The algorithm employed by cryptocurrency exchange Binance for Proof-of-Reserves (PoR) contains a vulnerability linked to its lending function and the accounting of so-called dummy users. This was stated by Enrico Bottazzi, an expert from the research organization Privacy Scaling Explorations.
The issue concerns non-existent accounts with a positive position in low-liquidity assets and a negative position in highly liquid products.
The expert detailed a potential attack scenario where a dummy user takes a loan in one cryptocurrency, using another as collateral.
“In this case, the balance for the collateral coin is negative, while the net balance of the two coins converted to dollars should be positive. Considering that Binance supports user debts, [there is a possibility] that the exchange could claim solvency even if it is not,” Bottazzi explains.
He added that when a user withdraws highly liquid coins, the exchange would not necessarily have them immediately at its disposal and would be obliged to liquidate low-liquidity assets.
“However, liquidation may prove impossible due to changing market conditions, exposing the user to the risk of being unable to withdraw their funds,” the expert added.
Bottazzi suggested that a potential solution would be to modify the PoR protocol by adding additional information about each client’s collateral and assets to the algorithm.
For its part, Binance previously proposed incorporating lending business logic into the zk-SNARK scheme. This involves creating a third field in the token configuration for each user, labeled “collateral,” indicating the number of coins used as collateral for borrowing other assets.
The latest PoR report from Binance is dated May 1. According to the document, 581,758 BTC (over $35 billion) are held in user accounts on the exchange. The platform’s Bitcoin reserves exceed 106%.
Back in December 2022, Binance ranked last in PoR solution quality in a rating by Castle Island Ventures’ general partner Nic Carter. According to the expert’s conclusions, the exchange does not disclose the full extent of its liabilities, complicating third-party verification of the procedure.