The controversy over a cryptocurrency's secret bug fix. On Tuesday, The Zcash Company, the for-profit company in charge of maintaining the cryptocurrency Zcash, made a shocking revelation: it had acted in secret to fix a software bug that would have given an attacker the means to create "fake" Zcash.
What's shocking is not that Zcash had a flaw. It's that just a handful employees knew about it and (as far as we know) kept it secret for eight months before fixing it. The way the team handled the issue probably wouldn't be quite so controversial if Zcash were a traditional software company. But this is crypto, where enthusiasts expect everything to be transparent and decentralized. Perhaps more importantly, this episode is a reminder that we lack clear definitions to distinguish between "centralized" and "decentralized" blockchain systems—even as policymakers have begun attaching real legal implications to these labels.
The story begins in March. According to a lengthy blog post, that's when Zcash cryptographer Ariel Gabizon discovered a "subtle cryptographic flaw" in an academic paper Zcash relied on to develop its technology. Zcash uses a fancy cryptographic tool called a zero-knowledge proof to let users transact anonymously. It allows transactions to be validated without giving away any other information about them.
The vulnerability Gabizon found is subtle enough that expert cryptographers missed it for years, write the authors of the blog post. In fact, that's one reason the company believes that no one else was wise to the flaw. "Discovery of the vulnerability would have required a high level of technical cryptographic sophistication that very few people possess," they write, adding that they've seen no evidence that any counterfeiting has gone on (though they admit they can't be certain).
After discovering the bug, the small team in the know decided the safest course was to only disclose it after it was fixed. According to Fortune, they used encrypted communications and "carefully selected confidantes to prevent rogue insiders, spies, or hackers from gaining knowledge of the vulnerability." Finally, in October, they snuck the bug fix into a upgrade that had been planned beforehand.
Assuming we trust the company's confidence that leaving the bug un-patched for so long was safe, since so very few people have the cryptographic expertise to exploit it, we've still got to ask: does the company's actions here mean Zcash is actually centralized?
Unfortunately, we aren't yet able to reach a meaningful answer, since we still don't have an agreed-upon definition of "decentralization." To date, this hasn't had much real-world consequence; debates over whether certain coins are truly decentralized have been mostly ideological. But given that "decentralized" is transitioning from a marketing term into one that has real legal implications, this is problematic, writes Angela Walch, a professor at St. Mary's University School of Law, in a new academic paper. "If we gloss over what (decentralization) means, we risk unintended consequences when these systems do not behave like we expect them to."
Take, for instance, a speech delivered in June of 2018 by William Hinman, director of corporation finance for the US Securities and Exchange Commission. In it, Hinman called both Bitcoin and Ethereum "sufficiently decentralized" such that their cryptocurrencies should not be regulated as securities, a category that includes stocks and bonds.
But since decentralization hasn't been defined, Hinman's standard is difficult to pin down. Other parts of his speech contradict his conclusion, argues Walch. For instance, Hinman says a digital asset may be a security (read: centralized) if "information asymmetries" exist between the promoters and the potential buyers (i.e some people know more than others about its internal workings). If a small number of developers are keeping secrets, this kind of asymmetry does exist, writes Walch.
We've already seen this happen in Bitcoin and Ethereum, she argues. In September of 2018, fewer than a dozen developers of Bitcoin Core, the main Bitcoin software client, waited for days before disclosing a critical bug they had discovered in the latest version. In November, lead developers for Ethereum faced backlash from some in the community after they held several private meetings to discuss proposed software upgrades.
As for Zcash, Walch tweeted on Tuesday, if four people keeping a critical bug secret for months doesn't demonstrate centralization, "I don't know what would." Even if that's true, so what? Presumably, policymakers will eventually tell us—once they decide what decentralization actually means.
Featured EmTech Digital speaker: Brendan McCord, Senior Advisor for AI, US Department of Defense
Every industry leader should be considering how to implement ethical AI. Brendan McCord will join us on stage at EmTech Digital for his session on Purpose-driven AI: Responsibly Addressing Our Big Problems. Purchase your ticket today.
Loose Change
Fill your pockets with these newsy tidbits.
-
A Canadian judge has temporarily paused lawsuits against QuadrigaCX, the cryptocurrency exchange that claims it has been locked out of $140 million worth of customer funds since its founder, who supposedly had sole access to the funds, died in December. (Reuters)
- Meanwhile, researchers are scrambling to make sense of the QuadrigaCX story by analyzing blockchain data. (Bloomberg)
- Scientists have been turning to blockchain technology to record and timestamp new experimental data. (Nature)
- Blockchain startup Abra will add a new feature that lets its global user base invest in stocks and bonds using cryptocurrencies. (The Block)
- A new study from South Korea's central bank has found that issuing a digital currency might leave commercial banks with a cash shortfall, which would lead to financial instability. (CoinDesk)
