Proof of reserves is the easy half

Every few months an exchange posts a "proof of reserves". Usually it is a wallet address, a signed message, and a round number with a lot of zeros. A few people verify the signature, and everyone moves on feeling a little safer.

The appeal is easy to see. It is a real cryptographic claim, and anyone can check it. But it is worth being blunt about what it does and does not tell you, because the gap between those two things is where people lose their money.

Two numbers, one shown

Coverage is a relationship between two numbers: what you hold, and what you owe. An institution's reserves cover its obligations when the first is at least as large as the second.

A reserves attestation shows you the first number. It proves that on a given block, some keys controlled some assets. It says nothing about the second number. And the second number is the one customers care about, because it is the sum of every promise the institution has made to pay someone back.

Showing your assets without your obligations is like proving you have cash in your wallet while staying quiet about your debts. The cash is real. It is also beside the point if you owe more than you hold.

Why the missing number is the dangerous one

There is a reason reserves get published and obligations do not.

Reserves are flattering. They sit on chains anyone can read, and a big number looks like strength. Obligations are the opposite. They are spread across internal ledgers, and a big number looks like risk. So the easy half gets a press release and the hard half stays in a spreadsheet.

That asymmetry is what makes the missing number dangerous. Reserves can be borrowed for the morning of a snapshot and returned that afternoon. Obligations can drift above assets for months between attestations, and no outsider would see it.

A snapshot of one number, taken on a schedule the institution controls, is not assurance. It is a photograph of the half that was never going to look bad.

What a useful coverage claim looks like

A claim worth relying on does three things the attestation does not.

It includes both numbers: assets measured against the full set of obligations, with every customer balance in the sum. Leaving one out has to be impossible, and discouraging it is not enough.

It is checked somewhere the institution does not control. A number an institution can edit is a number it will eventually be tempted to edit. The check belongs on a public chain, where verification is the network's job and not a line on a status page.

And it keeps individual accounts out of public view. The public result is the two totals, a commitment to the customer balances and a ledger number. Covered, short and stale states are coming soon. Nobody's balance is listed one by one.

In shorthand, the claim you want looks like this:

prove( reserves >= sum(all_customer_balances) )
  .publish("stellar")   // anyone can read, no one can edit

That is a proof of reserve coverage. Solva runs it against the institution's books, a contract on Stellar checks it, and the public reads the result.

Where this leaves us

Reserves proofs are not dishonest. Most of them are accurate. The problem is that they answer the easy question and let people believe it was the hard one.

The hard question is whether an institution can pay what it owes, checked again on every proof cycle rather than on one convenient morning a quarter. Daily cycles for live institutions are coming soon. Answering it means proving an inequality over two numbers instead of publishing one. It is more work, and it is the work that counts.

That is what Solva is built to do. Our other notes cover how: the commitment that keeps every balance in the total, and why the check lives on Stellar. In the meantime we would settle for one change in how we all read these announcements. When you see a proof of reserves, ask where the other number went.