As you have probably seen already, there has been some drama around Ribbon and Divergence Ventures. Please read this tweet thread first for context:

Julian 🤹 on Twitter: "Hey everyone, as you may have seen, one of our investors earned a lot of $RBN through farming our airdrop in May, and sold it for ETH today, for about ~$2mm https://t.co/4od8QhDFoU / Twitter"

Hey everyone, as you may have seen, one of our investors earned a lot of $RBN through farming our airdrop in May, and sold it for ETH today, for about ~$2mm https://t.co/4od8QhDFoU

Intro

This post will outline some historical context and steps forward.

Timeline:
April 24 — Started working on token
May 17 — Investor update email, which included that a token is launching and will be airdropped over next few weeks
May 22 — Snapshot for airdrop
May 24 — Token and airdrop announced

On May 18, under the instructions of the partners of Divergence, a Divergence team member deposited multiple times into Ribbon’s vaults in order to game the airdrop. With our minimum deposit requirement of $100 (this was not disclosed), this was not enough to prevent the 0.1 ETH deposit ($328 at that time) from being accepted as a legit deposit.

The airdrops collected from that was sold for ETH yesterday. The amounts earned from that airdrop (719 ETH) were returned back to the Ribbon DAO treasury.

Action 1

We are going to put up a proposal in a few days to decide on what we are going to do with the 719 ETH returned.

Action 2

We have seen a few tweets saying how Divergence’s public accounts have gamed the airdrop by depositing early into the vault. This is true, but due to the fact that they were not aware of an airdrop, we consider it fair play as early supporters of the protocol — they had over $2mm deposited before the team ever mentioned token airdrops to investors.

On top of that, significant portions of their RBN was earned in RGP-2: Liquidity Mining, which was a public program for people to earn RBN by depositing into Theta Vault, with governance processes and information on deadlines shared weeks in advance. We do not plan to pursue the additional ETH or RBN from them.

After speaking to Divergence, they have graciously agreed to donate their seed round allocation (~1.35M RBN) to organizations that can help make the industry better (diversity, regulation, etc), which will be decided over the upcoming days. In the meantime, this RBN allocation will be held in the DAO, then will be vested directly to the organizations. This allocation was on a 3 year vesting schedule, and the vesting schedule will remain as is.

Action 3

On top of that, to quell fears that our investors are depositing based on inside information, we have compiled a list of 137 addresses that have deposited after the investor email.

We will be sending an internal email to our investors to return all RBN airdrops received to the Ribbon DAO Treasury if they were depositors between between May 17 4pm UTC and May 22 12am UTC. Although it will be difficult/impossible to prove ownership, we believe that the chain analytics ninjas will figure out if there is more malicious airdrop farming.

Action 4

We will create a governance proposal to reward Gabagool with a 20,000 RBN bounty from the Ribbon DAO Treasury for identifying the airdrop farming transactions and bringing this to light.

Conclusion

This was an unfortunate situation overall for all parties involved — a learning lesson for other projects and investors regarding ethics and responsible disclosure.

Zooming out, this industry is still in its infancy and is learning how to navigate things such as this. We hope projects in the future benefit from what we have learned from this debacle. We will move past this soon and hopefully win back the community’s trust and confidence in the project.

One of the dominant narratives in DeFi is that regular people will be compelled to move their fiat into DeFi because of high yields. Empirically, this is true — lending rates for stablecoins on Compound today are >10% APY, and there are multiple “yield farming” opportunities with anywhere from 50% to 200% APY. In the real world, most banks give their customers sub 1% rates per year on their money.

However, when regular people hear these yield numbers for the first time, most express skepticism instead of confidence. This must be a scam! The yields must reflect some hidden risk that us crypto degenerates are not taking into consideration. This is a fair hypothesis — smart contract risks are difficult to quantify, so maybe lenders demand high rates from borrowers to compensate them for that risk.

Looking at Compound’s historical lending rates for USDC, we can see that rates have fluctuated between sub-1% all the way to 10%+ over the years. The smart contract risk has not changed meaningfully here, hinting that high rates are probably more demand-driven versus supply-constrained. Now that we have figured that out, why are borrowers willing to pay such high rates to borrow cryptoassets?

Zooming out slightly, lending out assets is only one of the ways people can earn yield. To truly understand where yield comes from, we need to think hard about how money grows in the first place, and why you can get paid for putting your money into something. I posit that there are four categories of where yield comes from: Demand for Borrowing, Exchanging Risk, Service Provisioning, and Equity Growth. This essay will examine each one in detail to try to understand DeFi yields.

Natural Demand for Borrowing

The most obvious source of yield comes from the fact that there exists some natural demand for borrowing. Businesses need to borrow assets to purchase capital goods, banks need short-term loans to finance their activities (repo markets), and individuals may need to borrow to pay for college tuition. Because this natural demand for borrowing exists, markets for borrowers and lenders start to form, and these loans get priced — one man’s demand for borrowing assets is another man’s yield. Looking out into the future, it is also highly unlikely that these yields will eventually dry up because this natural demand for borrowing persists at a very fundamental level.

Another reason why there exists natural demand for borrowing assets is because people desire leverage. As some people say, “leverage is a helluva drug”.

leverage is a helluva drug

Investors who are extremely bullish on an asset may want to borrow cash to buy more of that asset, especially if they expect that the asset growth will be greater than the interest rate they are paying to borrow. This is extremely clear in the context of DeFi. Interest rates on platforms like dYdX and Alpha Homora are amongst the highest in all of DeFi, because those platforms have created very simple ways for borrowers to use those assets for leveraged positions. To create high yield products you need to stimulate high demand for borrowing, and leverage is one of the best ways to stimulate borrowing in the current market environment.

Exchanging Risk

Another source of yield that is orthogonal to the demand for borrowing is through exchanging risk. The simplest example here is insurance. Alice may want financial protection in the case that she is involved in an accident and is willing to pay Bob for this. In essence, Alice and Bob are exchanging risk with each other, and Bob gets paid some yield for taking on that risk.

Another prominent example of exchanging risk is through options contracts. Options buyers are willing to pay a premium for protect themselves against large moves in asset prices, and options sellers earn some yield for being on the opposite side of the trade.

One of the newer ways of exchanging risk in DeFi is through tranching risk. Protocols like Saffron Finance take a stream of cash flow and split it into different tranches — a junior tranche which has a larger share of the cash flows but has to bear the risk of the cash flow diminishing, and a senior tranche which gets paid a smaller, but guaranteed, share of the cash flow. In essence, the junior and senior tranche are exchanging risks with each other, and they both end up being yield opportunities with different risks.

These risk-exchange contracts are a huge market in traditional finance, because there is always intrinsic demand for risk exchange, driven by the fact that different individuals/institutions have inherently different risk profiles. Because of this, I suspect that this will also become one of the primary sources of yield in DeFi in the long term.

Service Provisioning

One of the less intuitive ways that one can earn yields is by providing a service using your assets. For example, a money changer can charge a fee because they are using their assets to provide a service, in this case, the convenience of swapping between two currencies. Another example is an ATM — by having cash in the machine, it allows customers to withdraw money from their bank accounts immediately to pay for goods and services. This is a service, and customers are willing to pay for it.

In the case of DeFi, providing liquidity into an AMM falls into this category of yield-generation. By supplying your assets into this AMM-machine, you are effectively providing a service to users who want to swap assets. And in the case of Uniswap, you are rightfully compensated 0.3% for each trade that occurs.

As long as we expect demand for these services to persist over time, we can also expect that their respective yields will persist. However, providing this service comes with its own risks, namely the Impermanent Loss that arises from providing assets to AMMs. Over the long term, if the costs of hedging against these risks are sufficiently less than the fees they earn from providing the service, AMM asset provisioning will remain a yield-positive endeavour.

Equity Growth

Lastly, another source of “yield” comes from the value of equity growing. For example, if you lent money to Uber at the seed stage in exchange for equity in the business, your yields on that investment would be phenomenal, primarily driven by the growth of the equity.

Much of the high yields in DeFi today is driven by this growth in the equity (the cryptoasset). For example, when you “Yield Farm” on Compound, you are effectively lending money to the protocol PLUS getting free equity (free $COMP). Because of this, you are earning the base yield from lending assets (natural demand for borrowing), plus the “yield” from $COMP tokens appreciating in value. Because DeFi assets are currently in a hypergrowth phase, most of the insane yield numbers that you see come from this equity growth.

Many DeFi protocols see this endeavour as a short-term way to acquire users onto their protocols. By giving out free equity, they hope to win over a large group of users. Because of this, the current dominant strategy for asset owners is to “yield farm”, a.k.a collect these equity incentives for free, and pray that the equity value of these assets goes up, skyrocketing their overall yield.

It is unclear if this source of yield will continue to persist over the long-term. Once protocols realize that the equity incentives they are distributing for user acquisition may not be worth it, they may shut off these incentives. In this future, the primary strategies for earning yield in DeFi will likely be driven by one of the other 3 factors instead of equity growth.

Conclusion

As the DeFi ecosystem matures and progresses along the S-curve, we will likely see yields collapse from the ridiculous 1000% APYs to something more “normal”. Equity incentives will likely diminish over time, and the assets will fall out of their hypergrowth phase. In this future, I expect to see more sophistication on the Risk Exchange front, as people engineer more complex financial products that can boost yields.

Ribbon Finance is creating a protocol for the construction of these complex financial products, and aims to simplify them so that they will be highly accessible to a large retail audience.

Special thanks to Dave White for helping me think through this and organize my thoughts around this topic.

1. Bitcoin is still king

Bitcoin has remained the most prominent cryptoasset in the eye of both insiders and outsiders of the industry. Over the last 2 years, majority of cryptoassets have plummeted in value relative to Bitcoin — as markets tanked, people became more willing to sell their assets for Bitcoin. Bitcoin has also been the most liquid and least volatile cryptoasset.

In my opinion, Bitcoin is the only cryptoasset with product market fit. There are a core group of believers and a clear, singular message about the value proposition of Bitcoin — that it is a new type of store of value which will be valuable in the politically and economically volatile world we live in. This narrative is extremely powerful because it makes Bitcoin simple to reason about — if you place some probability that more governments and economies will collapse in the future, you can estimate with some probability, the future demand for this cryptoasset. This type of reasoning lets portfolio managers have some understanding of the risk/reward of holding Bitcoin, and may allocate some portion of their portfolio accordingly.

I believe that Bitcoin still has the clearest value proposition and best reputation/brand, making it the first asset new institutional and retail customers think about when considering investing in crypto. I believe that if we see growth of crypto markets in 2020, this growth will largely be captured by Bitcoin.

2. The DeFi story

Decentralized Finance applications have started to show signs of life this year. Applications like Compound and Maker have gone from zero to hundreds of millions of dollars flow through them in less than two years. While most dApps have floundered in terms of user numbers, DeFi applications have grown significantly.

The primary use case of these applications today is to increase one’s long exposure to Ether — by putting $ETH as collateral to borrow a different cryptocurrency, then exchanging that for more $ETH. This appeals greatly to a class of people I call “Ethereum enthusiasts”, who have both the desire to increase their Ether exposure and also the willingness to become early adopters in these new applications.

If these applications continue to improve their utility and liquidity, I have high confidence that they will continue to grow in 2020 and capture a larger share of the “Ethereum enthusiast” market. They may even capture the broader “Ether holder” market, which is orders of magnitude larger than the former. This is where I think the growth of these applications may start to plateau — they will likely struggle to create enough utility to convert people who are not already in the Ethereum ecosystem to use their applications.

For example, one of the prominent narratives is that decentralized lending applications will be able to break into the mainstream because they offer higher interest rate savings accounts to regular savers. This meme had a lot of mindshare when stablecoin interest rates were between 8–11%, but rates have continued to fall since then, and is currently sitting at around 4% on Compound.

Dharma on Twitter

1/ Your dollars do more on the Internet. Now, anyone can earn 8% APR interest on USDC from anywhere in the world, instantly. Upload your dollars to the Internet and start earning interest on Dharma today. https://t.co/Lt1XrXqU2c https://t.co/HejwbuiD2T

This is still significantly higher than rates offered by most banks in the world, but if we assume rates continue to fall, account for the cost of smart-contract insurance and the cost of moving dollars from fiat to crypto, the difference in interest rates will unlikely be worth the friction of the entire process. Although I am bearish on this idea attracting large swaths of US customers, having a USD-denominated savings account is still an extremely attractive value proposition to people in developing countries. If this is true, companies like Dharma and Linen have little value being in the USA and should double down on acquiring customers elsewhere.

Despite this reality today, I consider it foolish to be long-term bearish of DeFi simply because of how empowering it is for entrepreneurs and developers. The fact that teenagers can build new types of financial instruments in their dorm rooms, or that entrepreneurs can combine and compose different DeFi products & protocols in new and interesting ways is extremely powerful. Although I struggle to have the capacity to imagine DeFi-based applications that will appeal to the mainstream today, I have little doubt that someone else will in the future…just maybe not in 2020.

3. Trading still dominates

Trading is still by far the biggest “use case” of crypto. The most significant news item for crypto trading this year is the growth of derivatives products. Binance’s Bitcoin derivatives have grown and surpassed the volumes of their spot offering. New exchanges like FTX have been created to offer more diverse products and capture the market demand for these instruments, and have seen significant growth.

More interestingly, I predict that decentralized derivative products in crypto will start to gain traction in the new year. Dydx, the decentralized exchange that offers ETH-based derivative products, has seen volumes grow to approximately $70MM in Q3 this year. There are teams working on offering instruments like options and other derivatives in a decentralized fashion, which will hopefully launch in the new year as well. I predict that these decentralized protocols will see growth because users and operators can avoid the regulatory hurdles in engaging with derivatives products, as well as the potential for developers to create new instruments which suit their needs by utilizing these protocols.

4. Scalability is still a non-factor for blockchain usage

Many new blockchains are poised to launch in 2020 and finally allow decentralized applications to scale. These blockchains will probably work from a technical standpoint, but will likely struggle to attract any significant usage. The high cost of educating developers and the lack of developer tooling or interoperable smart contracts make it a poor choice for most developers who are thinking of building new applications. There are strong reasons to believe that the native currencies of these new blockchains will also significantly underperform in the short term. Chris Burniske has good writing on this.

I predict that many developers will try to replicate the breakout Ethereum applications such as Compound, Maker, and Uniswap on other blockchains in 2020 — but will fail to get traction. The quality of collateral in the Ethereum ecosystem is orders of magnitude better than the types of assets on other blockchains, making it difficult for other blockchains to compete on the DeFi front. A controversial opinion I hold is that the Tron blockchain may be the only blockchain that could compete with Ethereum on DeFi, simply because of the large amounts of USDT issued on it — stablecoins are the backbone for creating any type of synthetic asset or building financial products. I place low probability on this being true, but even lower on other blockchains.

5. Proof-of-Stake

Most of the aforementioned blockchains will be based on proof-of-stake. The jury is still out as to how secure these chains will be, and whether or not an attacker will be able to pull of a malicious block reorganization for profit. Because of this, incentivized testnets are now table stakes for new blockchain launches, where validators are rewarded with coins for setting up infrastructure to start producing blocks at launch, which helps with bootstrapping security. Many teams are also focused on building secure validator infrastructure, some taking the form of software providers and others as staking shops, which should help to foster fairly robust security on the various blockchains. Despite this, I predict that at least one proof-of-stake chain will be attacked in 2020, the same way proof-of-work chains are attacked to double spend exchanges.

Staking will also continue to become commoditized, as the space will be crowded with many undifferentiated staking-as-a-service businesses. Exchanges or custodians have an unfair advantage here because they can vertically integrate from their core business to offer staking, becoming a one-stop-shop for customers to park and stake their assets. I work on this, and am bullish about Coinbase Custody’s role in this space.

6. More on-chain governance sophistication

Throughout the year, we have seen both successes and failures in on-chain governance/co-ordination for different systems. Blockchains like Tezos and Cosmos upgraded their networks via coin-weighted voting mechanisms, and systems like MakerDAO adjusted interest rates through it’s own Ethereum-based coin-weighted voting system.

I personally feel that Tezos is the leader in on-chain governance sophistication, as the blockchain went through two protocol upgrades over the course of the year, both of which come close to a truly autonomous upgrade. Two noteworthy accomplishments:

• The Tezos Athens upgrade successfully tested the “invoicing” feature, meaning protocol developers can get paid in inflation funding for upgrades they make to the blockchain.
• These second protocol upgrade was co-written by the core team of Tezos developers, Nomadic Labs, and an independent company, Cryptium Labs. I expect to see more diversity in protocol developers in 2020, and more serious utilization of the invoicing feature.

We also saw some interesting decentralized organizations get formed such as MolochDAO and SAINTFAME DAO, although I would assert that these were nothing more than experiments. Jacob Horne has interesting predictions on where these will go in the new year, and is a lot smarter than me on this.

Jacob Horne on Twitter

There will be a DAO that manages more than $10m in capital. I put @VENTURE_DAO or some fork as a leading contender. There will be over 10k DAOs created. Cumulative capital across all DAOs will be over $50m

Concluding Thoughts

The growth of financial products in crypto, both centralized and decentralized, have clearly outpaced everything else this year alone. The surge in the number of derivative products and exchanges offering them within the last year alone are directionally indicative of the maturation of crypto markets.

On the decentralized web front, I feel that we still have close to no idea of what blockchains can accomplish other than financial use-cases — most things are still experiments. Furthermore, even for these financial use-cases, I do not have a good idea of the path to world domination for today’s class of DeFi protocols/apps. I would love to see a DeFi founder write a coherent Master Plan.

In 1945, Austrian economist Friedrich Hayek wrote a seminal essay titled The Use of Knowledge in Society. In this essay, Hayek invites us to consider a world where all information is known to a single mind. In this world, the problem of allocating resources efficiently in society would simply be an optimization problem to the single mind/computer who possesses all the information. If this is true, should we focus on making information more transparent and available to a central planner, like a government? Hayek argues that this is futile because knowledge is fundamentally decentralized — it consists of “dispersed bits of incomplete and frequently contradictory knowledge which all the separate individuals possess”. For example, it is an impossible task to constantly report our preferences for all the goods that we consume to a central planner, when we don’t even know our preferences for tomorrow’s lunch. Hence, the price system becomes an effective tool for economic coordination as individuals are able to signal what they want and how much they want it.

The price system leads to a “self-organizing system of voluntary co-operation”, dubbed a Catallaxy by Hayek and his predecessors. Hayek’s fixation on the idea of decentralized knowledge was for its superiority over centralized planning of societies — he even won a Nobel Prize in 1974 for these ideas. However, while Hayek was obsessed with figuring out how to allocate resources efficiently in society, I am obsessed with figuring out how to unlock the full value of local knowledge for the individual.

Local Knowledge = $

Every single human on Earth possesses knowledge which is valuable to someone else. A Google employee knows things about the business that a hedge fund would pay hundreds of thousands of dollars for. A terminally ill patient has valuable health data that could strengthen a predictive model. Your cinema booking for Toy Story 4 could be valuable to $DIS shareholders or a crazy ex-girlfriend. Fundamentally, by simply existing and making decisions in your daily life, you are generating local knowledge (location, purchases, health, consumption, ideas) that is valuable to someone else in the world.

Thanks to computers, we can express almost all types of knowledge as 0s and 1s. We can describe anything from insider secrets to scientific breakthroughs in text files, DNA sequences in .csv, and any real-world experience in video format. This effectively lets us communicate knowledge to anyone in the world — it is trivial to send or receive digital files on the Internet. This leads to the obvious question — can we create markets for all types of digital knowledge?

File-Sharing Protocols Suck

File-sharing protocols such as BitTorrent have created networks of anonymous users sharing all types of files; it ranks 5th place for the amount of traffic generated on the web. Although it suffers from free-rider problems, there are sufficient altruistic seeders in the world who keep popular content spreading across the Internet.

However, the BitTorrent model will fail to achieve our goal of building a market for digital knowledge. Firstly, there are many types of knowledge that are not valuable to a large group of people, but extremely valuable to a small group of people. An example includes solutions to homework of a specific college course — majority of people will have no use for these files, while desperate students will pay good money to acquire the knowledge. Secondly, torrents have no concept of “value” — there are no good ways for consumers to signal what they want, which leads to suppliers (seeders) essentially guessing. Naturally, this leads to a convergence towards content that appeals to the many — blockbuster movies, top40 songs, and hit games.

If we believe that every individual has local knowledge that is valuable to someone but not everyone, we need to invent a new model to match these buyers and sellers more effectively. Thankfully, we can easily build digital markets using digital money.

Blockchain-based Information Markets

Instead of regular file-sharing protocols, we can build a new protocol that allows people to attach a price tag (in cryptocurrency) to share any digital file. We can use smart contracts to facilitate the payment in exchange for digital files trustlessly. We can rely on decentralized file storage infrastructure such as IPFS & Filecoin, or use p2p communication protocols to send files directly from sellers to buyers. We can use encryption to ensure that only the person who paid for the digital file is able to access it.

For the blockchain skeptics, building this information market as a traditional web 2.0 product does not make sense. Would you sell an insider secret for a million dollars if a central party has to facilitate the trade, and hence have the power to see the contents of your message? We need to decentralize.

Building this as a decentralized, permissionless protocol also allows anyone to build applications on top of this platform. We will first see reputation calculators, Craigslist-like marketplace websites, and buyer/seller profile pages. We can further imagine insurance businesses, Netflix-like aggregation & curation websites, and mobile applications which make uploading as easy as posting on Instagram. May the best user experience win.

One of the biggest difficulties in making this work is the question of ensuring the validity of data. A seller could say he is selling a naked picture of himself, but instead send a picture of a cat. Numerai’s Erasure project uses the concept of “griefing”, where sellers have to stake cryptocurrency, and buyers can slash their stake if they are unsatisfied with the purchase. Myself and Ken have a different design — we propose a scarce reputation token combined with oracle/verifier services which endorse the validity of data. We also propose a suite of applications which let sellers reveal part of their data as proof while keeping the rest secret. For example, a seller could generate a “video summary”, a series of screenshots of the video to show that they actually own it. In essence, we can strive to recreate the trust model that eBay buyers and sellers rely on.

Conclusion

We are all probably sitting on local knowledge that someone in the world would pay you money for. This will initially start with digital files you own which are already explicitly valuable but cannot be found on torrent networks — rare ebooks, esoteric digital courses, access to paid forums & private Telegram group chats. There is already a market for these types of fringe content, but it is difficult to facilitate exchange using the existing platforms we have today.

We will then see personal knowledge which is difficult to value being bought and sold — insider secrets, sex tapes, personal texts & emails. Someone somewhere will find a use for this knowledge.

Finally, the long-term goal is to foster a flourishing marketplace for all types of exchange of local knowledge. Entrepreneurial individuals can buy medical history data from 100,000 people and repackage it into a data set for a researcher. Regular people can take photographs of stores they are shopping at for a hedge fund to forecast next quarter sales. Teenagers can sell their iPhone Screen Time to venture capitalists who want to find the next hot app. There will be many interesting and unique ways for people to make money based on what they know and their daily experience of the world.

If you have interesting ideas on what you want to sell or buy, reach out to me or Ken.

Linda Xie on Twitter

1/ With all of the discussion around @cosmos and @polkadotnetwork, here's my high level overview along with resources for learning more. Basically my beginner's guides in tweetstorm form (expect more of these). Corrections/further input always welcome.

Although there are many posts explaining and highlighting the differences between the two, I believe most “Cosmos vs Polkadot” posts today are either biased or lack nuance. This blog post is an attempt to create a deeper discussion about the two projects, from architectural trade-offs to philosophical differences.

Why Build A New Blockchain?

There are two primary reasons why one would prefer building an application-specific blockchain from scratch instead of writing the application as a smart contract on one of the existing platforms.

Firstly, the existing smart contract platform you want to build on may not offer the flexibility and customizability that your application requires. For example, if your application requires a custom hash function, writing it on Ethereum would cost a lot of gas because the function needs to be executed on the EVM each time it is called. An option is to propose that the Ethereum protocol include the hash function as a precompiled contract, but unless this function is used widely in many other application as well, your proposal would probably not be approved. Writing your own blockchain from scratch gives you the freedom and flexibility to design the core logic of the blockchain to fit your application’s needs specifically.

The second reason is sovereignty. Building an application on a smart contract platform forces your application to be subject to the rules and governance of the protocol. This could range from things that affect user experience such as block times and gas pricing to state-changing decisions such as chain rollbacks.

Naturally, an independent, sovereign chain gives up the ability to seamlessly communicate with other applications because they live on separate blockchains with separate state machines. Cosmos and Polkadot are attempts to solve this — Cosmos with the Hub-and-Zone model, Polkadot with the Relay Chain/Parachain model.

This post will assume approximate knowledge of the two projects, and will focus on teasing out the differences between them.

Difference #1: Local vs Global Security

Cosmos and Polkadot function under two vastly different security models. Simplistically, Polkadot works as follows:

Parachains are blockchains within the Polkadot network. These chains have their own state machine, their own rules, and their own local block producers (collators). Each parachain is essentially an independent state machine, and can utilize any type of unique functionality, consensus algorithm, transaction cost structure, and so on. In the Polkadot Network, all the parachains are children of a parent chain called the Relay Chain, which contains some representation of a “global state” of all the parachains combined. The Relay Chain has its own consensus algorithm called GRANDPA consensus, which finalizes blocks on the parachains quickly. Through this model, parachains in Polkadot operate under a “shared security” model — if the Relay Chain is highly secure with 1000s of validators, any parachain will benefit from this strong security by simply connecting to the Relay Chain. This allows parachains to have sovereignty over their state machine and other local rules, as well as strong security shared with hundreds of other chains.

The drawback to this model is that the validators in the Relay Chain have the final say over state changes made in any parachain. For example, the validators could, for some reason, continually reject blocks that come from collators of a specific parachain and permanently block the parachain’s progress from being included in the global state. Polkadot tries to reduce this from happening by shuffling validators so that they validate random parachains, lowering the possibility of a specific validator censoring a specific parachain. Polkadot also has another class of validators called Fishermen, who continually check the validators for malicious activity.

The architecture of the Cosmos Network is fundamentally different.

In the Cosmos Network, instead of using a local/global model for security, every blockchain is independent and secures itself. Each blockchain runs its own consensus and the validators of each blockchain are responsible for securing that blockchain alone. The network uses a hub-and-zone model for interoperability, where zones (independent blockchains) can “send tokens” to other zones by routing through a hub (also an independent blockchain). This protocol is called the IBC (Inter-Blockchain Communication), which is a protocol for sending messages between chains to represent token transfers. The IBC protocol is a work in progress, starting with token transfers and eventually any type of message passing between blockchains.

Comparing this model with Polkadot, the biggest difference here is that the state of each zone is secured by its validators and its validators alone. If a zone wants to have strong security, it needs to bootstrap and recruit its own validators, which may be difficult for smaller applications. However, this is a strong selling point for certain applications that desires more control. For example, Binance is bootstrapping their DEX by having their own nodes be validators for the Binance Chain as a starting point. This way, they have full control over the chain while they test the DEX and roll out new features. In my opinion, it is difficult to imagine the Binance Chain giving up sovereignty over which transactions get to go in which block, which they would have to do if building on Ethereum or Polkadot. For the same reason, I believe that there will be a category of companies (e.g Telegram, Facebook, Kakao) that will choose to build their own chain and retain full control, in which it will be trivial to connect to other chains in the future.

Difference #2: Governance & Membership

The second main difference between Polkadot and Cosmos is with regard to governance and membership. In the Polkadot network, there is one single Relay Chain and some number of parachains that the validators of the Relay Chain can support. The current estimate is that there will be 100 slots for parachains, but this number can shrink or grow in the future. The Polkadot Network allocates slots for becoming a parachain via an auction mechanism — the highest bidder is able to secure a parachain slot for some fixed time duration by locking up DOTs (the native cryptocurrency of Polkadot) in a Proof-of-stake system. This means that to become a parachain in the Polkadot Network, you would need to purchase a large amount of DOTs and lock them up for as long as you want to continue being a parachain.

The Cosmos Network on the other hand has no fixed rules of membership — anyone can build a hub or a zone. Hubs are themselves sovereign blockchains built with the intention of connecting a bunch of other blockchains. Two examples are the Cosmos Hub, which was recently launched by the Tendermint team, and the Iris Hub, a Hub that plans to connect blockchains which primarily operate in China and other parts of Asia. This hub-and-zone model makes inter-chain communication more efficient, because instead of connecting to every other blockchain, each blockchain only needs to connect to a hub.

Closely related to membership is the difference in governance processes on the two networks. In the Polkadot Network, governance decisions are determined by the amount of DOTs voters have. There will be a formal mechanism for voting on-chain, but it has not been finalized and the latest updates are here. Other than regular stake-weighted voting, Polkadot also uses the idea of a council to represent passive stakeholders. This council is a group of people, starting with 6 people and adding one every two weeks until 24 people. Each of the members is elected through an approval vote. While the specific details of this governance process are yet to be finalized, the implications are that there are ways to change parameters in the Relay Chain such as block time, block reward, etc., as well as ways to change membership rules for parachains. For example, the Polkadot governance process could change the number of DOTs required or the auction mechanism to become a parachain. A common misperception is that DOT holders can vote to kick out parachains at will, but in reality DOT holders can only change the process of membership. This means that a bonded parachain stays bonded throughout its entire lease.

On the other hand, there is no single “governance” process for the Cosmos Network. Each hub and zone has its own governance processes and there is no central set of rules that apply to the entire network of blockchains. When people talk about “governance of Cosmos”, they are referring to is the governance of the Cosmos Hub, the blockchain launched by the Tendermint team. The Cosmos Hub has a set of rules that lets anyone send a text proposal, and Atom holders are allowed to vote on it, where their votes are weighted by the number of Atoms they own. This is an example of what a proposal looks like. To learn more about the intricacies of the governance process, this blog post by Chorus One is a good primer on the governance of the Cosmos Hub.

Difference #3: Inter-blockchain Communication

Another differentiator between Polkadot and Cosmos is the architecture of their inter-blockchain communication protocol and its design goals. Polkadot is targeting arbitrary message passing between parachains. This means that Parachain A can call a smart contract inside Parachain B, can transfer a token between the chains, or any other type of communication. Cosmos on the other hand is focusing on asset transfers between chains, which is a simpler protocol. Right now, both communication protocols are fairly under-specified and have not been built. More detail about the two specifications can be found here: IBC (inter-blockchain communication) and ICMP (inter-chain messaging among parachains).

The biggest challenge in inter-blockchain communication is not how to represent data on one chain on another, but instead how to handle the case where the chain that the data originates from forks and reorganizes to exclude the transaction. This is where Cosmos and Polkadot differ the most because of the architectural designs.

Polkadot uses two different mechanisms for securing interchain communication. First, having shared security makes it easier to exchange messages. A byproduct of shared security is that all parachains have uniform levels of security, and as a result each chain can trust one another. To understand this, let us use the example of getting Ethereum (high security) and Verge (low security) to interoperate. If we wanted to represent Ethereum on Verge, we could lock up ETH and mint some ETH-XVG tokens on the Verge blockchain. However, due to low security, an attacker could 51% attack the Verge chain and send a double spend to the Ethereum blockchain, allowing the attacker to withdraw more ETH than he actually owns. Because of this, it is difficult for high-security chains to trust low-security chains when sending each other messages. This becomes even more complicated when messages are passed to multiple different chains of different security levels.

In theory, having uniform shared security is a nice way of securing interchain communication. However, to achieve this, the protocol must be able to shuffle validators assigned to each parachain often and randomly. This leads to the classic “data availability problem”, which is that each validator must constantly download the state for each parachain it is assigned to. This is one of the most difficult problems in the space today and it is unclear that Polkadot will be able to solve it.

Second, Polkadot uses the concept of Fishermen, which are “bounty-hunters” on the Polkadot Network who watch Parachains for malicious activity. This is, in some sense, a “second line of defense” against malicious activity. In the case that the validators for a specific parachain finalize an invalid block, the Fishermen can submit a proof to the relay chain and effectively roll back the entire state of the Polkadot Network and all the parachains within it. During interchain communication, we are most worried about one chain reorganizing and the other progressing as per normal, but Polkadot ensures that everything is rolled back if an invalid block is discovered.

Cosmos takes an entirely different approach to interchain communication. Since each blockchain has its own validators, it is entirely possible that there are zones which are “evil” with colluding validators. This means that when one zone wants to communicate with another zone, zone A needs to trust the Cosmos Hub (for routing) and validators in zone B. In theory, it sounds inefficient because people in zone A will have to look up the validators in zone B before they decide to send a message to it, but I believe in practice it will not be so bad. “Famous” validators such as Polychain Labs or Zaki Manian’s iqlusion will likely validate many different blockchains, and over time build a reputation for being a “good validator”. This means that when zone A sees that zone B is validated by Polychain Labs and iqlusion, they may decide to trust it.

However, even if people trust a chain, it can still get taken over by malicious actors and cause problems. Let us use this example, which was taken from this talk:

Let us say that the small red dots represent a token called ETM, the native currency of the Ethermint zone. Users in Zone A, B and C want to use ETM for some applications within those zones and they trust the Ethermint zone, so they do an IBC message which transfers ETM to these zones. Now assume that the Ethermint validators collude and start double spending, arbitrarily moving around coins, and so on. This will have an effect on the rest of the network, since ETM tokens also exist on different zones. However, the only people which will be affected by this are people who hold ETM tokens within Ethermint or within other zones. It is not possible for the evil validators within Ethermint to arbitrarily corrupt other zones except itself. This is the purpose of the Cosmos architecture — to ensure that malicious activity cannot affect the entire network.

Conversely, if an invalid state transition occurs on the Relay Chain (global state) and is not picked up by the Fishermen, this could affect every parachain in the Polkadot Network. We cannot assume that parachains are distinctly different objects because they ultimately still share one global state with the rest of the network.

Difference #4: Consensus Algorithms

The Polkadot Relay Chain uses a consensus algorithm invented by the team called GRANDPA. This algorithm allows the Relay Chain to finalize many blocks from all the parachains quickly and can also accommodate a large number of validators (over 1000). Simplistically, this is because not all the validators need to vote on every single block — instead, validators can vote on a single highest block they think is valid, and the algorithm transitively applies the vote to all ancestors of that block. Through this, the algorithm finds the set of blocks which have a supermajority vote and considers that final. GRANDPA is still under development and we do not know how it will perform in the real world.

The parachains can use a variety of consensus algorithms to come to local consensus. Polkadot provides a software development kit (Substrate) that comes with 3 consensus algorithms out of the box: GRANDPA, Rhododendron, and Aurand. It is likely that more algorithms will be added to Substrate and will be usable within the Polkadot Network.

On the other hand, each blockchain in the Cosmos Network can use any consensus algorithm that adheres to a certain specification known as the ABCI spec. This specification is created to standardize communication between chains. Right now, only the Tendermint algorithm fits this spec, but there are other efforts to create other consensus algorithms that fit this specification. At a high-level, the Tendermint algorithm works by having every validator talk to each other to approve/reject any single block, creating finality on a per-block level. The algorithm is fast and has been stress-tested in a live environment with 200 validators and 6-second block times during Game of Stakes. The Cosmos team also provides a software development kit with the Tendermint algorithm being usable out-of-the-box. This blog post is a good primer on consensus algorithms, and the features of Tendermint that make it useful.

The biggest downside of Tendermint is that it has a high communication overhead between validators. This means that while it could work fairly fast with ~200 validators, it will be much slower with 2000 validators. However, the trade-off here is that you get safety in asynchrony. This means that in a network partition, instead of having 2 different histories of transactions which will eventually merge (and 1 history will get discarded in the process), the network will halt instead. This is important because if you see a transaction that is “finalized”, it will never be reversed even in the worst network conditions.

My personal opinion on this is that comparing the two projects on the basis on which consensus algorithm they use is not particularly useful in the long run. Both the projects are creating architectures that will allow many different consensus algorithms to be used in the future. The vast majority of applications today should work fine whether they use Tendermint or one of Polkadot’s consensus algorithms.

Difference #5: Substrate vs Cosmos SDK

Both Polkadot and Cosmos offer a software development kit, called Substrate and the Cosmos SDK respectively. They are both intended to make it easy for developers to start building their own chains, and include various modules out-of-the-box, such as governance modules (voting systems), staking modules, authentication modules, and so on. The main difference between the two is that the Cosmos SDK supports Go, whereas Substrate supports any language that compiles to WASM (Web Assembly), giving more flexibility to developers.

They are both very new frameworks for building blockchains, and will add more features in the coming years. Doing a deep dive into both and examining the exact developer experience of building an application using either SDK is another blog post in itself. If you want to see that, write to me on Twitter @juliankoh.

Conclusion

Although this post is extremely long and detailed, it is still not exhaustive. The differences between Cosmos and Polkadot are difficult to grasp and have many nuances which I may have missed. It was surprisingly difficult to get a full picture of the two projects and sometimes documentation changed from day to day. Both projects are still in their infancy and will greatly evolve over the next year — some points which I have raised may become defunct soon. In conclusion, I have come to believe that the biggest advantages of Polkadot over Cosmos are the following:

1. Application developers do not need to bootstrap their own security
2. If they can solve data availability, interchain messaging under shared security is easier
3. They seem to be more ambitious with Substrate (WASM, more consensus algorithms & modules out-of-the-box)
4. Focus on arbitrary message passing better for cross-parachain contract calls. (Still unsure of use case today)
5. Seems to have more developers building version 1.0

Conversely, the advantages of Cosmos compared to Polkadot are the following:

1. Cosmos is live. Polkadot is not.
2. Polkadot has a restrictive & possibly expensive parachain membership process
3. More customizability is better for specific projects (e.g, Binance)
4. Evil validators of parachains could spread corruption throughout entire network. Cosmos restricts corruption to only within the zone & corresponding assets
5. Cosmos SDK used by many projects already
6. Focus on asset transfers simpler & easier to get right. Proven use case today.

Thank you to everyone who has answered my endless stream of questions, especially Zaki Manian & Gautier Marin from Cosmos and Alistair Stewart from Polkadot. The amazing Whiteboard Series from NEAR Protocol (Alex Skidanov) was instrumental in helping me understand both projects. These links curated by Linda Xie about Polkadot & Cosmos also helped me narrow down the scope of my blog post so it would remain readable. Special thanks to Cheryl Yeoh for brainstorming, proofreading, and helping to come up with the idea to write this post.

To understand this project, we need a large amount of historical context and a deep technical understanding of how both Tendermint and Cosmos works. This post breaks down the different components and gives an objective examination of the project in it’s entirety.

A Brief History of Decentralized Applications

Blockchains enable decentralized applications (dApps) to execute autonomously. The first of these blockchains is Bitcoin, which is a simple application that enables people to transfer value to other Bitcoin users. We quickly discovered that blockchains enable a wide range of possibilities — markets for file storage, prediction markets, decentralized autonomous organizations, and so on. However, back in 2013, the only way to build these things was to build a new blockchain from scratch which served their intended purpose. Developers had two options: write the entire application, networking and consensus layer from scratch, or fork the Bitcoin codebase (messy, hard-to-read C++ code) and adapt it to their intended purpose.

Ethereum came along and created a new paradigm shift. Ethereum built a new blockchain with a Virtual Machine on its application layer, allowing developers to write applications directly onto this virtual machine instead. This was a complete game-changer — developers did not need to worry about the networking or consensus layer, and could quickly write and deploy decentralized applications. Ethereum was poised to become the “World Computer” that every dApp or smart contract would run on. However, two problems soon became pronounced: Ethereum could not scale past more than 15 transactions per second, and dApp creators were beholden to Ethereum’s implementation, unable to customize certain parts of their application like a custom consensus algorithm or new privacy features.

This is where we are in 2018. New projects are faced with the decision of building on Ethereum (platform risk, cannot scale, but easy to deploy) or building on their own blockchain (customizable, very difficult to build). A bunch of new shiny blockchains DFINITY, Thunder, Tezos, etc are making the first option more attractive by building a super scalable, well-governed, blockchain — hoping to realize the dream of building a “World Computer” that runs every dApp. On the flip side, Cosmos is taking a fundamentally different approach — they imagine a world in which every dApp is run on it’s own blockchain, and they are building the protocol to connect all these chains to create the “Internet of Blockchains”.

To understand Cosmos, we must first understand the way it works under the hood, which is driven by the Tendermint consensus algorithm.

Tendermint Consensus Algorithm

A consensus algorithm is ways for nodes in a distributed system to come to agreement about some state of the world. In public-blockchain-land, we are only concerned about algorithms that can tolerate malicious behavior, i.e “Byzantine Fault Tolerant”, or BFT. Within this class of algorithms, we have seen two families of consensus protocols — classic consensus protocols such as Paxos or PBFT, and Nakamoto Consensus like Proof-of-Work.

Tendermint builds on the work of classic consensus, meaning that unlike Proof-of-work, it provides various different guarantees such as finality on every transaction, a deterministic algorithm for block production, and synchrony assumptions. For a more extensive explanation of Tendermint, read this blog post. Below we summarize and break down some of the most important features of Tendermint:

1. Finality
   Unlike Proof-of-work chains, blocks in Tendermint are final once there have been 2/3 signatures from the validators — they cannot be reversed or reverted. In Nakamoto chains like Bitcoin, we say that transactions are “final” after 6 confirmations, because the probability of a block being reversed via a chain reorganization is very small after 6 confirmations. However, as Kevin Sekniqi showed, the number of confirmations for a 10⁻⁵ guarantee of transaction reversion depends on the amount of mining power an adversary has. Attackers have used this fact to double spend exchanges, profiting in millions of dollars. Instead, by using a consensus algorithm with finality, we can be sure that transactions will not get rolled back after a single block.
2. Safety over Liveness
   Assuming a blockchain network splits into two (e.g Chinese Firewall), PoW chains will fork into two. Eventually, the chain will reorganize to select the longest chain as the canonical chain, and all the transactions on the other fork will get reversed. In Tendermint however, when there is a network partition, the protocol will choose to make no progress until 2/3 of the validators come to agreement once again. This tradeoff ensures that there is always “one source of truth” and the blockchain is always consistent.
3. Partial Synchrony
   A synchronous network has a known upper-bound of message delivery time. In Bitcoin, this bound is set to be approximately 10 minutes, imposing an artificial time delay in the network for all network participants to listen for a new block. On the other hand, Tendermint operates under a partial synchrony assumption, meaning that it does not rely on some fixed timing assumptions to make progress. This means that the bottleneck in the progress of the chain is the real network speed, not an artificial time delay set by the protocol — making this protocol faster than most Proof-of-work protocols.

Cosmos SDK (Software Development Kit)

After developing and testing Tendermint, Jae and Ethan built the Cosmos SDK — a software development kit for developers to quickly and simply build blockchains using the Tendermint consensus algorithm and pairing it with a sybil resistance mechanism using Proof-of-Stake. Using the Cosmos SDK, developers can easily build and deploy blockchains without worrying about the consensus layer and networking layer, only needing to focus on writing their application logic directly.

As mentioned at the start of the blog post, developers have 2 options when building their applications: write their own blockchain from scratch, or build on Ethereum (or variants of it). Building on Ethereum is quick and easy — you can piggyback on their consensus and networking layer and build your dApp on top of the EVM, but the tradeoff here is customizability. Using the Cosmos SDK, you do not have to follow the conventions of building on the EVM (Solidity, gas metering system, opcodes, limited cryptographic primitives, etc.). Instead, you have the ability to quickly deploy a Proof-of-stake Tendermint blockchain while retaining the flexibility to customize some things like validators, governance, staking, etc.

The drawback here is that building your own blockchain requires finding your own validator set. For hobbyist dApp developers, this much customizability may be overkill — it would be quicker and easier to deploy a contract on Ethereum. The team at Cosmos realized this and built an Ethereum clone using the Cosmos SDK, called Ethermint. There will be some validator set on Ethermint, and developers can reuse their exact same code on Ethereum on Ethermint, not having to worry about customizing anything else.

This post outlines some of the advantages of building dApps using the Cosmos SDK. Here we can also see a list of projects building/planning to build on the Cosmos/Tendermint ecosystem, compiled by one of the community members Asmodat.

Cosmos Network

Naturally, an important question to ask is how these Tendermint-chains can communicate with each other. In the Ethereum ecosystem, holding the base currency ETH allows users to interact with various smart contracts. However, some dApps on Ethereum like Numerai have their own currency NMR, which a user needs to hold to use some Numerai-specific operations like Staking. The best way to do this is to swap ETH for NMR in a decentralized exchange, then spend the NMR within the Numerai contract. This is even harder for cross-chain communication. If I own BTC and want to use a contract within Ethereum, I will need to send BTC to a centralized exchange (1 hour for confirmation), exchange it for ETH, withdraw ETH to a wallet, then spend it on the smart contract. There have been some specific implementations of bridges between two blockchains like the BTC Relay, but this is specific to only Bitcoin-Ethereum interoperability. Building a general protocol for all blockchains to interoperate is a much more Herculean task.

Hence the motivation behind building the Cosmos Network — the “Internet of Blockchains”, where every blockchain within the network is interoperable with another via hubs. The Cosmos team is building the first hub, which is the Cosmos Hub.

In this network, Tendermint-based projects can interoperate with one another via the Cosmos Inter-Blockchain Communication (IBC) Protocol, which uses cryptographic proofs to prove that a message was sent from a zone to another. Because of finality guarantees in the Tendermint consensus algorithm, interoperability is fairly straightforward — once a specific type of transaction is final in both blockchains, it can be assumed that a transaction was sent from one blockchain to another.

Interoperability between blockchains with different consensus algorithms is more difficult. Since no transaction is ever “final” on a Proof-of-work chain, we have to wait many confirmations before we can be confident that a transaction will not be reversed. Cosmos built a specification for Peggy, an interoperability protocol between Tendermint chains and PoW-based Ethereum. As we can see in the specification, building this requires a ‘witnesses’ and smart-contracts in Ethereum. Furthermore, the protocol requires 100 blocks to pass to be confident that a transaction will not get reversed. Using the IBC and various peg-like schemes like Peggy, Cosmos is hoping to make every blockchain interoperable.

Cosmos Hub

The centerpiece of the Cosmos Network is the Cosmos Hub. The Cosmos Hub keeps a record of the total number of tokens in each zone. Because of this, zones can send tokens between each other seamlessly without the need of an exchange. The more projects that build on Cosmos and connect to the Cosmos Hub, the more useful the hub becomes since it will facilitate all communication between zones.

The Cosmos Hub itself is a blockchain where transactions represent inter-zone communication. The blockchain uses the Tendermint consensus algorithm, where validators bond (stake) the native token of the blockchain, Atoms, to have a chance to produce blocks — the more Atoms bonded, the higher the frequency at which the validator will have the right to produce blocks. These validators contribute to the network by producing blocks, and are in turn paid in newly minted Atoms by the protocol. Somewhere between 7–20% of the total Atom supply will be minted every year to be paid to validators, providing a high enough yield to be attractive for validators.

Being a validator on Cosmos is no trivial task, their responsibility to the network is to validate blocks honestly, participate in governance, and most importantly run a high-performant server with high uptime. A failure to do so will result in their bonded Atoms being slashed. To be a Cosmos validator, one needs to be in the top 100 by amount of Atoms locked up and running the hardware could cost anywhere between $100k–300k a year and will get more expensive as the blockchain gets larger. If you do not have the capital or technical expertise to run a Cosmos validator, you can also opt to delegate your Atoms to a validator, pushing up their rankings within the top 100 and in return receiving a portion of their revenue. Because of the key role validators play in the Cosmos Network (and the potential for earnings!), the validators on the Testnet are extremely active.

Cosmos validators and delegators also can participate in the governance of the network. For example, Cosmos plans to do a “Hard Spoon” of Ethereum, which takes a snapshot of all balances on the Ethereum blockchain and replicating the balances on Ethermint, a Cosmos Zone. Atom holders get to vote when to do the snapshot and how the new tokens are distributed. Validators play a special role in the governance system, in which they are required to vote on every single proposal or face their Atoms getting slashed.

Concluding Thoughts & Current State of Cosmos

As of September 2018, the Cosmos team has proven that Tendermint consensus works, launched the Cosmos-SDK, and are on track to launch the Cosmos Hub by the end of 2018. However, this launch will be without the IBC, meaning that other Tendermint-chains cannot connect to the Cosmos Hub just yet, to ensure that the Hub works first. Soon after launch, they will be rolling out the IBC and Ethermint, allowing Ethereum developers to port over to Cosmos with ease. The team also already has a specification for making Cosmos interoperable with Proof-of-work Ethereum, but that will be rolled out a few months after the IBC is released.

Having done a deep dive into Cosmos, it is clear that the success of the Cosmos Network relies on 3 big components:

• Proliferation of Tendermint-based blockchains
• Reliability and effectiveness of Cosmos Validators
• Speed of deployment & out-executing the competition

Although this list says that there are over 60+ projects in the Tendermint & Cosmos ecosystem, the number is probably overblown — 0x, which is included on the list, is still built on core Ethereum not on Tendermint. Assuming that very few projects end up building on Tendermint consensus, the first generation of the Cosmos Hub (IBC between Tendermint-chains) will be largely useless.

Secondly, there lies a huge responsibility on the shoulders of Cosmos validators. Other than maintaining the integrity of the blockchain, they control the direction of the Cosmos Network. If the incentive structure of running a Cosmos validator is broken, we may see a lack of engagement from validators, and hence a poor governance structure. However, so far this has proven to be false, where validators in the Testnet are super active to make sure that their setup works properly once the Cosmos Hub launches.

Finally, and most importantly, is the question of how quick Comsos will be able to deploy the Cosmos Hub, IBC, and further developments to connect non-Tendermint chains. Building these technologies are hard, and the team has been pushing back their deadline for launching the Cosmos Hub multiple times in the past. Jae has delivered on his promise to shave his head after missing the deadline for launching in May 2018. Shipping code quickly is particularly crucial at this time, as the scaling problems of Ethereum have given teams an opportunity to compete with it. There is a race to build out smart-contract platforms that are able to win the hearts and minds of developers through scalability, privacy, interoperability, and other features.

Other than interoperability, Cosmos also has a compelling scalability story. Instead of being beholden to a blockchain that can be clogged up by digital cats, Cosmos gives developers to have control over their own applications, where bottlenecks in other applications will not slow down theirs. This is similar to Plasma, where each Plasma application on Ethereum can have it’s own set of validators and scales well. However, there is a lot of complexity in building a Plasma application, having to encode custom “exit transactions” and “fraud proofs” to leave the Plasma chain and interoperate with the main Ethereum chain. Cosmos’ simple SDK makes this part much simpler, yet preserving the scalability aspects of Plasma. While DFINITY needs thousands of transactions per second to support hundreds of different applications, we can think of the Cosmos Network as a blockchain which is sharded by application — meaning each shard supports a single application, and needs to have much less throughput capability per shard on average.

It is still unknown how majority of dApp developers will choose to build their applications over the next few years — on large blockchains or on their own blockchains. If we see the latter, we can expect the Cosmos Hub to be extremely valuable, being the channel by which all these applications talk to each other. A valuable Cosmos Hub will naturally lend towards a valuable governance token (Atom), as these governance tokens can dictate future changes in the network such as new fee structures paid to Cosmos Hub validators and so on. As a result, we can also expect value to accrue to these Atoms if the inflation rate makes sense.

Thanks to Ryan Sean Adams, Haseeb Qureshi, Chjango, Sunny Aggarwal, Jae Kwon, and others for feedback and conversations which led to this post.

Disclaimer: This post was not sponsored and is in no way a form of promotion for any projects mentioned. Any opinions, findings, and conclusion or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of Cornell University.

The ideal privacy-preserving smart contract should have the ability to hide inputs from everyone except the person supplying it, perform some arbitrary computation without revealing any state, and returning outputs following the program’s specification (broadcast single public output/return output to specific users/no visible output). This poses a few challenges:

• How do we hide inputs to a smart contract?
• How do we keep state hidden from everyone, yet ensure program correctness?
• How do we do arbitrary computations on hidden (or encrypted) data?

The most ambitious way to achieve the following is to use a cryptographic scheme called Homomorphic encryption. This type of encryption allows users to encrypt their private data, send it to a cloud computer, let the computer perform the computations on the encrypted data, return it back to the users, and only the users will be able to decrypt these outputs. However, homomorphic encryption is really impractical today and can at best, be used to perform simple arithmetic on integers. Hence, teams are forced to use different methods.

1. Trusted Execution Environments (TEE)

A trusted execution environment is an isolated area on the main processor of a device that is separate from the main operating system. It ensures that data is stored, processed and protected in a trusted environment. The most popular TEE to date is the Intel SGX, which is included out of the box in many Intel chips today.

These TEEs allow programs to run in secure enclaves, which are like black boxes where the state of the program is completely hidden and inaccessible by anyone. This is interesting because one can generate a private/public key pair within an enclave, encrypt a file with that public key, making the file onlyaccessible from within the enclave. Naturally, this sets the stage for private computation because users are able to encrypt their files, send it to the TEE, and let the TEE perform the computation without the inputs ever being exposed. Because of the trustless nature of the execution of these programs, all smart contract execution can be brought off-chain and can also bring scaling benefits to blockchains. The most notable projects which are using this approach are Enigma and Oasis Labs.

This general approach to private computing is the most scaleable today. Many computers have Intel SGXs enabled and there is no significant performance slowdown by using a secure enclave to run a program. However, this comes with significant trade-offs that may render TEEs completely unviable for highly sensitive data. Firstly, the majority of TEEs in the market today are Intel SGX. This is a centralization risk because it is unclear what the precise architecture of the chips are, and whether or not Intel may have reduced the security of the SGX to improve the performance of their chip overall due to the niche market for SGXs today. Secondly, to prove that a computer has an Intel SGX, the computer has to contact Intel’s remote attestation service. Again, this is a centralized cloud service that keeps track of all the chips that have been manufactured which contain Intel SGX technology. A hacker who is able to breach that cloud service can insert fake IDs into the cloud service which “proves” their computers contain Intel SGX even though they do not. If a smart contract runs on one of these fake TEEs, the operator will be able to see all the information.

These are not just theoretical attacks on the Intel SGX. To date, there have been two big vulnerabilities which undermine the security of Intel SGXs — Meltdown and Spectre, and Foreshadow. New TEE designs have been devised, but trusted hardware designs will always be exposed to the risk of being attacked. Instead of hardware guarantees, other cryptographic approaches are backed by math and computer science which is likely a more sound foundation.

2. Secure Multi-party Computation (sMPC)

The second approach to privacy-preserving smart contracts is using a cryptographic technique called secure multi-party computation. In sMPC, if we want to perform a secret computation, we can split data into multiple pieces in a very specific way and then have individuals perform arithmetic operations on those pieces without revealing anything about the original data. Those pieces can then be recombined to produce the final result.

For example, let’s say we want to calculate A + B without revealing what A and B is. We can split A into 3 parts ([A]₁ , [A]₂ , [A]₃) and B into 3 parts ([B]₁ , [B]₂ , [B]₃) such that [A]ₓ + [B]ₓ = [C]ₓ . We distribute the shares of the data to 3 different people, and on their own the shares are completely meaningless. After calculating their respective [C]ₓ values, the 3 people can come together and combine their [C]ₓ values, producing C. Through this process, the 3 people were able to compute C together without any of them ever knowing what A and B were. Multiplications are more difficult but can be achieved with some tricks.

Theoretically, once we can do additions and multiplication over a sMPC protocol, we can achieve any arbitrary computation. This is a very exciting way of doing privacy-preserving computations, because the only way to expose the underlying data is for every single node to collude. If there is even one node who is honest, all the other nodes will not be able to make any useful sense of the secret shared data, which makes it extremely resistant against adversarial behavior. However, the tradeoff here is that sMPC protocols are slow and expensive because of communication cost between the nodes. All the nodes must also execute the program correctly using the secret shared data that they were given. If a single node replaces their output [C]ₓ with a random value, the nodes’ combined C value will make no sense as well. By doing this, an attacker would have wasted the computational effort of all the other participants.

The two projects which are approaching privacy-preserving smart contracts with sMPC are Keep Network and Enigma. The original Enigma white paper came up with an design for a decentralized private computation platform using sMPC, but they have since changed their roadmap to use TEEs instead, which speaks to the practicalities of using TEEs instead sMPC in the short term. However, the future is bright for sMPC and lots of optimizations are being made to make sMPC more practical. Enigma plans to reintroduce sMPC into their current protocol, but that is still at least a year out.

3. Zero-knowledge Proofs (ZKP)

The final approach is by using a zero-knowledge proof — a cryptographic technique used to prove the validity of any statement without revealing any other information. This technique is useful in private computations because it allows computing nodes to create verifiable proofs that they performed the computation honestly with the correct inputs, and hence the output must be correct.

The only project which is working on this is Origo Network. In this protocol, all computing nodes are off-chain and must submit a zero-knowledge proof that they performed the program correctly. This allows the public to verify that computations were done correctly without any private data ever being on-chain. However, my largest criticism of the project is that it only minimizes the amount of private data being put on-chain; computing nodes can still see all the inputs and outputs. Furthermore, creating a zero-knowledge proof requires a trusted setup to be done beforehand. Performing a trusted setup for each different smart-contract is super expensive, and there are limits as to how complex a program can be able to generate a zkSNARK for. This is where cutting-edge technology like STARKs come into play — but these are still years out from any meaningful use in production.

The Golden Standard

Different projects use different techniques to achieve privacy-preserving smart contracts, each approach with its pros and cons. However, I do believe that these 3 techniques can be combined in a coherent way in the future.

One of the largest drawbacks of sMPC is that the protocol cannot tolerate adversarial behavior. If one of the nodes uses the wrong inputs or does a wrong computation, the output becomes meaningless. Hence, we can envision a new protocol where each node in an sMPC protocol is required to also submit a zero-knowledge proof, proving that they have performed the computation honestly. We can also run these sMPC protocols in TEEs, such that if in the worse-case scenario all the computing nodes collude, they will still be unable to uncover the underlying private data.

However, each one of these approaches is a colossal effort in itself and requires an entire company to build. The zero-knowledge proof and sMPC techniques are also still very nascent, and lots of cutting-edge research is being produced by top cryptographers to make these protocols more efficient and usable in real-life applications.

In the future, we can envision that even large companies start to use some of these techniques. Facebook, which gathers data about us and uses machine-learning algorithms to serve us the most effective ads, can use privacy-preserving techniques such that they can still run their algorithms on our encrypted personal data. This will also enable an entire range of industries such as healthcare or banking to share encrypted data across each other, vastly improving the quality of products like insurance plans, loans, and even personal health.

Thanks to Haseeb Qureshi, Ivan Bogatyy, Dani Grant, Howard Wu, Guy Zyskind, and others for feedback and conversations which led to this post.

This has created an arms race to build the first high-throughput smart-contract platform in hopes of stealing market share from Ethereum. These projects have come out guns-blazing with hundreds of millions of dollars in their war chests, world-class cryptographers and computer-scientists on their teams, and the backing of famous investors. Because these projects are all competing in the same space, this has become a literal race to be first-to-market.

Amongst this race to build Blockchain 3.0, Tezos, a “self-amending cryptographic ledger”, sits in an awkward position. Instead of touting thousands of transactions per second, it does approximately 50 tps. It does not have privacy features, use zero-knowledge proofs for blockchain compression, nor use cutting-edge cryptography for randomness. How does this project have a shot at competing with the other heavyweights?

The race is not always to the swift

What differentiates Tezos from other projects is its ability to upgrade itself. The architecture of Tezos allows anyone to propose an upgrade to the protocol and the Tezos community can vote on these upgrades to pass them. Ethereum, on the other hand, only permits a small group of insiders, known as editors and core developers, to include EIPs (Ethereum Improvement Proposals) into the main Ethereum protocol.

Diving more deeply, upgrades work through the following mechanism:

• Developers submit a proposal to upgrade the Tezos protocol, including some request for compensation for the work.
• Tezos holders vote on the proposal. If the vote is passed (some majority), the change automatically gets included into the Tezos testnet
• There is a fixed period of time where this change lives on the testnet. If bugs are found, the Tezos holders can recall the change anytime safely.
• Once the period ends, a confirmation vote is held. If the vote is passed, the change is included into the mainnet.

This is interesting because it is effectively a market-driven way of upgrading a protocol. If a developer creates an upgrade to the Tezos protocol and attaches a $100k request for compensation, the Tezos community can value if the upgrade is worth the $100k or not. If they decide it is, the upgrade will swiftly get passed with no bureaucracy or slowdowns. This is different in Ethereum, where the foundation gives grants arbitrarily based on the foundation’s discretion. For example, in this grant report, the team implementing Sharding, Prysmatic Labs, is funded with $100k whereas the team researching state channels, L4, is funded with $1.5m. As a part of the Ethereum community, I believe that sharding implementation is much more valuable and pressing than state channel research, but I have no say in this process. Was this because Vitalik is an advisor to L4 and is much closer with the Ethereum Foundation?

In Tezos, I can implement features which I deem valuable by the Tezos community and get paid if my upgrade is really valuable, without knowing anyone in the Tezos foundation whatsoever. This will incentivize a bunch of independent developers and teams to work on different upgrades to the protocol without a central body of coordination (Ethereum Foundation) deciding what needs to be worked on.

This is important for one main reason: Tezos can start out slow. Thunder mustlaunch with extremely high tps on day 1 to be interesting at all. Projects like Coda must launch with blockchain compression working on day 1 to garner any interest. However, this really does not matter at all for Tezos. With a strong enough developer community, Tezos can slowly copy these “killer features” and implement them into the Tezos protocol over time. While Thunder and Coda may seem interesting in 2018, they may completely fall out of relevancy in 2028 especially since they do not have a sound plan on how to keep improving.

Right now, Thunder’s consensus algorithm which lets it achieve thousands of tps or DFINITY’s random beacon gives them moats over other blockchain projects. My thoughts on this are perfectly articulated by Elon Musk, as he recently said “moats are lame”, and “what matters is the pace of innovation. That is the fundamental determinant of competitiveness.” In an open-source world, moats are even lamer, and co-ordinating developers to innovate on protocol upgrades are even harder. Because of this, Tezos’ architecture which formalizes protocol upgrades has set it up for long-term success.