Get Bucks for Bugs

Headline:  What is a “bug bounty attetmpt” within cryptocurrency?

Body:  I remember in Fifth grade, Mr. Turner’s class, if we found an error in a ditto he passed out (remember them?) then we would be paid 2 little Tootsie Rolls.  (I even once found a mistake in our textbook and wrote a letter to the publisher, mentioning the  candy reward.   I got a thank you letter with 5 Tootsie rolls.)  These Tootsie rolls could be considered a “bug bounty.’  But instead of a mistake in front of 30 10-year-olds, some mistakes are much more catastrophic, potentially.  Today, there are hack-a-thons where tech companies pay hackers thousands of dollars to spend 2-3 days in a hot conference room, doing their utmost to break the code or website put before them.  This is all in an attempt to only put out the most bulletproof code possible.  This is why there are bug bounties offered.

So, have there been any shenanigans in the real world related to this?

Yes.   In a French Court, 2 brothers admitted to stealing $8.5 Million   When tracked down, the 2 brothers explained that they were “ethical hackers” and were going to return all the funds, when a 10% bounty was offered.  The brothers were cleared of all criminal charges.

The U.S. government, thru agencies such as the NSA, have to deal with hackers on a regular basis.   So, for decades now, there was an arms race of sorts, to see who the best hacker was, a la Wile E. Coyote and the Road Runner, though with more serious ramifications.  But, now DoD has realized the value of these hackers to provide advanced warnings of weaknesses that could become exploits by foreign powers. So, Secretary Carter authorized  a cash rewards program to hackers who point out bugs before exploited by foreign governments.  Over 24 days, 130  vulnerabilities were discovered and fixed in outward facing websites.  The Army did a very similar thing and found 100 vulnerabilities and paid out just under $100,000.  Hack the Air Force followed with similar success.  Pursuant to the successes, there was an open-ended program opened up where rewards didn’t exist, but it was permitted to probe the government websites.

“It’s one thing for a company to come forward and work with their general counsel to do a bug bounty,” Rice says. “It’s a completely different thing entirely for the organization that really initiated the Computer Fraud and Abuse Act and that early hostility toward security researchers to openly start engaging and working with them. The weight that the DoD brings when they pair with the DoJ to say ‘hackers can do good,’ that just doesn’t exist anywhere else.”  Google seems to have instituted a similar program, and some programmers have earned up to $30,000 in bounty revenues.

So, yes, they can be effective, can they also be efficient?

Yes, they can also be efficient.   It is true that Google has paid over $5,000,000 in bug bounties, but contrast this to the cost of hiring, training and overseeing this many new employees, and the bug bounty program is efficient indeed.  Moreover, they can write their own terms for a “successful report” to obtain the award.

The Verdict

This is a tough one, so let’s think it through.   On one hand, the value of this type of “red-teaming” exercise  has been noted for many years.  Regularly, banks will have hack-a-thons.  Hundreds of geeks armed with laptops and 2-liter bottles of Mountain Dew descend upon a Las Vegas ballroom with the assignment to defend their own tokens within a network.   At the same time, they have to actively look for the tokens of other teams, hidden throughout the whole network.  Dozens of potential bugs have been found in this way, and it is highly effective.

But, herein lies the rub; The men and women most likely capable of an exploit this ambitious, are likely the same ones gathered in this ballroom.  Even though a game, they are continuously learning bit by bit, what the defense looks like.   What blind spots do they have?  All kinds of small details that would be vital when planning an attack.  This learning would make these programmers even more attractive to the bad actors who might pay them or force them to act.  In the end, I can’t imagine that anybody can prove we aren’t stealing from Petrov to pay Sergey.

REFERENCES

https://www.pcmag.com/news/google-expands-bug-bounty-program-to-include-generative-ai-attacks

https://www.wired.com/story/hack-the-pentagon-bug-bounty-results/

https://www.mentalfloss.com/article/589620/google-chrome-bug-bounty-program-increases-rewards

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

Sushi, anybody?

Headline: 

Body: 

What are the new KYC requirements for a Decentralized Exchange.

Uniswap, Sushiswap and many others are all examples of decentralized exchanges (DEX).   These DEX often charge no gas fees and have fewer  requirements for their users, but require more technically, from each individual user.  Now, normally, these requirements are no big deal for the average user.  But, some are quite adamant about protecting their identity.   So, it only seems appropriate that there be some standard.   Thus, at least for some countries, there are KnowYourCustomer (KYC) requirements before somebody can trade on that platform. 

To solve this conundrum, some are opting for an e-KYC solution.   Think of this as an escrow service.   But, instead of checks being circulated, the escrow agent is there to confirm all aspects of a client’s identity.   Then, when any exchange inquires, that 3^rd party  effectively says, “It’s all good, this is a real person.”  This is a very interesting approach because it takes the onus off of the exchange.  Though, the obvious question presents itself: How does one know they can trust the 3^rd party?  It would seem that we have to wait for this answer, as most entities appear to be in an early series of rounds of raising capital.  None appear to be mature at all.

So, what exactly ARE KYC regulations?

These are Know Your Customer requirements.   Most of these revolve around knowing that the wallet number refers to a single person.    Other identifying information is required and furnished, to include pictures of Driver’s Licenses or other identification papers.  These are required by all centralized exchanges like Coinbase or Binance.  But, as you might remember, there is another kind of exchange too,the decentralized exchange or the DEX/  

First, DEX is a bit of a misnomer.   The exchange does run based upon smart contracts and other code, this is true.  But, there has to have been at least a small corps of coders who put the exchange together.   You can bet your bottom dollar that these coders continue to profit based upon their work.  Regardless, some people do prefer the “lighter touch” of this type of management.   What they have to be aware of is that if more people are incentivized to use the exchange (by making it easier to use) the more likely they are to derive a profit from that exchange.  That said, a DEX is considered to be decentralized as it is neither a financial intermediary or a counterparty to the transaction.  For this reason, they can bypass most KYC regulations.

Second, it is undeniable that almost all exchanges are facing more stringent KYC requirements from governments.   (Binance added KYC requirements to comply with regulations in the U.K. and Japan.)

So, where in the world are we now?

Well, as it refers to cryptocurrency, many people would claim that location is irrelevant.  But, this appears to be not true.   In a study by CipherTrace, the Seychelles are notably poor at enforcing KYC requirements.  In fact, one person in the BitMEX case opined that local officials there could be bribed with “a coconut.”

As it relates to the U.S., it appears to many that over the long run, the DEX within the U.S. will be forced to shut down.  If they chose to comply with the Bank Secrecy Act (BSA), they would give up the decentralized nature that makes them attractive in the first place.  Arguments that a DEX is unable to do KYC without creating a honeypot of personal information lack technical merit and imagination. Multiple teams are already building identity solutions based on zero-knowledge proofs, a cryptographic method that allows one party to prove it has certain data without revealing that information

DEXs also have a unique and single-purpose suite of software, Automated Market Making or AMM, which allows liquidity providers to match with buyers and sellers, and pull in or determine a price for a given asset. This is not general-purpose software that can be leveraged for multiple use cases, as is the case with BitTorrent’s P2P protocol, which moves bits quickly and efficiently for Twitter, Facebook, Microsoft and video pirates. An AMM has a single purpose and produces a profit for teams.

Verifying user identities and checking that money and tokens are not illegal helps ensure some level of protection from cybercrime. It makes DeFi safer for users and more feasible for regulators and policymakers. To survive, DEXs will have to eventually admit this and adopt a level of identity verification and prevention of money laundering.

By implementing some of these solutions, DEXs can still deliver on the promise of DeFi. They can remain open for users to contribute liquidity, earn fees, and avoid relying on banks or other centralized entities while remaining pseudonymous.

If DEXs choose to ignore the regulatory pressure, it can end in one of two ways. Either more legitimate platforms can continue to adapt to growing government scrutiny and rising demand in crypto from more mainstream investors, who require usability and security, thereby leaving stubborn DEXs to die, or alternatively, unadaptable DEXs will move into the gray market of far-flung jurisdictions, tax havens and unregulated cash-like economies.

 REFERENCES

DEXs and KYC: A match made in hell or a real possibility? (cointelegraph.com)

What Is KYC and Why Does It Matter For Crypto? (coindesk.com)

Identity is the antidote for DEXs’ regulation problem (cointelegraph.com)

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

There is Now Accounting for Tastes.

What is AEM  Journaler and how well does it integrate with Quickbooks and other often-used accounting software?

We have had accountants of various types since time immemorial.   I am sure that in Ancient Greece, they had accountants quantifying volumes of wine, in Persia, there were accountants quantifying amounts of gold, and many other examples.  For years, the biggest changes have been to write down those changes, and then to install a standard protocol for writing down those transactions.   Centuries have come and gone and nothing else has changed very much.   But, recently computers have been introduced to accounting, and the game changed.    As cryptocurrency is invited to the party, it makes sense that these newly-introduced computers would be involved in dealing with the subsequent challenges of cryptocurrencies.

And so they are.   One of the newest pieces of software (so new, the writing of this entry has proven difficult) is called AEM Journaler, and it aims to simplify the reporting of transactions using cryptocurrencies.  This is not a simple thing, as to be helpful, Journaler has to integrate seamlessly with Quickbooks and other accounting software using fiat currencies (Quickbooks certified it in 2023.)    AEM software is special because, along with the traditional accounting functionalities, there is an associated wallet that will allow for storage of dozens of different cryptocurrencies.

The words of the CEO. Jakub Sawczuk, are interesting because they reveal the mission of AEM Algorithm. “At AEM Algorithm, we’re pioneering the future of crypto accounting by bridging the gap between traditional financial systems and the blockchain era.  We aim to empower businesses worldwide with accessible, efficient and secure solutions for managing crypto assets and push the boundaries to deliver something unique.”  Unique indeed; at some future date, AEM is looking into the floatation of its own token.   The objective appears to be their attempt to offer a cryptocurrency exchange of some sort.   Learning more about this software and its ilk, seems important as their impact spreads worldwide from Australian HQ to facilities in Hong Kong and China.

 Why is this so important?

This type of software is so important because cryptocurrency is so volatile.   We have already seen it as being explosively price volatile, even the definition of what cryptocurrency is,well squishy.  Per the IRS, cryptocurrencies are property on which you report a loss or gain on disposition.  But, for the larger from of accounting (governed by GAAP as espoused by the FASB) the question is still a much debated one.  They are not cash or cash equivalents due to their price volatility; they are not financial instruments  or securities because they are not an ownership interest, and they are not inventory because they lack physical substance.   They are intangible assets of indeterminate life, that need to be tested for impairment annually.  (To me, this is interesting; I work for the IRS and I am a  CPA, so when I see daylight between definitions, I see potential problems and potential solutions.)

The Verdict

Right now, AEM seems to have a very good product.   It seems to work well with Quickbooks and other systems.  I read that they seem interested in providing their own exchange too, and they are going to float their own token to pay for the project.  Unfortunately, ala FTX, 3-Arrows Capital and others, I smell a problem.  As you have an exchange, special product and a cryptocurrency of your own, I see the makings of a very tempting revisit of FTX.  I hope I am wrong, but we’ve seen this pattern a minimum of 5 times now, so, it might take some divine intervention to prevent.  Might that be the reason that all of our real money says, “In God we Trust.”?

REFERENCES:

Preparing business accounting for the crypto era with advanced tools (cointelegraph.com)

AEM Algorithm unveils Journaler as a global solution for reporting crypto (cointelegraph.com)

Accounting for Cryptocurrency Purchases, Sales and Receipts | BDO

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

The Fed Might Be Showing Some Reserve?

Headline:  What is the responsibility of the Federal Reserve to regulate cryptocurrency?

Body:  The Federal Reserve is so important to the financial transactions of this nation.  It is vital to the underpinning of banking, as it ensures a lender of last resort and it ensures that a run on one bank will not translate to a run on multiple banks that could be a major shock to the financial system.  So, it makes sense that if cryptocurrencies are really important to financial well-being, the Federal Reserve would be involved.  But, despite all of the readings I have done, I have not yet found a reference to what portion of the governance they would have to do.  So, let’s look at this.

How the Federal Reserve regulates cryptocurrency

The Federal Reserve is focused on regulating banks and the United States dollar, so cryptocurrencies are generally outside its sphere of influence. Crypto and the Fed overlap when banks hold cryptocurrency as an asset on their balance sheets.  And given the performance of Bored Apes, cryptokitties, Bitcoin and Etherum, this collection of digital assets is immense.  (Are you flashing back to Silicon Valley Bank, Signature Bank or Silvergate?   Yes, digital assets can form an outsized portion of the holdings in a bank.)  In this regard, it makes sense that the Federal Reserve would become important in the governance of digital assets.

The Federal Reserve decided that cryptocurrency-related assets must be disclosed separately by banks. New cryptocurrency asset activities require notifying the Federal Reserve. Banks are urged to consider the risks of crypto to their asset portfolios.

A new digital dollar?

The Federal Reserve popped up in crypto news recently to explore a Central Bank Digital Currency (CBDC), or digital dollar. In this case, the Fed is looking at creating a digital version of the US dollar that’s managed by blockchain technology. Other countries, including China, are also exploring using a CBDC.  At this point, the Fed issued a paper looking at the pros and cons of creating a new CBDC and solicited public feedback. Currently, banks and credit unions hold digital ledgers for our money. With a digital dollar, dollars would become part of a more transparent system, but there are still plenty of risks and issues to iron out before we can expect the Fed to move forward.

The Fed made it clear that it does not intend to proceed with a CBDC without clear support from the executive branch and Congress, ideally in the form of a specific authorizing law. On February 7, the Fed’s Board of Governors issued a policy statement clarifying permissible activities by member banks which would “presumptively prohibit” member banks from holding most crypto assets as a principal. Member banks wishing to issue dollar tokens will need to prove certain security measures and receive formal approval prior to their use in banking transactions.

The Federal Reserve is putting together a “specialized team of experts” to help it supervise the crypto sector, Michael Barr, the central bank’s vice chairman for supervision, said Thursday.  The Fed’s top regulatory official said the digital-assets specialists are needed to “help us learn from new developments and make sure we’re up to date on innovation in this sector.”

 “While crypto assets are hyped as decentralized, there has been an emergence of new, quite centralized intermediaries that are either not subject to or not compliant with appropriate regulation and supervision, which has perpetuated harm to consumers,” said Barr, who once worked as an adviser for Ripple, the issuer of the XRP token. “Our overall stance is that, at this stage of the development, banks should take a careful and cautious approach to engaging in crypto asset-related activities and the crypto sector.”

 An Aug. 8 announcement by the Federal Reserve Board established the Novel Activities Supervision Program, which aims to limit certain crypto-related activities and facilitate a more fair playing field for banks involved in servicing the digital asset industry.  While the program looks to provide stricter oversight on U.S. banks, the Federal Reserve implied that it isn’t discouraging state banks from cutting ties with industry, presumably including the digital asset firm sector.

The Verdict

This is interesting because the Federal Reserve is not a government agency, so their approach appears to be slightly different.  Instead of staking out their portion of cryptocurrency to regulate, they seem to be more interested in getting Congress to act and provide legislative solutions.   At the same time, they seem to want to educate consumers as to the real risk of cryptocurrencies, as much of their attention appears to be on stablecoins.  I hope their approach wins the day.

REFERENCES

Does The Federal Reserve Regulate Cryptocurrency? (forbes.com)

The (somewhat lively) state of crypto regulation – Thomson Reuters Institute

Federal Reserve Setting Up New Squad of Crypto Specialists (coindesk.com)

US Fed steps up oversight of banks’ involvement with crypto firms (cointelegraph.com)

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

Does This POSA Problem???

Headline: 

Body:  So, as a confirmed capitalist (really, a broker once dribbled water on my head, maybe it was beer?) I become instantly interested and alert (maybe a bit cynical) when I read about a “non-profit” organization that has a mission of representing an industry.   The Proof of Stake Alliance (POSA) therefore caught my attention.  They do advocacy work on behalf of cryptocurrency firms, and my antennae went immediately to full height.

So, what do they DO?

Good question.    They largely do advocacy work to make it easier for people to take advantage of blockchain technology.   They focus most upon issues related to staking.  Particularly, they are interested in reasonable taxation of staking rewards, and engineering of a commonsense legal framework to encourage liquid staking.  (I was intrigued to read that the industry uses the phrase “staking reward” because “interest” is such a traditional finance term.  This protocol should be avoided.)

The Nov. 9 announcement says three new principles will be added. First, staking providers will be encouraged to provide “clear communication […] to ensure users have all the information necessary to make informed decisions.” Second, users should be able to decide how much of their assets they want to stake, as this will promote “user ownership of staked assets.” Third, staking providers should have “explicitly delineated responsibilities” and “should not manage or control liquidity for users.”

In their blog post announcement, they said, “POSA urges service providers and key ecosystem participants to adopt the following industry-driven principles going forward, as staking continues to mature as a technical and commercialised service.” 

POSA has to proceed cautiously, though, as the SEC is watching very carefully.      In fact, the SEC just went after Kraken  for $30 Million, claiming violation of securities.  The new POSA staking principles have been framed to align with the SEC’s investor protection goals and allow staking providers to build trust and mitigate regulatory risks.

“Industry adoption of the best practice principles introduced by POSA will serve to further clarify how true staking services are technical services and are not securities, while also preserving consumer protection and responsible innovation.”

The Verdict

POSA is very interesting to me.  When studying for the CPA Exam, I had to carefully look at what makes a “profession” and key to that is a self-governing  set of principles that are adhered to, outside of law.   In the field of accounting, there are several things that you are not allowed to do in your marketing efforts, and, if a member is found to be in non-compliance   with respect to this guideline, they can be sanctioned by  the association.  It appears to me that POSA is working very hard to prove that the staking of cryptocurrencies is a mature activity, and they are bolstering their claim by working to prove that theirs is a self-regulating profession.  The problem is that there are a good number of large firms that are not in POSA and do not have to live by their edicts, thereby making many of these attempts aspirational.   Maybe this is enough?

REFERENCES

Proof of Stake Alliance updates recommendations for staking providers (cointelegraph.com)

Proof Of Stake Alliance (POSA) Updates Crypto Staking Principles – Forbes India

Proof of Stake Alliance Announces Updated Staking Principles with Support from 18 Industry Leaders Including Ava Labs, Alluvial, Coinbase, Lido Protocol, Paradigm, and Polychain (yahoo.com)

Proof of Stake Alliance publishes white papers on legal aspects of liquidity staking By Cointelegraph (investing.com)

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

Is Stellar Development Foundation Really a Star?

Headline:  What is the Stellar Development Foundation and what do they do?

Body:  During the day, I work for the Federal Government.  And there is a very special group of people who work with the entities called foundations.  As I was  reading some cryptocurrency information, I ran into a reference to the “Stellar Development Foundation” (SDF) and I became very interested to find out what they have to do with cryptocurrency.  Boy, is it an interesting story!  And, just like the Bible, it all starts with Genesis.    

OK, let’s first bust some pre-conceptions

The SDF I a non-profit group with the mission to help find development partners to promote the Stellar blockchain. ( Two of the founders of this blockchain were the ones who started Bitcoin.)  Currently, they seem to be using a lot of money to incentivize developers to creates d’apps to take advantage of the new “smart contract” functionality on the  Stellar blockchain.   One of their promotions is a $30 Million matching fund to incentivize the developers to try to get money together themselves for their own projects.   The match promises them that they will be supported in their efforts.

 But, don’t get it twisted.    SDF  might be a “non-profit” but there is a LOT of money running thru it.      I promise.   If you have trouble remembering this, just pause a moment and realize that the NCAA is also a non-profit, even in view of the $Billions they  deal with.    Remember too, that the American Hospital Association is also a non-profit,  and they do not have a charitable purpose, I am confident.  Also, please bear in mind just how incestuous the whole cryptocurrency milieu seems to be.  A few dozen high-net-worth individuals own a few business entities, and each of the cryptocurrency projects gives money to or gets money from these entwined entities.  This happened here, as SDF was one of the largest creditors of Genesis (remember them from a previous entry??)

Stellar did really well when they went after Star Power

Actor Idris Elba was looking at the cryptocurrency space, and realized that many of his star colleagues were harnessing their star power and actively promoting different cryptocurrencies.  He remained unconvinced, bought one NFT, and remained above the fray.   He has come to seem  to be a wise young man as many of the cryptocurrency projects implode in on themselves.  In other news, many of the actors/celebrities who did  use their fame to help promote cryptocurrencies are being sued by the U.S. Government for not publicizing that they were compensated to do so.

Even having seen the disaster that befell many of his friends and colleagues, Mr. Elba remains a fan of related technology.  He seems especially taken with blockchain technology  that he believes could solve some serious problems in West Africa.  To his estimate, half of the adult population is unbanked, and blockchain could provide the trustless foundation that they need to provide financial opportunities. “When I think about Africa and other emerging markets,” says Elba, “I think about incredible minds ready to be let loose, but surrounded by walls.” In crypto, which sits on top of a blockchain—a decentralized ledger under no government or bank’s control—he sees a way to “break down those walls.”

The Verdict

SDF is a very interesting group.  They seem to be backing some worthwhile projects, and the people involved seem to know how to promote their brand very effectively.  But, this is only one of  the problems.  Assuming that their promotions are all successful, they also need to know enough “technical geeks” to fill their demand for labor.  This seems like something not thought thru yet.  We shall see.

REFERENCES

Stellar Foundation Nicked by Genesis Bankruptcy With $13M Claim (coindesk.com)

Stellar Development Foundation launches $100M fund to support native smart contract adoption (cointelegraph.com)

Idris Elba Is Ready to Talk About Crypto | WIRED

Stellar Development Foundation Launches $30M Investment Fund (yahoo.com)

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.