application was Bonsai-Pay, which allowed users to send Ethereum to others’ Gmail addresses and was based on the RISC Zero Bonsai prover system [12]. The Hashflow Exchange is also launching an off-chain exchange engine called xOS that uses RISC Zero to prove the matching and risk calculations of a high-performance trading engine, with proofs posted to a Celestia-based chain [13]. By separating the fast “service layer” (running off-chain with normal performance) from the verifiable “settlement layer,” Hashflow can give users the best of both worlds: CEX-like speed with DEX-like trustlessness.

RISC Zero’s ZKVM also has further applications in the social and identity realm outside of web3, such as the example mentioned at the start of proving someone’s age without revealing the age itself. In fact, RISC Zero has shown how it can be used to prove that a JSON file contains a specific field and value without revealing the full file [14]. This could be especially useful in selectively proving sensitive information like photo metadata – we may want to prove that a photo was taken by a certain device (such as a Canon 5D Mark IV) without revealing other sensitive information such as the location of the photo.

Crucially, developers can write all of these applications using the familiar language of Rust, rather than have to learn a low-level ZK circuit language like Circom or a DSL such as Noir or Cairo. If you know Rust, or any other language that can compile to RISC-V, you can simply write your logic, compile with cargo risc0 to a RISC-V binary, and the toolchain emits a provable artifact in minutes. And in the process, you can leverage the power of all existing Rust sources, from language documentation to debuggers like GDB to AI-assisted coding tools like Copilot or Cursor. For example, our example at the beginning of proving a person’s age is over 21, we can simply write as our guest function:

// ----
// check_age.rs:

#![no_main]
risc0_zkvm::guest::entry!(main);

pub fn main() {
    let age: u32 = 25;

    let is_over_21 = age >= 21;

    risc0_zkvm::guest::env::commit(&is_over_21);
}

// -----
// main.rs:
use methods::CHECK_AGE_ELF;
use risc0_zkvm::default_prover;

fn main() {
    let prover = default_prover();
    let receipt = prover.prove(CHECK_AGE_ELF).unwrap();

    let is_over_21: bool = receipt.journal.decode().unwrap();

    println!("Proof generated. Over 21: {}", is_over_21);
}

Conclusion

In conclusion, RISC Zero represents a major leap in the evolution of zero-knowledge computing, offering a practical, performant, and developer-friendly ZKVM built on top of the open RISC-V architecture. By combining a transparent STARK-based proof system with a familiar Rust-based development experience, RISC Zero bridges the gap between cryptographic rigor and real-world usability. Its architectural innovations – such as the 0STARK prover, recursive-proof readiness, and hybrid STARK-to-SNARK compression – position it at the forefront of verifiable computation, unlocking a new generation of applications from scalable blockchain rollups to high-performant trading engines to privacy-preserving identity and social proofs.

Looking ahead, RISC Zero is building toward a future where zero-knowledge computing is universal, scalable, and developer-friendly. By standardizing proof APIs, enabling recursive proofs, accelerating performance with hardware, expanding language and tooling support, and streamlining the developer experience, RISC Zero aims to make ZKVMs a core primitive across blockchains and beyond.

References

[1] https://dev.risczero.com/api/zkvm/

[2] https://en.wikipedia.org/wiki/Arithmetic_circuit_complexity

[3] https://docs.circom.io/

[4] https://risczero.com/blog/RISCZero-formally-verified-zkvm

[5] https://risczero.com/blog/designing-high-performance-zkVMs

[6] See details of 0STARK technical paper: https://dev.risczero.com/proof-system-in-detail.pdf

[7] High-end 1990s computers like the Pentium operated at 60 MHz: https://en.wikipedia.org/wiki/Pentium_(original)

[8] See ZK Moore’s Law:

Stanford Blockchain Review

#22 - Moore’s Law for Zero Knowledge Proofs

Stanford Blockchain Review…

Read more

3 years ago · Stanford Blockchain Club and Roy Lu

[9] ZK11: SNARK proving ASICs - Justin Drake

[10] https://risczero.com/blog/kailua-how-it-works

[11] Zeth: https://risczero.com/blog/zeth-release

[12] Bonsai Pay: https://risczero.com/blog/bonsai-pay

[13] HashFlow: https://medium.com/@hashflowdex/introducing-xos-the-provable-exchange-e875f4e6b30e

[14] RISC Zero JSON Example: https://github.com/risc0/risc0/tree/release-2.0/examples/json

[15] Image Metadata: https://libguides.graduateinstitute.ch/rdm/image-metadata

About the Interviewees

Jeremy Bruestle

Jeremy Bruestle is the co-founder and CEO of RISC Zero, a company pioneering general-purpose zero-knowledge virtual machines (zkVMs). With over two decades of experience in cryptography, distributed computing, and software engineering, Jeremy has consistently focused on bridging emerging mathematical research with real-world applications. Prior to RISC Zero, he co-founded Spiral Genetics, where he served as CTO, developing cloud-based bioinformatics platforms for rapid genome analysis. He also held roles such as Principal Engineer at Intel and Chief Scientist at Vertex.AI, contributing to advancements in mathematical models and algorithms.

Yavor Litchev

Yavor is an undergrad at Stanford pursuing a degree in computer science with a focus on cybersecurity and cryptography. He has previously engaged in research projects relating to secure machine learning and digital signatures with more flexible access structures at MIT PRIMES. More recently, he is researching secure systems and program execution using software fault isolation through the CURIS program. He is currently the cryptography research lead for the Stanford Blockchain Club.

Jay Yu

Jay is an undergrad at Stanford pursuing a double major in Computer Science and Philosophy. He is President of the Stanford Blockchain Club and founder of the Stanford Blockchain Review. He researches designs for Decentralized Autonomous Organizations (DAOs) and blockchain governance with Stanford Law School faculty and as a Research Fellow for IC3. He also works on the investments team at Pantera Capital.

Many thanks to Andy Hung from Stanford Blockchain Club for reviewing and editing this article

Introduction

Science today sits on top of a paradox: on the one hand, scientific innovation thrives on open borders, open communication, and international collaboration. On the other hand, opaque and convoluted funding mechanisms, drawn-out research processes, and the uncertainty of breakthrough success forces scientists to fight for funding and mindshare from a handful of ivory-tower institutions and donors.

But what if, instead of having to seek funding and prestige from gatekeeper organizations, scientists could bootstrap their wildest ideas from a decentralized community? This is the promise of decentralized science: a paradigm shift in the way science is produced, accessed, and monetized. In this article, we will discuss how we might be able to use crypto rails to address three core issues in academic research: the accessibility of science, the funding of science, and the productionization of science.

1 - The Accessibility of Science

The History of Open Science

The concept of “open science” has a long history, and one that has been greatly intertwined with the development of the Internet [1]. The World Wide Web, for example, was originally conceived and developed as a tool for information-sharing between different universities around the world [2], and the idea of “open source software” also has its roots in an academic and research setting.

Open science is fundamentally about accessibility – of papers, data, and methodologies. Today, renting a single research paper for 48 hours from an academic publisher can cost over $30 – something completely unsustainable for scientists with a budget constraint and not affiliated with wealthy universities or research institutions [3]. Journal publishers have built billion-dollar businesses with profit margins that dwarf even those of the most successful tech companies, largely by positioning themselves as intermediaries using prestige. Critics argue that this publishing model diverts valuable resources away from productive research [4].

Within the “open science” movement, perhaps one of the most interesting and controversial projects is Sci-Hub, a “shadow library” that provides direct access to millions of research papers and journals, regardless of copyright. Unsurprisingly, Sci-Hub, like many other open-access “shadow libraries,” have faced a lot of criticism over the ethical considerations, and in 2022, the head librarians of Z-Lib were arrested for copyright infringement and other charges [5]. These arrests sparked some alarm from the research community, with some calling this a modern day “burning of the Library of Alexandria” [6] – a testament to the vital role that open access plays in the process of academic research.

Today, in many fields of academic research, researchers often share their latest work via online “preprint servers” such as ArXiv, before submitting their work to journals for peer review. Unlike shadow libraries such as Sci-Hub, which operate outside of the process of academic publishing, preprint journals are an integral part of the multi-year academic process. However, many of the popular preprint servers today rely on legacy infrastructure from over 30 years ago, and are hosted by centralized university servers. ArXiv, for example, was created by Cornell University researchers in 1991 [7]. Papers are usually directed and shared as PDFs, with no way for others to rate, comment, or otherwise interact with the content.

Creating A Crypto-Based Preprint Server

One of the most interesting ideas within the “decentralized science” movement is the creation of a modern, crypto-based preprint server. ResearchHub, for example, is a DeSci project led by Brian Armstrong, the founder and CEO of Coinbase [8]. In November 2024, it announced the ResearchHub journal [9], an open-access journal with immediate preprint publication services and a 21-day peer review. In line with crypto ethos, ResearchHub is attempting to challenge the status quo of intermediaries in the realm of scientific publishing.

ResearchHub Preprint Server. Source [10]

In its preprint server, ResearchHub augments the PDF hosting of traditional preprint servers with a modern, Reddit-like discussion forum, allowing researchers to receive instant feedback and discussion. This brings transparency into the traditionally opaque peer review process and opens a research article to the wider community for scientific discourse. Perhaps one of the most interesting aspects of ResearchHub is its use of the ResearchCoin token to create a novel incentivization system. ResearchHub incentivizes publication, reviewing, and collaboration using RSC, and allows users to create grants, tip other users, and gain voting rights using their tokens [11]. Peer reviewers, for example, are awarded 1000 USD worth of ResearchCoin each month [12].

ResearchHub is a great case study for how token incentives can be used to reimagine the publication process. Accessibility is fundamentally a financial problem – and by offering financial incentives for open-source work, ResearchHub may be able to create a compliant, open-access alternative not only to paywall publications, but also existing open-access services such as shadow libraries and preprint servers.

Open Questions for Open Access

Nonetheless, ResearchHub and other open-access DeSci platforms remain in an experimental stage, and there remain several open questions that still need to be addressed, including but not limited to:

• Tokenomics Design: As mentioned previously, RSC tokens act as a core way to incentivize open science work on the platform, and can be used on the platform itself – in governance, research requests, and tips. But to what extent are recipients of RSC actually spending on-platform versus converting to fiat? Are these token incentives sustainable and effective in driving quality research? To what extent is on-platform research quality affected by market fluctuations? This question of tokenomics design is perhaps the core question at stake for ResearchCoin and other token-based preprint servers.

• Disciplinary Fragmentation: The scientific process today is highly specialized, and there is no monolithic process of publication. Even within a single discipline, such as biology or computer science, there are numerous subfields, each with their own publications, conventions, and timelines. Today, many DeSci projects tend to focus on a single discipline or research area. ResearchHub’s journal, for example, focuses only on biomedical topics and publications. This fragmentation potentially limits the scale and market for each individual project – after all, there are only so many professional endocrinologists in the world. As DeSci projects develop, one likely scenario is that they will develop a federated structure, similar to professional organizations such as IEEE (Institute of Electronics and Electrical Engineers), containing numerous subcommittees and different conference conventions for each subtopic.

• Quality Control: Another key question for an open-access journal and preprint platform such as ResearchHub is quality control. Compared to a traditional journal, a fully open-source platform may have a lower mean but higher variance in the quality of publication. For every outstanding paper published on these platforms that is blocked on traditional venues, there are perhaps thousands of other papers inferior in quality. Although identity and authorship verification, token rewards, and reputational scores may help, they still don’t fully address the question of quality control. The effectiveness of all these metrics are also limited by the expertise of the community, and could potentially even be compromised by those farming for reputational points and token allocations.

• Association of Prestige: In science, as in many places, scarcity creates prestige. Publications such as Nature are coveted precisely because there is a rigorous selection process and low acceptance rate – the opposite of an open-access process. Since prestige requires a continuous process of curation, open-access journals where all articles are accepted run the risk of being seen as inferior in quality and content to traditional venues. This sense of conventional prestige is perhaps the strongest moat for traditional processes for scientific publication, and makes it uniquely difficult for a decentralized platform to disrupt.

• Community Accessibility: Finally, there is the question of audience. Are these open-access platforms such as ResearchHub aimed at an audience of professional scientists, or that of a wider, science-curious audience? At the moment, there does not seem to be a clear answer on either side, as some features – such as article publication and peer reviewing – seem to be geared towards professionals, whereas others, such as question posting and commenting seem geared towards a wider audience. This question of audience is important due to the differing incentives and levels of understanding that professionals and hobbyists have. One interesting idea could be for these decentralized science platforms to act as places for scientific communication and “technical translation” – to transform dense, jargon-ridden research papers into easily understandable ideas.

2 - The Funding of Science

Decentralized Incubation of Science

Today, researchers can spend as much as half their time writing grant proposals for their work, and this vicious competition for funding can impact the quality of research work that they produce [13]. The current funding model leaves a gap for non-mainstream ideas, replication efforts, and early-stage applied research. One of the core missions of DeSci is to reform the funding process, and allow scientists to directly bootstrap their work from a decentralized community interested in their work.

One of the early pioneers in this space is Molecule Protocol, which provides biology researchers with a platform to create funding proposals for their research projects. For each project, Molecule will mint an IP NFT that represents the patentable research output. Ownership of this NFT is then fractionalized into “IP tokens” that are given to all of the participants that provided funding to the research project through “crowdsales” [14]. If the funding is successful and reaches its goal, the project then enters a negotiation phase, where the researcher, their research organization, and the funders will reach a licensing and revenue sharing agreement.

Molecule DAO Projects [15]

Molecule’s IP NFT infrastructure underlies many of the popular DeSci protocols today. VitaDAO, for example, is a DeSci project focusing on accelerating research in the longevity space to provide tangible, usable research. Similarly, HairDAO is a DeSci organization aimed at creating hair loss solutions, while CerebrumDAO seeks to tackle Alzheimers and advance brain health.

Recently, Molecule has also introduced pump.science, a DeSci funding platform on Solana inspired by memecoin launch platforms such as pump.fun. On pump.science, anyone can submit experiments with drug regimens for C. elegans worms, trying to create a regimen that will extend the lifespan of the worm [16]. Users can try to predict the success or failure of the various regimens, and the token liquidity can be used to fund the ongoing research. The data from the research will then be streamed back to users, who will have a stake in the success of the project.

The core observation in pump.science is that memecoins can be more than just for capturing the social media zeitgeist – they can be used to bootstrap attention for socially productive ideas such as scientific experiments. In December of 2024, Siqi Chen, the founder of Runway, shared on X (fka. Twitter) his daughter Mira’s battle with a rare brain tumour. This prompted an X user to launch a memecoin named MIRA with half the supply dedicated to Siqi [17]. The token eventually allowed Siqi to donate over a million dollars towards a research study for his daughter’s rare brain cancer at the Hankinson Lab at the University of Colorado – showcasing the potential for memecoins to direct attention and capital to good causes [17].

Another prominent project working on this funding and bootstrapping aspect of decentralized science is BIO protocol. Building off of the success of Molecule and early DeSci DAOs such as VitaDAO, BIO protocol is a “financial layer” for DeSci, aiming to incubate a new generation of BioDAOs that provide researchers with community-sourced funding and resources to conduct pharmaceutical research and pharma products [16]. Some of the the latest projects in BIO protocol’s cohort include Long Covid Labs, aiming to provide a cure for long COVID patients, Curetopia, creating a space to unite families suffering from rare diseases, and Quantum Biology DAO, aiming to build a quantum biology microscope [18].

Evaluating Science DAOs and Community Ownership of Science

Interestingly, many DeSci projects today take shape in the format of a DAO, emphasizing the communal ownership of science and IPs. Aside from the historical reason that many early experiments in the DeSci space took shape as DAOs or DAO-launching platforms, there may be several reasons behind this. Firstly, launching a DAO token allows for a simple, straightforward way of crowdsourcing funding via a publicly tradable token. Secondly, this token creates a community of engaged stakeholders within a project that a researcher can communicate their findings with.

However, DAOs as an organizational form have faced many unique challenges in their development. One of the most prevalent is the question of community engagement and voter apathy – a problem systemic to the vast majority of DAOs. Even in popular DeSci DAOs, such as VitaDAO, voting quorum for any given proposal is around 10% of the total supply, and there are sometimes less than 10 votes for a proposal [18]. In VitaDAO’s recent VDP-157, for example, which introduces the concept of pump.science, the vote, which has only around 2M votes, is dominated by a single voter with 1.2M VITA tokens [19]. This poses centralization risks to the voting process.

Furthermore, unlike some of the largest protocol DAOs today, such as Uniswap, Arbitrum, or Optimism, the governance of VitaDAO and other BioDAOs occur entirely offchain, relying on Snapshot as a centralized service provider. Moreover, unlike protocol DAOs that use smart contracts to manage a “tangible” on-chain treasury, it is not immediately clear how precisely a decentralized organization would govern an “intangible” asset of an IP NFT. Compared to their centralized counterparts, decentralized governance could add a lot more latency and coordination problems to the research process, not to mention potential regulatory hurdles within the space.

Perhaps one of the core issues that decentralized funding and governance bring to this process of scientific research is the question of audience. Although the token-buying stakeholders may be interested in a project, they may not necessarily be fully aware of the research norms, context, and specialized knowledge of academic research. This would push researchers to have to do much more technical communication and “translate” their research to a generalist audience, a burden that may slow down frontier research efforts.

Moreover, for projects like pump.science that have adopted a memecoin launchpad model, it is unclear if the short attention cycles and reflexive market behaviour of memecoins would be able to uphold a multi-year, or oftentimes multi-decade process of biomedical research. Crypto and academic science simply operate on two different timescales. The average time to market for a new drug is 10-15 years, which is about as long as the entire history of blockchains [20]. If these protocols seek to return tangible products back to their stakeholders, they will likely only be able to tackle products in the late phases research productionization, rather than contribute to the cutting edge discovery process that many DeSci evangelists envision.

Finally, deploying new funding into science does not address the complex issues funders face to meaningfully define success. Researchers and funders have become dependent on publication and citation counts as metrics, but this incentive system has contributed to a reproducibility crisis, undermining public trust and impeding genuine progress [21]. Merely diversifying the sources of funding fails to address the underlying inefficiencies inherent in current research institutions.

3 - The Productionization of Science

From DeSci to DePIN: Productionizing Research IP

As mentioned above, one of the core problems for DeSci is the timescale mismatch between crypto attention span and the time it takes to develop a wholly new scientific project. This means that as opposed to helping scientists do groundbreaking foundational research, perhaps DeSci’s edge and primary use case will be in the productionization of science – turning proven research into a specific consumer product. In this way, DeSci’s future can be seen as a domain-specific extension of DePIN – combining physical consumer products with tokenomics design to incentivize user behavior and aid researchers with data collection.

Many of the major existing DeSci projects seem to recognize this “productionization” angle. Molecule’s Catalyze platform, for example, emphasizes that it is for “translational research” that will directly result in an IP that can be productionized, rather than for fundamental research [22]. Moreover, it has several restrictions on project size, asking scientists to raise each round of funding with <$50k of funding and taking less than 12 months to complete [22]. Compared to traditional science, DeSci’s capacity for permissionless contributions is particularly well-suited to product translation. Motivated patients and users can act as citizen scientists, giving a project instant access to real-world feedback and expertise.

Introduction of Lushair device [23]

So what might these “productionization” projects for DeSci actually look like? Recently, HairDAO has also partnered with Genpulse to create Lushair, the world’s first at-home AI-powered scalp analysis solution that provides data analysis on metrics including hair density, follicle activity, and oil state [23] [24]. Lushair, as a physical product, may provide us with some hints of what “productionized research” may look like in the future via DeSci:

• Crowdsourced funding from a widespread, known consumer pain point

• Productionization of patents and analysis from existing, well-established scientific literature

• Creation of physical products, such as detector devices, designed for everyday consumer use

• Using DePIN-like tokenomics structures to crowdsource consumer data and provide real-world data for further medical literature

As DeSci DAOs continue to develop these consumer-grade physical devices for their members, we can see a path for a business model for DeSci that looks similar to existing decentralized physical infrastructure networks (DePIN) such as Helium and Hivemapper.

Crypto as a Distribution Channel for Evangelizing Research

Aside from the creation of physical consumer products such as Lushair, one of decentralized science’s most promising aspects is the ability to allow existing but niche areas of research to be popularized into the mainstream. As we’ve mentioned before, the token holders within these DeSci communities are more likely to be generalist users with interest in a specific scientific problem, rather than being academic scientists themselves. This may present an “audience problem” for some of the previously mentioned projects that try to create a platform intended for academic scientists.

Rather than trying to bootstrap an audience of academic researchers or converting a generalist audience into research scientists, perhaps DeSci DAOs should lean into the “technical communication” part of science and actively engage their audience with digestible summaries and takeaways from research that can be applicable to their daily lives. Thus, it is possible that DeSci DAOs will act as “research amplifiers,” with products and educational programs that popularize science for a generalist audience.

Recently, we’ve seen how platforms such as pump.science have been inspired by the rise of memecoins. The attention-grabbing economics of memecoins could be particularly interesting in creating educational channels and awareness campaigns for science projects. However, memecoins only represent a top-of-funnel attention; the core challenge for a DeSci DAO is to optimize for retention, and transform this top-of-funnel attention into long term holders and stakeholders of these research projects.

These education products can take place in many different ways. For example, these DeSci communities could create AI agents that are able to translate academic papers into attention-grabbing short videos, tweets, and other forms of media for a mass audience. We could also potentially see the development of “Masterclass-style” platforms that allow for the decentralized education of science. By developing these education-based products, DeSci projects can use a wider crypto community as a distribution channel and carve out another path to allow these communities to stay relevant, both within a crypto context as well as in the scientific community.

Disciplinary Limitations for DeSci: The Lifestyle Relevance Test

Throughout our discussion of DeSci, we’ve pretty much only focused on a single discipline – biology – that is not necessarily representative of research in other scientific disciplines. As we’ve suggested above, this may be because there are certain disciplinary limitations for DeSci. In other words, DeSci works far better for some scientific disciplines than for others.

But what characterizes these disciplines with DeSci potential? I believe that the most important litmus test for DeSci is the “lifestyle relevance” test – does the science being conducted actually affect my day-to-day lifestyle?

This litmus test, derived from the observation that most DeSci community members are an interested, informed public, explains why many of the DeSci projects we see today – from VitaDAO to HairDAO to CereberumDAO – focus on biology and medicine. The findings from these research projects could actually affect the day-to-day lifestyle of many consumers. Thus, in the productionization of existing research, DeSci organizations will likely prioritize projects that can create tangible products that create lifestyle changes for a mass consumer audience.

Conclusion

Throughout this article, we’ve examined three key aspects of science that the DeSci movement aims to tackle – the accessibility of science, the funding of science, and the productionization of science. While projects like ResearchHub and Molecule Protocol demonstrate promising innovations in open access publishing and research funding, many of these existing DeSci models face significant challenges around tokenomics, governance, and audience.

Because of the fundamental timescale mismatch between academic science and crypto, perhaps the future of DeSci will be in the productionization and distribution of research-proven solutions. Moreover, DeSci seems to be much more suitable for certain types of scientific problems – those that can affect behavioral and lifestyle changes – rather than covering all research in all disciplines. Thus, in the long term, DeSci’s future likely lies not in replacing the traditional scientific research process, but in complementing them by creating new funding vehicles, new publication channels, and new productionization venues that allow theoretical results to quickly translate into tangible consumer products. This perhaps is the ultimate goal of DeSci, translating abstract scientific advances into concrete, everyday products that can benefit humanity at large.

References

[1] https://en.wikipedia.org/wiki/Open_science

[2] https://home.web.cern.ch/science/computing/birth-web

[3] https://www.forbes.com/sites/johncumbers/2023/04/28/the-desci-movement-will-crypto-really-solve-sciences-biggest-problems/

[4] https://www.theguardian.com/science/2017/jun/27/profitable-business-scientific-publishing-bad-for-science

[5] https://www.vice.com/en/article/shadow-libraries-are-moving-their-pirated-books-to-the-dark-web-after-fed-crackdowns/

[6] https://seattlespectator.com/2022/11/16/z-library-shutdown-raises-questions-about-educational-accessibility/

[7] https://info.arxiv.org/about/index.html

[8] https://www.researchhub.com/team

[9] https://www.researchhub.com/researchhub-journal

[10] https://www.researchhub.com/paper/1299036/biomedical-publishing-past-historic-present-continuous-future-conditional

[11] https://docs.researchhub.com/welcome/what-is-researchhub

[12] https://docs.researchhub.com/researchcoin/rsc-tokenomics

[13] https://www.vox.com/2016/7/14/12016710/science-challeges-research-funding-peer-review-process#1

[14] https://docs.molecule.to/documentation/ip-tokens/what-is-a-crowdsale-of-ipts

[15]

https://www.molecule.xyz/

[16] https://www.molecule.xyz/blog/solana-foundation-awards-grant-to-molecule-for-building-solana-native-desci-funding-platform-pump-science

[17] https://www.coindesk.com/markets/2024/12/27/memecoin-degens-raise-millions-for-rare-cancer-research-after-a-father-s-plea

[18] https://www.bio.xyz/blog-posts/desci-2-0-how-bio-will-unleash-biotech-revolution

[19] VitaDAO VDP-157 Snapshot vote:

https://snapshot.box/#/s:vote.vitadao.eth/proposal/0x01fdb4f1a1fa5dfbca0cd3a046740e752f05c221ae01be543987ad639988aeec/votes

[20] https://pharmaoffer.com/blog/how-long-does-it-take-to-bring-new-medicines-to-the-market

[21] https://www.nature.com/articles/483531a

[22] https://docs.molecule.to/documentation/catalyst/submit-a-project

[23] https://x.com/GenpulseAI/status/1865976938663428461

[24] https://www.lushair.net/about

Introduction

Threshold decryption is a flexible yet powerful tool that allows for secure management of trusted secrets by distributing key shares among multiple parties. However, current threshold decryption systems are not robust against cases where participants may choose to sell their decryption key shares to an adversary.

In this article, we will dive into “Accountability for Misbehavior in Threshold Decryption via Threshold Traitor Tracing”, a new paper by Stanford Professor Dan Boneh’s Applied Cryptography Group that addresses this problem. First, we will explore the overarching idea of threshold decryption and its features. We do this to motivate why accountability measures are necessary for threshold decryption schemes in the first place. Next, we will examine the overall construction of Boneh, Partap, and Rotem’s novel traitor tracing scheme, which we term BPR Traitor Tracing. Finally, we discuss the applications and implications of BPR Traitor Tracing on threshold decryption in the blockchain space.

Threshold Decryption

Threshold decryption is an instance of multi-user cryptography. In a threshold decryption setup, there is a public key that anyone can use to encrypt data. On the other hand, decrypting data requires a secret decryption key that is shared amongst N different parties. To decrypt a piece of data, there needs to be a quorum of at least t parties to decrypt a ciphertext using a “threshold signature.” Importantly, t - 1 or less parties cannot learn anything about the plaintext from the ciphertext. This construction is called a t-out-of-N threshold decryption scheme, which often creates shards of the keys and distributes said shards to each of the participants using techniques such as Shamir’s secret sharing algorithm [1].

In many respects, a t-out-of-N threshold signature scheme is like a traditional “multi-signature wallet” (multisig) such as a Gnosis Safe wallet. A multisig also requires a quorum of t-out-of-N signatures to take any action, such as transferring funds to another user or casting a ballot for a proposal. However, a threshold signature scheme has many desirable properties and holds several advantages over a traditional multisig.

Firstly, a traditional multisig requires all t members to sign, so the number of signatures needed scales linearly to t. For a 9-out-of-12 multisig, such as for Arbitrum’s security council [2], this would require verifying 9 signed messages for a multisig action. In a threshold signature setup, on the other hand, this would only require verification of a single signature, composed of 9 out of the 12 signature shards. Therefore, it is much cheaper and easier to scale threshold signature setups than multisigs.

Secondly, the shards of a threshold signature can undergo a process of proactive refresh [3], where the key shards themselves can be updated at regular intervals. This means that even if an attacker compromises a user’s key shards, the user can simply refresh their key shards, and the old shards that the attacker has become invalid. This process of proactive refresh is impossible to do in a traditional multisig setup. If an attacker compromises the secret key of one of Arbitrum’s security council members, it will have signing access to that account in perpetuity. The multisig would need to laboriously revoke the compromised users’ signature through a group vote. Therefore, a threshold signature setup has a significant security advantage over a traditional multisig.

Thirdly, in multisig wallets, all of the t signees are public. If Alice, Bob and Charlotte are three members of a security council, in a multisig setup, everyone can publicly view how they each individually voted on each proposal. This is great in some cases as an accountability measure to ensure that signees act in good faith. In other cases, however, it may be desirable to not reveal who specifically voted for what – such as in contentious proposals with risk of retaliation. Threshold schemes can help alleviate this accountability problem by ensuring that the final produced signature is identical no matter which parties participated in the signing process, thus granting plausible deniability to the participants.

Threshold signatures come in two flavors that provide for both options. Accountable threshold signatures identify the specific shards (users) that participated in generating the threshold signature, just like a classic multisig. Private threshold signatures, on the other hand, do not reveal either the signees that participated in the generation of the signature, nor the threshold itself [1]. Thus an attacker does not even know how many shares it needs to forge a signature.

Although private threshold signatures can allow an organization to preserve their internal structure and not reveal this to the outside world, there is an accountability problem with private threshold signatures. Specifically, if an attacker has a general idea of who the signees are for the private threshold signature, they can bribe each of the signees for their shards. Once the attacker gains t shards, they’re able to decrypt any given ciphertext from the comfort of their home.

BPR Traitor Tracing for Private Threshold Signatures

Because by nature, a private threshold signature is “private” and does not reveal which shards generated this signature, it is impossible to trace which signees sold their signatures. This is a huge problem, as it means that standard accountability mechanisms, such as slashing bad actors, would not work in a private threshold signature setup. This is precisely the problem that BPR Traitor Tracing seeks to tackle [4].

To better understand how such a tracing algorithm can be created, we must first formulate what we wish to accomplish with such tracing. Intuitively, we wish to be able to detect a set of participants in the decryption process, and make sure that we do not falsely identify and accuse innocent parties.

To formalize this notion, given a set of decrypting participants J, if the traitor tracing algorithm identifies a subset of parties J’, it is critical that J’ is a subset of J. In other words, it should be of negligible probability that any of the parties identified in J’ are not in fact involved in the actual decryption parties J. This would appear to be a sufficiently robust definition for what we seek to accomplish with traitor tracing, however the following issue arises: The traitor tracing algorithm that always outputs none of the parties (i.e. J’ is the empty set) will perfectly satisfy this definition. This is clearly unacceptable, as we would wish to have this tracing algorithm to be practically useful in identifying at least one participant in the decryption process. Thus, we additionally require that J’ is never the empty set. Following this, we define Good Trace (GoodTr) and Bad Trace (BadTr) as follows [5]:

As we expect, under this definition our traitor tracing algorithm will always return a good trace, with cryptographically-small margin of error. Now that we have formalized our end goal, we need to first introduce a cryptographic primitive before we fully solve the problem of traitor tracing, and that is the idea of fingerprinting codes [5].

Formally, a binary fingerprinting code is a set of words:

where each w̅ is an ℓ-bit string.

A fingerprinting code comes with a function Trace. In this function, the adversary has access to a subset W ⊆ Γ of words. The adversary generates a new word w̅ by combining bits from words in W, such that for every n-th bit in w̅, it has to take the value of the n-th bit in an existing w in W. So if W = {011, 010, 001}, such that all w in W start with the “0” bit, then the adversary’s w̅ must also have “0” as their starting bit. We can call this word feasible for W. This requirement of feasibility and resulting distribution of bits ensures that w̅ can be traced back to at least one word in W, to identify traitor parties.

Although this primitive provides a “tracing” capability we need in our threshold decryption scheme, it is not immediately obvious as to how this mechanism can be usefully implemented within the context of traitor tracing. We need to introduce another building block: Bipartite Threshold Key Encapsulation Mechanism, or BT-KEM [6].

The core innovation in BT-KEM is that instead of representing words as binary sequences (0's and 1's), we represent these as pairs of secret keys. Each pair corresponds to a bit, with a “left key" representing 0 and the “right key” representing 1. This approach allows us to trace the decryption process back to specific groups of participants, similar to how traditional fingerprinting codes work.

When a group of decryptors collaborates, they create a "traceable" word using these secret key pairs. This word can be linked back to the specific subset of parties involved in the decryption. This solves our problem of identifying groups attempting unauthorized decryption, as using only one key from each pair reveals information about which group is involved.

The BPR traitor tracing mechanism builds on BT-KEM to create the Traitor Tracing Threshold KEM (TTT-KEM) [7]. The key addition here is a Trace function. While fingerprinting codes theoretically allow us to identify specific subsets of parties attempting decryption, the Trace algorithm makes this practical by leveraging BT-KEM.

Here's how Trace works:

1. We feed carefully crafted invalid ciphertexts into the decoder (the decryption mechanism used by potential traitors).

2. Some of these ciphertexts have a valid left component and an invalid right component, while others are entirely invalid.

3. By analyzing how the decoder responds to these different inputs, we can determine individual "bits" of the fingerprinting code.

4. Using these bits, we apply fingerprinting code tracing algorithms to identify which set of parties were likely involved in the unauthorized decryption attempt.

This approach allows us to effectively trace and identify groups attempting unauthorized decryption, even when they try to conceal their identities.

BPR Traitor Tracing in Blockchain Applications

BPR Threshold Decryption Traitor Tracing has enormous implications for the blockchain space, as this is a cryptographic scheme that solves the accountability system for any private threshold decryption system.

Today, one of the most prominent applications of BPR traitor tracing is in securing encrypted mempools. Threshold decryption is used in encrypted mempools, such as the case in Osmosis [9], in order to minimize the impact of Maximal Extractable Value (MEV) operations and other orderflow attacks. The core idea for threshold decryption is that each validator holds a decryption shard, and transactions require 2/3 of the validators to be decrypted – thus requiring the finality of the block before knowing the block’s contents.

The problem that emerges here is that a MEV searcher that wants to decrypt transactions early can simply bribe validators to sell a decryption algorithm with their key shards. With BPR traitor tracing, even if malicious validators sell a decryption algorithm derived from their combined key shares, that algorithm can still be traced to these individual validators’ shards. The network can then slash these validators’ stakes, thereby increasing the security of the system [4].

Other potential applications of threshold decryption include in private voting systems and sealed-bid auctions, where there is a need for data to be encrypted to ensure privacy. A DAO such as Arbitrum, for example, may choose to have a private ballot on a sensitive topic, such as treasury management or committee elections. The key shards could be split amongst its security council members, and they can only decrypt and view the results of the private ballot after the election is over. This measure can potentially prevent herding, apathy and some other centralizing forces common in DAOs [10].

For sealed-bid auction systems, threshold decryption may be used such that the results and winning bids of an auction are only revealed after the auction period is over. This process prevents players from seeing other bidders' prices in an effort to “outbid” them, such as the case of ConstitutionDAO [11].

In both of these cases, BPR Traitor Tracing is necessary for them to be effective, as it provides an extra measure of accountability and enforcement in cases where, for example, a security council member decides to sell their decryption shares to some malicious third party.

Conclusion

Fundamentally, threshold decryption as a construction yields numerous benefits over other multi-user cryptography schemes such as multi-signature wallets. In particular, accountable threshold signatures exceed multisigs in their flexibility, efficiency, and security, and may see increased adoption of threshold decryption setups as time goes on.

BPR Traitor Tracing seeks to extend the security and usability of the other flavor of threshold decryption – private threshold signatures. Through combining the tracing capability of fingerprinting codes and the BT-KEM construction, the TTT-KEM solution that the authors present elegantly solves the accountability problem of private threshold signatures. With this trace data, this allows private threshold decryption setups to be more useful and efficient in various blockchain applications – from encrypted mempools to private voting and auctions and beyond.

Thanks for reading the Stanford Blockchain Review! Subscribe to support our work in pioneering a dedicated industry journal for Web3

About the Interviewees

Prof. Dan Boneh

Professor Boneh heads the applied cryptography group and co-directs the computer security lab. Professor Boneh's research focuses on applications of cryptography to computer security. His work includes cryptosystems with novel properties, web security, security for mobile devices, and cryptanalysis. He is the author of over a hundred publications in the field and is a Packard and Alfred P. Sloan fellow. He is a recipient of the 2014 ACM prize and the 2013 Godel prize. In 2011 Dr. Boneh received the Ishii award for industry education innovation. Professor Boneh received his Ph.D from Princeton University and joined Stanford in 1997.

Yavor Litchev

Yavor is an undergrad at Stanford pursuing a degree in computer science with a focus on cybersecurity and cryptography. He has previously engaged in research projects relating to secure machine learning and digital signatures with more flexible access structures at MIT PRIMES. More recently, he is researching secure systems and program execution using software fault isolation through the CURIS program. He is currently the cryptography research lead for the Stanford Blockchain Club.

Jay Yu

Jay, or 0xFishylosopher, is an undergrad at Stanford pursuing a double major in Computer Science and Philosophy. He is President of the Stanford Blockchain Club and founder of the Stanford Blockchain Review. He researches designs for Decentralized Autonomous Organizations (DAOs) and blockchain governance with Stanford Law School faculty and as a Research Fellow for IC3. He also works on the investments team at Pantera Capital.

References

[1] See Chapter 22 in “A Graduate Course in Applied Cryptography” (Boneh and Shoup). Online version: https://toc.cryptobook.us/book.pdf

[2] Arbitrum Security Council setup: https://docs.arbitrum.foundation/dao-comprehension-check

[3] Proactive refresh (Boneh, Partap, Rotem): https://eprint.iacr.org/2022/1656.pdf

[4] See Medium article on BPR Traitor Tracing: https://medium.com/@boneh/how-to-slash-misbehavior-in-threshold-decryption-0888af5ae3b6

[5] See Section 3 in paper: https://eprint.iacr.org/2023/1724.pdf

[6] See Section 4.1 in paper

[7] See Section 4.2 in paper

[8] See Figure 6 in paper

[9] See discussion of Osmosis: https://arxiv.org/pdf/2307.10878

[10] Centralizing forces in DAOs: https://www.coindesk.com/opinion/2024/09/13/daos-need-a-vibe-check/

[11] Discussion of sealed auctions and ConstitutionDAO: https://hackmd.io/@dabo/Hkj9Zp-B9

This article is a long-form exploration of the discussions and ideas with Jay Yu of Stanford Blockchain Club during an interview conducted in June 2024. Full Video here.

Article Published on the Stanford Blockchain Review

Introduction

Stablecoins today are a staple of the crypto industry, combining the dollar’s reliability as a store of value with a blockchain token’s transactability and ease of use. Among these is USDC, Circle’s flagship product and one of the most widely adopted stablecoins, and the 6th largest crypto token by Market Cap [1].

In this article, we will discuss USDC’s unique features as a stablecoin product, its current adoption as a means of payment, and the regulatory landscape that USDC and other digital assets may face today, and what all this means for the digital future of the dollar.

Creating a Stablecoin of Trust and Transparency

At its core, USDC solves a very simple issue: how do you buy digital assets with dollars? Before the advent of stablecoins, the solution was to bridge over fiat dollars from the traditional banking system into cryptocurrency exchanges, often a slow, cumbersome, and expensive process. USDC addresses this “onramping” issue by creating a “digital dollar,” a programmable, tokenized representation of the US Dollar that is backed 1:1 by fiat cash and cash-equivalent assets [2].

Since its inception in 2018, USDC has grown to become one of the leading stablecoins in the crypto industry. Perhaps the key factor that distinguishes USDC from other major stablecoins is its emphasis on trust and transparency throughout the issuance process. Unlike other stablecoin providers, which are often based overseas and are not regulated, Circle is a wholly US-owned, US-operated company that issues these “digital dollars.” Every month, USDC’s reserve assets undergo an independent attestation by a Big Four accounting firm, and Circle has a public dashboard where anyone can view USDC’s reserves composition in real time [3]. For example, as of Aug 8, 2024, Circle’s dashboard records $34.5 billion dollars worth of USDC in circulation [4].

Circle’s Reserve Compositions, accessed Aug 8, 2024. Source [4].

So, how are Circle’s USDC tokens issued and redeemed from this fiat backing? The direct issuance and redemption of USDC are processed through “Circle Mint”, an Application Programmable Interface (API) for institutional traders, fintech firms, exchanges, and other corporate businesses. To receive USDC in any amount, a Circle Mint customer initiates a fiat transfer in that amount through its API to Circle’s USDC reserve account, and Circle issues the equivalent USDC to the customer’s Circle Mint account. Similarly, when a Circle Mint customer requests a fiat redemption for USDC, Circle will send this USDC to a “burn address,” and upon this “burn event,” will transfer USD to the business’ linked bank account [2].

The asset management process also aims to promote trust through leveraging the expertise and transparency of traditional asset managers. In USDC’s $34.5 billion current reserves [4], $4.5 billion is held at reserve banks, while the remaining $30.1 billion is held in the Circle Reserve Fund, a SEC-registered government money market fund managed by Blackrock that has a 5.29% 7-Day SEC yield [6].

Fiat-backed stablecoins like USDC stand in stark contrast to the traditional fractional banking system. Whereas most dollars in a bank are backed solely by the bank’s lending portfolio (which often comprises relatively illiquid and riskier assets), every “dollar” of USDC is backed by an equivalent amount of highly liquid cash and cash-equivalent USD assets. In this sense, Circle’s USDC paves the way for the future of the dollar in a digital setting. Through providing a secure, safe, and innovative infrastructure framework for “digital dollars,” Circle aims to reimagine one of the most important assets in the financial world.

Adoption of USDC From DeFi to TradFi

Of course, the true value of a stablecoin lies in its use. No matter how well-designed or how transparent the product is, the real test for a stablecoin is in its adoption in everyday use cases — both within blockchain contexts, as well as with traditional payment rails.

Dune Dashboard of Stablecoin Volume in DeFi [9]

Circle’s USDC remains the world’s largest regulated digital dollar and is natively supporting 16 different blockchains, where it has seen significant usage as a preferred stablecoin for use in DeFi protocols [16] [10]. Amongst these, the largest transaction volumes are on Solana and Ethereum, with the primary use cases being in trading, and other activities in the crypto ecosystem. To ensure compatibility between different supported blockchains, USDC has developed a native interoperability infrastructure for cross-chain transfers, called the Cross-Chain Transfer Protocol (CCTP) [11].

The interoperability mechanism in CCTP is quite similar to Circle Mint’s fiat-to-token infrastructure. Currently, CCTP supports 8 different chains, namely: Arbitrum, Avalanche, Base, Ethereum, Noble, OP Mainnet, Polygon PoS, Solana [11]. To transfer USDC from one chain to another, such as from Ethereum to Solana, there are three main steps:

1. First, USDC is burned on Ethereum, the source chain.

2. Then, the user fetches a signed attestation from Circle to this burn, which acts as a receipt to this “burn event”.

3. Circle uses this attestation to authorize the mint of USDC on Solana.

One of the advantages of this burn-and-mint mechanism is that it allows for compatibility across blockchains running different Virtual Machines — such as EVM for Ethereum and SVM for Solana, enabling use cases such as cross-chain swaps, deposits, and purchases in Decentralized Finance (DeFi) systems.

But perhaps the most exciting area of growth for USDC is in its adoption beyond just crypto transactions and DeFi products. Traditionally, money has three main functions: (1) as a store of value, (2) as a unit of account, (3) as a medium of exchange. USDC has seen growing adoption for all three functions of money in real-world settings.

As a “store of value,” USDC emerges as a natural solution for people in developing countries without reliable access to either US dollars or a dollar-denominated bank account. In Argentina, where the annual inflation rate surges above 200%, stablecoins have emerged as a major way for citizens to preserve their wealth [12]. In 2023, 60% of crypto purchases in Argentina were for dollar-denominated stablecoins such as USDC, and the country ranks 15th for crypto adoption in the world [12]. In December 2023, Circle also announced a partnership with Brazil’s Nubank to provide its 85 million customers with access to “digital dollars” [13].

As a “unit of account,” USDC has also advanced significantly over the past few years, as Circle has conducted extensive pilots with Visa and Mastercard, two of the biggest payment processors globally. For example, since 2021, Visa has partnered with Crypto.com to pilot using USDC as a settlement mechanism, and in 2023, Visa announced that it would roll out increased support for USDC settlement, with new merchant acquirers Worldpay and Nuvei and utilizing the Solana blockchain [14]. Similarly, in 2021, Mastercard announced that it would be offering crypto companies the ability to launch branded card offerings, settled with stablecoins such as USDC [15].

As a “medium of exchange,” USDC can be used today at any Visa terminal through the Coinbase Visa Card. Launched in 2020 for US consumers, this debit card allows consumers to directly spend USDC at any Visa terminal, providing a fiat-like payment experience while earning rewards in crypto [16].

Coinbase Visa Card, which allows clients to spend USDC at any Visa terminal. Source: Original Content.

Another example of USDC being used as a “medium of exchange” is the Singapore-based Grab app, a ride-hailing, food-delivery, and grocery services superapp in Southeast Asia with over 180 million users. In September 2023, Grab announced that they had partnered with Circle to create a web3 wallet that supports USDC payments and NFT government vouchers and food stamps [17]. Today, consumers can use USDC on Ethereum, and Solana as a means to top up their Grab wallet [18].

Thus, we see that USDC today is gaining increased support and integrations with traditional payment rails, merging an internet financial system with traditional financial services. But how do stablecoins compare as a means of payment to existing digital payment systems, such as Automated Clearinghouses (ACH)?

In many existing systems such as ACH, the money and the message moves separately across centralized ledgers [19]. If Alice makes a transaction to Bob via ACH or credit card, a transaction will first be labeled as “pending” for up to several days, before it becomes finalized. This is because at the moment of transaction, the system merely emits a “message” that a transaction occurred, without moving the money itself. The money is credited asynchronously, sometimes after a delay of several days.

A key advantage of stablecoin payments over these legacy systems is that the money and the message move at the same time. Thus, when Alice makes a stablecoin transaction to Bob, Bob receives the full amount of the money the instant the transaction message is emitted, just like a cash payment. In this way, stablecoins as a payment mechanism represent a technological leap over many existing settlement solutions, and are far more suited to play the role of a “digital dollar” in the future.

Legal and Regulatory Perspectives on Stablecoins

As with any emerging technology, stablecoins have raised many legal and regulatory questions. As stablecoins such as USDC make their way into the mainstream, one key issue is that they may become a tool for malicious actors to conduct money laundering, terrorism financing, and sanctions evasion. This is particularly important as the rails between traditional financial services and stablecoins mature over time to build a new Internet-based financial system; there needs to be a focus on advancing regulatory compliance for stablecoin products.

Throughout this piece, we’ve emphasized how Circle aims for USDC to serve as a regulated, transparent, stablecoin issued by an issuer that prioritizes regulatory compliance. As a regulated money transmitter, Circle complies with relevant FINCEN guidelines and state money transmitter laws, and all US-based users of Circle Mint are subject to anti-money laundering and know-your-customer regulations such as the Patriot Act [20].

But while it is necessary to introduce compliance to prevent abuse of stablecoins such as USDC by malicious actors, this regulation should be more sophisticated and fine-tuned to also protect the interests of everyday consumers that wish to use USDC; creating a regulatory system that shuts out everyday consumers — especially those already marginalized by the existing financial system — does not advance American interests.

Today, the two main regulatory bodies that are attempting to regulate stablecoins in the US — the Securities and Exchange Commision (SEC) and the Commodity Futures Trading Commission (CFTC) — were created far before the invention of the modern Internet, let alone digital assets such as cryptocurrencies and stablecoins. Regulators today are working with tools from over 90 years ago, and while some guidelines remain useful in certain cases, regulators need to be especially thoughtful on how to apply existing rules to this novel industry and create new rules to effectively regulate activities that are novel based on the innovations of blockchain technology.

Although the blockchain industry can make some technical innovations, such as decentralized digital identity systems, which make it easier to balance end-users’ demands for privacy with regulatory requirements, this alone will not be enough to fill this regulatory gap. It is up to Congress to act in order to increase regulatory transparency for both stablecoins and for digital assets at large, and new legislation such as the draft of the Stablecoin Transparency Act represent steps in the right direction [21].

In this regard, several other jurisdictions, including the European Union, are much farther ahead than the United States. Recently, the EU has introduced the Markets in Crypto-Assets Regulation (MiCA), which is set to be fully implemented by December 2024 [22]. The core innovation with MiCA is that it seeks to create a whole new regulatory framework built for digital assets, with provisions such as mandating liquid reserves for stablecoin issuers, limitations on non-euro denominated stablecoins, and a unified authorization regime for the EU’s 450 million citizens. MiCA represents a significant step in increasing regulatory clarity around both stablecoin and digital asset regulation [22], and Circle’s stablecoins are the first global stablecoins that are complaint under MiCA [23].Based on their work to comply with MiCa, Circle’s products are well-positioned to gain adoption in the EU as a leading compliant stablecoin.

Largest Foreign US Treasury Holders. Source [24].

Thus, there is a great incentive for the US Congress to act on stablecoin legislation. A regulated, dollar-denominated stablecoin such as USDC can greatly advance American interests in the digital asset space. USDC’s reserves mandate means that there will always be a natural demand for US Treasuries. As of June 2024, stablecoins are the 18th largest holder of US debt, holding more T-Bills than South Korea or Germany [24]. And as demand for stablecoins and digital assets grows, this number will only increase. In other words, demand for US-denominated stablecoins directly translates into demand for US dollars and US debt. Therefore, it is imperative that Congress increases regulatory clarity for the digital asset space, to further strengthen the power of the dollar in the digital age.

Conclusion

Stablecoins such as USDC have come a long way since their inception just a few years ago, emerging as one of blockchain technology’s most compelling use cases. The core idea of a stablecoin is to bring the interoperability, composability, and accessibility of the Internet to the legacy institutions of money, and USDC leads the way in building a safe and transparent “digital dollar.”

In the next few years, as stablecoin products, adoption, and regulation mature and develop, we can expect millions of businesses and people adopting a new open standard for financial transactions. In this sense, Circle’s mission is to fulfill the unfinished promise of the Internet — to bring the Internet’s openness and transparency to the realm of money to ultimately build an Internet financial system [25].

Thanks for reading the Stanford Blockchain Review! Subscribe to support our work in pioneering a dedicated industry journal for Web3

About the Interviewees

Heath Tarbert

Chief Legal Officer & Head of Corporate Affairs, Circle Internet Financial

Heath is responsible for driving Circle’s vision and business goals forward by leading on a range of global legal and regulatory matters, corporate governance, capital markets transactions, M&A deals and negotiations with financial institutions and governments around the world. Throughout his career, Heath has held a number of top public sector leadership roles, including CFTC Chairman, Assistant Treasury Secretary, and Associate White House Counsel.

Jay Yu

President, Stanford Blockchain Club

Jay, or 0xFishylosopher, is an undergrad at Stanford pursuing a double major in Computer Science and Philosophy. He is President of the Stanford Blockchain Club and founder of the Stanford Blockchain Review. He is currently researching designs for Decentralized Autonomous Organizations (DAOs) and blockchain governance with Stanford Law School faculty. Previously, he worked on research and investments at Pantera Capital.

References

[1] Accessed June 23, 2024: https://coinmarketcap.com/currencies/usd-coin/?update=1719157889899

[2] https://www.circle.com/blog/an-overview-of-usdc-and-circles-stablecoin-infrastructure

[3] https://messari.io/project/usd-coin/profile

[4] https://www.circle.com/en/transparency

[5] https://www.circle.com/en/circle-mint#Institutional-Traders

[6] https://www.blackrock.com/cash/en-us/products/329365/

[7] https://www.reuters.com/business/crypto-firm-circle-reveals-33-bln-exposure-silicon-valley-bank-2023-03-11/

[8] https://www.federalregister.gov/agencies/federal-deposit-insurance-corporation

[9] https://dune.com/thb3100/stablecoin-dashboard

[10] https://www.circle.com/en/multi-chain-usdc

[11] https://developers.circle.com/stablecoins/docs/cctp-getting-started

[12] https://www.coindesk.com/markets/2024/02/12/tether-and-circle-stablecoin-purchases-dominate-in-argentina/

[13] https://www.circle.com/en/pressroom/circle-and-nubank-partner-to-increase-digital-dollar-access-in-brazil

[14] https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.19881.html

[15] https://www.mastercard.com/news/press/2021/july/mastercard-creates-simplified-payments-card-offering-for-cryptocurrency-companies/

[16] https://cointelegraph.com/news/usdc-usdt-stablecoin-dominance

[17] https://www.circle.com/en/case-studies/grab

[18] https://x.com/jerallaire/status/1769696996326068259

[19] https://www.investopedia.com/ach-transfers-what-are-they-and-how-do-they-work-4590120

[20] See Sections 6–7 of USDC Terms: https://www.circle.com/en/legal/usdc-terms

[21] Stablecoin Transparency Act: https://www.congress.gov/bill/117th-congress/senate-bill/3970/all-info

[22] Summary of MiCA by Coindesk: https://www.coindesk.com/learn/mica-eus-comprehensive-new-crypto-regulation-explained/

[23] https://www.circle.com/en/eurc

[24] https://www.coindesk.com/markets/2024/06/20/stablecoin-issuers-now-18th-largest-holder-of-us-debt/

[25] https://www.circle.com/en/reports/state-of-the-usdc-economy

Many thanks to Nelly Mensah, Global VP of Digital Innovation at LVMH and Stanford alumna, for our conversation in March 2024, and for her insights and feedback on this piece.

Introduction

Cover Image: NFTiff Pendant. Source [1].

In the summer of 2022, LVMH made a splash with the NFTiff Pendant, a first-of-its-kind limited edition pendant featuring the iconography of Cryptopunk NFTs. Tiffany & Co. minted a collection of 250 digital passes as part of the NFTiff collection, which were able to be purchased and redeemed by CryptoPunks holders for a custom pendant crafted by Tiffany & Co. with the iconography of the holder’s CryptoPunk [2]. Within each crafted pendant, there are at least 30 gemstones used, including Sapphires, Amethyst, and Spinel, and made with 18k rose or yellow gold, depending on the specific color of each CryptoPunk [2]. With its custom-built design and exclusive offering to Cryptopunk holders, the NFTiff was a daring step towards a whole new world, where luxury fashion intersected with an icon of crypto culture.

Yet, the shiny announcement of the NFTiff is only the tip of the iceberg when it comes to LVMH’s experimentation and innovation in the web3 sphere; behind the scenes, the luxury conglomerate has taken huge strides to reinvent the concept of “digital luxury.” In this article, we will explore a wide range of LVMH’s web3 projects, from the development of Digital Product Passports on the luxury-focused Aura blockchain, to 3D “Digital Twins”, to co-creation communities and beyond. In this process, we will discuss how the conglomerate has expanded their luxury empire into the metaverse, and what this might look like for the consumer of the future.

Digital Product Passports and Aura Blockchain

One of the biggest trends in the digital luxury space is the rise of “Digital Product Passports.” As part of a new sustainability law, the European Union has introduced a Digital Product Passport mandate for all durable consumer goods, with the aim to improve supply-chain traceability, enhance product authenticity, and create a more sustainable consumer economy [3].

Essentially, a “Digital Product Passport” is a digital “identity card” for a given consumer product, created as an NFC chip or QR code embedded in each consumer product that can link to online information about the product’s supply chain details, provenance, and attest to its authenticity. And blockchains, both general-purpose public blockchains such as Ethereum or Polygon, and enterprise-focused permissioned blockchains, have emerged as a major way to implement this Digital Product Passport mandate.

Aura Blockchain Homepage. Source [4].

In 2021, LVMH co-founded the Aura Blockchain Consortium with brands such as Mercedes-Benz, Prada Group, and Cartier to create the luxury-specific Aura blockchain. One of Aura’s missions is to create Digital Product Passport NFTs for its member brands and other well-known luxury retailers [5].

“Here’s how [Digital Product Passports] work in practice. A designer handbag is fitted with a QR code as it leaves the warehouse destined for the store. As well as a QR code, any other type of authentication technology could be used, such as an NFC chip.

When someone buys the bag, they scan the QR code on the item, claim its ownership, easily certify its authenticity and access all of the product information. The certificate of authenticity lasts forever and will always be available digitally. The owner has full control of their data. If they later want to take it back to the store for maintenance, they can prove that the bag hasn’t been found or stolen by demonstrating ownership via the Aura Blockchain Consortium platform. Similarly, bags sold on the secondary market are instantly verified as genuine, obviating the need for checks, and enabling simple transfers to the new owner to ensure they have the same access as the previous owner to the information about the product.”

— Aura Blockchain Consortium, cofounded by LVMH. Source [5].

On the backend, the Aura Consortium maintains the Aura Multi-Token Minter (MTM), which is a platform that allows brands to mint and distribute tokens across multiple blockchains. These tokens include Ethereum ERC-721 standard Non-Fungible Tokens (NFTs), Soul-Bound Tokens (SBTs), Proof of Attendance NFTs, and more. Moreover, since the MTM uses Ethereum ERC-721 and ERC-1155 standards in its minting process, Digital Product Passports and other token assets can be minted across multiple blockchains, from permissioned blockchains such as Aura to public blockchains such as Etheruem and Polygon, with all of the metadata of the Digital Product Passport stored on IPFS [6].

Dior B33 Digital Product Passport. Source [7]

An example of Aura’s Digital Product Passports in action is Dior’s B33 Sneakers. Each pair of these sneakers comes with a DPP that acts as the shoe’s certificate of authenticity, allows the user to gain insights into the shoe’s manufacturing process, and enables the user to receive exclusive updates about Dior’s upcoming sneaker releases. Aura’s Multi-Token Minter implements the B33 Digital Product Passport as an ERC-721 token on Ethereum [8].

Digital Twins as a Medium for “Savoir Faire”

LVMH’s vision for web3, however, doesn’t just stop at Aura Blockchain’s Digital Product Passports. One of LVMH’s goals in the space is to use “digital twins” as a medium of “savoir faire” to convey the historic craftsmanship for each of their luxury brands. This digital storytelling is increasingly important in the context of younger generations, as their first point of contact with a brand is often through digital venues, such as on social media or on a brand’s website.

This is part of the rationale why in June 2023, LVMH announced a partnership with Epic Games, the creator of Fortnite and Unreal Engine, to transform the maison’s creative pipeline with cutting edge rendering technology [9]. From digital twins to virtual fashion shows and 360 product carousels, this strategic partnership will allow LVMH to continue to apply their brands’ storytelling expertise with this new medium of digital collectibles.

Bulgari’s “Beyond Wonder” Digital Jewel

One pioneering example of a “digital twin” is Bulgari’s 2022 NFT jewel series. This series contained two multi-million euro necklaces, the “Magnifica Ruby Metamorphosis” and “Emerald Glory” necklace, both of which give the buyer a physical product and a NFT “digital twin” [10]. In addition, this collection also featured a third not-for-sale jewel called “beyond wonder” which Bulgari claims to be the first pure NFT jewel [10].

Bulgari 2022 NFT Jewel Series. Source [11].

Curated by Japanese artist Azuma Makoto, who is known for his experimental floral and botanical art, the immaculate creative setup of this jewelry collection shows how Bulgari seeks to convey the idea of high luxury within the digital sphere while embracing a spirit of innovation. One of the core ideas behind “Beyond Wonder” is to create an intangible form of art that transcends material boundaries. Thus, this collection powerfully conveys Bulgari’s brand as a bold innovator in high-end luxury that seamlessly blends together heritage with innovation.

Louis Vuitton’s VIA Program

Another more extensive experiment of “digital twins” is Louis Vuitton’s VIA program. In June 2023, Louis Vuitton introduced its VIA program with the debut of its “VIA Treasure Trunk” [12]. Collectors were invited to purchase a $42,000 non-transferrable digital collectible of the iconic LV treasure trunk, which served as a soul-bound token recording membership in the VIA program [12].

Louis Vuitton VIA Treasure Trunk Website and OpenSea page. Sources [13] [14]

Owners of the VIA Treasure Trunk could then participate in exclusive VIP events, for which they also received Proof of Attendance NFTs. This membership token also enabled them to purchase transferable “digital twins” of subsequent physical products in the program, with all of these collectibles being available to sell on secondary markets [12].

Louis Vuitton VIA Products. Source [12] [15] [16]

Over the past year, there have been several products released in the VIA program. First, in July 2023, LV released an exclusive Pharell Williams’ orange monogram “Speedy 40” bag, where the orange colorway was only available to VIA Trunk holders [15]. Next, in November 2023, the maison released a mini-trunk designed by Nicolas Ghesquière for the Spring/Summer 2024 runway, the “VIA Tile Trunk” [16]. Most recently, in April 2024, the program released a third item, a Western-style varsity jacket that appeared on LV’s Fall/Winter 2024 runway [12]. This jacket also marks the VIA program’s first ready-to-wear garment, reimagined as an NFT from the brand. Thus, through the VIA program, Louis Vuitton is reimagining the digital luxury experience, using token-gating as a mechanism to convey a sense of digital exclusivity and brand loyalty.

Hennessy Café 11

Another exploration of brand loyalty is in Hennessy’s Café 11 project, which has sought to create an exclusive community-curated loyalty program. Inspired by the freethinking Parisian cafe culture of the 1920s, Café 11 seeks to curate novel cultural experiences for a digital-first community. This includes communing with artists and cultural icons, attending exclusive in-person events, and a novel culinary experience [17].

Hennessy Café 11. Source [17]

Partnering with the Friends with Benefits DAO, Henessy allowed members of this online community to participate in its creative process, working with New York artist Johnsville to reimagine the iconic Hennessy V.S.O.P. Bottle. Participants in Café 11 were also invited to curated events, such as at Miami Basel 2022 [17]. Thus, Hennessy’s Café 11 may be considered an early experiment of a “Cultural DAO,” where the token-gated community itself becomes a collective of cultural change-makers that take part in shaping a brand’s future.

The Vision of Digital Twins

So, what is the overarching purpose for LVMH’s introduction of digital twins and these web3 community programs? Because there are a wide variety of brands, with everything from handbags to shoes to beverages, there does not really exist a one-size-fits-all method to implement “digital twins” and other metaverse ideas across the board. But there are a few general principles that hold, which provide the rationale for LVMH’s move into the metaverse [18].

For many of LVMH’s products, their value greatly depends on their social symbolism as items of prestige and luxury. This is why there is a consistent emphasis on using these digital tools, such as Unreal Engine, to convey a sense of artisanship and “savoir faire”.

But more importantly, these digital collectibles augment the physical experience of a brand. Many of these experiments, such as LV’s VIA Treasure Trunk or Hennessy’s Café 11, enhance the social experience of luxury for these brands; they connect end users with both the world-class designers and artists behind these brands, as well as with each other. While becoming digital is key to innovating the client journey, we as humans are always naturally drawn towards the fully-immersive nature of physical products, particularly for inherently social luxury products. Thus, what these digital collectibles ultimately seek to do is to bring the client back to the physical, back to the social and experiential nature of these products.

Conclusion: Bringing Your Handbag to Web3

Throughout history, one of fashion’s core traits is that it is a trendsetter and distribution channel, one that can integrate once-fringe products and subcultures into the mainstream — sometimes without even consumers realizing. It is very plausible that in the near future, blockchain technology, such as NFTs and crypto wallets, will be so seamlessly integrated into retail applications that consumers will barely notice the innovation in the backend tech.

So what might the future of “digital luxury” look like, to the everyday consumer of the future?

Louis Vuitton App Screenshots on Google Play Store. Source [19].

Take the Louis Vuitton app, for example. Imagine that in the future, all the handbags displayed here on the digital store are actually represented as NFTs on the backend. When you go and select a bag to buy on the app, you actually connect to a digital wallet in the app. After the purchase, you automatically purchase the product’s “Digital Twin,” an AR-animated digital collectible that you can display, perhaps even show off in a metaverse game or social media platform. When you go to a retail store, showing this digital collectible will allow you to redeem the physical item, as well as be eligible for customer care and other loyalty experiences — such as product shows or co-creation programs.

To take things even further, the “myLV” panel in the app could be technically realized in the future as a noncustodial crypto wallet, where the private keys are stored on your local device and protected by FaceID and other biometrics. Your purchase collection in the “myLV” panel consists of all the “Digital Twin” NFTs to your previous purchases. You can click to view the Digital Product Passport to each one, as well as transact them on second-hand markets with any user that has a crypto wallet through a QR code.

Crucially, all of this integrated wallet UX is possible with current blockchain infrastructure through Wallet-as-a-Service providers. And as these technologies gain greater adoption, perhaps most end-users may not even realize that NFTs and blockchain technology are being used on the backend. One day, at a family dinner, a distant aunt or cousin may just say, “Hey look, my LV handbag is on my phone!” without any idea that what they’re holding up is an NFT.

And perhaps that is the instant when blockchain technology breaks into the mainstream.

References

[1] https://www.voguebusiness.com/technology/tiffany-is-turning-cryptopunks-into-pendants-with-nftiff

[2] https://nft.tiffany.com/faq/

[3] The European Commission’s official notice on Digital Product Passports: https://commission.europa.eu/energy-climate-change-environment/standards-tools-and-labels/products-labelling-rules-and-requirements/sustainable-products/ecodesign-sustainable-products-regulation_en

[4] https://auraconsortium.com/

[5] https://auraconsortium.com/insight/authenticating-luxury-goods-with-blockchain

[6] See Technical Information about Aura’s MTM: https://auraconsortium.com/support

[7] https://www.dior.com/en_us/fashion/mens-fashion/shoes/b33-sneakers

[8] https://www.forbes.com/sites/stephaniehirschmiller/2023/07/06/decrypting-the-strategy-behind-dior-mens-connected-b33-nft-sneakers/?sh=e8dbc3829eae

[9] https://www.lvmh.com/news-documents/news/lvmh-and-epic-games-announce-strategic-partnership-to-transform-maisons-creative-pipeline-and-customer-experiences/

[10] Bulgari’s “Beyond Wonder” Jewel: https://www.voguebusiness.com/technology/emeralds-rubies-and-nfts-inside-bulgaris-new-era-high-jewellery

[11] https://www.vicenzaoro.com/en/news/talking-with-vo/Bulgari-Enters-the-World-of-NFTs

[12] https://jingdaily.com/posts/louis-vuitton-s-usd8k-phygital-jacket-shows-nfts-are-here-to-stay

[13] Feel the full UX yourself: https://us.louisvuitton.com/eng-us/stories/louis-vuitton-via

[14] Louis Vuitton VIA Treasure Trunk on OpenSea: https://opensea.io/collection/via-treasure-trunk-lv

[15] https://jingdaily.com/posts/louis-vuitton-pharrell-williams-speedy-40-valentino-web3

[16] https://jingdaily.com/posts/louis-vuitton-7k-ghesquiere-phygital-mini-trunk

[17] https://hennessy.cafe11.xyz/

[18] https://www.nftparis.xyz/blog/fireside-chat-with-nelly-mensah-vp-of-digital-innovation-at-lvmh

[19] Louis Vuitton App on the Google Play Store: https://play.google.com/store/apps/details?id=com.vuitton.android&hl=en_US

This article is a general overview into Digital Product Passport NFTs and the luxury industry at large. For a case study of how this is applied in the case of LVMH, please view this sister article here.

Many thanks to Pierre-Nicolas Hurstel, CEO and Cofounder of Arianee Protocol and Phoebe Beigbeder, Cofounder of NFTParis and Consumer Investor at Greenfield Capital for conversations and insights. This article would not have been possible without it.

Introduction

From esoteric designs to exorbitant price tags, the luxury industry is no stranger to controversy. And as the new crypto economy churns millionaires by the day and sells NFTs for millions of dollars, this centuries-old industry seems to have found a new partner-in-crime — at least in terms of causing a stir.

In this article, we will present a comprehensive thesis on the future of luxury fashion in web3, from digital product passports, to enhanced loyalty programs, to wallets as a service. Starting with an exposition of the EU’s recent “Digital Product Passport” law, we will see what it means to live in a world where every luxury consumer item, from watches to handbags, has an on-chain digital identity as a Non-Fungible Token (NFT), and how this may represent a tipping point in blockchain adoption. Finally, I conclude with a reflection on NFTParis as a convention that brings to life all of these innovations, and an paradigmatic example of how to pioneer a new consumer economy.

Digital Product Passports: Blockchains as an Infrastructure for Authenticity

It all starts with a law. Recently, the European Union has announced that all fashion goods and other consumer products need to be fitted with “Digital Product Passports” (DPPs) by 2026 in order to improve supply-chain traceability, enhance product authenticity, and create a more sustainable consumer economy [1]. As its name suggests, a DPP is basically an “identity card” for each consumer product, printed as a QR code tag (or NFC chip) on each consumer product that can link to online information about the product’s supply chain details, provenance, and attest to its authenticity.

Although DPPs can be technically realized in many different ways, such as by reading directly to a centralized database, one of the most popular ways is to use a blockchain-based backend infrastructure to realize these DPPs [2]. There are several key advantages that blockchain-based solutions offer over database solutions:

1. Standardization and Interoperability: In a centralized database approach, companies need to design different schemas for their different products, resulting in a lack of interoperability and high overhead. Adopting a blockchain-based standard, such as the Ethereum ERC-721 standard for Non-Fungible Tokens (NFTs) allows for a simple, intuitive, and interoperable interface to implement DPPs.

2. Transactability and Ownership: There is not really a notion of ownership of DPPs using a centralized database, and it is almost difficult to track transactions of the products on secondary markets. Public blockchains, on the other hand, provide a mature ownership structure for users to “own” Digital Product Passports and trade goods on secondary markets. This is especially important for durable goods and luxury products such as designer handbags, shoes, and watches, which have mature second-hand markets.

3. Provenance and Authenticity: Public blockchains, through their immutable nature, provide a traceability that can be used to guarantee the authenticity of the product, as well as its use throughout the supply chain. Post sale, this provenance history and guarantee of authenticity also allows for a safer second-hand market, with the publicly viewable blockchain DPP allowing the buyer to digitally verify the authenticity and provenance of the product [3].

Take, for instance, Panerai, an Italian luxury watchmaker with over 160 years of history. Since October 2023, every Panerai watch sold globally is equipped with a blockchain-based Panerai Digital Passport — essentially an NFT of the physical watch. Recorded on this Panerai Digital Passport NFT is each watch’s unique product and ownership history, technical details, and tamper-proof authentication of the moment of purchase [4]. Every Panerai consumer can collect an NFT of their watch by simply scanning the watch’s serial number QR code, and all consumers that collect this NFT become eligible for an extended international warranty protection of 8 years [6].

This Panerai Digital Passport NFT is implemented on the backend by Arianee Protocol, which makes blockchain-based Digital Product Passports for durable goods using the popular Ethereum ERC-721 standard [7]. These ERC-721 DPPs adopt one of the most common standards for NFTs (Non-Fungible Tokens), and are thus able to be fully transactable and interoperable with any blockchain running the Ethereum Virtual Machine (EVM) and can benefit from the years of open-source infrastructure that the NFT community has built in streamlining transactions, marketplace infrastructure, and enforcing creator royalties. All this, as well as Arianee’s decentralized governance structure in conjunction with various brand partners [8], allows Arianee’s Digital Product Passport NFTs to stay true to the blockchain ethos of being disintermediated, transparent, and preserving privacy at its core.

Arianee Protocol is not the only technical route for luxury brands to create blockchain-based Digital Product Passports (DPPs). LVMH, the world’s largest luxury retailer, for example, has cofounded the Aura Consortium, a group that develops a luxury-focused blockchain solutions and standards, including for Digital Product Passports. Brands have the option to either create Product Passports on Aura’s permissioned blockchain, which offers more regulation and control for individual brands, or on a public blockchain, such as Etheruem, as Aura’s Multi-Token Minter (MTM) is also primarily based on the ERC-721 standard, and so is compatible with any public blockchain that runs on the Ethereum Virtual Machine (EVM) standard [9].

Product Passport NFTs as a Digital Primitive: Reinventing the Social Experience of Luxury

Product Passport NFTs are more than just on-chain “washer-tags” for our existing handbags. Instead, they represent a new digital primitive for digital luxury. Crucially, Digital Product Passports act as a digital link between the brand, the physical product, and the end consumer [10]. Their real power is in reimagining the social experience of luxury in an increasingly digital world. In this section, we will explore three specific use cases in which Product Passport NFTs act as a new primitive to enhance the luxury experience in web3: (1) token-based loyalty programs, (2) projecting metaverse “flex power”, and (3) wallets-as-a-service for mass adoption.

1 — Token-Based Loyalty Programs

The luxury industry is uniquely suited for a token-based loyalty program for two reasons: (1) because of the thriving secondary market, and (2) because luxury’s value proposition depends on a perception of exclusivity and social signaling. Token-based loyalty programs, anchored on Digital Product Passports, address exactly these two problems for luxury retail brands.

Consider, for example, the case of gifting and secondary sales of luxury handbags. Because of the widespread nature of second-hand sales, gifts, and transfers of these luxury products, traditionally it can be incredibly difficult to differentiate between the initial buyers of a product and the actual users of the product. If Bob buys a handbag for Alice as a birthday gift, it is difficult for the retailer to know that Alice is the end consumer, as the retailer would only know that Bob swiped the credit card.

With a Digital Product Passport, however, Alice can leverage the NFC chip inside of the handbag once Bob gives her the handbag. This can then open the retailer’s app, and allow the retailer to target Alice with loyalty programs around this handbag. If Alice sells this handbag to Charlotte on a second-hand market, she can just transfer the handbag’s Product Passport NFT to Charlotte, and the retail brand can now target Charlotte with the relevant loyalty programs.

Swiss luxury watchmaker IWC Schaffhausen demonstrates how a novel loyalty program might look like, centered around Arianee Protocol’s Digital Product Passports [12]. To join the IWC “Diamond Hand Club,” a consumer simply needs to buy an IWC watch with a Product Passport NFT, which they can then activate by scanning a QR code. This will give them a certain amount of “points,” and users can gain points by participating in various online and offline loyalty events that IWC hosts. Based on the number of points that a user has, they are eligible to various member events, including watchmaking masterclasses, an exclusive meetup with the CEO of DC Studios, and a dedicated trophy.

Thus, IWC Schaffhausen’s “Diamond Hand Club” provides us with a glimpse of how Digital Product Passport NFTs can be used to bootstrap a wholly new consumer experience — one that enhances a brand’s sense of exclusivity and prestige targeted for a selection of dedicated “superfans”. In the future, it is easy to imagine that these “superfans” can self-organize events token-gated by an NFT of their luxury watch to create a new form of collector DAO (Decentralized Autonomous Organization).

2 — Projecting Metaverse “Flex Power”

Nonetheless, reimagined loyalty programs represent the first look of a new, digitized social luxury experience. Fundamentally, many luxury products derive their value from a “flex power,” creating a social signaling of prestige and clout. As online venues gain greater importance as social venues, there is an increasing demand for online “social flexing” — this is the idea of luxury in the metaverse.

Importantly, the “metaverse” defined here doesn’t necessarily need to be the cliché all-immersive digital world brought to you by brick-like goggles strapped to your forehead. It merely refers to an online venue or platform where users demonstrate complex social behavior — such as a social media platform (eg. Instagram), an online game world (eg. Roblox), or an online marketplace (eg. OpenSea). Product NFTs represent one of the best ways to amplify a brand’s social signaling power online, as the NFT essentially acts as an “ambassador” for the brand in the metaverse.

An early prototype of this type of token-powered “metaverse” is The Sandbox Game, which released Sandbox Alpha in 2021. This is an open game of User Generated Content, where users can buy plots of land (represented as ERC-721 NFTs) using SAND tokens. Once a user buys these plots of land, they’re able to create assets (represented as ERC-1155 tokens), and creating scripting logic to bind these games together. Thus, users are able to use a variety of on-chain primitives, such as NFTs and tokens, to create completely new virtual experiences.

Of course, it is not only individual users that are able to create tokens, resources, and games using The Sandbox’s platform. Over the past few years, The Sandbox has emerged as a major online social venue for major brands and pop culture icons, including Gucci, Adidas, Snoop Dogg, Deadmau5, and Steve Aoki [14]. For brands, The Sandbox represents an easy way to extend their social influence from web2 to web3 and experiment with a new form of digitization of the brand experience.

Product Passport NFTs have a natural synergy with metaverse platforms such as The Sandbox, as they represent asset primitives around which brands can build a metaverse experience using tools such as The Sandbox. For example, the Product NFT of my Gucci handbag may allow me to access special games, perks, and assets within the “metaverse booth” that Gucci has set up in Sandbo. Or, perhaps a Product NFT of an IWC watch will make me eligible to buy premium Sandbox land at a discounted price.

Indeed, the unique feature of Product Passport NFTs is that they are programmable digital assets with a real world link — one that can really combine the tangibility of a real-world luxury item with the infinite programmable possibility. And in turn, this will allow physical luxury items to extend their “flex power” into the digital social world.

3 — Wallets-as-a-Service

The growth of Product NFTs as a new digital primitive will likely also lead to an explosion in demand for Wallet-as-a-Service providers. After all, when there’s an NFT, there needs to be a wallet available to store this NFT.

Traditionally, web3 wallets, especially non-custodial wallets such as MetaMask, have been long criticized for their poor user experience (UX), which may partially explain their relatively limited adoption. After all, one cannot expect everyone to be self-custodying 24-word seed phrases for an inexplicable, marginal benefit.

On the other hand, Digital Product Passports are expected to be implemented on all durable consumer products in the European Union by 2026. This means that within 2 years, all 450 million EU residents will need to be able to somehow know how to navigate wallets and NFTs. Therefore, one of the biggest criteria and challenges for Product NFT wallets is that they need to have a seamless UX for the end user. Ideally, the wallet for Product NFTs should be so smoothly integrated into existing sites, apps, and accounts such that users will not perceive any UX difference. The user should be able to login with their existing retailer accounts with an email and password, and automatically have access to their crypto wallet with all of their handbags as NFTs — an “integrated wallet”.

Wallet-as-a-Service providers realize this vision of an “integrated wallet.” For example, Arianee Protocol develops their own Wallet-as-a-Service solution to help brands adopt their standard for Digital Product Passports inside an integrated UX flow, and has pioneered this at scale with Breitling, IWC, Panerai, and Moncler [16]. For example, Arianee allows Moncler to integrate a custodial crypto wallet directly in their mobile app in order to store the Digital Product Passport NFTs of certain Moncler jackets. Moreover, these Moncler NFTs were also interoperable with various blockchain and metaverse platforms, including being viewable on the OpenSea marketplace and usable in The Sandbox Game.

Another technical route to creating these consumer wallets at scale include using a non-custodial Wallets-as-a-Service solution such as Magic or Passport Protocol. Unlike Arianee’s custodial wallets, which rely on the retail brand to safeguard consumers’ wallets, these non-custodial Wallet-as-a-Service providers allow for a system of more securely storing users wallets. Through using decentralized key management systems and algorithms — such as the Delegated Key Management System (DKMS) for Magic and Multi-Party Computation (MPC) for Passport Protocol — users do not have to safeguard their own seed phrases and passkeys, and can rely on social recovery mechanisms similar to traditional “Forgot my Password” systems [17] [18].

These advanced key management systems of Wallet-as-a-Service providers allow for the benefits of an integrated UX and flow of a traditional consumer app with increased security properties. With these technologies, all that a customer needs is just an email address and login, and suddenly, they too have a crypto wallet, all within the UX of an existing retail app.

NFTParis: Pioneering a New Consumer Economy

So what might luxury and fashion look like in web3, where the physical and the digital asset interoperate and mirror each other? I myself was fortunate enough to attend NFTParis, one of the premier consumer crypto conferences in Europe, held in late February 2024.

Unlike many other conferences that are primarily targeted towards a crypto-native audience and developers, NFTParis presented a vision of crypto tightly integrated with traditional retail and consumer products, with NFTs as a sociotechnical medium to bridge these two different worlds. And fashion played a crucial role in this sociotechnical vision of the future.

For example, at the conference, there was a fashion walk, where live models demonstrated clothing that were available to purchase and collect as NFTs, and other pieces that were inspired by web3 game assets. Large sections of the conference also featured NFT artwork and galleries by practicing digital artists that minted and sold their artwork as NFTs. Panels throughout the conference also included a strong emphasis on the future of digital fashion, including discussing the integration of DPPs, generative AI art, and wearable technology with the fashion industry [20], with speakers at the event ranging from global fashion brands such as LVMH and Sephora, to game studios such as Roblox and Ubisoft, to a host of web3 companies in the consumer and fashion space, including Arianee, Art Blocks, and 9dcc [21].

For me, perhaps the biggest takeaway of NFTParis was that a lot of the advances that we’ve been discussing throughout this article, from product passport NFTs to revamped loyalty programs to wallets as service, are not just theoretically possible; they are already being piloted today, by both global brands and newcomers in the space. Even during the week, there were several fashion product unveils, such as American denim label Wrangler’s experimental collaboration with digital wearables brand MNTGE, featuring Wrangler vintage western shirts embedded with digitally-signed NFC chips that recorded the garment’s product history on-chain [22].

All this serves as a testament to NFTParis’ commitment to integrating blockchain technologies, such as NFTs, with broader consumer culture — a part that is often neglected in crypto-native communities. Indeed, whereas many crypto-native communities are still preoccupied with niche, jargon-laden infrastructure trends, the world of digital fashion is quietly edging towards mass consumer adoption, and use-cases that may ultimately build a completely new consumer economy.

Conclusion: Product Passports as a Product Market Fit for NFTs

For a long time, the crypto community has debated on how to find a “product market fit” for tokenized technologies. In discussing how to build a “killer application” that onboards millions of users, many people in the industry look towards crypto-native games, social media, or other variants of “X-to-earn” opportunities using sophisticated token technologies.

But I argue that the “killer application” — especially for NFTs — may be much more mundane than this tokenomics wizardry. The European Union’s Digital Product Passport mandate is expected to come into full effect in 2026 [23]. Whether intended or not, this law may in fact provide a strong product-market fit for consumer NFTs. As outlined above, blockchain-based Digital Product Passport implementations yield material advantages over traditional databases for standardization, transactability, and provenance. Combined with the luxury industry’s existing experiments with tokenized technologies and the overarching movement towards a new conception of “Digital Fashion,” it is very possible that Product Passport NFTs will become a new digital primitive, on top of which we will see a reimagined consumer experience — whether it be NFT-based loyalty programs, a luxury experience in the metaverse, or through integrated wallets in consumer apps.

Thus, mass consumer adoption of blockchain technology may be much closer than you think; luxury watches and designer handbags may in fact become the “killer app” for NFTs — perhaps all within the next two years. As more retail brands comply with EU regulations and create DPPs on blockchain rails, we may well see luxury retail become the distribution channel for mass consumer adoption, and ultimately “mint your watch as an NFT.”

References

[1] The European Commission’s official notice on Digital Product Passports: https://commission.europa.eu/energy-climate-change-environment/standards-tools-and-labels/products-labelling-rules-and-requirements/sustainable-products/ecodesign-sustainable-products-regulation_en

[2] A BCG report on using tokens to instantiate DPPs: https://www.bcg.com/press/15february2023-european-digital-product-passport-from-yet-another-constraint-to-a-consumption-revolution

[3] https://www.arianee.com/use-cases/panerai

[4] https://www.panerai.com/us/en/service/customer-service/digital-passport.html

[5] Image Source: https://www.arianee.com/digital-product-passports-for-watches

[6] https://services.panerai.com/en/register/manual

[7] https://docs.arianee.org/docs/arianee-project

[8] https://www.arianee.org/association

[9] See Technical Information about Aura’s MTM: https://auraconsortium.com/support

[10] https://auraconsortium.com/insight/the-digital-product-passport-a-new-era-of-luxury-unveiled

[11] See https://nft.iwc.com/

[12] https://www.arianee.com/use-cases/iwc-diamond-hand-club

[13] https://medium.com/sandbox-game/what-is-the-sandbox-850de68d893e

[14] https://www.musicbusinessworldwide.com/warner-music-group-sandbox-video-game-notorious-b-i-g/

[15] https://www.sandbox.game/en/map/?lat=-40&lng=-13&zoom=2&x=3&y=-39

[16] https://www.arianee.com/use-cases/moncler

[17] https://magic.link/docs/home/welcome

[18] https://blog.0xpass.io/p/introducing-passport-protocol-programmable

[19] https://magic.link/enterprise

[20] https://www.nftparis.xyz/blog/path-to-mainstream-the-digital-fashion-journey

[21] https://www.forbes.com/sites/stephaniehirschmiller/2024/02/25/nft-paris-blockchain-and-the-commercial-imperative-for-retail/?sh=7eb9222c7151

[22] https://www.forbes.com/sites/stephaniehirschmiller/2024/02/26/nft-paris-how-technology-is-shaping-cultural-marketing-and-circularity/?sh=58b7cef84dad

[23] https://blog.worldfavor.com/the-eus-new-digital-product-passport-dpp-everything-you-need-to-know

Note: This article is a long-form exploration of the discussions and ideas between myself and Chris Dixon, General Partner of a16z and head of a16z crypto on his new book “Read Write Own”, conducted in January 2024.

Full Interview:

Published: Stanford Blockchain Review

Introduction

The Internet is arguably one of the most important inventions of the post-war era, and a technology that makes much of the comforts of modern life possible. Despite beginning as an open and non-profit network, much of the Internet’s value today is captured by a handful of big tech companies such as Google, Meta, and Amazon. Within “Read Write Own,” however, we present a vision of blockchains as a new turning point in the Internet’s evolution [1].

In this article, we will explore some of the major themes within “Read Write Own,” such as situating blockchains within the broader context of Internet history and network economies, discussing the importance of “tokens” as a new digital primitive, the relationship between “casino culture” and “computer culture” in the crypto space, as well as how blockchains reinvent the idea of digital ownership. In doing so, we will show how by giving value back to users, creators, and entrepreneurs at the “edges” of the network, blockchains represent a technological breakthrough that redefines ownership dynamics to unlock new possibilities for innovation.

Network Economies and the History of the Internet

To understand blockchains’ technological and cultural significance, we need to place them in the context of broader Internet history. Fundamentally, what we call the “Internet” today is an intricate “network of networks,” built up of several layers of network protocol technologies that form the “Internet Protocol Stack” [2]. This reaches from the basic network transfer protocols, such as IP, or the Internet Protocol, to application-layer network protocols such as SMTP (Simple Mail Transfer Protocol) for email or HTTP (HyperText Transfer Protocol) for the World Wide Web [2], to the even more abstracted social networks within specific applications themselves, such as for Facebook and X (fka. Twitter).

Much of the value of the Internet — such as our social networks, our financial histories, and medical records — are all recorded and captured on these interlocking network structures. Thus, to understand the modern Internet, we need to understand network design, since the way these networks are designed directly affects how money and power flows through the network system.

Before the advent of blockchain technologies, there were two primary designs of network economies: protocol networks and corporate networks.

A protocol network is defined by a set of open-source rules that describe how different participants in the network interact with each other. As the protocol is completely open-source, any of the participants easily bootstrap applications using this code and all the value accrues to the participants of the protocol, rather than any centralized entity charging exorbitant fees for network use. Like all networks, the value of a protocol increases as more participants enter into the network. One of the most classic examples of protocol networks is RSS, or the Really Simple Syndication protocol, which is an open-source web feed format that allows users to subscribe to content from other users and websites that they follow [3]. This open-source protocol was frequently used to subscribe to content outlets such as blog entries, news headlines, and podcast episodes.

A corporate network, on the other hand, is a closed-source network, such as Facebook or Twitter, where a single company designs, maintains, and distributes the network in order to advance its own corporate interests. Although many of these corporate networks support APIs and an ecosystem of outside developers and creators on their platform, their interests are secondary to the profit-seeking motives of the core company. As such, many of these corporate networks have incredibly high “take rates,” where the vast majority of the value that creators, developers, and other users on the network accrue to the platform, rather than to the users themselves.

As the modern Internet has matured, we’ve systematically seen closed corporate networks, such as Facebook or Twitter outcompete open protocol networks such as RSS. Twitter, for example, actually started out as an easy-to-use front-end built to support RSS, but gradually users began to solely rely on Twitter’s platform and network rather than that of RSS. Eventually, Twitter completely supplanted RSS in popularity, and the company decided to end its support for RSS feeds in 2013.

One of the core reasons why these corporate networks are able to take advantage and supplant these open protocol networks is because they are incredibly well-funded and are well designed to put forward their own strategic interests. Platforms such as Amazon, YouTube, and Uber, for example, are more than happy to initially suffer losses to subsidize their growth and attract users to their platform. Many protocol networks, on the other hand, lack systematic funding for continued development and maintenance of the project because of their decentralized nature, with many developers maintaining the network out of pure goodwill. Thus, these open protocol networks cannot hope to compete with the “war-chest” of a corporate network. All this has greatly undermined the Internet’s founding ethos of being an open, public space to share and advance knowledge for all.

Tokens, Computers, and Casinos

Blockchains, on the other hand, introduce a new form of network economy, one that combines the openness of protocol networks with the funding mechanism that allow them to compete with the teams of corporate networks. This is done so through the introduction of “tokens” as a new primitive to represent both a unit of ownership and a unit of value within a blockchain application.

Consider Bitcoin, the oldest and most well-known blockchain project. The Bitcoin blockchain essentially acts as a massive, decentralized “ledger” (similar to an Excel spreadsheet) that permanently records all financial transactions on the network [4]. This big “ledger” is maintained and replicated on millions of computers around the world called “miners” or “validators” on the network, who are rewarded for their work in maintaining this ledger through Bitcoin “tokens,” with the specific rewards determined through an algorithm known as “Proof of Work”. Essentially, Bitcoin “tokens” (BTC) serve as both a unit of value and a metric of ownership to incentivize participants of the network to act in a particular way, such as maintaining the financial ledger through the “Proof of Work” algorithm [5].

Tokens provide a flexible framework to coordinate behavior on a mass scale — we can easily switch out Bitcoin’s “Proof of Work” reward algorithm for another algorithm in different applications. Ethereum, for example, uses a “Proof of Stake” algorithm to extend Bitcoin’s Excel-like decentralized ledger into a fully Turing complete global computer. All this creates a new discipline in the blockchain industry known as “tokenomics,” which incorporates elements of computer science, economics, and game theory to design effective token-reward systems for blockchain applications.

Unfortunately, the idea of “coins” and “tokens” in crypto often brings to mind negative connotations and the stereotypical depiction of crypto as nothing more than an unregulated online casino. Although there are many cases of bad actors within the blockchain space, such as Terra founder Do Kwon and FTX founder Sam Bankman-Fried who exploit the industry’s novelty to perpetuate fraudulent schemes, this caricature of the crypto space obscures the real innovations and technological advancements in the industry.

Roughly speaking, crypto can be characterized as having two distinct cultures: the “computer” and the “casino.” The “computer culture” represents the developers, entrepreneurs, and visionaries that can situate “crypto” within the broader history of the Internet and understand blockchains’ technological significance in the long run. On the other hand, the “casino” culture is much more focused on short-term gains and profiting from price fluctuations.

It is our hope that with greater regulation and increased legal clarity, it is possible to mitigate the myopic and harmful effects of “casino culture”. One potential solution could be to make great use of vesting schemes and time horizons, locking up tokens for some specified amount of time either through technical means such as staking or through traditional legal means such as contracts. In turn, this could promote more long-term thinking in the space and thus promote blockchain technologies as a force for social good.

Reinventing Digital Ownership

The key to promoting a healthy, vibrant culture in the blockchain industry is to harness the power of “computer culture” within the crypto movement. Fundamentally, tokens allow blockchains to redefine the concept of ownership on digital networks. For many blockchain projects, such as Bitcoin and Ethereum, there is no single person or company that “owns” the network, as whoever owns the token of the network, such as ETH or BTC, is the owner of the network, and all the code of the protocol — such as the algorithms determining the distribution of token rewards — is open source.

As such, blockchains are a natural inheritor of the open, collaborative spirit of protocol networks. At the same time, because tokens such as ETH and BTC represent units of value that can be exchanged for real money, participants on blockchain networks are also able to fund project development and maintenance to compete with corporate networks.

Already, we’ve seen the potential of harnessing “tokens” and other blockchain technologies as a force for social good and giving back to a community. Helium, for example, rewards its users with HNT tokens for setting up wireless hotspot hubs to provide wireless connectivity, allowing communities ignored by traditional internet service providers Internet access [6]. Through the deft use of token incentives, Helium is able to bootstrap an interconnected network of hotspot hubs, to enjoy network effects. This is an exemplary case of how tokens allow much smaller companies to overcome the traditional “cold start problems” and disrupt much larger incumbents, such as traditional Internet service providers. As the project matures, users with HNT tokens are also able to actively participate in the governance of the protocol and allow these early adopters to have a voice in the future directions of the project.

Thus, blockchains structurally redefine the concept of digital ownership, redistributing the profits of a network back to the users and communities that created this value in the first place. Through creating a novel incentive structure for network participants on open protocols, blockchains disrupt the “winner-takes-all” model of “corporate networks”, and return the Internet back to its original free, decentralized, and democratic values.

Protocol, Corporate, and Blockchain Networks. Source [1].

The Future of Blockchains

Today, we’re at an inflection point in the crypto space. Over the past few years, there has been systematic improvement in blockchain infrastructure and technologies on numerous fronts, such as the advance of zero knowledge proofs, modular blockchains, and interoperability solutions. In the same way that underlying improvements in GPUs paved the way for the “killer app” of ChatGPT, we believe that blockchain infrastructure may soon enable the advent of a “killer app” in the crypto space, one that serves as an “iPhone moment” in its significance for wider adoption.

As the crypto industry turns over a new leaf over the previous series of collapses over the past year and a half, we look forward to seeing the diverse array of new blockchain projects that may arise, such as novel social networks, games and the metaverse, open-source financial infrastructure, and a new AI-centric creator economy that will drive forward the next stage of the Internet’s evolution.

Ultimately, blockchains today represent a frontier in computing, just as the Internet once was in the 1990s. Unlike other frontier technologies such as AI and VR/AR, which primarily benefit and sustain the hegemony of big-tech incumbents, crypto represents a true disrupting force that redistributes value back to the edges of a network, empowering the creators, users, and participants of a network to become true owners of a protocol and building a new “Read, Write, Own” economy in the digital realm.

References

[1] Images and content from the book READ WRITE OWN by Chris Dixon. Copyright © 2024 by Chris Dixon. Reprinted by arrangement with Random House, an imprint of Random House Publishing Group, a division of Penguin Random House LLC. All rights reserved. Find out more about Read Write Own: https://readwriteown.com/

[2] https://dev.to/tsuarez/the-internet-protocol-stack-o01

[3] https://rss.com/blog/how-do-rss-feeds-work/

[4] See Bitcoin Whitepaper: https://bitcoin.org/bitcoin.pdf

[5] https://www.ledger.com/academy/blockchain/what-is-proof-of-work

[6] https://a16zcrypto.com/posts/announcement/investing-in-helium/

Published: Stanford Blockchain Review

Introduction

From wrestling with bytecode on Etherscan to guarding against all sorts of code exploits in Solidity, the EVM tech stack of blockchain development is quite different from that of a web2 tech stack for many developers, thus creating a “gap” between the Solidity-EVM tech stack and the mainstream languages such as Rust, C++, or Python. As the blockchain space continues to mature, there is a great need to bridge this developer gap and allow for a much more composable web3 development.

Within this article, we will introduce Offchain Labs’ latest project, Arbitrum Stylus, unveiled at the Blockchain Applications Stanford Summit (BASS) conference during Stanford Blockchain Week. Arbitrum Stylus is a landmark project that aims to create a new standard for smart contract composability through unifying the execution environment of the EVM with that of WASM. First, we will discuss some of the motivations behind this project, before diving into some of the project’s implementation details, and finally discussing the project’s impact in the web3 space.

Motivation for Arbitrum Stylus

Arbitrum Stylus was developed to address two key problems in blockchain development: (1) the accessibility of blockchain development, and (2) the executional efficiency of smart contracts.

Making Blockchain Development more Accessible

Developer Report by Electric Capital. Image from Source [1]. Retrieved Oct 20 2023

According to Electric Capital’s Developer Report, there are currently around 20,000 monthly active blockchain developers [1]. Although this number has greatly increased over the past few years, it is still orders of magnitude behind the millions (or tens of millions) of developers that mainstream general-purpose languages such as Rust or C++. As the blockchain space continues to grow, there is an increasing need to streamline the process for onboarding millions of new smart contract developers.

One of the best ways to do this is through integrating the smart contract development process with existing mainstream languages, such as Rust or C++. This is the approach that many non-EVM ecosystems, such as Solana and Cosmos have adopted, with Rust emerging as the de facto smart contract language in those ecosystems. The EVM ecosystem, until now though, primarily relies on its own distinct programming language Solidity to write smart contracts. Arbitrum Stylus, however, seeks to change this through allowing blockchain developers to write smart contracts in mainstream languages such as Rust and then deploy on EVM-compatible chains.

Making Smart Contract Execution more Efficient

Over the past few years, as decentralized applications have exploded in popularity, there has been a dramatically increased demand for on-chain computation, especially on the Ethereum network. This spike in network demand has led to exorbitant gas prices. This in turn has spurred a flurry of innovation in increasing the transactional throughput of public blockchains, and Arbitrum is one of the most prominent projects and ecosystems in this space. This includes the flagship Arbitrum One L2 chain, as well as the Arbitrum Nitro tech stack.

Arbitrum Stylus is a natural extension of all these and the latest solution in Arbitrum’s toolkit. Compared to previous solutions, which focus on optimizing the inter-transactional efficiency of transactions (such as batching transactions through rollups), Stylus focuses on optimizing the intra-transactional level — specifically, how each transaction is executed. Through allowing contracts to be executed in WebAssembly (WASM), Stylus contracts are an order of magnitude faster, promising lower gas fees, as well as having access to memory that can be up to 100–500x cheaper than using the EVM [2].

Stylus: Providing WASM + EVM Composability

WebAssembly and Arbitrum Nitro

To understand why Stylus is so much more efficient and composable than a traditional EVM engine, we need to first understand the role of WebAssembly, or WASM. WASM is a form of assembly language, which means that it is essentially machine-readable binary code, rather than human-readable languages such as Rust or C++. Instead, these human-readable languages need a “compiler” to transform them into machine-readable “assembly languages” before they are executed.

WASM in particular, as its name suggests, is an assembly language optimized for web browsers, to increase the executional speed of primarily Javascript-based Web applications. By being a portable, modular and easily executable assembly language, WASM allows developers to directly write code snippets in a variety of mainstream languages, such as Rust or C++ [3].

With Arbitrum’s Nitro upgrade, because all disputes on-chain are played out in WASM, this means that Nitro has a working fraud system for any arbitrary WASM [2]. And because Arbitrum Nitro is able to provide fraud proofs for any WASM code, this means that it can provide fraud proofs for any program that compiles down to WASM.

Arbitrum Stylus primarily adds a WASM execution engine on top of this existing WASM fraud prover inherited from Arbitrum Nitro, based on one of the leading WASM engines called Wasmer, which executes code much faster than Geth executes EVM bytecode [2]. With both an execution engine and a proof engine, this enables smart contracts to be completely written, executed, and proved in WASM. Given that many mainstream languages, such as Rust and C++ are able to compile directly into WASM, this in turn is how Arbitrum Stylus allows blockchain developers to write, deploy, and execute smart contracts in a wide variety of mainstream general-purpose languages.

Comparing the EVM with Stylus EVM+. Image from Source [2].

Coherence in the EVM+ Engine

Arbitrum Stylus provides developers with the extra option to write contracts in Rust and other WASM-compatible languages, without having to sacrifice the ability to write and execute smart contracts in Solidity. By having two co-equal executional engines of the EVM and WASM, Stylus also provides developers with the option to write part of their application in Solidity, and another part in Rust.

This, however, raises a question: how does the Stylus VM manage the coherence between the two different engines? How does it know when to switch between EVM and the WASM VM?

Firstly, Solidity and other EVM-based contracts are compiled into the same bytecode, then executed as they normally would in a pure EVM engine. WASM-based smart contracts, such as those written in Rust for example, will be annotated by an extra “header” at the beginning of the contract. Thus, when these contracts are called, the Stylus VM is able to tell which contracts require the EVM engine, and which contracts require the WASM engine. This design also accounts for a large degree of interoperability, where contracts written in WASM can make calls to contracts written in Solidity, and vice versa. This is also the main way in which Stylus differs from other blockchains that have adopted WASM execution engines: Stylus ensures that WASM contracts are completely composable and interoperable with EVM ones, allowing for backwards compatibility and WASM contracts to tap into EVM liquidity.

Another perspective to look at Stylus’ dual engine of EVM and WASM is to see the blockchain as a “world state machine” that undergoes certain state transactions as defined in the EVM. In Ethereum, the on-chain state is represented through a Trie-structure, or a tree-like data structure used to store and retrieve data efficiently [4]. Both Stylus’ EVM and WASM engines use the same Trie-structure to read and write data to and from the “world state machine.” Both engines produce some given state change to update the world state; the only difference is how they compute this state change.

Cost Savings of the EVM+ Engine

Previously, we’ve already hinted that using the WASM engine can allow for substantial cost savings due to the increased executional efficiency. We can now examine how this is achieved. To do so, let’s consider a single ADD instruction, say for 2 + 3.

In the EVM, we would need to do the following steps [5]:

1. Pay for gas, requiring multiple look-ups of an in-memory table

2. Consider tracing, even if disabled

3. Pop two items of the simulated stack

4. Add them together

5. Push the result

We can see that only Step 4 really involves the addition of these two integers, whereas all the other steps are “boilerplate instructions” within the EVM system that all cost exorbitant amounts of gas relative to the calculation itself.

On the other hand, suppose we used WASM for this simple ADD operation. We only need one step:

1. Execute a single x86 or ARM ADD instruction

Comparison of EVM ADD and WASM ADD. Image from Source [7].

We can see here that this is 150x cheaper than the EVM add. Given all these gas savings, Stylus VM has even introduced a new subunit of “gas,” called “ink,” currently defined by default as 1/10000 of 1 gas, and even configurable by the chain owner [5].

There is, however, one caveat to all these gas savings, namely, it requires gas to activate the Stylus VM in the first place, currently set to a fixed rate of 114 million gas. In addition, calling a Stylus program itself currently takes about 128–2048 gas [5]. Thus, activating the WASM environment just to optimize for a single ADD operation for two integers may not necessarily make economical sense. However, for smart contracts that are memory-intensive, all these savings will compound, offsetting this “activation cost.” For example, a call that allocates 3.8 MB of RAM in the EVM would cost ~32 million gas, whereas in the Stylus WASM VM this would only cost ~64 thousand gas, providing a saving of 500x [6]. A corollary to this is that memory-intensive applications are simply not possible on the vanilla EVM, as one quickly runs up against all sorts of gas limits. However, this becomes completely possible in the Stylus VM, given the orders of magnitude cheaper RAM becomes using a WASM runtime.

Unlocking New Use Cases with Stylus

1. Memory-Intensive Applications

As discussed above, one of the most exciting parts about Arbitrum Stylus is its enabling of memory-intensive applications on-chain. This unlocks a whole new class of applications, such as generative AI NFTs, high-frequency trading, and on-chain gaming [7]. Indeed, Stylus VM may be a landmark technology that allows for AI, notorious for its high memory demands, to be computationally viable on-chain, and be fully interoperable with EVM contracts.

2. Alt-VM Composability with EVM Liquidity

Moreover, Stylus’ EVM compatibility and ability to allow WASM-based contracts to be interoperable with native Solidity contracts means that these WASM contracts can fully tap into the massive liquidity and user base on the EVM. Recall that we’ve mentioned before that many alternative VMs, such as Solana and Cosmos, use WASM-compatible languages such as Rust to execute their smart contracts. Stylus’ WASM engine means that developers in these alternative VMs can easily port their contracts over to the EVM ecosystem and immediately take advantage of the EVM’s liquidity.

3. General-Purpose Libraries, Precompiles, and Debugging Infrastructure

Another advantage of Stylus allowing developers to use mainstream languages such as Rust and C++ to write their smart contracts is that developers can make use of the massive amounts of general-purpose libraries that support these mainstream languages that contain everything from on-chain computation to cryptographic primitives to file I/O.

More importantly, developers can benefit from sophisticated tooling infrastructure built for these mainstream languages. This not only includes advanced package managers, but also familiar debugging infrastructure, such as the GDB toolkit in C/C++. All this will likely greatly increase the development familiarity of web3, and allow for a much simpler onboarding process into blockchain development and the EVM stack.

4. Bringing On-Chain Computation to the IoT for DePIN

With WASM’s increased executional efficiency, Stylus VM may open the door to integrate on-chain computation with portable devices in the Internet of Things (IoT) — including everything from traffic lights to smart fridges to smartwatches. Although WASM was originally intended for browser environments, its portable, modular architecture and efficient execution has made it a perfect fit for IoT devices, which require small and efficient runtimes [8].

Thus, Arbitrum Stylus’ WASM VM is a natural fit for the growing trend of Decentralized Physical Infrastructure Networks (DePIN), which seek to use blockchain networks and novel token incentives to maintain physical infrastructure, from WiFi systems to solar-powered batteries [9]. As much of DePIN relies on integration of the blockchain stack with IoT devices, Arbitrum Stylus could serve as an important gateway to allow for these devices to both efficiently run WASM based computation and tap into EVM-liquidity through the Arbitrum ecosystem [10].

Conclusion

Throughout this article, we’ve explored in depth the motivation, implementation, and impact of Arbitrum. Stylus. By enabling developers to write and deploy smart contracts in a wide variety of mainstream languages, Stylus makes blockchain development both more accessible and efficient, combining mainstream composability with EVM liquidity to unlock a wide range of novel applications, especially those that are memory-intensive. Thus, Stylus is arguably a landmark project in defining the next generation of composable smart contracts, becoming a platform that is able to blur the boundaries between web2 and web3 development to create a more efficient, integrated, and performant blockchain development stack.

Note: This article is a long-form exploration of the discussions and ideas between Rachel Bousfield of Offchain Labs and Jay Yu, Chief Editor of the Stanford Blockchain Review during an interview on Arbitrum Stylus conducted in September 2023.

Full Interview:

Arbitrum Stylus — Smart Contract Composability

References

[1] https://www.developerreport.com/

[2] https://docs.arbitrum.io/stylus/stylus-gentle-introduction

[3] https://developer.mozilla.org/en-US/docs/WebAssembly

[4] Ethereum State Trie Explained: https://medium.com/@eiki1212/ethereum-state-trie-architecture-explained-a30237009d4e

[5] Gas and ink: https://docs.arbitrum.io/stylus/concepts/stylus-gas

[6] https://twitter.com/CryptoIsCute/status/1697647188153917575

[7] https://blog.caldera.xyz/arbitrum-stylus/

[8] https://thenewstack.io/why-webassembly-is-perfect-for-tiny-iot-devices/

[9] https://iotex.io/blog/what-are-decentralized-physical-infrastructure-networks-depin/

[10] https://iotex.io/blog/w3bstream-integrates-arbitrum/

Introduction

It’s hard to have missed dramatic rise of Pepecoin over the past month, and along with it, a resurgence of memecoin hype. Indeed, on May 5, Pepecoin broke through the stunning $1B market cap to become a Top 50 cryptocurrency [1]. In many respects, Pepecoin’s rise calls to mind the famously stunning rise of Dogecoin and Shiba Inu, two of the most famous memecoins in history. In fact, Pepecoin itself even pays homage to the long tradition of memecoins it descends from, writing that it will “make memecoins great again” [2]. So what makes a memecoin “great”? And why do they exist (and even thrive) in the crypto ecosystem, in spite of their evident lack of utility?

Know Your Memecoins

Memecoins have always been a crypto novelty and oddity. Their most characteristic trait is in fact their own self-professed lack of any utility, something they wear around with a semi-sarcastic sense of pride. Even though almost anyone can create a memecoin today just with a few clicks of a button, not all memecoins are created equal. After all, a lot more people hold Dogecoin than say, “HarryPotterObamaSonicInu” (this is an actual real coin on CoinMarketCap) [3].

Indeed, the most successful memecoins never come from humble backgrounds: they are warriors. These are memes that have fought in ferocious battles on the turbulent seas of Internet meme culture, as any cultural sensation or anything that grabs people’s attention, ranging from Elon Musk references (Tweelon), sex jokes (CumRocket), literal poop (PooCoin), GPT-references (PepeGPT) can all be turned into memecoins [4].

In these epic battles, only those memes that have proven their demonstrated approachability, relatability, persistence can survive. For those that do, they are rewarded with boundless glory, with glamour from the crowds, homage from the powerful, and a memecoin that will wear through even the toughest of crypto storms. And amidst all of this, perhaps Pepe does actually stand a chance of surviving, prevailing, and thriving.

Pepe the Meme Royalty

Pepecoin was born with a silver spoon in its mouth, as the meme of Pepe belongs (along with Doge) to a class of Internet meme royalty. Born in 2008 out of the hand of cartoonist Matt Furie, the green frog with a bulging green eyes was depicted literally urinating (pee-pee-ing) while commenting “feels good man” [5]. And since then, Pepe has taken off in all shapes and forms, including a sad version, a smirk version, and so many more [6].

Since its inception, the Pepe meme and the corresponding image of an ugly frog has had a distinctly counterculture and subversive connotation, in particular when contrasted with the much more sanguine Doge meme. While most usage of Pepe is very benign, this ugly frog also has a distinctly “ugly side.” On 4chan and other more fringe social media platforms, the frog meme is often twisted and modified to take darker turns and sometimes embody extremist political symbols. And gradually, variants of the Pepe family of memes became staples on alt-right groups and other darker, more subversive corners of the Internet [7]. Thus, the Pepe meme exists in a massive duality: on the one hand, it exists in the mainstream as a benign counterculture image of an ugly frog with a happy or sad or smirky expression on its face. On the other, this counterculture symbol has been coopted for extremist political movements that actively cause societal instability.

This duality is what has made Pepecoin so controversial, and why it landed Coinbase in hot water after Coinbase accused the Pepe meme of being “co-opted as an alt-right hate symbol,” before later being forced to apologize and acknowledge that most mainstream uses of Pepe are non-bigoted [8]. But in the context of memecoins, they thrive on controversy and continued media attention. After all, it is precisely Pepe’s status as a longstanding meme royalty and one of the undisputed hallmarks of Internet meme culture that underwrites the value proposition for Pepecoin, and explains its eye-watering ascent to a $1 billion market cap, with a $1.87 billion trading volume at its peak.

In this respect of leveraging its power as an undisputed Internet meme royalty to underwrite its value as a cryptocurrency, Pepecoin greatly resembles Dogecoin. And one could argue that there is a kernel of truth in the Pepecoin slogan of “make memecoins great again” and its self-proclamation of being fueled solely by “pure memetic power.” After all, as Pepe is such an important meme royalty, it is certainly conceivable that Pepecoin could stick around for quite some time, just like Dogecoin [9].

Pumps, Dumps, and the Power of FOMO

Memecoins such as Dogecoin and Pepecoin, along with their self-processed lack of any utility, are of course ripe targets for pump and dump schemes and regulations. And in many cases, “shilling shitcoins” is a favorite pastime for the rich, whether it be individuals or institutions.

One need to look no further to see how Elon Musk has been instrumental in shaping the fortunes of Dogecoin to see the influence of how key opinion leaders can send prices soaring to the moon [10]. After simply Tweeting “Doge” and writing that “Dogecoin is the people’s crypto”, Dogecoin prices soared 40%, and in the massive bull run of 2021, Dogecoin did a phenomenal 147.6x price increase in just over five months.

Why is this possible? Arguably, this ability to be pumped-and-dumped at will by key opinion leaders is in-baked into the economic logic of memecoins. As mentioned before, memecoins monetize and gain according to how much attention and cultural capital the underlying meme (or cultural phenomenon) is able to accrue and sustain over a long period of time. Key opinion leaders such as Musk have by definition the power to single-handedly create and sustain cultural phenomenon, and thereby allow these cultural derivatives (i.e. memecoins) to gain immensely in value, and in turn, kickstart a cycle of fear-of-missing-out (FOMO) for retail investors, who want to hop aboard the get-rich-quick crypto ride.

This same logic that applies to Pepecoin’s rapid ascent over the past month or so. Although there isn’t a clear single celebrity pushing Pepecoin on Twitter (as in the case of Musk and Dogecoin), from on-chain data it seems as if there have been some outsized winners with the Pepecoin hype. For example, a wallet labelled blackrock3.eth bought $244 worth of Pepecoin on April 21, and sold all of them on May 5 at its peak for $2.63 million [11].

And of course, with a pump inevitably comes a dump. Today, exactly 20 days from its peak, Pepecoin is down 70% from its all-time-high [12]. As the attention of the memecoin inevitably dissipates and the frenzy of FOMO subsides, the price (a function of this attention) naturally also decreases. But that’s simply the virtue or characteristic of memecoins. For a memecoin, Pepecoin’s -70% can already be considered tame and “benign.” At least Pepecoin hasn’t mimicked the fate of the “Squid Game token,” a memecoin which rode on the wave of the Netflix TV show “Squid Game’s” massive success in 2021. The “Squid Game token” jumped from 1 cent to $2856 in a week, before plummeting to zero after its creators essentially ran away with the money earned and did a classic “rug pull” [13]

But this volatility coming from memecoins, who self-profess that their only value comes from their memetic power, one really shouldn’t be surprised — after all, they literally say “useless” on the label.

Memechains and the Question of Utility

But what does the future of memecoins look like? Will they ever only really be objects of pure speculative bubbles? The answer actually is a bit more complicated than a simple yes or no. Memecoins by design are backed up by the potency of their underlying meme. The problem is that you can never really quantitatively measure the economic value of a meme. These, after all, are simply free JPEGs widely accessible and distributed on the Internet, and as such, obviously generate no monetary value. After all, why pay for a meme I can see, copy, and create for free?

But just because a meme does not have a price tag on it does not mean that it lacks intrinsic value. If Pepe the meme did not have any value, why would people continue to use it to this day, as a symbol for resistance, counterculture, and digital identity? This is the paradox at the center of all art, but particularly digital mementos that can be freely copy-pasted: no one doubts that they are valuable, yet there is no way to measure that value.

Memecoins, to some extent, may in fact be one way out of this problem. If a meme is a some “unquantifiable value,” a memecoin is in essence a “quantifiable un-value.” The two therefore fit together hand-in-glove, and attaches some quantifiable representation to the value of the meme behind the coin. Therefore, even if much of the memecoin mania is fuelled by speculation, I don’t expect the memecoins of mainstream memes such as Pepe and Doge to ever go to zero, so long as the memes themselves still exist.

Nevertheless, there has been a frenzy in memecoin communities to add on so-called “utility” to these originally supposedly “useless” coins. This notably includes the Dogecoin community’s Dogechain, a smart-contract executing PoS built using Polygon Edge where gas fees can be paid in Dogecoin [14], as well as the Shiba Inu community’s Shibarium, a L2 scaling solution that recently just announced its public beta [15]. Most of these “added utility functions” are centered around the classic playbook of getting a chain in order to nominally “have utility.” But the crypto industry is already strewn with the corpses of failed chains, and today there are already too many L1 and L2 chains that are able to match and surpass the proposed functionality of something like Dogechain and Shibarium. The central problem of building a chain to inject so-called “utility” into these tokens is this: why should I use Shibarium and Dogechain to execute smart contracts, over say Arbitrum, Optimism, or Polygon?

Any satisfactory answer to these questions must go back to where memecoins started from in the first place — the original meme underwriting the whole memecoin, such as Doge in the case of Dogecoin, or Pepe in the case of Pepecoin. In fact, if any of these memecoin powered memechains do succeed, they likely will be some sort of a meme-focused chain, where the design of the chain leverages and magnifies the iconographic power of the meme, which in turn adds value to the memechain. Viewed through this lens, one could argue that a memechain’s long-run potential is in becoming a special sort of appchain, one that specializes in operating the underlying meme.

In the long-run, the successful operation of a memechain would likely be more similar to the operation of a successful NFT community, such as BAYC, Azuki, Nouns or Doodles, rather than the operation of an actual L1 or L2 chain like Ethereum, Arbitrum or Polygon. The focus needs to be on the underlying asset backing the memecoin in the first place — the meme — rather than the functionality of the chain itself.

This convergence and triangulation between memes, coins, and tech is arguably the most innovative and inspiring aspect of memecoins. If Pepecoin, Dogechain, and Shibarium are able to innovate out a novel governance structure that perpetuates the longevity of the underlying meme, they will undoubtedly leave a significant mark on the cultural legacy of web3. And then, perhaps, we will truly be able to “make memes great again.”

🐦 @0xfishylosopher

📅 25 May 2023

References

[1] https://markets.businessinsider.com/news/currencies/what-is-pepecoin-pepe-memecoins-dogecoin-shiba-inu-crypto-news-2023-5

[2] See Pepecoin’s Website: https://www.pepe.vip/

[3] https://coinmarketcap.com/alexandria/article/9-funniest-memecoin-names

[4] What are Memecoins: https://www.pcmag.com/how-to/what-is-a-meme-coin-how-do-they-work

[5] https://knowyourmeme.com/memes/pepe-the-frog

[6] Derivative memes of Pepe the Frog: https://knowyourmeme.com/memes/pepe-the-frog/children

[7] https://www.thedailybeast.com/how-pepe-the-frog-became-a-nazi-trump-supporter-and-alt-right-symbol

[8] https://www.forbes.com/sites/antoniopequenoiv/2023/05/11/coinbase-apologizes-for-tying-meme-token-pepecoin-to-racist-symbols/?sh=37957e942419

[9] https://www.forbes.com/advisor/investing/cryptocurrency/what-is-dogecoin/

[10] Elon Musk and Dogecoin: https://coincodex.com/article/21927/elon-musk-dogecoin/

[11] Blackrock and Pepecoin:

https://coinmarketcap.com/headlines/news/blackrock-labeled-wallet-nets-2-4m-from-pepe/

[12] Data from CoinMarketCap, as of May 25: https://coinmarketcap.com/currencies/pepe/

[13] About the Squid Game Token Collapse: https://www.bbc.com/news/business-59129466

[14] About Dogechain: https://coinmarketcap.com/alexandria/article/what-is-dogechain-the-smart-contract-platform-for-doge

[15] About Shibarium: https://blog.shibaswap.com/introduction-to-shibarium/

[16] See the importance of community building in NFT circles such as NounsDAO: https://review.stanfordblockchain.xyz/p/nouns-dao-and-the-philosophy-of-governance

Pepecoin and the Rise of the Meme-Backed Currency was originally published in Web3 Insights on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction

MEV, or Maximal Extractable Value, is a uniquely DeFi phenomenon that emerges as a byproduct of blockchain design. At its core, MEV is simply an instance of profit-maximizing behavior, whereby the validators that operate a blockchain seek to maximize their profit on their task of transaction-validating. While one can argue that MEV can be beneficial through improving capital efficiency, MEV can significantly affect the user experience in using decentralized applications, including higher gas fees, slippage, as well as the risk of collusion and centralization of validators. Within this essay, I will first examine MEV as a theoretical concept, as well as the systemic risks that it poses to the ecosystem. Next, using Flashbots as a case-study, I will examine how the DeFi community as attempted to resolve all these negative externalities of MEV, before explaining why the story of MEV is an emblematically DeFi story: one that exposes many of the underlying questions, challenges, principles, and tradeoffs towards building a truly decentralized financial system.

The “Flash Boys” Club

MEV is a feature, rather than a bug of blockchain technology. Within a given blockchain network, it is the validators (or the miners in a traditional PoW model) that decide what data is put onto the chain. Specifically, they can control what data is included and excluded, as well as how this data is ordered on-chain [1]. And as it turns out, some transactions are more profitable for validators than some others. Thus, as a rational economic agent that seeks to maximize its profit, validators will seek to arrange transactions in a way that maximally profits themselves in terms of transaction fees.

This concept of MEV was first formalized in detail by smart contract researcher Phil Dainan in a seminal paper called “Flash Boys 2.0,” in which the researchers highlight how there exist a myriad of bots and arbitrage agents that attempt to “anticipate and exploit” ordinary users’ DEX trades, similar to how high-frequency traders in traditional finance aggressively optimize for transaction latency [2]. And to get a sense of the scale of this phenomenon, just within the last 24 hours of writing, 2578 ETH, or around 4.9 million USD of profit has been realized through MEV operations [3].

Although MEV is a generic umbrella term that encompasses many different arbitrage methods and scenarios [4], there are several key features that underwrite many of DeFi’s MEV opportunities. Firstly, much of MEV is made possible through a process of “priority gas auctions” (PGAs) where users can pay higher transaction (gas) fees in order to have their transactions run first [2]. As many arbitrage bots rely on having their transactions being run first in order to reap profit, these bots will engage in gas-bidding wars, ordering higher and higher prices to have their transactions be run by the validators, in turn causing high network congestion and out-pricing the average user who won’t get their transaction run, unless they too pay an exorbitant transaction fee.

Validators, on the other hand, are one of the key beneficiaries of this practice. Indeed, with great power comes great profit: because validators (at least theoretically) hold the power to determine which transactions are run, they can benefit from “ordering optimization” fees by determining which transactions which transactions give them the most cash. In practice though, having the validator do the entire MEV-searching, packaging, and execution pipeline is simply too much work [5]. Thus, most of the “ordering optimization” is outsourced to dedicated searchers, builders, and relayers, intermediaries which you can imagine as the “secretaries of the validators,” that each simplify the process of MEV in exchange for a cut of the profits. Specifically, searchers will find MEV opportunities, builders will bundle those opportunities into full “blocks,” and relayers will send these full “blocks” to the validators, or the actual block builders. Thus, a general picture of the modern MEV ecosystem looks like this:

As we’ve hinted at before, although MEV-enabled arbitrage can have some benefits, including higher capital efficiency and ensuring that prices will stay the same across different exchanges, there can be huge externalities for both the end user, such as leading to higher transaction fees, slower execution, and higher slippage (such as the case of sandwich attacks). This however, is not the greatest risk that MEV poses for a blockchain — MEV practices can actually undermine the security guarantees of a blockchain’s consensus layer, especially if validators collude together [5].

This security problem arises from a problem of incentive alignment — with all these lucrative MEV opportunities, miners can earn far more by optimizing for transaction fees rather than sticking to the constant block-reward stipend. As Dainan et al. write, this means that:

As a result, a miner can fork a high-fee block, holding back some fees to attract other miners to build on the fork. In extreme cases, incentives to deviate from the protocol may lead to disruption in miner strategies for economically rational miners, reducing the security provided by block confirmations. [2]

This is known as an “undercutting” attack, and is just one of the several ways in which MEV can undercut the underlying security guarantees of a blockchain. Other known attacks include a “time-bandit attack,” where instead of colluding to steal lucrative transactions from the current block, validators steal and exploit MEV opportunities from past blocks through colluding to rewrite past history. Indeed, MEV extraction doesn’t even need to lie on-chain: it is completely possible for all this to be done through backroom deals off-chain, such as between large traders and validators.

So as we can see, there is much at stake (pun intended) [6].

Flashbots and the Fight Against MEV

Given these potentially dire consequences of unchecked MEV, there have been several projects and teams dedicated to mitigating the negative externalities of this practice. One of the most important teams in the space is the Flashbots team, dedicated to re-align MEV incentives in a way that both sufficiently rewards validators for honest actions in building the chain, while also mitigating the worst effects for ordinary users.

To this end, Flashbots seeks to take three distinct steps: illuminate the MEV “Dark Forest,” democratize the extraction of MEV, and redistribute benefits back to the ecosystem. For the first goal, Flashbots has a dedicated product called MEV-inspect aimed at “illuminating” the “Dark Forest” of MEV in order to quantify the negative externalities caused by MEV and highlight the scale of the problem [7].

The other two goals of “democratizing the extraction of MEV” and “redistributing benefits,” on the other hand are far more complex, comprising of an entire suite of products, gradually evolving as the problem scope and emphasis also shifts. In some respects, one could argue that Flashbots product development history over the past two years itself is a timelapse of Ethereum’s growth and development [8].

The first major set of products Flashbots released was the MEV Auction marketplace, using a MEV-Geth client, which was a modified version of Ethereum’s Golang implementation that is better able to prevent MEV manipulation through routing this to a private transaction pool [9]. An MEV auction marketplace is built on top of this, using a “first-price sealed-bid auction” method (also known as a “blind auction”), where each participant is only allowed to submit one price, and none of the auction participants know what prices the other participants bid [10]. Through this design, Flashbots mitigates the “price-bidding” wars that we have previously discussed that causes increased network congestion.

The guiding principle behind creating MEV-Geth and an MEV marketplace is to diffuse both the powers and the responsibilities of the validators that build the blocks themselves through a process of incentive realignment called “proposer-builder separation” [11]. Instead of having to do the complicated process of both MEV searching and bundling up transactions, validators using the MEV auction can simply look at the MEV marketplace, find which transactions will give them the highest MEV and place a single bid that reflects their actual preferences. Moreover, to prevent validators to include their own transactions and profit from frontrunning users’ transactions, actual transaction detail (eg. a buy order, a sell order, a liquidation etc.) is not revealed until the block-building is already complete [12].

So why would validators actually use this algorithm and give up the aforementioned lucrative MEV opportunities? This is because this Flashbots algorithm of simply picking MEV transactions from a marketplace was far easier and cheaper to run for validators. And as more and more high-quality MEV transactions go through this marketplace instead of directly on-chain, miners are able to reap higher rewards through sticking with the Flashbots implementation. And the results were incredibly impressive: just soon after MEV-Geth was released, over 90% of Ethereum validators began using this implementation, thus showing the importance and effectiveness of incentive realignment in solving a potentially existential issue [8]. But as the Ethereum ecosystem evolved and moved from a Proof-of-Work (PoW) model to a Proof-of-Stake (PoS) model in September 2022, this change in Ethereum’s underlying consensus structure necessitated an update of how the idea of “proposer-builder separation” is conceived [13].

The main reason why PoS is more efficient than PoW is because instead of having every node build and propose blocks from scratch as in PoW, in PoS there is only a handful of validators that serve as the primary block proposers to append data to the blockchain. While this is great for the environment and great for computation efficiency, with the lucrative appeal of MEV, this could pose an additional centralization risk, especially if validators (“proposers”) collude with key “builders” on the seller-side of the market. Even Flashbots itself, running the private transaction pool could fall prey to the lucrative allures of collusion, and of course, placing trust within a single entity, such as Flashbots, goes against the ethos of decentralization.

Thus, Flashbots released MEV-boost, which was a piece of software that decentralized the “supply side” of this MEV marketplace. Instead of containing only transactions in the Flashbots private transaction pool (essentially a monopsony), MEV-boost allowed any builder running this software to submit transactions to all participating validators [14]. For the validators, with many more builders participating in the construction of all these different blocks, this allowed greater revenue for validators, and evened out the playing field of which validators had access to which transactions, thus building a more robust and secure ecosystem [15]. As with before with MEV-Geth, this novel design realigns incentives of multiple parties to avoid centralization risk, and had a resounding success, with over 85% network adoption, of which Flashbots only relayed 34%, showing the success of this decentralized process [16].

Flashbots SUAVE

Thus far, the quest to mitigate all of the centralization risks and make decentralized finance safe from the most harmful effects of MEV is still unfinished, however. In implementing proposer-builder separation, Flashbots’ solutions have diffused, or rather redirected, the key power and responsibility of validators to “builders,” introducing these “builders” as separate entities from validators that do the picking-and-choosing of transactions for the validators. As it turns out, there exist centralization risks within this builder community itself, as there exist significant builder economies of scale.

Recall that previously, we’ve mentioned how searchers, builders, and relayers all play separate role, with searchers searching for MEV opportunities, before sending these to builders, who in turn sent full blocks to relayers. This means that searchers must choose who to send their results to. And to maximize their own return, they will choose the highest-quality builders, who will have their transactions selected by the validator the most often. As more high-quality transactions go to the top builders, this creates a centralizing effect, where the top builders will always get the top MEV transactions from searchers, in turn cementing their position [17].

This builder centralization effect is borne out in practice. Within the last 24 hours of writing, the top 5 builders have proposed around 90% of the total MEV-Boost blocks [18]. And with this level of concentration, these oligopolies could start using their dominant positions to manipulate transactions, including collusion and censorship of certain transactions, all of which again could compromise the security of transactions. This is the motivation behind Flashbots’ latest project: the Single Unifying Auction for Value Expression, a project aimed at disbanding the block-building process from any single blockchain, and outsource this to a separate network, thus decentralizing the role of the block builder [19].

SUAVE is in effect a separate and dedicated block sequencing chain, that will take care of the transaction mempool and builder roles, while the validators of the native chain such as Ethereum will take care of the proposal and attestation roles. As we can see, SUAVE is thus a natural extension of the “proposer-builder separation” principle, where instead of keeping the proposer and the builder on the same chain, we put them onto two completely separate chains, so that they are both sufficiently decentralized and separated from each other. Moreover, the vision of SUAVE is that it will serve as the common sequencing layer for many different chains, such that no matter if you are a validator on Ethereum, Arbitrum, Polygon, or any other EVM chain, you’re able to use SUAVE to find the best MEV opportunities, not only for the native chain that you are on, but also find opportunities for cross-domain MEV from cross-chain transactions that you could not have gathered from just looking at the transaction mempool of that chain alone [19].

Nonetheless, although SUAVE has a grand vision of MEV that ultimately benefits all parties involved and allows the Ethereum ecosystem to be more decentralized, in the 6 months since its proposal in November 2022, there remain several key design issues to be worked out. One of the core issues, for example is whether to build SUAVE as a separate L1 chain (similar to Chainlink), or use a rollup solution, or use a restaking service that “borrows” Ethereum validators like Eigenlayer [20]. Each of these solutions has its distinct tradeoffs in terms of ease of implementation, validator retention, security, and flexibility, which we won’t discuss in detail here.

Another core question is whether SUAVE will release its own token. Although the SUAVE forum currently denies that it will launch its own token “for now” and keep using ETH as its native token on chain, there are several doubts on whether Flashbots will stick to this, especially since launching a SUAVE token seems to make the most economic sense for Flashbots as a company in the long run [21]. Moreover, one could make a fair argument that the reason why Flashbots believes it can raise a unicorn valuation of $1 billion in a bear market is the implicit promise of a future SUAVE token launch [22].

So what’s holding Flashbots back from announcing that it is launching a SUAVE token? As it turns out, launching a token brings several headaching design decisions. For example, would this token have utility for certain transactions or simply be “another governance-only token”? If this token were to have utility, how would this utility look like? How could the different stakeholders using Flashbots (eg. different chains, end users, builders on Flashbots etc.) all be incentivized to use and trust this new token, as opposed to more established tokens such as ETH or even L2 tokens such as ARB [21]? There is an intricate and hair-pulling process of incentive alignment that needs to be worked out in either case; thus it completely makes sense for the Flashbots team to avoid for time being.

Beyond Flashbots: The Bigger Picture for DeFi’s Future

Although it is far too early to tell what shape SUAVE will ultimately take form, and whether this brand-new sequencing chain will succeed in its initial goals and align incentives in a way that truly mitigates the harm of MEV once and for all, I believe that the phenomenon of MEV and Flashbots represents a quintessential image of the various tradeoffs, questions, and principles in designing a truly decentralized financial system.

Firstly, as mentioned before, MEV is a feature, rather than a bug of blockchain design. These arbitrage opportunities and profit incentives for validators derive from the instant accessibility of the blockchain, and guarantee the capital efficiency of DeFi. The negative side-effects of MEV, including congestion, gas-wars, and slippage for the end user are simply byproducts and negative externalities of this process.

By definition, a negative externality does not affect the agents that engage in the negative behavior. In this case, causing network congestion and slippage for end users doesn’t actually harm the validators or arbitrage bots that are engaging in this profit-seeking behavior. In traditional economics, it is well-known that a pure-market base system cannot well-account for all of these externalities. In the case of externalities, traditionally it is the government or some regulatory authority and steps in to correct market dynamics and minimize the impact of the negative externality (eg. taxes on tobacco and alcohol).

DeFi, on the other hand, is by its very nature trustless and opposed to any form of human government enforcement. The closest that it has to coming an “enforcement agency” is through encoding rules and regulations in code (such as through smart contracts) that are deterministic and transparent. Thus, as Flashbots’ story shows, reducing the negative externalities of a phenomena such as MEV is always reliant on a process of incentive re-engineering and alignment. After all, just like Wall Street quant traders, DeFi arbitrage bots are not known for their high moral standards and goodwill of heart.

This method of using incentive re-engineering to reduce MEV’s negative externalities aren’t just intrinsic to Flashbots either [23]. Beyond Flashbots, there are numerous other teams that attempt to realign incentives to develop protocols that realign incentives to reduce MEV’s impact. For example, Chainlink’s Fair Sequencing Services (FSS) leverages its decentralized oracle network to outsource the “transaction ordering” process away from validators, achieving something analogous to what the SUAVE network seeks to aim for [24]. Another example is the idea of “coincidence of wants” (CoW) mechanism on CoW Protocol (formerly Gnosis chain), which automatically glues transactions together, based on if they complement each other (eg. I want 1500 USDC for 1 ETH, and you want 1 ETH for 1500 USDC), running an algorithm of solvers to ensure that everyone trades at an optimal price [25].

But incentive re-engineering, particularly in a decentralized setting without trusting any single party, can be a hair-pullingly difficult task, as fundamentally you are trying to fight against economies of scale. In the case of Flashbots’ builder centralization, for example, builders that have “proved their worth” are more likely to be “trusted” by searchers, who in turn will give them more high-quality transactions and cement their position as market leaders. To identify, solve, and implement a decentralized alternative through incentive re-alignment is essentially playing a game of “whack-a-mole” — you will never know how a newly introduced incentive system may contain loopholes of centralization and hidden economies of scale, and all of these will only retrospectively make sense.

Moreover, in a complex system (such as the blockchain) with many different stakeholders and agents, it is almost impossible to avoid externalities, as there will almost certainly be a corner case where the actions of one stakeholder will spillover and affect the actions of another. And, and Dainan has shown in “Flash Boys v2.0,” many of these externalities can pose very real threats that undermine the stability of the entire system. Thus, any decentralized system and any set of even well-engineered game-theoretic principles will always have this innate intricacy, delicacy, and fragility to it, where a single unforeseen loophole can threaten its very existence.

Compared with centralized systems, in which it is obvious how such a system may be corrupted (in which case it is possible to create necessary countermeasures), decentralized systems do not contain any obvious “single point of failure” — but it is precisely this that makes decentralized systems sometimes even more lethal than their centralized counterparts. Instead of having no “single points of failure”, every node can potentially be a “single point of failure,” if there is a loophole in system design.

Ultimately, the story of MEV and Flashbots tells us how maintaining the health of a decentralized system will always require a consistent, Herculean effort — a consistent participation in a game of “whack-a-mole.” A diffusion of trust in a decentralized system necessitates a diffusion of responsibility and a diffusion of vigilance, especially as there is so much financial incentive at stake: for better or for worse, MEV is here to stay.

🐦 @0xfishylosopher

📅 6 May 2023

References

[1] https://ethereum.org/en/developers/docs/mev/

[2] The paper name of “Flash Boys v2.0” is a reference to Michael Lewis’ exposé “Flash Boys” on Wall Street high-frequency traders: https://arxiv.org/pdf/1904.05234.pdf.

[3] From Flashbots Transparency Dashboard as of May 6 https://transparency.flashbots.net/

[4] https://www.coindesk.com/learn/what-is-mev-aka-maximal-extractable-value/

[5] https://chain.link/education-hub/maximal-extractable-value-mev

[6] https://writings.flashbots.net/frontrunning-mev-crisis

[7] https://github.com/flashbots/mev-inspect-py

[8] See Section I: https://writings.flashbots.net/the-future-of-mev-is-suave/

[9] https://github.com/flashbots/mev-geth

[10] https://etherworld.co/2022/04/05/mev-research-report/#section111

[11] Vitalik’s discussion on PBS: https://ethresear.ch/t/proposer-block-builder-separation-friendly-fee-market-designs/9725

[12] https://docs.flashbots.net/flashbots-auction/overview/

[13] Discussion of MEV in ETH2: https://writings.flashbots.net/mev-eth2/

[14] MEV Boost Docs: https://boost.flashbots.net/

[15] https://writings.flashbots.net/why-run-mevboost/

[16] MEV Boost dashboard data as of May 6: https://www.mevboost.org/

[17] Details on builder centralization: https://simbro.medium.com/mev-driven-centralization-in-ethereum-ec829a214f18

[18] Builder centralization statistics, data as of May 6: https://www.relayscan.io/

[19] See Section II and III: https://writings.flashbots.net/the-future-of-mev-is-suave/

[20] Discussions on routes for SUAVE’s technical implementation: https://collective.flashbots.net/t/suave-economic-security-models/1070

[21] See https://blockcrunch.substack.com/p/is-flashbots-a-bad-business-the-flashy

[22] Flashbots recent raise: https://www.theblock.co/post/203637/flashbots-fundraise-billion-dollar-valuation

[23] https://www.coindesk.com/markets/2021/07/27/how-to-fix-ethereums-mev-problem-and-give-traders-the-best-price/

[24] Chainlink FSS: https://blog.chain.link/chainlink-fair-sequencing-services-enabling-a-provably-fair-defi-ecosystem/

[25] CoW protocol: https://docs.cow.fi/overview/introduction

MEV and Flashbots: The Uniquely DeFi Tale was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Key Takeaways

• “Multi-dip staking” refers to earning multiple yields on a single staked principal (such as ETH)

• Liquid Staking Derivatives (LSDs) are the oldest and most mature form of multi-dip staking, using IOUs to allow for “double-dipping” in DeFi of staked assets and increase capital efficiency. LSD market is primarily for ETH because of historical reasons

• ETH LSD Market is likely a long-run oligopoly, since there is a centralizing force of liquidity (provider trust), and a decentralizing force of security (BFT concerns). Lido, with 32% of all staked ETH, is already at the upper limit of allowed centralization.

• Post-Shanghai Upgrade, in the short run smaller LSD providers may face liquidity issues (as there is an exodus of rewards), but in the long run a full PoS Ethereum may 3–4x the LSD market and heavily benefit small to mid-sized players such as Rocket Pool and Frax. A new generation of players will also likely enter, and the endgame would likely be several players with 10–20% market share each

• Eigenlayer has greatly catalyzed the “multi-dip staking” model, and creates a lend-a-validator model for middleware projects (sequencers, bridges, oracles etc.) that benefits all parties, i.e. middleware projects, DApps (increased security), validators, mom-and-pop stakers (more choice and more yield).

• Eigenlayer’s Practical Risks include regarding validator “interference” (simultaneously staking on multiple projects), fractured liquidity pools for LSDs, and the risk of re-centralizing the Ethereum ecosystem.

• Post-Eigenlayer, “multi-dip staking” will have entered the mainstream, and this unlocking of capital is ultimately beneficial to all parties within the Ethereum ecosystem. Similar ideas will likely also expand into other “base” blockchains, especially Cosmos (IBS proposal), catalyzing a narrative of modular blockchains.

Introduction

Since the Ethereum Merge in September 2022, Proof-of-Stake (PoS) has established itself as the mainstream consensus mechanism for all major L1 chains apart from Bitcoin. As repeatedly touted, PoS has several advantages over Bitcoin’s Proof-of-Work (PoW), such as being more environmentally friendly, having lower hardware barriers to entry, and the use of efficient economic incentives rather than brute-force computational superiority to guarantee transaction safety [1].

One thing that is often overlooked is that the act of “staking” itself is an action that has greatly transformed DeFi, with the yield incentive within staking becoming a springboard for innovation in DeFi mechanisms. Within this article, I will explore the emergence of what I call “multi-dip staking,” where a user is able to earn multiple yields on a single staked deposit. Specifically, I believe that this is a metanarrative that combines the narratives of the liquid staking derivatives (LSDs), the Shanghai upgrade, and the impact of Eigenlayer on the future of staking, and will have ramifications both in the Ethereum ecosystem and beyond.

Liquid Staking Derivatives

Liquid staking is one of the earliest and most important forms of staking-based DeFi innovations, and in many ways is a byproduct of Ethereum history. In late 2020, as part of Ethereum’s long-term transition from its initial Proof-of-Work consensus mechanism to its Proof-of-Stake consensus mechanism, the “Beacon Chain” went live, initially as an independent blockchain running PoS and segregated from mainnet transactions to ensure protocol safety [2]. Validators could deposit a minimum of 32 ETH to secure the Beacon Chain, and were promised validator rewards to do so. However, validators are unable to withdraw their staked deposits and rewards in native ETH until the transition to Proof-of-Stake transition is complete after the Shanghai upgrade (which we will discuss later) [3]. So all this capital was just sitting there, stuck like a lame duck. Surely someone needed to do something about it.

Enter Liquid Staking. The basic premise is simple: when you stake a token (such as ETH) through a liquid staking service (such as Lido), that liquid staking service will return you an IOU token, guaranteeing you that you can redeem both your principal and any accrued “interest” through staking yields. These IOUs are known as “liquid staking derivatives,” or LSD. The big advantage of LSDs was that it allowed for a far greater capital efficiency, as these IOUs, such as Lido’s stETH, could be traded on secondary markets and used in DeFi applications, in the same way that one would use the native token. Of course, being temporarily unredeemable, all these IOUs were underwritten by trust in the Ethereum community, trusting that it will eventually the PoS transition will be complete and validators will be able to unstake their deposits. Viewed from this lens, one could argue that LSDs are essentially bonds, maturing with interest after the Shanghai upgrade.

Crucially, LSDs allowed stakers to both have their cake and eat it: one could reap the rewards of staking on the Beacon Chain, as well as have (at least somewhat) the liquidity of the underlying capital, ready to be reallocated and recollateralized. This process is also known as rehypothecation in TradFi, where the same underlying asset (say 10 ETH) is used as a collateral for many different uses, as you can use the same 10 ETH to stake and reap rewards on the Beacon Chain, as well as use the stETH LSD as collateral for a DeFi loan [4]. In other words, you’re double dipping that same principal of 10 ETH.

There are a great variety of ways to engage in liquid staking, with both centralized exchanges, such as Coinbase, and decentralized providers such as Lido and Rocket Pool. Furthermore, there is a diversity in the ways that different providers implement liquid staking. In particular, there are three main methods for staking rewards [5]:

ETH2 Liquid Staking and the Shanghai Upgrade

The liquid staking derivatives market for Ethereum 2.0 is the most established and active LSD market, due to the historical reasons outlined above. The current market for Ethereum LSDs is highly concentrated, with Lido dominating, having approximately 75% market share. Nonetheless, as shown in the diagram, there has been an increase in diversification of liquid staking providers, with Coinbase and Rocket Pool having 15.6% and 5.8% respectively [6].

Fundamentally, the LSD market is shaped by two countervailing forces: a centralizing force of liquidity, and the decentralizing force of security. As is the case in the majority of DeFi protocols, liquidity is critical to a LSD project’s success. With increased liquidity comes increased adoption, as more DeFi projects trust the LSD and will be willing to use it as a collateral. This creates a self-reinforcing feedback loop, as the LSD’s increased adoption in DeFi will allow it to onboard more users, which increases the LSD’s liquidity and in turn expands its adoption in DeFi even more. This flywheel effect is arguably the most important reason why Lido has retained its dominance within the LSD market. The rapid rise of Coinbase as a liquid staking provider can also be explained through this framework, as it is able to leverage its unparalleled amounts of liquidity on its exchange to quickly kickstart this liquidity flywheel.

There is, however, also the decentralizing force of security. Most blockchains are built to be Byzantine Fault Tolerant, guaranteed to hold so long as a bad actor does not control more than 1/3 of the validators [7]. In a PoS system, the danger zone is if a single staking provider controls more than 33% of the staked ETH on the blockchain, as a single hack or bug for that provider could compromise the security of transactions on the entire system. Crucially, Lido is already close to hitting that upper threshold. As per data from Dune Analytics, around 43% of all staked ETH is current staked through liquid staking pools (such as Lido, Coinbase, Rocket Pool etc.), and of this, Lido commands 74.2% market share. This means that Lido controls almost 32% of all staked ETH, veering dangerously close to the point of centralization where there could be a systemic security risk. As such, there is a huge incentive for the Ethereum community to move away from Lido to actively use and promote alternate liquid staking providers in order to maintain sufficient decentralization and thus guarantee the underlying security.

A key transformative event within the ETH2 LSD sector is the Shanghai upgrade, scheduled for April 2023. As mentioned before, the Shanghai upgrade will allow the previously issued IOUs (i.e. liquid staking derivatives such as stETH) to finally be redeemable from the Beacon Chain, thereby potentially upending the liquid staking market. In the short run, there may be immense unstaking and selling pressure, as validators are finally able to withdraw their ETH after two and a half years of waiting. About 1 million ETH in staking rewards will be eligible to be withdrawn on the day-of the Shanghai upgrade, representing roughly 10% of daily trading volume [8]. As users swarm to withdraw staking rewards, this could create a negative spiral and pose liquidity challenges for smaller liquid staking providers.

In the long-run however, the Shanghai upgrade could turbocharge Ethereum’s liquid staking market. Currently, Ethereum only has around 15% of its total volume staked, compared to other major PoS chains that have 60–70% staked [9]. One reason for this may be because validators are currently unable to withdraw their stakes from the Beacon Chain. Thus, after the Shanghai upgrade, it is very plausible that the staking ratio of Ethereum could reach triple or quadruple to 50–60%, roughly on parity with its other PoS peers. With the enabling of staking withdrawals, the Shanghai upgrade could also incentivize retail participants into the sector, and thus increasing the proportion of ETH that is staked through liquid staking pools (both centralized and decentralized services) such as Lido, Coinbase, and Rocket Pool.

As mentioned before, because there is a great security incentive for LSD market to decentralize, this increase in LSD demand post-Shanghai upgrade may greatly benefit midsize players such as Rocket Pool and Frax, while also potentially giving birth to a whole generation of liquid staking protocols that may implement LSD models in vastly different ways than the three commonplace methods mentioned above. In the long run, however, because of the centralizing effect of liquidity, I expect that the LSD market will achieve equilibrium as an oligopoly, with several LSD projects each commanding between 10–20% of the staked ETH.

Enter Eigenlayer

The liquid staking derivative scene presented above, however, is only the tip of the iceberg for “multi-dip staking”. One of the most important recent developments within the ecosystem is the rise of “restaking” as a concept, a narrative popularized by the debut of Eigenlayer’s whitepaper in February 2023. In its whitepaper, Eigenlayer describes itself as a “restaking collective” that allows validators to “opt in to validating new software modules built on top of the Ethereum ecosystem” [10]. But what does this mean, specifically? What problem does it actually solve within the Ethereum ecosystem?

Essentially, all DApp smart contracts running on the Ethereum blockchain are secured by Ethereum validators, which provides incredibly strong security guarantees. But as DApps have become more and more complex, they’ve begun to require many other moving pieces, including bridges, oracles, and other forms of middleware, which can’t live on the Ethereum blockchain, and so are not secured by Ethereum validators. Many of these middleware projects employ their own blockchains (such as Chainlink) run their own blockchain with their own validators, or on centralized servers — in short, methods that do not have the security rigor guaranteed by the Ethereum validators [11].

Indeed, these oracles, bridges, and other pieces of middleware often have a “validator bootstrap problem,” where setting up validators for this project is expensive and time-consuming, not necessarily trustworthy, and prone to attack [12]. Eigenlayer aims to solve this issue through allowing projects to define a set of validation rules and use these to “borrow” Ethereum’s validators, as an alternative to bootstrapping their own and thus provide these projects with a stronger security guarantee.

As shown above, Eigenlayer’s ecosystem has several moving parts and stakeholders, and thus may be difficult to understand at first glance. So let’s break this down into each of the different stakeholders (pun intended) in the system, and explain why Eigenlayer’s design benefits them.

Middleware Projects

Middleware projects are arguably the most important part of Eigenlayer’s ecosystem. These are usually infrastructure projects that are 1–2 levels removed from the end-user, and include rollup sequencers, bridges, oracles, and RPC nodes [11]. Instead of bootstrapping the validators themselves (which we have discussed before is problematic), middleware projects simply needs to define two things: the task and the bounty. For the task, the middleware projects needs to define the validation and slashing rules, and for the bounty the project needs to define how validators will be rewarded. Intuitively, think of this as a job posting: you define what you need to do in that position (eg. flip burgers for an hour), and your compensations (eg. $15 minimum wage salary). And with other people flipping your burgers for you, you can move on to the more productive things in life.

Validators

Validators are the ones flipping the burgers for these middleware projects. But they’re picky too; after all, it’s a free market out here. With all these multiple middleware “job-postings,” validators are free to pick and choose any combination of middleware projects and rewards to validate, buffet style. As different validators may have different specialities and risk preferences, this will result in different validators securing different middleware projects and choosing different “restaking” combinations, thus offering differing validator yields. All these yields will also be in addition to the base yield of the Ethereum base layer.

DApps

User-facing DApps, such as decentralized exchanges, lending platforms etc. will still be built on the Ethereum base layer. However, within the Eigenlayer ecosystem they will interface with the middleware projects built on top of Eigenlayer (which are secured by the re-staking validators). Compared with the status quo, using an Eigenlayer-secured middleware will allow for the top-level user-facing DApp to also be more secure.

Users

In addition to interacting with user-facing DApps (that in turn use Eigenlayer), users can also directly interact with the validators through LSDs. Specifically, each validator may choose to release their own LSD, with a different yield resulting from their different pick-and-choose project combinations. In turn, users have a diversity of yield strategies to choose from, and create a “multi-dip” staking strategy which they can tailor according to their own risk profile.

Thus, in theory Eigenlayer hopes to provide a win-win solution to all parties involved. But what are some of the implications and corollaries of such as system? Firstly, with different validators restaking to different projects, they will have different yield APYs, as established above. As each validator may release its own LSD, this may result in a myriad of LSDs floating out in the market. Now recall that we’ve established that for LSDs projects to thrive, they need a liquidity moat, as it is only through sufficient liquidity that DeFi projects will be able to trust these LSDs. If every validator releases its own little xETH, yETH, zETH LSD, this may result in a very fractured liquidity pool that handicaps LSDs usefulness in rehypothecation of DeFi.

Secondly, there is the question of what is the “interference factor” here. In other words, is there an upper limit to how many “jobs” a validator can “work”? It is unclear what the constraint is here, and how each “job” the validator works may interfere with other jobs. The real life analogy here is that I only have so much working time and energy in a day, so can’t possibly work infinite jobs. Knowing this interference factor is incredibly important, as it directly affects the distribution and overlap of validators across different projects, which in turn underwrites the diversity of yield strategies that each validator gives, and in turn affects how fractured the resulting LSD market may become.

Thirdly, there is the question of systemic risk, and if Eigenlayer poses a risk of recentralization. Specifically, Eigenlayer itself, with its access to validators stakes (as it needs to apply rewards/slashing rules), may represent a single point of failure, and if exploited a significant amount of ETH may be stolen [13]. This becomes a more and more significant issue once a significant percentage of validators on Ethereum opt in to secure Eigenlayer projects, as it snowballs out to be a recentralization of Ethereum itself, becoming antithetical to the initial purpose of the project and network. To combat these systemic risks, Eigenlayer proposes an EigenDAO and a manned committee of overwatchers, comprised of experienced Ethereum, Eigenlayer, infrastructure, and application developers, that will review and resolve cases of systemic risk [13]. But the feasibility, transparency, and effectiveness of such an institution remains to be seen.

The bottom line is that Eigenlayer is a revolutionary project that solves a real need, and promises a new way of conceiving the different roles that participants play within the Ethereum ecosystem. However, because it is such a revolutionary leap, the full implications of this project cannot possibly be theorized in the abstract and predicted beforehand. Only time will tell its vision of a win-win scenario for all stakeholders within its ecosystem is actually feasible, and if it is robust enough against adversarial and malign exploits.

The Horizon Beyond Ethereum

So far, we’ve concentrated our discussion of “multi-dip staking” on the Ethereum ecosystem. But of course, Ethereum isn’t the only PoS chain out there, and multi-dip staking is absolutely possible on other PoS chains. As we’ve hinted at before, there already exist LSDs for alternate PoS chains, such as Lido’s stMATIC, stSOL, stKSM and stDOT. But it is dubious if the LSD actually increases value for the token itself in this cases. Arguably, Ethereum LSDs success was due to its special historical circumstances (of the Beacon Chain not allowing withdrawals), as well as its robust DeFi ecosystem that unleashes the full potential of capital reallocation that LSDs allow for. This is not necessarily true for all PoS chains, and as such, releasing an LSD for such a chain may not actually increase the underlying token’s value [14].

A more interesting question is if a restaking idea such as Eigenlayer may hold up within other ecosystems. I believe that it can, given certain network traits. First, the underlying network’s validators are sufficiently decentralized. For a lot of PoS chains, their validators are highly centralized and controlled by a single entity. This means that having a restaking mechanism such as Eigenlayer will not increase decentralization and security of infrastructure protocols, and such becomes meaningless to implement. Secondly, there needs to be sufficient infrastructure demand on this network. In other words, an ecosystem needs to have enough bridges, oracles, sequencers, and other middleware projects such that it warrants the necessity of having an Eigenlayer-style restaking mechanism.

Given these two prerequisites, I believe that the ecosystem that best satisfies these is the Cosmos Network. Firstly, the Cosmos Hub has sufficiently decentralized validators, and thereby can provide a relatively strong security guarantees for other projects (or in Cosmos’ case, other chains built using the Cosmos SDK). Secondly, there is sufficient demand for such a system on Cosmos, as many chains do indeed face a validator bootstrap problem, and there are many infrastructure projects built on top of the Cosmos SDK.

Indeed, Cosmos v2.0’s whitepaper vision of an Inter-Blockchain Security framework is very similar to Eigenlayer’s vision for Ethereum, as the IBS framework essentially allows for Cosmos chains to “borrow” validators from the Cosmos Hub to solve the validator bootstrap problem, and end users can stake ATOM tokens to earn yields on multiple Cosmos ecosystem chains. And even though Cosmos v2.0’s whitepaper was ultimately vetoed by its community, the IBS framework has recently been greenlit in a landslide vote [15], and so we can expect this idea of “multi-dip staking” to also gradually emerge within the Cosmos ecosystem.

Overall, throughout this essay we’ve explored in-depth the idea of “multi-dip staking,” tracing through Liquid Staking Derivatives on the Ethereum network to the Shanghai upgrade, to Eigenlayer’s significance in reforming liquid staking, and finally to a discussion on opportunities for “multi-dip staking” beyond Ethereum. Through this, I hope that I’ve shown how Proof-of-Stake itself can unlock a myriad of new DeFi opportunities, complete with a new set of incentives, risks, and opportunities. It looks like there is indeed a lot at stake, after all.

🐦 @0xfishylosopher

📅 8 April 2023

References

[1] See PoS benefits: https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/

[2] Beacon Chain: https://ethereum.org/en/upgrades/beacon-chain/

[3] Shanghai upgrade: https://coinmarketcap.com/alexandria/article/ethereum-s-shanghai-upgrade-everything-you-need-to-know

[4] See https://coinmarketcap.com/alexandria/article/the-ultimate-guide-to-ethereum-liquid-staking

[5] Adapted from this Twitter thread

[6] Data and subsequent calculations derived from Dune’s Dashboard, April 2 2023: https://dune.com/eliasimos/Eth2-Liquid-Staking

[7] See explanation of BFT: https://decrypt.co/resources/byzantine-fault-tolerance-what-is-it-explained

[8] Short-term volatility effects of the Shanghai upgrade: https://www.coindesk.com/markets/2023/02/17/unlike-merge-ethereums-shanghai-upgrade-could-bring-price-volatility/

[9] Long-run effects of the Shanghai upgrade: https://cointelegraph.com/news/ethereum-s-shanghai-upgrade-could-supercharge-liquid-staking-derivatives-here-s-how

[10] See Eigenlayer Whitepaper: https://docs.eigenlayer.xyz/overview/whitepaper

[11] https://coinmarketcap.com/alexandria/article/a-deep-dive-into-eigenlayer

[12] See https://mazii08.substack.com/p/eigenlayer-what-is-it

[13] See critiques of Eigenlayer re-centralization: https://probablynothingresearch.substack.com/p/empire-podcase-summary-how-eigenlayer

[14] An argument for why intrinsic LSDs cannot increase a coin’s value. Twitter thread.

[15] Cosmos Greenlighting IBS: https://blockworks.co/news/cosmos-greenlights-interchain-security

The Ultimate Narrative of Multi-Dip Staking was originally published in Web3 Insights on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction

For Web3, privacy is the elephant in the room. It is at once crypto’s biggest selling point, going hand in hand with the principles of decentralization, anonymity, and trustlessness, and its biggest pain point, with excruciating KYCs, easily trackable PII, and an ever-suspicious gaze from the outside world.

Unfortunately, this is also a topic that is largely misunderstood and misconceived, with many people viewing crypto “privacy” as simply an excuse to finance terrorists and conduct money laundering. The fact that crypto Twitter prides itself for its “anon culture” and that mainstream media often (intentionally or unintentionally) reinforces these biases doesn’t help a case in dissolving these stereotypes.

Because Web3 privacy is such an all-encompassing concept, touching upon everything from ape profile pictures to cryptography and Zero Knowledge Proofs, its useless to talk about it in the aggregate, and make lump-sum judgements on whether it is good or bad. Instead, we must break down the problem into different smaller segments. In this essay, I will first break down and analyze Web3’s “privacy” infrastructure at three distinct levels — network level privacy, protocol level privacy, and user level privacy — before exploring the role that technological solutions such as Zero Knowledge Proofs play in the future of Web3 privacy.

Network Level Privacy

The first and oldest conception of privacy is at the network level. Network level privacy is where every transaction of a cryptocurrency on a given blockchain network is guaranteed privacy through underlying consensus mechanisms of the blockchain and network-level design choices. As such, these are also called “privacy coins.”

This conception of privacy traces its roots all the way back to the Bitcoin protocol, and its idea of anonymizing “wallet addresses” as 160-bit cryptographic hashes [1]. While Bitcoin itself has fully transparent transactions, where any user can inspect any transaction on its network, Bitcoin’s design principles of decentralization and anonymity have undoubtedly inspired the driving force behind the development of “network level privacy” and privacy-first blockchains.

One of the leading projects in establishing network level privacy is Monero, a privacy-first blockchain established in 2014. Unlike Bitcoin, Monero hides both user wallets and transactions behind “Ring Signatures,” in which users within a given “ring” have access to a certain group signature, and use that group signature to sign transactions. Therefore, for any given transaction on the Monero network, you can only tell that it comes from a certain group, but you don’t know which user in that group actually signed the transaction. In essence, this is a form of “privacy in the crowd,” in which users band together into groups in order to provide everyone with privacy. [2]

Another project that tackles this same space is ZCash, an early pioneer of a form of Zero Knowledge Proofs called zk-SNARKs which has been recently popularized. The fundamental concept behind Zero Knowledge Proofs is that it is a way of proving something is true without revealing any further information (which could compromise security and privacy) [4].

A simple example of a Zero Knowledge Proof is a Gradescope autograder [5]. You need to “prove” that you did your CS homework correctly, but don’t need to tell the autograder any further details about your code implementation. Instead, the autograder checks your “knowledge” through running a bunch of hidden test cases, and your code must match the “expected” output of the Gradescope autograder. Through matching the “expected” output, you can provide a Zero Knowledge Proof that you’ve done your homework without showing your actual code implementation.

In the case of ZCash, while transactions are by default transparent, users can choose to use these “Zero Knowledge Proofs” to create private transactions. When a user wants to send a transaction, they create a transaction message that includes the sender’s public address, the recipient’s public address, and the amount of the transaction, and then convert this into a zk-SNARK proof, which is the only thing sent to the network. This zk-SNARK proof contains all the necessary information to prove the validity of the transaction, but doesn’t reveal any of the details of the transaction itself. This means that the network can validate the transaction without knowing who sent it, who received it, or the amount involved.

Despite their design and implementation differences, for both Monero and ZCash the transaction privacy is guaranteed at the blockchain level, such that all transactions happening on the network are automatically guaranteed to be private. This privacy guarantee can be easily abused by bad actors to conduct money laundering, terrorist activities, and drug trafficking, and Monero is particularly notorious for its popularity on the Dark Web [6]. Furthermore, as Monero and other “privacy coins” become synonymous with illicit financial activities, this drives away users using these “privacy coins” out of legitimate privacy concerns, feeding a negative feedback loop that only results in a more harmful shadow economy.

This is the biggest drawback of guaranteeing privacy at the network level: it is an “all or nothing” approach in design, where there is a zero-sum tradeoff between the transparency of a transaction versus the privacy of this transaction. It is precisely because of this lack of transparency that “network level privacy” draws the most ire from regulators, and the reason why several major centralized cryptocurrency exchanges, such as Coinbase, Kraken, and Huobi have delisted Monero, ZCash, and other privacy coins in several jurisdictions [7].

Protocol Level Privacy

A different approach to privacy is to ensure “protocol level privacy,” where instead of hardcoding private transactions into the consensus level of the blockchain network, we process private transactions on a “protocol” or an “application” that runs on top of a blockchain network.

Because early blockchain networks, such as Bitcoin, had limited programmability, building “protocol level privacy” was incredibly hard to do, and it was much easier to fork the Bitcoin network and implement privacy from the ground up in the form of a new blockchain and “privacy coin.” But with the advent of Ethereum and the rise of “smart contracts,” this opened a whole new avenue for privacy-preserving protocols.

One of the most notable examples of “protocol level privacy” is Tornado Cash, which is a decentralized application (dApp) on Ethereum that “mixes” transactions together into a pool in order to guarantee transaction privacy — conceptually somewhat similar to Monero’s “blend in with the crowd” approach.

The Tornado Cash protocol roughly speaking has three main steps:

1. Deposit: Users send their funds to a Tornado Cash smart contract. This initiates a private transaction with a randomly generated “anonymity set,” which is a group of users who are also making transactions at the same time.

2. Mixing: Tornado Cash mixes the deposited funds with other users’ funds in the anonymity set, making it difficult to trace the original sender or recipient. This process is called “mixing” or “anonymizing.”

3. Withdrawal: Once the funds have been mixed, users can withdraw their funds to a new address of their choice, breaking the link between their original address and the destination address. The user can then complete the transaction by sending the funds directly from the “new” destination address to the recipient. [9]

Unfortunately, in August 2022, Tornado Cash was sanctioned by the US government, as the Office of Foreign Assets Control (OFAC) alleged that North Korean hackers were using the protocol to launder stolen funds [10]. As a result of this crackdown, US users, companies, and networks are no longer able to use Tornado Cash. USDC stablecoin issuer Circle went a step further, freezing over $75,000 worth of funds connected to Tornado Cash addresses, and GitHub deleted the accounts of Tornado Cash developers [11].

This triggered a controversial storm in the crypto sphere, as many argued that with the vast majority of users using Tornado Cash for legitimate privacy-preserving transactions, and that protocol users should not be punished for the bad actions of a small minority. But importantly, because Tornado Cash is a “protocol level privacy” on Ethereum, rather than a “network level privacy” solution, the crackdown and fallout was restricted only to this one protocol on the Ethereum network rather than affecting the entire network — unlike Monero and ZCash, Ethereum didn’t get delisted from Coinbase because of these sanctions.

An alternate approach to “protocol level privacy” pioneered by the Aztec Network focuses on “rollups” to shield user funds and support private transactions. Aztec’s primary product is zk.money, which uses a 2-layer deep recursive Zero Knowledge Proof for both scaling and privacy. The first ZKP proves the correctness of the shielded transaction, ensuring that the transaction was in fact private and there was no informational leak. The second ZKP is used for the rollup itself, in order to bundle the computation of batches of transactions together and ensure that all of these were executed correctly [12].

While rollup-based “protocol level privacy” solutions are still in their early stages, they represent the next evolution of “protocol level privacy” solutions. One key advantage of rollup solutions over dApp-based “protocol level privacy” solutions such as Tornado Cash, such as their enhanced scalability, as the heavy-lifting of the computation largely happens off-chain. Furthermore, because much rollup research has been focused solely on increasing computation, there is still ample space for exploration in applying and extending these technologies into the privacy sphere.

User Level Privacy

A third (and most recent) approach to conceptualizing privacy in Web3 is through exploring “user level privacy,” where privacy guarantees are made for an individual user’s data rather than focusing on the data of the user’s transaction. In both the “network” and “protocol” level, we witness the recurring problem of a minority of bad actors (such as Dark Web transactions and money laundering schemes) affecting the use of the network and protocol for the innocent majority that are simply concerned for their personal data privacy.

The crucial point of “user level privacy” is that through focusing on individual users of a network itself, we conduct a “targeted” form of filtering where benign users and addresses are free to interact with the blockchain network privately, while bad users can be quickly filtered out. As you can imagine, this is a Herculean task, walking a fine line between transparency and privacy. This user-centric view of privacy also spawns an entire debate (and industry) about the role and future of decentralized identity (dID) adjacent and derived from the question of Web3 privacy [13]. For the sake of brevity, I will not discuss this question of KYC and authentication in Web3.

The core insight of “user level privacy” is to separate and reimagine the relationship between the user themselves and their wallet addresses on-chain, as wallet addresses are the atomic identifiers on a blockchain network. Importantly, there is a one-to-many mapping from users to chains: users often control more than one wallet address on each blockchain network they interact with. This is the idea of “on-chain identity fragmentation.” Thus, the crux of “user level privacy” is finding a secure way of mapping users’ personally identifiable information (PII) to all these fragmented on-chain identities.

A key project in this regard is Notebook Labs, which seeks to use Zero Knowledge Proofs to link fragmented identities together with a user’s PII [14], while providing the following guarantees:

1. Users can prove their humanity with any fragmented on-chain identity

2. It is impossible to link these identities together (unless the user’s secret key is leaked)

3. It is impossible for any third party or adversary to link a fragmented on-chain identity to the user’s real-world identity

4. Credentials can be aggregated across identities

5. Each human receives a single set of fragmented on-chain identities [15]

While the cryptographic specifics of the protocol are beyond the scope of this essay, Notebook Labs demonstrates two core principles of “user level privacy” — the importance of addressing reimagining the relationship between the multitude of fragmented on-chain identities with real-world human users, as well as important role that Zero Knowledge Proofs play in aggregating and linking together all of these identities [16].

Another emerging solution to the question of “user level privacy” is the idea of “stealth wallets.” Again, the idea of “stealth wallets” capitalizes on the fragmentation of on-chain identities, using the fact that a user typically has more than one identity on-chain. Unlike Tornado Cash and other “protocol level privacy” solutions, which seek to obscure the transaction data itself, stealth addresses seek to obscure who the real people are behind the sender and recipient addresses. This is implemented through essentially finding an algorithm to quickly and automatically generate “one-time wallets” for a user’s transaction [17].

One important conceptual difference between “stealth wallets” and previously discussed privacy solutions such as Monero and Tornado Cash is that this is not a form of “privacy in the crowd.” This means that unlike Tornado Cash, which can only make privacy guarantees for mainstream token transfers such as ETH, stealth wallets can also provide security guarantees for niche tokens and NFTs, or unique on-chain assets that have no “crowd” to blend into [17]. Nonetheless, thus far the discussion of “stealth wallets” on Ethereum has remained at the theoretical stage, and the implementation effectiveness and legal repercussions of this novel technological solution are yet to be seen.

ZKPs and The Future for Privacy in Web3

As we can see, privacy is complicated in Web3. Different approaches to the problem — at the network level, at the protocol level, and at the user level — invite different solutions to it, and explore different tradeoffs between transparency and privacy. That said, any discussion of privacy is incomplete without considering the flip side of the coin: transparency and accountability.

For better or for worse, regulators are right in saying that there needs to be a greater accountability in cryptocurrency transactions. Bad actors engaged in money laundering, terrorist activities, and financial fraud should be held accountable, regardless of whether they use fiat or crypto to complete their transactions. But hopefully, in Web3 this accountability can be achieved without governments resorting to shutting off privacy networks altogether and forcing people to use these blockchains “cryptographically naked.” Privacy should be seen as a basic right, and a measure of digital dignity.

For a long time, privacy and accountability were seen as a zero-sum game, where you could either hide your data and have privacy, or show your data and have transparency. The innovativeness of Web3 comes in its pioneering of elegant technological solutions, especially Zero Knowledge Proofs, to overcome this zero-sum dilemma. But the burden is on the Web3 community, not regulatory agencies, to show that these technologies can actually work in ensuring both privacy and accountability.

Far too often, Zero Knowledge Proofs are touted as the end-all-be-all for any privacy problem. But despite all their mathematical magic, ZKPs are far from being a panacea for all of Web3’s privacy concerns and have several critical drawbacks. Firstly, ZKPs are often highly specialized circuits used to prove a certain piece of information structured in a particular way. In general, they suffer from a lack of scalability and compatibility. Secondly, they are very expensive to create, run, and maintain, requiring orders of magnitude more of computation power than an equivalent non-ZKP program.

Thus, when thinking about ZKPs in the realm of privacy, the important question will always be “what” are you going to prove, and “why”? After all, there’s no free lunch, and designing a ZKP always will always come with a cost. It is just as irresponsible for tech evangelists to declare that ZKPs will solve everything in privacy as it is for regulators to shut down all privacy protocols.

Fundamentally, privacy in Web3 is not just an engineering question; it’s a first principles one. Ever since the release of the Bitcoin whitepaper and the commercial adoption of the blockchain, one of the foundational principles of Web3 is its emphasis on trustlessness — where you don’t need to trust information to any party that could potentially turn that trust against you. A network can only truly be trustless when its users’ privacy is guaranteed through a decentralized, transparent, and unbiased manner.

So what should privacy look like in Web3? That’s the most pressing question for us to decide.

🐦 @0xfishylosopher

📅 25 February 2023

References

[1] https://bitcoin.org/en/protect-your-privacy

[2] https://decrypt.co/resources/monero

[3] https://blog.pantherprotocol.io/ring-signatures-vs-zksnarks-comparing-privacy-technologies/

[4] https://z.cash/technology/zksnarks/

[5] The Gradescope example is from one of my previous blog posts, which discusses the principles of ZKPs (and zk-Sync v2.0) in more depth: https://medium.com/web3-insights/zk-sync-v2-0-and-the-future-of-zk-rollups-2d9617d5193b

[6] https://dailycoin.com/monero-xmr-darknet-darling/

[7] https://www.techtarget.com/searchsecurity/news/252512394/Monero-and-the-complicated-world-of-privacy-coins

[8] https://messari.vercel.app/article/on-chain-privacy

[9] https://www.coincenter.org/education/advanced-topics/how-does-tornado-cash-work/

[10] https://home.treasury.gov/news/press-releases/jy0916

[11] https://time.com/6205143/tornado-cash-us-crypto-ban/

[12] See more: https://zk.money/

[13] See more about dID: https://beincrypto.com/learn/decentralized-identity/

[14] https://www.coindesk.com/business/2022/10/27/bain-capital-crypto-leads-33m-round-for-privacy-focused-identity-protocol/

[15] Notebook Labs Whitepaper: https://assets.website-files.com/635b21dddd46c8cddf2171fd/635b21dddd46c8be9021722c_Notebook_Whitepaper.pdf

[16] https://securityboulevard.com/2022/09/y-combinators-summer-2022-cybersecurity-privacy-and-trust-startups/

[17] Technical discussion of “stealth wallets” omitted here for simplicity. Vitalik Buterin has a very clear schematic diagram of how the cryptography behind “stealth wallets” work: https://vitalik.ca/general/2023/01/20/stealth.html

What is Privacy in Web3? was originally published in Web3 Insights on Medium, where people are continuing the conversation by highlighting and responding to this story.

Web3.com Ventures Original Research Analysis

0xFishylosopher

Introduction

Ethereum is great — for most people at least. But one of the key problems of Ethereum and other public-facing blockchains is that there’s not that much customizability. Sure, you can write and deploy smart contracts, but as a single user or company, you can’t really do much about the consensus mechanisms, execution engines, and other underlying architecture. After all, you aren’t the only one using Ethereum, so you don’t really get to dictate the rules.

Suppose that you are building a cross-chain decentralized exchange that needs to aggregate data from all these different chains [1], or you want an on-chain real-time-strategy game [2], or you’re a Fortune 500 company tracking your supply chain. Ready-made public blockchains can’t really handle the thoroughput, data aggregation, or privacy requirements that these applications need. This is where the concept of an “appchain” comes in. Appchains are decentralized, application-specific blockchain networks that are designed to support specific use cases and meet specific requirements. Within this essay, I will explore three exemplary approaches to the emerging appchain landscape: the Cosmos ecosystem, Hyperledger Fabric, and Rollups-as-a-Service (RaaS), before discussing appchains’ rise affects the Web3 infrastructure landscape at-large.

Cosmos Network

The Cosmos network is perhaps one of the most important appchain solutions within Web3. Stretching all the way back to 2016, the Cosmos network aims to create an “internet of blockchains,” or the infrastructure of a multi-chain world. Essentially, Cosmos provides an software development kit (SDK), which provides developers with the tools and interfaces they need to easily build their own blockchain applications. While the SDK has some default architectures that come out of the box, such as the Tendermint PoS consensus protocol, developers are given a large leeway to overwrite these default architectures and design a blockchain complete with its own custom consensus mechanism, token standards, and smart contract platforms.

Within the Cosmos Network, there are two distinct types of blockchains: “hubs” and “zones” [3]. “Zones” are fairly straightforward to understand — these are just the application-specific chains that run the application (such as a decentralized exchange or on-chain game) itself. “Hubs” on the other hand, function to connect these “zones” and other “hubs” together in order to enable inter-chain communication through the “Inter-Blockchain Communication Protocol” (IBC).

At the center of the Cosmos network is the “Cosmos Hub,” which is the first “Hub” chain to be built on the Cosmos network, and essentially acts as a “Grand Central Station” for all other hubs and zones. Nonetheless, as shown in the diagram above, “Hubs” don’t necessarily need to connect to the Cosmos Hub. A private company, for example, could choose to launch its own private hub that connects its own private zones.

Indeed, the Cosmos SDK has a focus on customizability and interoperability, and developers are given a wide latitude to let their imagination run free. Within the Cosmos ecosystem are some major general-purpose L1 chains, such as the EVM-Compatible BNB Chain (originally Binance Smart Chain) [4]. For an appchain builder, the interoperability of the Cosmos network is incredibly enabling, as it allows the appchain to access data from a large variety of chains through the IBC. This is one of the reasons why many appchains built using the Cosmos network are oracles, multi-chain DEXs, and other services that require the aggregation of data from a wide variety of different chains.

Hyperledger Fabric

Another way to implement appchains is through Hyperledger Fabric, an open-source blockchain platform for building enterprise-grade applications and solutions. It is one of the projects under the Hyperledger umbrella, which is hosted by the Linux Foundation [5].

Like the Cosmos SDK, Hyperledger Fabric is designed to support modular blockchain network architecture and provide flexibility in building and deploying blockchain-based applications. It provides a plug-and-play architecture that allows components such as consensus, membership services, and smart contract execution (chaincode) to be easily added or replaced. But the most important difference between the Cosmos SDK and Hyperledger Fabric is one of audience: Cosmos SDK is oriented towards Web3-native users and developers, whereas Hyperledger Fabric targets enterprise-grade institutional clients. Thus, while Cosmos SDK focuses on building a decentralized, interoperable system, Hyperledger Fabric focuses on building private and permissioned networks, where participants must be explicitly authorized to join and participate in the network.

Indeed, enterprise-grade appchains operate in a vastly different way to Web3-native appchains. Whereas Web3-native appchains often focus on the tokenomics and use the blockchain structure to financialize their products, enterprise-grade appchains focus on using the blockchain as an efficient way of record and maintain data. Fundamentally, these enterprise-grade appchains leverage the fact that blockchains are tamper-proof, verifiable, append-only data structures that can have data-writers spread out across time and geographic locations. Essentially, a Hyperledger Fabric-based appchain simply seeks to replace the dusty, inefficient databases enterprises have maintained for decades.

As shown in the diagram above, essentially all of the “permissioned nodes” on the Hyperledger Fabric blockchain are employees in various parts of the supply chain, using the blockchain as a way of synchronously recording different data states — such as if a piece of produce has entered a factory or a store. There is far less of a focus of interconnectivity between different blockchains, and unlike Cosmos, there is no native support for inter-blockchain connectivity using Hyperledger Fabric. Instead, there are data APIs and interfaces for integrating with other blockchain networks or systems. This means that it is possible to build inter-blockchain communication solutions using Hyperledger Fabric, but it requires custom development and integration, unlike the built-in hub-and-zone design of the Cosmos ecosystem. Intuitively, this makes sense: as an enterprise-grade appchain, blockchains built using Hyperledger fabric are usually siloed away from the outer world — after all, you don’t want the public to be messing with your supply chain data.

One case study of Hyperledger Fabric in action is in managing Walmart’s supply chain. Walmart’s appchain, also known as the “Walmart Food Traceability Platform,” is a blockchain-based food traceability system designed to improve food safety and transparency in the supply chain [6]. The Walmart appchain allows for the tracking and tracing of food products from farm to store shelves, helping to quickly identify and isolate any potential food safety issues. At every stage in the process, suppliers had to upload labels and certificates of authenticity through a web interface onto the blockchain, where it would be permanently accessible to all of the relevant stakeholders. With the blockchain serving as a single “ground truth” of information, this greatly reduced the time to record and track food quality issues, such as food-borne diseases:

The Hyperledger Fabric blockchain-based food traceability system built for the two products worked. For pork in China, it allowed uploading certificates of authenticity to the blockchain, bringing more trust to a system where that used to be a serious issue. And for mangoes in the US, the time needed to trace their provenance went from 7 days to… 2.2 seconds! — Hyperledger Foundation [6]

Thus, Hyperledger showcases the use of appchains in an entirely different setting to Cosmos — to large, enterprise-grade use-cases where the blockchain is used as an alternate to traditional data-recording and tracing methods. Sure, one can argue that this use-case of appchains is “not really Web3,” simply because it doesn’t leverage tokenomics, decentralization, and crypto-native principles in the same way. But the enterprise adoption of appchains cannot be ignored — the underlying technology is the same, and it is a vital step to gaining public trust of blockchain technologies to enable mass adoption. And in the long run, if companies like Walmart have an appchain setup, it is far easier to integrate them into the “Web3-native” world.

Rollups-as-a-Service

A more recent alternate approach to building appchains is through the use of rollups, especially through “rollups-as-a-service” (RaaS). Rollups-as-a-service are a type of blockchain scaling solution that allow for off-chain computation and storage while maintaining the security and trust of the underlying blockchain. They work by batching a large number of transactions into a single, compressed transaction that is then recorded on an underlying L1 blockchain, most commonly Ethereum.

Rollups can be used for appchains because they provide a way to scale the processing and storage of transactions for dApps built on these chains, without sacrificing the security and trust of the underlying blockchain. While the developer may sacrifice some customizability in the underlying consensus layer compared with a Cosmos-based solution, there are several advantages of using a rollup-as-a-service for an application-specific blockchain instead of a full chain.

Perhaps the most important advantage is that there is no need for developers to bootstrap a validator set. Because the consensus and settlement is outsourced to an underlying L1, this results in not only a cheaper appchain solution, but also one that is more robust, as it is secured through the underlying L1. Moreover, because rollups are vertical solutions that are modular in structure, they are not constrained to a single blockchain framework, and can leverage data and functionality on multiple blockchains.

Essentially, in the rollup appchain model, L1 chains become the equivalent of “Hubs” that contain wealths of data and security. A gaming appchain, for example, could use a rollup-based solution where Ethereum’s security is leveraged for consensus and settlement, and Solana’s high-thoroughput can be leveraged for executional speed [7].

Rollups-as-a-service companies provide the infrastructure and services necessary for appchain developers to implement their custom appchain rollup solution. Different RaaS abstract this toolkit to different levels: some projects, such as the Op Stack [8], are SDK based, allowing the developer to customize the rollup fairly extensively, other projects such as Constellation focus on a complete no-code “white-glove” deployment solution, allowing appchain developers to focus on the “app” part of development, rather than the “chain” part of development [9].

The Implications of Appchains

The emergence and rise of these appchain solutions has several profound implications for the Web3 infrastructure landscape at large. Appchains usher in a paradigmatic change between the relationship between “chains” and “apps” from a supply-driven model to a demand-driven model.

Before, when infrastructure solutions were still maturing, and many modern infrastructure concepts such as Proof of Stake, sharding, and rollups were still in the proof of concept stage, infrastructure projects were often implemented for the sake of exploring the feasibility of these technical solutions. This is most typically the case in “third-generation blockchains” such as Avalanche, Cardano, NEAR, and Solana. The supply of these chains (their thoroughput and technical implementations) drove the demand for these chains. In other words, the design of the “chains” determined the the design of the “apps.”

However, the rise of appchains marks a distinct fourth-generation of blockchains, where demand for blockchains drives the supply of these blockchains. All of the technical routes presented above, the Cosmos network, Hyperledger Fabric, and Rollups-as-a-Service, present plug-and-play blockchain deployment solutions that are simple, customizable, and cost-effective. It has never been easier to design, customize, and deploy your own blockchain. Because of this, it is now the opposite way round: the design of the “apps” determines the design of the “chains.”

One likely result of this is that there will likely be a more concentrated L1 scene, with a shift from a monopolistic competition-style scene (where different L1s are slightly differentiated between one another) to an oligopolistic scene, dominated by a few key chains with enormous ecosystems and liquidity. This is because with the advent of appchains, there is less of a reason for top-level DApps to deploy on smaller L1s rather than run their own chain (with infinitely customizable features) or deploy an appchain rollup on a large, established L1. Smaller L1 chains simply cannot compete with the combination of large L1s and appchains in terms of flexibility, customization, security, and support.

Furthermore, appchains are also a key mechanism to institutional onboarding to Web3. As mentioned before, though enterprise chains such as Hyperledger are usually excluded from our typical idea of Web3, they leverage the same underlying blockchain technologies to achieve greater transparency in logistics and supply management. So why can’t this also be extended into payment and beyond? Thus, I believe that it will only be a matter of time before these enterprise-grade blockchains become more integrated with native Web3 DeFi, payment, and NFT projects. Already, there is some exploration into the feasbility of expanding the Cosmos IBC beyond just Cosmos appchains, connecting platforms such as Hyperledger Fabric and targeting other enterprise-grade blockchain solutions [10].

Conclusion

Nowadays, it is clear that there never was, and never will be a one-size-fits-all blockchain. Whether it be through Cosmos SDK, Hyperledger Fabric, or Rollups-as-a-Service, the maturity and ease of deployment for custom appchains will transform the Web3 infrastructure space into an app-first, user-first experience — a sign of growing maturity in Web3. The future of Web3 space is a multichain galaxy, and given their customizability, effectiveness, and ease of deployment, appchains will play an ever-increasingly important role in this universe, shining like stars in a galaxy of decentralization.

🐦 @0xfishylosopher

📅 6 February 2023

References

[1] Osmosis, a cross-chain DEX: https://osmosis.zone/

[2] Curio.gg, on-chain gaming company: https://www.curio.gg/

[3] https://newsletter.banklesshq.com/p/a-beginners-guide-to-cosmos

[4] See BNB Chain Whitepaper: https://github.com/bnb-chain/whitepaper/blob/master/WHITEPAPER.md

[5] https://www.ibm.com/products/blockchain-platform-hyperledger-fabric

[6] Walmart case study: https://www.hyperledger.org/learn/publications/walmart-case-study

[7] Example from https://messari.vercel.app/article/the-rollups-as-a-service-ecosystem

[8] See https://www.optimism.io/op-stack

[9] See https://constellation-labs.gitbook.io/constellation-labs-documentation/getting-started/overview

[10] https://medium.com/the-interchain-foundation/expanding-the-interchain-taking-ibc-beyond-cosmos-appchains-b0f9bebb4405

Disclaimer: the information presented above is purely educational does not constitute financial advice, and represent the views of the author alone.

Many thanks to my friends at Constellation Labs for their insightful conversations on Rollups-as-a-Service.

New to trading? Try crypto trading bots or copy trading on best crypto exchanges

The Appchain Galaxy: Where Everyone Gets a Blockchain was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

This article is a “vertical” introduction to Web3 that discusses the industry using three ideological pillars. For a “horizontal” introduction of how generations of Web3 projects have grown over time, see my sister article “A Family Portrait of Web3”

Introduction

There already exist too many articles that try to explain what “Web 3” is. So why am I bothering to write this article? As both a computer scientist and a philosopher, Web 3 is uniquely interesting to me because it is fundamentally an ideological revolution enabled by a technological evolution.

The most crucial technological underpinning of Web 3 is the use of the blockchain. The blockchain is to Web 3 what the steam engine was to the Industrial Revolution — the underlying technological leap that powered a whole generation of new mechanisms. Fundamentally, the blockchain is a publicly-viewable, append-only data structure that is unique in its merging of three distinct fields: cryptography, distributed systems, and game theory [1].

Each of these three fields have contibuted a pillar to Web 3’s ideological evolution. Specifically, cryptography enables trustlessness, distributed-systems enables permanence, and game-theory enables voluntariness. In this article, I will use these three principles as primary axes to connect the dots between a myriad of Web 3 projects and lay the technological innovations of Web 3 side-by-side with their philosophical implications.

Trustlessness — Powered by Cryptography

Long long ago in a faraway land, the word “crypto” was merely shorthand for “cryptography” rather than “cryptocurrency.” Cryptography has always been, and likely will always be, the key technology (pun intended) underpinning cryptocurrencies. Public-key encryption (or asymmetric cryptography) allows users to send data anonymously without having said data be compromised.

This encryption of data is extremely important when building a financial system, whether centralized or decentralized. This is because you want to prevent prying eyes from being able to view and steal your funds. Imagine the outrage if you found out that your bank didn’t take any measures to protect your financial data, and everyone could view every single one of your financial transactions. Scary stuff.

This is even more important when you have a decentralized financial system, such as the Bitcoin blockchain. There is no centralized entity that you can take to court. If you’re funds are hijacked mid-transaction, they’re just gone. Tough luck. This is why the Bitcoin protocol takes so much care in protecting transactions through public-key cryptography. For a transaction to be deemed valid, the user has to provide a “digital signature,” a cryptographic hash of data that requires the user’s private key to create but only the user’s public key to verify [2]. Furthermore, the “wallet address” from which the user is sending the funds from is itself a hash of the user’s public key, providing an extra proof of authenticity that the user signing the transaction is the author of the wallet. Even a user’s public key itself is not revealed until a user decides to send a transaction. [3] All of these minute design decisions in the Bitcoin’s protocol shows how the blockchain is designed to operate on a trustless basis: trusting the process, rather than the people. After all, math is reliable, while people are not.

Trustlessness can be used as an important discriminator to determine which projects are ideologically Web 2 and which ones are truly Web 3 native. Consider two stablecoin projects, Tether’s USDT and MakerDAO’s DAI. Both are aimed at the same goal of maintaining a cryptocurrency token pegged 1:1 to the US Dollar. But they implement this in diametrically different ways.

In the case of Tether, the model is very simple. Whenever I give Tether a dollar, Tether will give me 1 USDT, promising that I can exchange that 1 USDT back for 1 dollar whenever I wish. The problem is, I need to trust that Tether won’t run away with my actual USD and “rug pull” me, leaving me with worthless USDT [4]. Tether is therefore an ideologically a Web 2 project, as it relies on my trust that Tether will keep my original USD safe and not just disappear with it [5].

On the other hand, MakerDAO’s DAI is an ideologically Web 3 project, and is arguably one of the most successful decentralized projects. DAI is kept afloat through MakerDAO’s “overcollaterized” lending protocol. To borrow 1000 DAI from MakerDAO, I need to lock up at least $1500 worth of ETH as collateral [6]. For the DAI stablecoin, the “over-collaterized loans” used to mint these DAI become the backing of the currency. When the price of DAI drops below $1, people will buy DAI on exchanges to pay back their DAI principle at a discount, thereby reducing the supply of DAI and putting the price up. On the other hand, if the price of DAI goes above $1, then people are incentivized to “mint” more DAI by putting up their ETH as collateral. This increased DAI supply and ETH collateral will cause the price of DAI to go back to $1 [7].

Instead of trusting a single centralized entity, such as Tether, you only need to trust the decentralized MakerDAO smart contract code to check that it functions as expected. If you want, you can even copy paste the code into your own environment, and run a bunch of demo tests to ensure that it works as expected. This allows for maximal transparency, and is a paradigmatic example of Web 3 ideology [8].

Importantly, decentralization is a means, whereas trustlessness is an end. Decentralization in an of itself does not constitute a “first principle,” as it does not make sense when there are significant economies of scale to be exploited. Consider the case of the garbage truck collection. Imagine instead of having a centralized garbage truck collect the garbage each week and drive it to the dump, this was “decentralized” so that everyone in the neighborhood had to drive to the dumps every week to take out their trash. This is a massive and unnecessary inconvenience. Thus, decentralization is not a panacea that will make everything inherently better.

Rather, decentralization makes sense only when the advantages of trustlessness, permanence, and voluntariness outweigh the economies of scale forsaken. For now, let’s focus on trustlessness. In the case of the garbage collection example, there aren’t really any clashing incentives between the players involved. People generally don’t really have a burning desire to know what’s inside your garbage. And your garbage probably doesn’t contain your most secret and precious items. As such, the stakes of trusting a centralized entity, such as a community garbage truck, is very low, and the economies of scale gained from centralizing far outweight the cost.

But in the case of banking data and financial transactions, the opposite is true. There isn’t really that much of an economy of scale for you to keep your money in a centralized bank rather than in cash in your own safe. On the other hand, many people would have a burning desire to have your money. Thus, decentralizing a financial system to ensure a trustless network has advantages that far outweigh its costs. That’s why Bitcoin makes sense as a blockchain project.

Permanence — Powered by Distributed Systems

Fundamentally, economies of scale are also vulnerabilities of scale. Having a single point of failure is incredibly fragile, and not conducive for data “permanence.” Just as how animals reproduce to increase their DNA’s chances of survival in an uncertain environment, copying data to multiple locations and “nodes” makes this data much more resilient to bugs, hacks, and system failures. Decentralization, through storing the same data on various machines rather than a single one, is also a great idea to achieve this principle of permanence.

But coordinating data across distributed systems is a hard problem [9]. How do you deal with data corruption and the malicious actors that inevitably infiltrate the distributed network? The key idea that modern blockchains employ is the concept of “Byzantine Fault Tolerance,” which suggests that a blockchain should continue to operate so long as “bad actors” constitute no more than 1/3 of the network’s total nodes [10]. Essentially, when a node on the network proposes a block to append to the blockchain, it needs to gather the signatures of at least 2/3 of the node validators before it is deemed to be valid. This signature-gathering process is called “consensus.” While modern blockchains implement “consensus” in different ways (Bitcoin’s Proof of Work, Ethereum’s Proof of Stake, Solana’s Proof of History), they are all “Byzantine Fault Tolerant.” Crucially, as the number of the nodes increases, a “Byzantine Fault Tolerant” blockchain enjoys a decentralized economy of scale, where it becomes harder for a hacker to control enough nodes to attack the blockchain at the consensus level.

Now that we have established how “permanence” is achieved through distributed systems in the blockchain, we need to ask: what should be permanent and stored on the blockchain? Going back to the garbage truck example, you obviously don’t care if your garbage disappears (in fact you actively want for it to disappear). On the other hand, you obviously don’t want your money to suddenly disappear one day. So financial transactions, such as the Bitcoin ledger, are an obvious area where permanence is important. But that’s not all. There has always been an innate human drive to forge a permanence out of our impermanent life, whether that is through religion, stories, sculptures, or monuments [11]. Digital mementos, such as personal websites, photo albulms and game achievements all represent this desire for permanence in an everchanging life. These are just as precious to us, if not more, than our actual money.

Right now, we mostly store these items on a hard-drive, or in a cloud backup. But these are fundamentally unreliable. What happens if you lose your hard-drive? What if Google or Dropbox are hacked? What if they steal your data? These Web 2 solutions are fundamentally reliant on an element of trust; these companies can censor and delete your data any time they want. But the distributed consensus enabled Web 3 solutions are completely different. Herein lies the promise of a “permaweb,” one which can preserve your most precious digital assets for as long as you wish, without the worry of censorship [12].

One of the most prominent projects building the permaweb is Arweave, which promises permanent, distributed storage for a small upfront fee. While the design of Arweave is heavily inspired by the blockchain, it does not technically implement a blockchain. Fundamentally, a blockchain is a one-dimensional linked-list where one block points only to the last block. On the other hand, Arweave uses a “blockweave,” where each “block” can point to multiple blocks, forming a two-dimensional graph, similar to the “file system tree” on your laptop [13]. This design allows for a more efficient access of content. In the consensus mechanism, Arweave also uses a “Proof of Random Access” method, ensuring that every node can randomly access data stored on the blockweave.

As you may expect, Arweave and other decentralized “permaweb” protocols (such as IPFS) have a natural affinity with Non-Fungible Tokens, or NFTs [14]. If permaweb assets on Arweave and IPFS are a house, then NFTs are the house’s title deeds. The “house” itself may be available to view by anybody visiting it or passing by the street. But only the owner holds the title deed to the house. And when the owner sells the house to another owner, she doesn’t do anything to the house itself; she only hands it over the the buyer. Having a title deed NFT makes the ownership and transfer of the asset practical and cryptographically-ensured. Thus, NFTs are more than “vanity plates for crypto bros”; they have a practical use as title deeds of digital assets. But a title deed is only as valuable as the asset its pointing to. So let’s try and use NFTs to point to something other than the picture of an ape.

Voluntariness — Powered by Game Theory

A third tenet in the unique ideology of Web 3 is a game theory enabled voluntariness. People don’t become nodes on a network out of altruism or the kindness of their hearts. They’re in it for the money. This game theory induced voluntariness manifests itself in all sorts of places, most notably in the “Proof of Stake” consensus models that underlie many of the top blockchains, including Ethereum, Polygon, and Binance Smart Chain [15]. As the infographic shows, essentially you “stake out” a certain number of coins, such as 32 ETH on Ethereum, onto the network to become a validator and participate in consensus. If you are an honest actor on the network, you will receive “staking rewards,” reaching around a ~10% APY. On the other hand, if you are discovered to be a malicious actor, your staked coins (the 32 ETH) will be “slashed,” and you will lose all your rewards. So you have a game-theory incentive to be an honest node on the network.

Another application of game-theory induced voluntariness is in Decentralized Exchanges (DEXs) such as Uniswap and Curve, which decentralized smart contracts that act as cryptocurrency exchange stations. Where does the money for these DEXs come from? They come from voluntary users, called Liquidity Providers (LPs), that provide a pair of coins they own onto the exchange so that the traders can use to swap them. In return, these LPs will receive part of the transaction fees that the traders have to pay through the DEX, thus effectively earning “interest” on their pooled coins [16].

Crucially, unlike in Web 2, where Google and Facebook forces its algorithm upon you, no one is forcing you to stake on Ethereum or become a Uniswap LP. You use it out of your own accord, because you know you can have the chance for massive earnings. Ideologically Web 3 communities are completely self-voluntary, and community actions are fundamentally driven by game theory.

This idea of game-theory driven voluntariness is not only present in Decentralized Finance (DeFi) projects, but also Web 3 communities at large, most notably in the form of a DAO, or a Decentralized Autonomous Organization. These organizations bring together a bunch of people with a similar end-goal in mind (such as purchasing the US Constitution, in the case of ConstitutionDAO) [17], and allow people to democratically vote on proposals using “governance tokens,” or a token issued by the DAO to track membership and make collective decisions on how to spend community resources.

Unfortunately, today truly decentralized and ideologically Web 3 DAOs are rare. Many projects purport to be DAOs by having a “governance token” of some sort, but because the comapny that runs the project may hold the lion’s share of the tokens, even if there is voting, the project is de facto centralized. Thus, these governance-tokened “pseudo-DAOs” are ideologically Web 2 under the hood, even as they assume the luring façade of a decentralized organization.

Thus, game-theory induced voluntariness gives us another important principle to discriminate between ideologically Web 2 projects versus ideologically Web 3 projects. The former are characterized by having a single, centralized entity determining how users will interact with it, whereas the latter will have the users democratically vote upon the community’s collective actions.

Conclusion

Web 3 is still in its infancy, and still has a long way to go. Nonetheless, we can already begin to see its revolutionary view of the future, with an ideology based on trustlessness, permanence, and voluntariness. Of course, there are still a lot of structural issues that Web 3 has to face. For example, how do you move forward when the “company” behind a project and its community fundamentally disagree with one another? Does the company steamroll the community or abdicate its power to it? Furthermore, how can the blockchain be used to connect offline, real-life resources and objects? Or here’s another interesting problem: are financial punishments (such as slashing) enough to deter any malicious actors? Do we still need to resort to physical violence to truly “punish” people? I’m sure that in the future, more Web 3 native projects will gradually evolve out satisfactory responses to all these questions.

But there is one pressing and lingering question that remains: what will Web 3 do to Web 2? How will the centralized and decentralized internet interact with one another? Recall that fundamentally, an ideologically Web 3 project is a voluntary project. It relies on willing participants, incentivized by game theory rewards, to participate in the active maintenance of a decentralized community. If no one is willing to vote, participate, and commit, a DAO will either disband or devolve into a de-facto centralized entity. After all, a democracy doesn’t work if no one votes in it. But everyone has a limited amount of time, energy, and effort, and not everyone cares about the same things. So oftentimes, people may actually prefer someone else making decisions for them, as this takes far less mental effort — a Web 2 algorithm, which essentially has an AI making the choices for them.

Thus, I envision a world where Web 2 and Web 3 essentially coexist. In the parts of our lives that we really care about, perhaps a community project, art collection, or online game, we can actively participate and earn in a Web 3 DAO or community. But in the other parts that we would prefer to autopilot, we can use Web 2 solutions and AI systems that happily make the decisions for us. The important part is that Web 3 gives us a choice, a viable alternative to “choose our own destiny” for the parts of our lives that we really care about, as opposed to just having a totalitarian AI governing every facet of our daily routine. Remember that in Web 3, we don’t need to rely on anyone’s trust, we can ensure that what we do will be kept as long as we wish, and we can define our priorities on our own accord.

And so, the wind of freedom shall blow.

🐦 @0xfishylosopher

📅 14 October 2022

References

[1] From Prof. Dan Boneh, Stanford’s CS 251:

https://cs251.stanford.edu/

[2] See https://river.com/learn/how-bitcoin-uses-cryptography/

[3] Bitcoin Whitepaper: https://bitcoin.org/bitcoin.pdf

[4] Introduction to Tether: https://www.forbes.com/advisor/investing/cryptocurrency/what-is-tether-usdt/

[5] For more of the Tether controversy: https://www.forbes.com/sites/seansteinsmith/2022/08/28/crypto-accounting-matters-and-tether-is-finally-moving-in-the-right-direction/?sh=16a1241b72e3

[6] From Coindesk:

[7] See answer to https://ethereum.stackexchange.com/questions/89328/how-does-the-dai-peg-to-dollar/102052#102052

[8] Vitalik Buterin on MakerDAO’s significance:

[9] See State Machine Replication: https://en.wikipedia.org/wiki/State_machine_replication

[10] Details of Byzantine Fault Tolerance: https://decrypt.co/resources/byzantine-fault-tolerance-what-is-it-explained

[11] An interesting exploration of this topic is British philosopher John Gray’s book: “The Immortalization Commission”

[12] Introduction to the Permaweb: https://arweave.medium.com/welcome-to-the-permaweb-ce0e6c73ddfb#

[13] https://arweave.news/what-is-arweave-ar/

[14] https://docs.ipfs.tech/how-to/mint-nfts-with-ipfs/

[15] https://wiki.polygon.technology/docs/home/polygon-basics/what-is-proof-of-stake/

[16] Introduction to Uniswap: https://whiteboardcrypto.com/uniswap-v3/

[17] ConstitutionDAO: https://coinmarketcap.com/alexandria/article/constitutiondao