You are watching news of Coinbase. Go back to all news.
-
View all news of Coinbase
Posted on November 8, 2019EOS enters congestion mode due to EIDOS airdrop
by Don Yu, Patrick O’Grady, Peter Kacherginsky
What’s going on with EOS?
On November 1st 2019, Coinbase began seeing degraded performance for EOS transactions. Coinbase did not have enough staked CPU to successfully have its EOS transactions processed by the network. You can learn more about EOS and CPU here. This degraded performance can be attributed to the massive increase in activity on the EOS network related to the recently launched EIDOS token airdrop. Coinbase responded to this issue by increasing the amount of staked CPU in the wallets we control to unblock customer transactions. In this report we share our analysis of EOS resources, REX markets, and how these were affected by the EIDOS token airdrop.
Key Facts
- A token called EIDOS was released on the EOS network on October 31st 2019.
- EIDOS airdrop distribution involves sending EOS transactions to and from the EIDOS contract.
- Exchanges are listing EIDOS/USDT pairs, meaning that people can sell airdropped tokens for USDT.
- To take advantage of this trading opportunity, people are using leased CPU to dramatically increase the number of transfers processed by the EOS network.
- This increased activity has caused the EOS network to enter congestion mode, which limits the amount of transactions a user can broadcast to their pro-rata share of total staked CPU resources on the EOS network.
- Normal users are unable to get their transactions processed due to their relatively low amount of staked CPU resources.
- It is important to note that the EOS protocol is behaving as expected, but congestion mode prevents users from having transactions processed that exceed their CPU stake.
- The EOS network should be expected to stay in this state until it is no longer profitable to collect EIDOS or until the massive leases taken out on REX expire after 30 days and the leasers don’t renew their lease.
EIDOS Airdrop
At 6pm PST, October 31st 2019, a new contract was created on the EOS blockchain for the EIDOS token. In order to distribute EIDOS, the contract uses an airdrop pattern that functions as follows:
- An EOS user sends a minimum of 0.0001 EOS to the EIDOS contract.
- The EIDOS contract will then send a transaction returning the same amount of EOS back to the original sender.
- The EIDOS contract airdrops a certain amount of EIDOS to the original sender’s address. In this way, anybody holding at least 0.0001 EOS is able to receive EIDOS.
bloks.io The image above illustrates the pattern of interacting with the EIDOS contract. Note that this behavior can be observed in the EIDOS contract code that is open-sourced here.
Exchanges are listing EIDOS
On November 1st, a number of exchanges decided to add the EIDOS token to their list of supported assets. Specifically, these exchanges have introduced an EIDOS/USDT trading pair.
Cleared EOS/USDT Trades (Source: MXC Exchange) The above screenshot shows EIDOS/USDT trades clearing at 3:40pm PST on November 4th 2019. EIDOS is still worth a positive amount of Tether. Therefore, anyone who owns at least 0.0001 EOS can send a transaction to the EIDOS contract, receive some EIDOS, then attempt to trade it on an exchange for a non-zero amount of Tether.
EOS is dominated by EIDOS related actions
A number of parties realized that they can repeatedly invoke the EIDOS contract to obtain additional EIDOS, then trade the airdropped EIDOS for USDT. The EOS network has become flooded with these transactions. Note that in EOS, a single transaction can have a number of actions. One type of EOS action is a transfer, which sends some currency from the sender to the receiver.
Ratio of EOS EIDOS Contract Transfer Actions to Total Transfer Ops Currently, we’re observing around 95% of all EOS transfer actions are related to the EIDOS contract. Because each transfer counts towards the amount of CPU used in a block, this spike in transfer actions caused the EOS network to enter congestion mode.
Number of actions per hour (Source: EOS Titan) After the EIDOS launch, we see the actions per hour skyrocket.
Congestion Mode & CPU
The EOS network relies on special resources called CPU, NET, and RAM to perform actions on the network (e.g. interacting with a smart contract). These resources can be obtained by staking your own EOS assets or renting them from a specialized resource exchange called REX. When the EOS network is not congested (when the total CPU used in a block is under 40 milliseconds = 20% of a block’s CPU limit of 200ms), users of EOS are able to use more CPU than they’ve staked. However, congestion mode (when the total CPU used in a block is greater than or equal to 40 ms) strictly constrains the number of transactions a user can perform to the amount of CPU they’ve staked.
As a gross simplification, the less CPU an address has, the fewer transactions it will be able to get processed through the EOS network. We believe some parties predicted that the network would become congested as the result of the airdrop, and began proactively purchasing CPU leases on REX in order to dominate the network’s throughput.
CPU Price between 10/29 to 11/1 (Source: EOSPark) On October 31st, around 10:30pm PST, the amount of staked EOS required for a ms of CPU (called “CPU price”) spiked drastically. Over the course of 4 hours, CPU price increased by ~100,000%.
Airdrop Participation Pattern
A number of addresses that made the early investment in CPU have been using it to extensively invoke the EIDOS contract with transactions to obtain airdropped EIDOS, then sending the EIDOS on various exchange platforms. The following sequence of transactions illustrates a common pattern of users renting CPU resources and eventually cashing out on a DEX:
Step 1: EOS address renting CPU
(Source: EOSAuthority) Step 2: EOS address participating in the EIDOS airdrop
(Source: EOSAuthority) Step 3: EOS address sending EIDOS to an exchange
(Source: EOSAuthority) The above address leases over 2000 EOS worth of CPU on November 1st. After leasing the CPU, the only transactions this address makes are to the EIDOS contract and deposits to exchanges.
Sample exchange of EIDOS token to EOS through a DEX exchange (Source: eosq) The EIDOS token is actively traded on both centralized and DEX exchanges. In the above case, someone uses a decentralized exchange to receive EOS for their EIDOS.
Current EOS State
As of November 8th 2019, the EOS network is still in a congested state. Only addresses with significant CPU resources staked are able to have their transactions processed in a reasonable amount of time. As mentioned above, currently ~95% of transfer actions are related to EIDOS. It is fair to say that most of the CPU staked right now is being used for participating in the airdrop and collecting EIDOS.
REX Lending Over Time (Source: EOSAuthority) Illustrated in the image above, around 84% of EOS on REX is currently in a leased state. According to the EIDOS project website, the airdrop is going to continue for the next 15 months. As long as the money made from selling EIDOS for USDT outweighs the cost for leasing CPU from REX, we can expect the EOS network to stay in this state.
Coinbase will continue monitoring the state of the EOS network and issue advisories on any changes which may affect its customers.
EOS enters congestion mode due to EIDOS airdrop was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on November 8, 2019How Coinbase views proof of work security
Coinbase recently changed the confirmation requirement of four different assets, including reducing Bitcoin confirmation requirement from six confirmations to three. This post describes our views concerning proof of work security that informed our decision to make these changes.
By Mark Nesbitt, Security Engineer
Introduction: Proof of Work
All cryptocurrencies define a state of ownership within the currency network. In order for a cryptocurrency to be usable, there must be a way of updating this state of ownership. In most existing cryptocurrencies, the state of ownership is defined by a canonical history of all transactions that have ever occurred, which are stored by network nodes in a data structure known as the blockchain. In order to update the state of ownership, there must be a way to add recent transactions to the transaction history stored in the blockchain.
Different cryptocurrencies add to their blockchains in different ways. In cryptocurrencies that utilize proof of work, the blockchain is extended by a process known as mining. Miners bundle newly announced transactions together into data structures called blocks, which are added to the blockchain.
A miner attempts to add a block by solving a proof of work puzzle unique to the proposed block. If the miner can find a solution to the puzzle, the miner will announce the block and its solution to the rest of the network. The rest of the network will recognize the valid proof of work solution and consider the proposed block as the most recent addition to the blockchain. Notice that there is no permission required for a miner to produce a block, a fact that allows miners to enter and leave the network at will.
In order to determine a canonical transaction history in situations where miners may produce multiple valid transaction histories (i.e., different valid blocks or even chains of valid blocks), proof of work cryptocurrencies define the blockchain with the most accumulated work as the canonical transaction history. This consensus rule introduces a fundamental property of proof of work cryptocurrencies: any actor that can outwork the rest of the network by finding more proof of work solutions can unilaterally produce a valid transaction history that the rest of the network will adopt as the canonical transaction history. (Note: this does not mean that this actor has unlimited power over the network)
This post makes two claims about the security of proof of work Cryptocurrencies.
Claim one: It is a security feature for a particular coin’s mining operations to be the dominant application of the hardware used to mine that coin.
Owners of the hardware lose the value of their investment if the primary application of the hardware loses value.
Hardware owners are incentivized to consider the long term success of the main application of their hardware. The longer the lifetime of their equipment, the more invested they become in the long-term success of the hardware’s primary application. At time of writing, Bitcoin ASICs are beginning to have significantly longer useful lifespans as efficiency increases of newer models are diminishing.
This idea is related to the Dedicated Cost Principle.
Large pools of computational power that exist outside of a coin pose a security threat to the coin
Coins at the greatest risk of 51% attack are the ones where there exists large amounts of hashpower not actively mining the coin that could begin mining and disrupt the coin’s blockchain. This is especially important to consider in light of the argument above regarding hardware owners’ incentives regarding their hardware’s application — if the owners of the hardware have other applications outside of mining where they can monetize their hardware investment, the negative consequences of disrupting a coin’s blockchain are minimal.
Algorithm changes to “brick ASICs” simply allow the massive general purpose computational resources of the entire world to mine, and potentially disrupt, a cryptocurrency at will. Coins that have implemented “ASIC-resistant” algorithms have been, empirically, very susceptible to 51% attacks for this very reason. Notable examples of ASIC-resistant coins that have been successfully 51% attacked include BTG, VTC, and XVG. To date, there is not a single case where a coin that dominates its hardware class has been subject to a 51% double spend attack.
A case study: The 51% attack on Bitcoin Gold (BTG)
In May 2018, Bitcoin Gold (BTG) was repeatedly 51% attacked, resulting in millions of dollars of double spends. In the aftermath of this attack, the BTG developers announced a change to their proof of work algorithm to Equihash-BTG:
Because Equihash-BTG is different from the existing pool of regular Equihash power, we’ll effectively be in a separate pool of power. This means BTG will dominate the hashrate on this new PoW algorithm, which is “personalized” to BTG, adding a layer of incompatibility versus other coins that will be moving to the <144,5> parameter set, such as BTCZ (we’ve been collaborating with many other coin teams in the space.)
This was a very interesting statement. The BTG developers acknowledged the importance of dominance of hashrate, however, they incorrectly concluded that it’s important to dominate the hashrate algorithm, rather than the hardware that produces the hashrate. Unless the hardware producing the hashrate is dominated by mining the coin, nothing about the hashrate is “personalized” to BTG. Miners who own generalized hardware for other currencies can change the mining algorithm at will, allowing the hardware to mine BTG with no new investment.
Claim one summary
The only way a proof-of-work coin can materially reduce the risk from 51% attacks is to be the dominant application of the hardware used to mine the asset. A coin mined on widely available general purpose hardware, such as CPUs and GPUs, lacks this major security feature.
Claim two: Manufacturing and ownership diversity will be improved with ASIC-friendly algorithms.
No algorithm is ever ASIC-proof, merely ASIC-resistant
For any particular computational problem, hardware specialized to solving specifically that problem will always be more efficient than general purpose hardware. In addition to the advantages of writing application-level logic directly into the circuitry, specialized hardware does not need to be burdened by other requirements of general purpose hardware, such as security isolation, clock interrupts, context switching, and other tasks required to support multiple applications. Thus, no proof-of-work algorithm is ever ASIC-proof, merely ASIC-resistant.
Empirically, ASIC-resistant algorithms have repeatedly failed to prevent the development of ASICs. Prominent examples include scrypt (LTC), equihash (ZEC, BTG), ethhash (ETH), and cryptonite (XMR).
ASIC-resistant algorithms raise the barrier to entry in the mining hardware market
ASIC-resistant algorithms are effective in making it more difficult to build an effective ASIC. The natural result of this is that it takes greater investment and expertise before a chip builder can produce an effective ASIC.
Thus, ASIC-resistance merely raises the barrier to entry into the ASIC market. This results in greater centralization of mining hardware manufacturing — the very situation that the selection of an ASIC-resistant algorithm is meant to avoid!
The goal, instead, should be to select an algorithm where it is cheap and easy to manufacture an ASIC. This will result in ASICs that are practically a commodity, with little expertise or IP providing a moat for ASIC manufacturers. This will result in a diversity of manufacturers, which more easily encourages diversity of owners/operators, which is more likely to result in a network with decentralized mining.
When developers choose an ASIC-resistant algorithm, they provide a competitive moat to the chip developers that will eventually build an ASIC for their algorithm.
A case study: Monero’s regularly scheduled algorithm tweaks
The Monero development team has implicitly acknowledged the fact that algorithms cannot be ASIC-proof, merely ASIC-resistant, in their strategy for pursuing a coin minable on general purpose hardware. They seem to realize that an attempt to develop a silver bullet ASIC-proof algorithm aimed to perpetually stop ASIC development will not be effective. Instead, they’ve decided to make tweaks to their proof of work algorithm on a 6 month schedule with the intention that this will disincentivize creating specialized hardware by quickly making it obsolete.
This strategy underestimates the ability of talented hardware designers to quickly incorporate functionality into a chip design. It is almost certainly possible for a highly skilled chip designer to master a development process that can incorporate whatever pattern will inevitably develop for Monero’s proof of work changes. This will force a small, tightly guarded group of Monero developers to attempt a high stakes, highly secretive game of cat and mouse to hide their algorithm plans, with huge financial incentive for any member of this group to violate this circle of trust and leak information to chip builders. The criticality of this group’s decisions and the extreme trust placed in them are not good characteristics for a permissionless world currency, and arguably creates a centralization risk more severe than the risk of miner centralization.
The limitations of this strategy are already clear, with ASICs predictably being successfully developed and deployed on the XMR network for at least 3 different versions of the mining algorithm.
Aspirations are only important insofar as they can be accomplished
The vast majority of arguments in favor of ASIC resistance are expressed aspirationally. The general goal is usually something along the lines of: “Make sure the network isn’t controlled by a small number of people.” This is a fantastic goal, and is critical in ensuring that digital currencies live up to their promise.
Practically speaking, all the good intentions in the world are completely irrelevant when actions taken due to those intentions do more harm than good. Coins that implement ASIC-resistant mining algorithms, ironically, end up with greater miner centralization and control.
Claim two summary
The only accomplishment of ASIC-resistant algorithms is to raise the cost and expertise required to create an effective ASIC. This, in turn, means that any proof-of-work coin with significant value will eventually be mined by ASICs, which will result in highly centralized mining because successful ASIC manufacturers will have a deep competitive moat.
Conclusion
Cryptocurrencies do not provide a completely egalitarian system that eliminates all power structures or advantage provided by additional resources. Cryptocurrencies do achieve a dramatic improvement over the opaque, manual, error-prone, permissioned financial system that currently exists. It is critical to zealously defend one’s principles when attempting to change the world, however, it is equally critical to not make an illusory perfect system the enemy of an achievable good system.
As digital assets mature, participants have to ask themselves if the industry is going to be secured by hobbyists running old laptops in their homes, or if it will become, like nearly every other consequential endeavor in human history, pushed forward at scale by large, self-interested groups of people investing significant resources. Every at-scale, professional industry utilizes specialized equipment — it is naive to think that cryptocurrency mining will or should be any different.
How Coinbase views proof of work security was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on November 8, 2019Announcing new confirmation requirements
Coinbase is changing the number of confirmation requirements we require for four assets on the platform. We expect this change to both improve customer experience and security posture.
What’s changed
We changed the confirmation requirements for Bitcoin, Litecoin, Zcash, and Ethereum Classic. The table below shows the changes:
Why we made these changes
The confirmation requirements for several of these currencies were determined over a year ago. At this time, we did not have a consistent approach that informed each currency’s requirement. This resulted in a situation where some assets may have had an overly conservative confirmation requirement, and some assets where the confirmation requirement may have been too low.
In the case of Bitcoin, Zcash, and Ethereum Classic, we determined that it was safe to reduce the confirmation requirement. This allows customer deposits to be confirmed on Coinbase faster than before.
In the case of Litecoin, we decided to raise the confirmation requirement. This reduces the risk that a 51% attack on Litecoin will impact Coinbase customers.
Want to learn more?
Coinbase is constantly working to ensure a good customer experience while maintaining extremely high security standards. As such, we are always looking for ways to make adjustments to our services in pursuit of both of those goals.
We have published a separate blog post on our engineering blog that dives into greater detail about how we view the security of proof of work.
Announcing new confirmation requirements was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on November 6, 2019Introducing Staking Rewards on Coinbase
Coinbase is now offering an easy, secure way to earn staking rewards on Tezos
By Rhea Kaw, Product Manager
At Coinbase, we’re focused on offering more ways for customers to earn rewards by holding crypto. Today, we’re announcing staking rewards on every Tezos (XTZ) held on Coinbase by eligible US customers. Coinbase now stakes Tezos on behalf of customers and distributes rewards directly to customer accounts.
Staking lets you earn income with your crypto by participating in the network of a particular asset. When you stake your crypto, you make the underlying blockchain of that asset more secure and more efficient. And in exchange, you get rewarded with more assets from the network.
With today’s launch, Coinbase is offering an easy, secure way for anyone to actively participate in the Tezos network. While it’s possible to stake Tezos on your own or via a delegated staking service, it can be confusing, complicated, and even risky with regard to the security of your staked Tezos. We’re changing that with staking rewards on Coinbase.
With Coinbase staking rewards:
- You can begin earning rewards on your crypto. The current estimated annual return for Tezos staking on Coinbase is ~5%. You’ll see your pending rewards increase in real-time in the app, and once your initial holding period completes (35–40 days), you’ll receive rewards in your account every 3 days.
- You will always maintain control. Your Tezos always stays in your wallet; you just earn rewards while keeping your crypto safely on Coinbase. You can opt out any time you want.
The return rate stated by Coinbase is a projection based on the rewards we’ve generated over the past 90 days. The Tezos network sets the underlying return rate depending on the number of staking participants. Coinbase distributes the return to customers and keeps a portion as commission.
To get started, simply buy Tezos on Coinbase or deposit Tezos to your Coinbase account from an external wallet, and you’ll start earning rewards immediately.
Coinbase Earn Tezos
Starting today, eligible customers in all Coinbase supported countries can also participate in the Coinbase Earn Tezos campaign. Customers can earn a bit of Tezos simply by learning about the token and taking a few quizzes. Through Coinbase Earn, you can earn up to $6 of Tezos, which Coinbase can then start staking on your behalf.
You shouldn’t have to be an expert crypto trader to grow your crypto wealth. Offering simple ways for our customers to earn crypto through staking is an important step in building an open financial system. You can learn more about staking rewards on Coinbase at coinbase.com/staking.
You can sign up for a Coinbase account here and download the iOS or Android app to start earning staking rewards today.
For eligibility criteria, please visit our support center.
Introducing Staking Rewards on Coinbase was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on November 1, 2019Coinbase is a product led company
There is a lot of variety in how companies are run. Some companies have design, legal, engineering, or ops act as final decision makers on new product features. Some companies have a single decision maker while others opt for committees or “two in a box” decision making.
Each of these can work, and there is no right or wrong answer. But it is important to have a clear policy/philosophy in each company so that everyone is on the same page about how work gets done.
At Coinbase, our philosophy is to use product leads as DRIs (directly responsible individuals) on all projects which impact customers.
We use DRIs because it helps us move quickly when there is a single decision maker. And we choose product leaders to be the DRIs, at least for decisions that impact customers, because we are a customer focused company. We want decisions to be driven by what will create the best customer experience. Over the long term, optimizing for customer experience is 100% aligned with what is best for shareholders, regulators, and employees. Happy customers lead to a thriving business that is good for society, with a number of positive downstream effects.
What does this mean in practice?
Let’s walk through some examples. Note that these are illustrative, and not meant to be critical of any particular function.
In situations like those above, we try to work together to co-create good outcomes for the business, with a single DRI making the final decision.
Will we miss out on other valuable perspectives if the product lead is the DRI?
Having a product lead as a DRI does not mean that they originate all the ideas for the product, or that they do all the work. Great products are the result of collaboration among many different teams in the company, and good ideas can come from anywhere. However, we choose to have one person responsible for coordinating and being the final decision maker on all those efforts. The product lead must take requirements from various groups, and prioritize them appropriately, to be effective. They are also held accountable for doing this job, which means they will often have Key Results that we track over time where they are named as the DRI.
Do we use product leads as the DRI on projects that don’t impact customers?
No. We try to use product lead DRIs for areas of the business that impact customers. But there are examples, such as moving to a new office, which is not intended to have a customer impact. There is a lot of grey area here, and it’s not always clear how directly a customer is impacted (for instance, if we were to make a change to our legal entity structure). The goal in these situations is to default to using product leads as DRIs, but we don’t need to be dogmatic about this.
What do we do when a product lead is not available?
If there isn’t a product lead available, we periodically name other employees as DRIs on projects with a customer facing component. But we default to using product leads when one is available.
The above is a document that I shared internally at Coinbase to help create clarity as we continue scaling.
If you’re interested in learning more about what it’s like to work at Coinbase, please apply for a role through our careers website. Thank you!
Coinbase is a product led company was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on October 31, 2019Charting the course of Bitcoin, 11 years and counting
Eleven years ago today, the Bitcoin white paper was published, forever changing technology, finance, and our relationship with money.
As with other technologies, money has gone through many upgrades over the years. It’s evolved from trading seashells and metal coins to tapping apps and swiping cards, and from facilitating transactions between neighbors to connecting billions of people worldwide. However, our current financial system still has constraints that result in billions of people unable to open a bank account or access stable currencies, international transactions that can take days, and more.
Bitcoin is the latest breakthrough in a technology that’s millennia old. And although Bitcoin was invented only 11 years ago, it’s already changed the way the world thinks about money. To celebrate the 11th anniversary of the publishing of the Bitcoin white paper, we examine eleven quantitative indicators that Bitcoin is gaining momentum, enabling economic opportunity, and increasing global utility.
Few transformative technologies have captured the public’s interest — and imagination — as quickly as Bitcoin has in just 11 years. Email was invented in 1972 but it took until 1997 for adoption to surpass 10 million people. The television set was invented in 1927 but by the end of the 1940s only 2% of American families owned one. Bitcoin, on the other hand, went from an idea in 2008, and a first transaction in 2009, to an estimated over 27 million users in the US alone in 2019, or 9% of Americans.¹
The first Bitcoin transaction occurred on Jan. 12, 2009, when Satoshi Nakamoto sent 10 BTC to computer programmer Hal Finney. Since then, activity on the network has steadily accelerated, up and to the right, regardless of movements in price.
Bit-sized fact: On Sep. 24, 2019, over 820,000 unique addresses transacted bitcoin on the network.
According to Google Trends, interest in Bitcoin has been spreading across the world since 2009. For many years, a new country took the top spot for highest relative interest in Bitcoin, indicating growing global interest in the technology.
In 2009, Austria had the highest relative interest, followed by Kazakhstan (2010), Estonia (2011), Finland (2012), Ghana (2015), Nigeria (2016), and South Africa (2017).
Bit-sized fact: Americans typed “Bitcoin” into Google more times in 2018 than they searched for a range of headline-making phrases, from “royal wedding” to “election results.” Read more in the recent Coinbase Report: United States of Crypto.
More than 55,000 nodes — essentially computers running the Bitcoin software — are connected to the Bitcoin network. Nodes are the fundamental source of truth for the Bitcoin ledger, and are responsible for recording and validating transactions. While the Bitcoin network could theoretically operate on just a handful of computers, more nodes increases decentralization and security. By allowing anyone with a computer and internet access to run a node, Bitcoin allows anybody, anywhere, to have a vote in this global system.
Although Bitcoin was first conceived as a peer-to-peer electronic cash system, it’s become much more than that — it’s now also a popular investment and store of value, similar to gold. This is especially true in areas with high economic volatility.
According to a national survey of 4,415 people that Coinbase conducted in partnership with Qriously, investors think cryptocurrency, e.g. Bitcoin, will have a higher return than ETFs, index funds, and stock in their own company ten years from now.²
Calculated on 10/21/2019 Since 2013, bitcoin has outperformed the world’s most popular stock indexes, including tech stocks and the S&P 500. While bitcoin’s price fluctuates, it’s trending up and to the right following many bull runs. This year, bitcoin has also outperformed world stock market indexes, generating a +132% return. In comparison, the Nasdaq 100 generated +17%, the S&P 500 +12%, the FTSE Europe 100 +11%, and the FTSE ASEAN 40 -3%.
Bit-sized fact: Investors aged 18–34 are more likely to hold crypto than precious metals in their financial portfolios, and 1 in 4 investors with an MBA or PhD hold crypto as part of their financial portfolio, according to a survey Coinbase conducted with Qriously.³
If you had bought $10 worth of bitcoin starting on Oct 21, 2015, and continued to do so every month for the next four years, your total investment of $480 would be worth around $3,337 today — a gain of 595% (as of 10/21/19). Dollar-cost averaging, or buying bitcoin on a regular cadence, is a popular way of gaining long-term exposure to this new asset class. Buying bitcoin on a regular cadence is also called “stacking sats,” in reference to the satoshi, which is equal to 0.00000001 BTC.
Bit-sized fact: 77% of investors with higher incomes ($200k+/year) who have cryptocurrency in their portfolio own bitcoin, according to the Qriously survey.⁴
In Venezuela, Argentina, and Hong Kong, three regions that experienced high economic volatility this year, peer-to-peer BTC exchange LocalBitcoins.com experienced premium prices and surging volume. Argentina and Venezuela’s economies are being wracked by inflation, corruption, and capital controls.⁵ And Hong Kong, which is consistently ranked #1 on the Index of Economic Freedom, is currently experiencing political dysfunction and mass protests.⁶ Since 2013, volumes on Argentine peso, Hong Kong dollar, and Venezuelan bolivar bitcoin pairs have exceeded $600 million in total value. Recently, coinciding with heightening tensions, Hong Kong bitcoin volumes have similarly reached record highs.⁷
Bitcoin was originally created to be “electronic cash” that could be used for everyday transactions instead of traditional cash or credit, but that hasn’t been the main driver of its growth to date, outside of a few regions experiencing economic volatility. However, millions of people are already transacting on the Bitcoin network, thousands of stores are accepting Bitcoin payments, and new technologies are making it even faster and cheaper to use Bitcoin daily.
Bitcoin’s ability to settle immense value across borders, 24/7, is unprecedented in the history of money. Every day, billions of dollars worth of value is successfully transferred through the Bitcoin blockchain. On Dec. 7, 2017, $48.7 billion worth of bitcoin was transferred across the network — Bitcoin’s highest volume to date — and on June 18, 2019, over $21 billion worth of bitcoin was transferred.
Bitcoin’s best known attack vector involves a bad actor altering the Bitcoin network by controlling more than 50% of the network’s computing power, or hash rate. Known as a 51% attack, this would allow the attacker to double-spend their transactions and/or censor other’s transactions.
Bitcoin’s hash rate is important because it measures how secure the network is. The higher the hash rate, the more computing power is needed to compromise it. Bitcoin’s hash rate recently reached a record high of 108 million terahashes per second. Bitcoin is far and away the largest computational network ever created, and the most secure blockchain. This means controlling a majority of that computing power requires an enormous amount of computer hardware — hardware that would cost over $4 billion to buy outright. And even if someone happened to have a few billion burning a hole in their pocket, the costs to acquire, store, and power that hardware would be exorbitant.
Compared to the legacy financial system, Bitcoin fees and transaction time are minimal. Sending an international wire transfer by major US banks costs around $45, can take days to process, and can be done only during banking hours. Bitcoin transactions, on the other hand, typically cost around $0.75,⁸ can be done 24/7, are instantly seen on the network, and are widely regarded as secure after confirmation of six blocks, which happens in about one hour.
Bit-sized fact: In September 2019, a Bitcoin address transferred over $1 billion dollars worth of bitcoin for a $700 fee. That fee is just 0.00007% of the total value.⁹
A current limitation is the number of transactions the Bitcoin network can process per second, currently around seven. The Bitcoin Lightning Network is one path to increased throughput by using the concept of a bar tab. Instead of settling every single transaction on the Bitcoin blockchain every single time, the Lightning Network allows individuals to carry a bar tab with everyone else, where many transactions can take place back and forth and only the final consolidated balance is periodically settled on the main Bitcoin blockchain.
The number of Lightning channels has grown 19x in this year alone, and Lightning Network node participation recently surpassed 10,000 nodes in 83 countries around the world.¹⁰
Bitcoin’s underlying code controls how much new bitcoin is created and limits the maximum amount of bitcoin that may ever exist. Today, on Bitcoin’s 11th anniversary, over 18 million bitcoins have been mined, further edging toward the 21 million maximum, which is estimated to be reached in year 2140.
By programmatically controlling the number of new bitcoin created, Bitcoin’s supply inflation is predictable and steady. Fiat currencies, on the other hand, can have wildly fluctuating supplies that are impossible to predict. Since 2008, the average supply increase for the US Dollar has been 36% per year, and 129% per year for the embattled Argentine peso. In comparison, Bitcoin’s annual supply increase is currently 3.7%, and will fall next year to 1.7%.
What’s next for Bitcoin?
Hal Finney, the computer developer who was the recipient of the world’s first Bitcoin transaction, said: “the computer can be used as a tool to liberate and protect people, rather than to control them.” Bitcoin is the world’s first global currency that harnesses the power of computers — and humankind’s innate need to innovate — to enable worldwide economic freedom. We’re looking forward to what 2020 brings in Bitcoin adoption, innovation, and interest.
Footnotes
- Bitcoin is a Demographic Mega-Trend: Data Analysis
- To assess investors’ sentiments about cryptocurrency, Coinbase commissioned a study conducted by Qriously of 4,415 people ages 18+ in the US. The survey asked questions about their investment strategy, portfolio holdings, and thoughts on cryptocurrency.
- 19% of investors aged 18–34 hold cryptocurrency and 16% hold precious metals according to a Qriously survey of 983 people.
- According to a Qriously survey of 38 people.
- Venezuelans in Argentina get sense of deja vu as crisis builds
- Index of Economic Freedom, 116 Days of Hong Kong Protests
- Coin.dance
- CoinMetrics.io 2019 average median fee
- The $700 was optional; the transaction fee could have been as low as $0.75, Blockchain.info
- 1ML.com, Internet Archive
Coinbase doesn’t provide investment advice, and this article shouldn’t be viewed as investment advice. Always make your own independent assessment of whether any particular investment or investment strategy is right for you, your risk tolerance, and financial means, before entering into a transaction. When in doubt, consult with a professional financial advisor.
This website contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of Coinbase, Inc., and its affiliates (“Coinbase”), and Coinbase is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. Coinbase is not responsible for webcasting or any other form of transmission received from any Third-Party Site. Coinbase is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by Coinbase of the site or any association with its operators.
All images provided herein are by Coinbase.
Charting the course of Bitcoin, 11 years and counting was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on October 22, 2019The Biggest Challenge of the Consumer Web — and How Crypto is Poised to Solve It
The Biggest Challenge of the Consumer Web — and How Crypto is Poised to Solve It
Introducing Around the Block, a new blog from Coinbase that aims to provide context on the constantly evolving cryptocurrency landscape through explanations of new protocols, key ecosystem developments, and more.
By Justin Mart and the Coinbase Ventures team
Coinbase’s mission, vision, and strategy centers on conviction that cryptocurrency will help enable an open financial system. Crypto represents a paradigm shift in technology, which we believe will enable new, innovative applications to emerge across several categories.
This post aims to explain one category: the potential to “Decentralize the Web.” This is a loaded term, so let’s unpack this piece by piece.
What’s wrong with the web today?
It may be surprising when someone asks what’s wrong with the web given how central it is to our lives, but the internet has fallen short of its original vision in two key ways:
First, for a variety of reasons, the consumer internet has primarily embraced ad-based business models. This has led to a proliferation of obtrusive ads, clickbait articles, and services that optimize for capturing personal data which can be repackaged and resold at will (and increasingly in nefarious ways e.g., Cambridge Analytica).
Second, the internet began as a collection of community-controlled services built on open protocols, but centralized services with seamless user experiences soon emerged, tapping into native network effects to quickly grow and outpace open source development. This has evolved to produce a small set of powerful platforms who now control most of our interactions on the web (GAFA — Google, Amazon, Facebook, and Apple).
This evolution also introduced a centralized element of control where new companies came to rely on centralized platforms for access to large audiences, trusting they would not restrict their growth, censor their products and services, or otherwise change the rules from beneath them. But this inevitably occurred as these startups grew threateningly large (there are many examples).
The result is stifled innovation where entrepreneurs are wary of building on top of centralized platforms, coupled with large companies controlling or affecting a disproportionate amount of our lives.
Why would decentralizing the web fix this?
In both cases, centralization restricts innovation and enables platforms to abuse our data and privacy. A web built on a decentralized base prevents any single-party from disproportionate control, and thus can re-introduce open innovation and restore data and privacy rights back to the individual.
How can we decentralize the web?
Today, building on the web requires many centralized elements and services (e.g., compute and storage, database and querying, etc). However, Bitcoin pioneered a decentralized path by introducing crypto-economic networks.
Specifically, crypto-economic networks use provably-scarce digital tokens to incentivize a distributed network of actors. These actors contribute valuable resources to a network, and are rewarded for their contributions.
Bitcoin is the first example of a crypto-economic network, where the block reward incentivizes independent, for-profit actors to expend resources in order to validate bitcoin transactions, which contributes to Bitcoin’s security. But this model can be extended beyond Bitcoin’s security-based model; similarly incentivizing a group of actors to provide computation, storage, identity services, etc, through separate crypto-economic models.
These new networks restrict excessive single-party control, providing open platforms for entrepreneurs to leverage as they build products and services. When enough elements are fully decentralized, the result may be a unified experience that captures the vision of an open web.
What are some examples?
Decentralized crypto-economic based networks have emerged for a variety of use cases:
Storage: IPFS Filecoin, Sia, Storj, Swarm, Textile*
Compute: DFINITY, Fluence, Golem, Blockstack, Offchain Labs*
Platform and Network Coordination: Base cryptocurrencies like Ethereum, Tezos, EOS, NEAR*, etc.; and Urbit
Query: The Graph*, OrbitDB
Messaging: Whisper, Orchid
Interoperability: Cosmos, Polkadot, Interledger Protocol
Oracle Services: Augur, Chainlink, UMA*
DNS: Handshake, ENS, FIO
Identity: Civic, uPort, Torus*
Exotic: Video streaming (Livepeer), Social Networks (Steemit, Relevant*), Governance (Commonwealth*, Decred, Tezos), Bandwidth (Helium, Althea)Finance
Wallets: Several, including Coinbase Wallet, Blockchain Wallet, Ledger, Trezor, Wasabi, BRD, etc.
Borrow / Lend: Compound*, Dharma*, bZx
Payments: Coinbase Commerce, BTCPay, Celo*, and base cryptocurrencies like Bitcoin Lightning Network, XRP, etc.
Stablecoins: Several, including USD Coin, MakerDAO (Dai), Reserve*, etc.
Exchanges: 0x, Uniswap, Kyber, dYdX
Insurance: Etherisc, Nexus Mutual
* Coinbase Ventures Portfolio Company
** This list is informational only and does not constitute investment advice.Interestingly, these crypto-economic networks also change traditional cost models by more efficiently utilizing previously wasted resources, and removing intermediaries.
For example, individuals participate in decentralized storage or compute networks by loaning out their spare hard disk or CPU cycles, and are paid in each network’s native token. In return, app developers pay for these resources to store encrypted files or perform app computations, all while operating on a decentralized censorship-resistant network.
In theory, the result is greater efficiency of resources, lower costs to consumers, and decentralized platforms where individuals control their own data and intermediaries cannot restrict access or change the rules of participation.
Final Thoughts
Decentralizing the web holds tremendous potential and there are a number of talented teams working hard to make it a reality. If successful, consumers’ relationships with digital products and services will be fundamentally redefined and will carry profound implications.On the other hand, building, scaling, and securing these networks is complex and challenging, and many questions remain unanswered. How will we upgrade or govern these networks? How can they scale to millions of users while retaining decentralization? We are early in this journey, but some projects are showing promising signs of traction.
Coinbase will look to support these new crypto-economic networks where possible by providing safe and trusted paths for our customers to participate. A truly open web is a large part of the promise of cryptocurrency, and aligns with our mission and vision of an open financial system. We’re excited, engaged, and actively investing in many of these projects today via Coinbase Ventures.
If this excites you, join us and help build the bridge! To learn more about decentralizing the web, see Chris Dixon’s many thoughts, Fred Wilson’s blog, and Multicoin’s survey on Web 3.0.
This website contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of Coinbase, Inc., and its affiliates (“Coinbase”), and Coinbase is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. Coinbase is not responsible for webcasting or any other form of transmission received from any Third-Party Site. Coinbase is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by Coinbase of the site or any association with its operators.
All images provided herein are by Coinbase.
The Biggest Challenge of the Consumer Web — and How Crypto is Poised to Solve It was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on October 21, 2019How the Coinbase Security team deployed CTFd to Power our First Capture the Flag contest at Defcon…
How the Coinbase Security team deployed CTFd to Power our First Capture the Flag contest at Defcon 27
By Nishil Shah and Peter Kacherginsky
We recently ran Coinbase’s first Capture the Flag (CTF) competition called Capture the Coin. As part of running the CTF, we needed to setup the underlying infrastructure. In this guide we’ll describe our process from choosing a CTF platform to getting it production ready. This CTF definitely would not have been possible without all the open source contributors, projects, tutorials, and free services we leveraged, so we’re making this guide as a small contribution back to the community. Overall, the process took us a few weeks to setup, but with this guide, you’ll only spend a few days.
Choosing a CTF Platform
We chose CTFd as our CTF platform based on the following criteria:
- Challenge Input Interface
- Support for Types of Challenges
- Free Response (Static and Pattern-Based)
- Dynamic Value
- Multiple Choice
- Custom Plugins
- Public Scoreboard
- User and Team Registration
- Admin Panel
- Player Communications
- Hints
- Active Maintainers
CTFd had support for most of our requirements except for multiple choice questions. However, requirements like having active maintainers was useful when the maintainers quickly patched a bug in a few hours. We also wanted to write challenges that forced users to interact with a real blockchain. This would require some custom development, so we also wanted the ability to build our own custom modules. Anecdotally, a few other CTFs had run successfully on CTFd. Given these requirements, CTFd matched our needs the closest.
CTFd mostly worked out of the box by following the README instructions; however, we did run into one issue. Out of the box, CTFd started running really slow. We did some basic debugging like looking at memory and CPU utilization to see if we needed to upgrade our EC2 instance. In general, resource consumption was generally less than 1%. We eventually found out that using Sync workers was inefficient. We changed the settings to use async gevent workers and correctly setting worker_connections and workers using the advice from this post. This solved our issue and CTFd worked great with very little latency.
Capture the Coin Infrastructure
Setting up and running this CTF was a great learning experience in getting hands-on with AWS and debugging real issues. As appsec engineers reviewing code or infrastructure, we often times can become unsympathetic to how hard an engineers’ job can be when defining security requirements even in a #SecurityFirst engineering culture. Just for something as simple as a CTF, the bill of materials starts to pile up as you can see below.
- Cloudflare Free Tier
- CTFd
- Google Recaptcha v2
- Infura
- Let’s Encrypt/CertBot
- Redis (AWS-managed or locally running)
- SES Email Forwarder Lambda (Here’s a guide we found very helpful to setup this lambda)
- AWS (Paid Tier)
- EC2
- IAM
- Lambda
- RDS Aurora
- S3
- SES
Here’s a network diagram of what our AWS infrastructure looked like at a high level.
Our vendor choices were typically determined by our own familiarity. We used AWS as our infrastructure provider, and we used Cloudflare as our DoS protection for similar reasons. For email and email verification, we used SES to trigger an email forwarder lambda and save a copy of the email to an S3 bucket. The lambda then pulled the email from the S3 bucket and forwarded the contents to the recipients defined in the lambda. Eventually, we swapped out our EC2 instance hosting an Ethereum node with Infura as this gave us reliable connectivity to the ETH blockchain for the smart contract challenges. Our infrastructure is rather simple compared to the complicated microservice environments today, but there was still some complexity involved.
Our Setup Notes
- Signup for AWS Account.
- Buy a domain with your favorite provider.
- Set up Route53 NS DNS records in AWS.
- Set up Route53 MX DNS records in AWS.
- Set up Route53 SOA DNS records in AWS.
- Set up Route53 SPF DNS records in AWS.
- Set up Route53 DKIM DNS records in AWS.
- Note: The AWS SES Domain Verification step will require an additional TXT record.
- Spin up an EC2 micro instance. You can always resize later.
- Attach the right security groups. Initially, we limited external access to private IP ranges so that we didn’t accidentally leak challenges until we started the competition.
- Spin up RDS instance. We went with the AWS managed solution because this was the simplest and we wouldn’t have to worry about load balancing or patching.
- Follow this guide to get inbound and outbound emails working under your CTF domain.
- Install CTFd by cloning the repo and installing dependencies. (We used v2.1.3)
- Setup Google Recaptcha v2 for spam and DoS protection.
- Setup Infura or your own node if you want Ethereum smart contract challenges.
- Setup Let’s Encrypt/Certbot for HTTPS during testing and eventually for connections from Cloudflare to CTFd.
- Setup AWS-managed Redis or use a Redis instance locally.
- Setup port forwarding 80 to 443 and 443 to 8443 so CTFd doesn’t have to run with sudo and http:// is auto-redirected to https://.
- Run CTFd! Note that Unix security best practices still apply like running the application under a limited user.
- Run the following commands to set all the environment variables.
# CTFd Database
export DATABASE_URL=
# Web3
export WEB3_PROVIDER_URI=
export GETH_ACCT_PASSWD=
# Redis Caching
export REDIS_URL=
# Infura
export WEB3_INFURA_API_KEY=
export WEB3_INFURA_API_SECRET=
# reCAPTCHA
export RECAPTCHA_SECRET=
export RECAPTCHA_SITE_KEY=
cd CTFd
gunicorn3 -name CTFd —bind 0.0.0.0:8443 —statsd-host localhost:8125 —keyfile /etc/letsencrypt/live/capturethecoin.org/privkey.pem —certfile /etc/letsencrypt/live/capturethecoin.org/fullchain.pem —workers=5 —worker-class=gevent —worker-connections=5000 —access-logfile /home/ubuntu/access.log —log-file /home/ubuntu/error.log “CTFd:create_app()”
- We found this guidance for optimizing workers and worker-connections helpful.
- When finished testing with your running CTFd instance, setup the competition dates in the CTFd admin interface.
- Install the Ethereum Oracle CTFd extension and generate contracts.
- Add SES SMTP credentials to CTFd admin interface for user registration if you want email verification.
- At this point, the CTF should be entirely setup. Only keep going if you’d like to setup Cloudflare for DoS protection.
- Setup Cloudflare DNS and modify the AWS security group for the CTFd box to allow ingress from Cloudflare IPs.
- Setup Cloudflare SSL/TLS. SSL — Full (strict) if you still have a valid cert from Let’s Encrypt
- Setup Edge Certificates — Cloudflare Universal SSL certificate unless you have the budget and security requirements for a dedicated cert or uploading your own cert.
- Setup Cloudflare by enabling Always Use HTTPS, HSTS, TLS 1.3, Automatic HTTP Rewrites, and Certificate Transparency Monitoring
- Setup Cloudflare by using minimum TLS version 1.2
- You can also setup whitelisting for known good IP addresses in Firewall Tools so that Cloudflare doesn’t challenge requests from these ranges.
Dynamic Oracle
One requirement for the competition was to support Ethereum smart contract challenges, after all, this was called Capture the Coin. If no (testnet) coins could be captured, we would not have lived up to the name.
The contest included the excellent CTFd Oracle plugin by nbanmp which allowed us to process on-chain events such as determining whether or not the deployed smart contract was successfully destroyed by the player. We have modified the original oracle to allow for contract pre-deployment since Ethereum Ropsten network may sometimes be unreliable.
You can find the source code for the oracle and contract deployer here: https://github.com/iphelix/ctc-eth-challenge
Future Steps
In the future, we plan to use the dockerized setup so that it is easy to spin up and down the entire CTFd platform. CTFd already allows for codification of the settings which is helpful in being able to get predictable application deploys. We also would like to codify our infrastructure so that we can get predictable and simple deploys.
Thank you to all the open source contributors without their contributions hosting this CTF would not have been possible.
If you’re interested in working on solving tough security challenges while also creating an open financial system, please join us!
This website contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of Coinbase, Inc., and its affiliates (“Coinbase”), and Coinbase is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. Coinbase is not responsible for webcasting or any other form of transmission received from any Third-Party Site. Coinbase is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by Coinbase of the site or any association with its operators.
All images provided herein are by Coinbase.
How the Coinbase Security team deployed CTFd to Power our First Capture the Flag contest at Defcon… was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on October 15, 2019Pay Coinbase Commerce merchants directly with your Coinbase account
By Eli Haims, Product Manager, Coinbase Commerce
As of today, customers of Coinbase Commerce merchants are able to pay for goods and services directly out of their Coinbase account. Instead of copying complex cryptocurrency addresses and long decimals of amounts, you can simply log into your Coinbase account, select a wallet from which to pay, and we handle everything necessary to ensure the correct amount of cryptocurrency reaches the correct merchant address. Customers who do not have a Coinbase account, or wish to use another wallet, are still able to do so.
Not only does this simplify the customer experience, it also reduces the operational burden on merchants to resolve issues with payments. Cryptocurrency wallets pull exchange rates from various sources, which may have slight variations that cause payments to be a couple of cents over or under what was expected. Merchants must then manually inspect and resolve a charge before delivering the purchased goods. When customers pay with Coinbase, these payment mismatches will no longer occur.
Regardless of whether a customer chooses to pay with their Coinbase account or from another wallet, all transactions on Coinbase Commerce are still secured by the blockchain and deposited directly into the merchant’s user-controlled wallet.
Pay Coinbase Commerce merchants directly with your Coinbase account was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
-
View all news of Coinbase
Posted on October 14, 2019Ethereum Smart Contract interaction out of the coldest of storage
By Max Blaushild, security engineer, Coinbase Custody
(This blog post reflects a talk that Max Blaushild gave at Devcon 5 in Osaka, Japan)
At Coinbase Custody, security is our top priority. The strength of our battle-tested cold storage solution is why more customers choose us to hold their funds than any other custodian on the planet.
We use friction as a feature, introducing obstacles such as offline storage, single use addresses and human validation that make it extremely difficult for attackers to steal our customers’ funds.
This friendly friction comes with certain trade offs however. Our solution natively struggles with the sort of on-chain network participation that makes Ethereum great. Interacting with dApps like Maker Governance, or participating in signalling events like the Edgeware lockdrop require many transactions to be signed with an address that holds funds, which violates our one-transaction-per-address rule.
We’ve discovered a simple, yet effective pattern that allows us to bypass these restrictions. By leveraging the power and safety of smart contracts, our customers can have their cake (hold their crypto safely) and eat it too (use it to do neat things with smart contracts)!
How do we pull this off? Let’s dive into it!
Proxy Smart Contracts
We use smart contracts as a bridge between our cold storage system and these on-chain Ethereum contracts.
When we choose to integrate with a new network, like Maker Governance, we start by writing a customized smart contract that wraps around their smart contracts’ APIs like a glove. These ‘proxy’ smart contracts all come out slightly different, since they wrap different functionality, but share a few core similarities.
First, they are exceedingly simple. All storage variables are set when the contract is deployed, and never change. No branching logic is implemented in these contracts as well. Regardless of their simplicity, a 3rd party security audit is performed to ensure the safety and security of these contracts..
For instance, the proxy contract we used to allow our customers to participate in the Edgeware lockdrop was less than 30 lines of code with only one externally callable method:
Second, they are designed to interface with only a single cold address. This keeps all client funds segregated and maintains the security and auditability of all actions taken by this contract.
Third, and most importantly, these contracts are all configured to return funds to, and only to, a pre-set cold storage address. Securing this out-channel gives confidence that once we move funds into these contracts, their only possible destination is a Coinbase Custody Cold storage address.
Using our Proxy Smart Contracts
When onboarding a customer to a new network integration, we start by delegating them an address controlled by our Ethereum wallet service called Macbeth. This address never receives customer funds. Rather, it is used exclusively to make contract calls for our customer to their proxy smart contact. You can think of it as an “admin” address.
We then use this address to deploy a proxy contract on behalf of the customer. This address and the return Coinbase Custody Cold storage address are the only addresses able to call the contract:
Next, we process a standard withdrawal to send the customers funds from cold storage to the smart contract. Once the customer’s funds have been transferred to their proxy, the fun can begin!
To perform a network action, we simply use Macbeth to call the proxy contract method that facades the intended network method on behalf of our customer. In the instance of Maker Governance, we have the method on their contract that performs a vote:
Which is in turn wrapped by our proxy method:
When a customer wants to vote, they press a button on our UI without having to provide any keys or integrate with any Ethereum identity provider. We then handle all of the heavy lifting for them, grabbing the address of their proxy contract from the blockchain, forming their transaction and broadcasting it to the blockchain:
In conclusion
Our proxy smart contract pattern provides a frictionless user experience when interacting with Ethereum smart contracts. Moving the customers’ funds to a specialized proxy smart contract allows us to sign specific transactions behind the scenes, while maintaining the safety and security of client funds.
Through the use of this pattern, our customers have successfully participated in Edgeware Signalling, and now, Maker Governance. We have many more integrations planned for the future as well!
If you’re interested in helping us expand our bridge between cold storage and smart contracts, or just want to build cool things with blockchains in general, please apply for an open position at: https://www.coinbase.com/careers.
We’d love to have you!
This website contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of Coinbase, Inc., and its affiliates (“Coinbase”), and Coinbase is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. Coinbase is not responsible for webcasting or any other form of transmission received from any Third-Party Site. Coinbase is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by Coinbase of the site or any association with its operators.
All images provided herein are by Coinbase.
Ethereum Smart Contract interaction out of the coldest of storage was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
