BitMEX / proof-of-reserves-liabilities

Other
31 stars 4 forks source link

Remove 0-value liabilities from generated dataset #2

Closed instagibbs closed 1 year ago

instagibbs commented 1 year ago

They actually leak information that a user has an empty account, and are otherwise useless.

A user with 0 value in their account will end up with the right value printed at the end anyways.

shuckc commented 1 year ago

Note that BitMEX filters zero balances upstream of the PoL generation process:

% wget https://s3-eu-west-1.amazonaws.com/public.bitmex.com/data/porl/20221109-liabilities-762408-20221109D101503.455087000.csv
% grep ",0" 20221109-liabilities-762408-20221109D101503.455087000.csv | wc -l
   0

However without that pre-filter, we would indeed emit one leaf node for every user with a zero balance, which would disclose the total number of zero balance accounts (since the random split is bounded [1...balance], they are not produced any other way). The flip side is that users with a zero balance could claim exactly one zero leaf node when they run validate_liabilities.py, which would confirm their nonce and other arguments are good.

I'll probably tuck it behind a flag and add test coverage. Thanks 🙏