Tornado Cash Fallout: Can Ethereum Be Censored?

With the sanctioning of Tornado Cash last week, the cryptoverse has been rife with speculation about how far protocols and companies will go to comply with government regulations.

Underneath this debate, a key question is being tested: Can Ethereum be censored? The answer isn’t as simple as “yes” or ”no,” and it requires differentiating Ethereum the protocol from the many apps and services built atop it.

This article originally appeared in Valid Points, CoinDesk’s weekly newsletter breaking down Ethereum’s evolution and its impact on crypto markets. Subscribe to get it in your inbox every Wednesday.

Services can be censored. Ethereum infrastructure providers like Infura and Alchemy have already restricted access to data on Tornado Cash smart contracts. Circle, the company that powers the USDC stablecoin, has begun denying service to accounts that have interacted with Tornado-linked addresses.

But it’s not all doom and gloom. The Ethereum protocol – the technology dictating whether transactions get propagated out to the rest of the network – has (thus far) not been censored. If a U.S. citizen wants to shuffle money through Tornado Cash, miners will still add the transactions to blocks and propagate them out to the wider network.

Read more: Are Crypto Mixers Legal?

But as a series of Twitter think-threads have pointed out this week, this doesn’t mean that the protocol is completely immune.

Whatever your opinion on the Tornado Cash debacle, the fact that so many companies have jumped to comply with the sanctions by the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) should not be surprising. As CoinDesk’s Daniel Kuhn opined earlier this week, “It is perfectly reasonable, and possibly preferable, for Ethereum blockchain-based apps to block users with exposure to Tornado Cash, following the sanction of that anonymizing service last week. The alternative would likely open large parts of the Ethereum network to criminal liability. And that would include founding teams who are building the nascent, alternative economy of decentralized finance (DeFi).”

The founder of Tornado Cash has already been taken into federal custody. For Ethereum app builders and exchanges to flaunt sanctions on principle, they risk jeopardizing everything they’ve been building toward. At scale, this could imperil the entire ecosystem.

Industry think tank Coin Center has argued that the U.S. government’s dictate surrounding Tornado Cash is overbroad: “How can it be proper to add to the sanctions list not a person, or a person’s property, but instead an automated protocol not under anyone’s control?”

As Coin Center indicated, one could theoretically just clone Tornado Cash’s smart contracts (though this would still be extremely risky).

But this broadness applies in other ways.

In an act of protest (and comedy), Ethereum users have been testing how far the sanctions extend by sending money to public figures via Tornado Cash. Because Jimmy Fallon, for example, has received a bit of ETH from a Tornado address, he will presumably lose access to services that flag Tornado-linked wallets – all through no action on his part.

For the pranksters, this proves these sanctions were clumsily defined and therefore difficult to apply practically. But it also demonstrates how interpreting the sanctions requires one to get a bit technical.

Should a person lose access to apps even if they can’t actively “accept” a Tornado Cash transfer? What does it even mean to “use” Tornado Cash?

This is where things get interesting on a protocol level.

Read more: Decentralized Mixer Tornado Cash Makes Its User Interface Open-Source

Recall that the Ethereum network, like other blockchains, relies on a community of miners – or validators, in the upcoming proof-of-stake system – to assemble blocks and issue them out to the network. When you initiate a transaction on Ethereum as a user, it is added to the mempool – a big pile of transactions that have yet to get confirmed. Validators and miners assemble blocks by selecting transactions from the mempool and placing them in some order. They then propose those blocks to the broader network so they may be confirmed by others and added to the chain.

Now let’s look back at the Tornado Cash situation. If a validator adds a Tornado Cash transaction to a block, would they be running afoul of sanctions? While unlikely, the answer to this question isn’t so clear.

This has left room for speculation as to whether the Ethereum network is, at its very core, at risk of censorship. It has also kicked off a conversation on Twitter around how the Ethereum community would respond should validators take it upon themselves to no longer accept Tornado Cash transactions.

As we’ve discussed in past editions of this newsletter, centralization on Ethereum’s upcoming proof-of-stake (PoS) network is becoming increasingly difficult to ignore.

Twitter user elonyverse kicked off a debate Monday by predicting that over 66% of Beacon Chain validators – those who “stake” ether and operate the nodes that run Ethereum’s proof-of-state network – will adhere to OFAC regulations.

Thus far there’s no evidence from these validators that they will, indeed, censor transactions. It’s not even clear that governments would require them to do so. However, elonyverse’s tweet raises important questions about the influence that states could theoretically have over a blockchain the more centralized its validator set.

Jon Charbonneau, a research analyst at Delphi Digital, explained to CoinDesk that only one-third of validators would need to collude with one another in order to pose a nuisance to the network. If these many validators decide they don’t like Tornado Cash transactions, they could theoretically meddle with the network by preventing transactions from being finalized.

The validators would have even more sway over the network if they managed to amass 51% of staked ether. And should two-thirds of validators decide they want to completely censor certain transactions, Charbonneau says there’s not much that the rest of the network would be able to do in order to stop them, short of forking to a new blockchain.

There hasn’t been any indication as yet from validators (or miners) indicating that they’ve altered their activity pursuant with the U.S. Treasury’s Tornado Cash mandate. Moreover, it’s not clear that validators would censor the chain even if required.

Lido – the largest Ethereum staking pool – divides its stake among several different validators. If Lido’s community decides sanctions bar them from processing Tornado Cash transactions, they’d need to get all of their validators on board or find new ones.

Luke Youngblood, who founded the Polkadot-based Moonwell protocol after previously helping to build Coinbase’s Ethereum staking product, told CoinDesk he thinks it is incredibly unlikely that the validators staked by Coinbase would ever censor transactions.

For one thing, says Youngblood, all of Coinbase’s staking infrastructure was set up outside of the United States. Even if it wasn’t, Youngblood thinks the company would sooner shut down its staking service than censor transactions (and risk losing part of its staked ether as a penalty).

Charbonneau explained to CoinDesk that there are additional layers of nuance around whether validators are proposing or building a block.

Eventually, in order to tackle the so-called miner extractable value problem (MEV), Ethereum will separate the parties that build blocks from those who propose them out to the wider network. While full proposer-builder separation (PBS) seems like it may be a couple of years out, an interim feature called MEV-boost, which is set to accompany the Ethereum Merge in September, will allow validators to propose pre-built blocks from central “relayers” rather than build blocks themselves.

In messages with CoinDesk, Delphi General Counsel Gabriel Shapiro speculated that proposers and builders could possibly be viewed differently from a legal perspective.

“The legal conception of ‘facilitation’ or ‘aiding/abetting’ can be very broad,” Shapiro wrote in a message to CoinDesk. “Validators who do not propose a block containing a sanctioned [transaction], but nevertheless sign an attestation for that block as part of the sequence of events leading to that block becoming finalized, might be guilty of facilitating or aiding/abetting the sanctioned [transaction], and thus might be violating sanctions laws (or other laws, as applicable).”

Youngblood thinks this whole debate around whether validators will censor transactions is silly. “It's just good engagement farming to spread FUD [fear, uncertainty and doubt] about companies, whether true or not. It gets a lot of likes/retweets,” he wrote in a message to CoinDesk.

FUD or not, the risk of protocol-level censorship is being taken seriously on Twitter, where prominent crypto investor Eric Wall polled the Ethereum community on how it would respond should validators begin censoring transactions.

So far, 61% of users have selected Option X: “Consider the censorship an attack on Ethereum and burn their stake via social consensus.”

This would mean forking to a brand new blockchain, where the offending validator’s stake is eliminated or reduced.

Among the majority in favor of punishing censors was Ethereum co-founder Vitalik Buterin, tweeting simply: “fwiw I voted X in your above poll.”

The following is an overview of network activity on the Ethereum Beacon Chain over the past week. For more information about the metrics featured in this section, check out our 101 explainer on Eth 2.0 metrics.

Disclaimer: All profits made from CoinDesk’s Eth 2.0 staking venture will be donated to a charity of the company’s choosing once transfers are enabled on the network.

Celsius appears to be in even worse financial straits than previously thought.

DeFi platform Acala’s stablecoin came close to regaining its peg to the U.S. dollar.

Research firm FSInsight says ETH might eclipse BTC’s market capitalization in the next year.

Monero successfully completed a hard fork upgrade.

Ethereum-based lending and borrowing platforms Yearn Finance, Iron Bank and Homora joined Optimism, the layer 2 network.

Valid Points incorporates information and data about CoinDesk’s own Ethereum validator in weekly analysis. All profits made from this staking venture will be donated to a charity of our choosing once transfers are enabled on the network. For a full overview of the project, check out our announcement post.

You can verify the activity of the CoinDesk Eth 2.0 validator in real time through our public validator key, which is:

0xad7fef3b2350d220de3ae360c70d7f488926b6117e5f785a8995487c46d323ddad0f574fdcc50eeefec34ed9d2039ecb.

Search for it on any Eth 2.0 block explorer site.

UPDATE (Aug. 17, 2022, 15:00 UTC): Corrects the spelling of Jon Charbonneau. Clarifies that 1/3 of Ethereum proof-of-stake validators can prevent blocks from finalizing, but cannot "halt" the chain as originally stated.