Digital Asset Industry Standards

Level 1 - NGMI

As we stated in a post early this summer, the lawyers are coming.

We started covering regulatory updates on a weekly basis not because we love reading about regulations, but because that is one of the core challenges the industry is facing today. We can no longer ignore the regulatory faceoff.

Sam Bankman-Fried, founder of Alameda and FTX, as well as numerous industry leaders seem to agree.

SBF released a v1 draft proposal for “Potential Digital Asset Industry Standards” here and is looking to crowdsource community feedback. This is a rare opportunity for those without the resources to take their views to Washington to provide input. We intend to use this opportunity and hopefully add value.

If you’re new here, we’re anon cartoons with backgrounds in software, wall street, trading, etc. We’ve been deep in DeFi as researchers for close to two years now. Given our backgrounds and experience in DeFi we hope to add some unique perspective.

SBF’s Proposal

Sam makes 3 proposals for regulating DeFi

1. Don’t censor the base layer - decentralized code is speech

2. Hosting a website (frontend / interface) for a financial app should require government licensing - GUIs hosted on Amazon’s AWS are centralized

3. Regulate marketing activities by or on behalf of DeFi protocols

There is no community appetite for changing core principles of the blockchain.

Permissionless access allows anyone to deploy a financial smart contract. Immutability means that the contract cannot be altered. Distributed consensus requires that everyone be able to receive a copy of the code. And current validator consensus rules mean that in practice anyone can make a transaction with the code. Even if some smart contract addresses are censored by a majority of validators, when a validator which does not censor gets to propose a block the transaction will be included.

The community is educated and motivated to reject base layer censorship, so any credible proposal must avoid requiring it.

Base layer censorship would be a worst case outcome of regulation. Referring to it in a proposal, even to argue against it, allows the positioning of less drastic solutions as an acceptable compromise by comparison. SBF is positioning his solution as a middle ground between base layer censorship and doing nothing.

This should be strongly resisted by DeFi leaders. Censoring the blockchain at the base layer is not realistic - politically or technically.

Our perspective on this is that stating he is not in support of base layer censorship (no one credible is) is intended to make the rest of the proposal more palatable.

If the community perceives the proposer as someone who shares their values (such as freedom of speech, openness, and lack of censorship), they are more likely to view the proposal favorably.

There is no obvious technical distinction between uploading software code to a public blockchain or to a public website. Any modern computer is capable of both hosting a website or a blockchain node and so these services are equivalently decentralized. The practical difference is that lacking technical skills presents a barrier to using the blockchain absent a web interface.

Imagine a politician proposes the following law:

Protests against the Mayor may not be conducted within 25 miles of City Hall

This type of law doesn’t regulate content of speech but rather the Time, Place, and Manner of speech. There’s an interesting body of First Amendment case law around this which we don’t have the space to explore in detail, but is good background as the problem has already been thoroughly explored by bright minds in a legal context.

A fair summary of this proposal would be: you can have your unregulated DeFi, so long as you don’t provide a web interface to it which would allow an ordinary non-technical member of the public to participate.

Source: Possible Digital Asset Industry Standards - FTX

Or more neutrally: Solidity source code deployed on a block chain is speech and must not be censored, but JavaScript source code deployed on a web server is not speech; and publishing this non-speech should only be permitted with a government license.

How could legal restrictions on frontends even be enforced?

Anyone can download a frontend from Github and run it locally, and frontends can also be hosted on Arweave or IPFS which are decentralized and censorship resistant.

Regulation of Marketing Activities

The third part of the DeFi proposal argues that marketing financial products to US retail investors is or should be a regulated activity and DeFi should not be exempt.

The US has thorough financial promotion regulations. There are two key things these regulations are aimed at:

• Traditional financial products are custodial. It is important for the promoter tell the truth about the product and the histories of the people promoting it because they are in a position to physically steal customer funds

• Investors must be provided with important information about an investment, including its risks, to enable an informed decision

DeFi is non custodial and a technically qualified person can inspect exactly what the software will do with their funds. It is therefore fully self-documenting.

We acknowledge that gaps in technical understanding are a problem.

The leading free-market based self-regulatory solution is to have a reputable auditor confirm in layman’s terms that the smart contracts execute in a way which corresponds to the protocol’s user documentation.

In the future, transaction simulation technology will improve to the point where an average retail user will be able to view what a financial product would have done with their money if they had deposited it.

Misleading marketing of traditional financial products causes harm. Some of these harms could transfer to DeFi if users do not take upon themselves the responsibility to ask for third party software audits or simulate how the financial protocol operates before depositing funds.

Our contribution to solving this issue is user education. Education can be cheap and accessible worldwide; whereas regulation and enforcement is very expensive and jurisdiction specific.

Disclosures for Tokens

SBF suggests a disclosure document for governance tokens could be required, modeled after a registration statement used in TradFi listings. This seems like a good idea and FTX has produced a draft statement for Bitcoin. Unfortunately, it has more pages than the Bitcoin whitepaper.

Perhaps we’re being idealistic, but we’re not keen on a priestly class interpreting finance for the masses. A document explaining to an investor what Bitcoin is shouldn’t be longer than the technical document which enabled builders to turn an idea for peer-to-peer cash into reality. We’ll just end up with a box ticking exercise where investors are deemed to have been warned about the risks in a dozen pages of legalese which they didn’t read.

Stablecoins

any stablecoin holding itself out to be stable relative to the US Dollar should be backed by at least as many US Dollars (or federal government issued treasury notes/bills) as there are stablecoin tokens in circulation, and should maintain up to date and public information and audits attesting as such.

The first decentralized stablecoin was Maker DAO’s Single Collateral DAI, a token backed only by ETH collateral. Maker, by necessity, produces an unfalsifiable and current record of its reserves to anyone who can access the public blockchain.

It is likely that this proposal will be read by many people who are not familiar with how MakerDAO works. We think it is disingenuous to ignore the decentralized CDP model when there is a live implementation with a proven track record securing billions of dollars and running for half a decade without default. The only stablecoin solution acceptable under these proposals is a centralized full reserve model, but no reason is given for rejecting alternatives. It’s unclear why discussing alternative stablecoins is entirely omitted in the current draft.

A Community Standard for Hackers

Hackers should be compensated for discovering bugs if they whitehack the contract and transfer all the funds, minus their authorized bounty, back to the protocol.

The authorized bounty is proposed as the minimum of:

• A fixed dollar amount (perhaps $5M)

• A fixed percentage of the exploit value (perhaps 5%)

• The threshold beyond which paying the bounty would involve loss of customer rather than protocol (treasury) funds

SBF has been clear that the exact values and percentages are up for discussion, so we won’t comment on ideal values. Our feedback concerns incentives which were not explicitly discussed in the proposal.

First, we think that if a community has decided on a fair and acceptable bug bounty, then that bounty needs to be paid, even if it means customers funds suffering a haircut. Perhaps this haircut could be capped to some percentage of funds deposited.

Why? Customers take on risk when they elect to use a DeFi protocol. Establishing a norm that customers are always made whole favors VC backed incumbents or protocols with large treasuries over new challengers. If customer funds are (partially) at stake, customers will have an incentive to enforce responsible security behaviors from the protocols they use and pay fees to.

Much of DeFi facilitates investment activity. Investment activity comes with risk. Instead of counterparty risk in DeFi, we have smart contract risk. It’s reasonable for some of this risk to be borne by the customer.

The second reason to ensure that a whitehat is always paid is incentives. If a protocol isn’t rich enough to pay the full bounty, and the norm is that bounties can never be paid from customer funds, a rational whitehat won’t spend time auditing the protocol. This makes the protocol more likely to be exploited by an outlaw actor, e.g. North Korea, who will not return any funds, who may be immune from law enforcement.

Finally we need to consider incentives at the team and investor level. Whatever value the community decides on for a bug bounty must both fairly compensate the hacker and serve as a deterrent to the team. The team have ultimate responsibility for and control over the security of the product. Nobody else does. Not users, not hackers. Teams, advised by their investors, should make appropriate ongoing investments in software security. They will only do so if they face financial consequences if their protocol design or implementation is vulnerable to a significant hack.

Sanctions

This section begins with the premise that everyone should respect OFAC’s sanctions lists. We’re not sure that should be a given, and cite three contrary examples:

• The issuer of the Tether stablecoin stated it would not freeze Tethers in Tornado Cash addresses sanctioned by OFAC

• Paxos, the issuer of Binance’s BUSD, also did not freeze Tornado Cash addresses

• Four plaintiffs have sued the director of OFAC, believing the sanctions imposed on Tornado Cash addresses to exceed the authority given to the agency by law (the legal reasoning was covered by DeFi Education last week)

The section continues with suggestions to use automation to minimize delays between sanctions being applied and funds being frozen in practice.

Private Blacklists

SBF proposes that “trusted actors” - presumably exchanges - create and share lists of addresses they suspect are associated with crime.

Source: Possible Digital Asset Industry Standards - FTX

Legal remedies to freeze funds in these addresses exist in the form of court orders and OFAC sanctions. It is unclear why we need an additional list, with mere suspicion forming the lower bar to flagging an account.

When a government agency sanctions economic activity, it must be open about which addresses are being sanctioned and why. It can be sued if it acts beyond its authority. It is accountable in court if it acts arbitrarily or capriciously which implies that the agency must create and follow fair standards in accordance with the law.

Private companies are under no such restrictions. And SBF does not address the important question of how the “trusted actors” under this policy are expected to earn their trust from the community, and the consequences for betraying that trust. In particular the proposal does not contain information on how an innocent party could have their addresses removed from the “suspected to be associated with crime” list.

And the proposal is silent on what the lists should be used for: the proposal only states that many people may find it useful to reference the lists.

We infer that he expects some participants - perhaps exchanges or recipients of payments - will consult the list and treat payments involving these addresses differently. Whether that means requesting further information as to the identity of the account holder and the origin of the funds or declining to interact with the address at all is not specified.

Our Feedback and Recommendations

• Code is Speech: censorship of website frontend code instead of blockchain code requires Great Firewall of China scale restrictions to be effective. The US DeFi community should not tolerate unconstitutional restrictions on the Time, Place, or Manner of online speech, including publishing software code.

• Stablecoins: MakerDAO has proved that an overcollateralized USD stablecoin backed by non-dollar collateral can remain solvent. DeFi native CDP stablecoins necessarily publish a public, up to date, and tamper-proof account of their reserves. There is no need to mandate that stablecoins be centralized on the full reserve model and people should learn about proven DeFi alternatives.

• Hacks - incentives matter: both the protocol and users should jointly contribute to bug bounties where necessary to pay the whitehat in full; bounties should be generous to whitehats and large enough to incentivize protocols to invest in security.

• Regulation by Corporations could be worse than by Government: Governments are (usually) accountable, private corporations less so. The community should strongly resist types of restrictions which would be politically impossible or illegal when imposed by the state being enacted instead by a voluntary association of corporations.

  This is the “free speech on social media” issue writ large, but this time YOUR freedom to use financial services is at stake. We are distrustful of associations of private companies creating customer blacklists, especially under conditions of oligopoly.

• We have adequate systems already: sanctions and freezing orders can be applied by government authorities (OFAC and courts) in accordance with the law. There is oversight and accountability and a clear path for citizens to challenge unfair decisions.

Concluding Thoughts

This is a serious matter and we hope that people take our feedback and recommendations to heart. The community has a chance to have a voice here but it needs to come from a place of constructive feedback even if we disagree.

We side with DeFi not CeFi. In the long run, we will support centralized businesses that defend open finance and the core principles the industry is built on because otherwise, why are we even here?

Until next time.

Disclaimer: None of this is to be deemed legal or financial advice of any kind. These are opinions from an anonymous group of cartoon animals with Wall Street and Software backgrounds.

• Security: Our official views on how to store Crypto correctly (Click Here)