Proof of reserves is live

Most exchanges publish what they hold. That is only half of the picture — it says nothing about what they owe.

From today we publish both.

Assets

Every wallet we hold the keys to is listed at /reserves with its address and a link to a block explorer, read live from our own nodes. Anyone can check those balances without trusting us.

Liabilities

Every account's balance is hashed into a Merkle tree and the root is published. A total on its own is just our word for it, so each user is shown their own leaf and the hashes leading up to that root, and can recompute it independently.

Verify your own balance at /reserves/verify — you will need to be signed in, since it shows your own figures. The page hands you your balances, your leaf hash, the published root, and the proof as a file.

The verifier

It is roughly sixty lines, has no dependencies, and contacts nothing. We serve a copy at /verify-reserves.mjs, but a verifier handed to you by the party being verified is only as good as your willingness to read it — so it is also published at github.com/SpotEx-trade/Proof-of-reserves.

The format is four lines long, and reimplementing it in any language is the better check:

leaf = sha256("<nonce>|<userId>|<SYM>:<amount>,...")   balances sorted by symbol
node = sha256(leftHex + rightHex)                      the hex strings, joined as text
odd  = a lone node at the end of a level rides up unchanged
root = the one node left at the top

What this does not prove

• Balances at an address show coins sit there, not that we hold the keys.
• Nothing here distinguishes coins we own from coins borrowed for the day.
• A snapshot is a moment. We take one a day.