In the interest of championing transparency, we would like to share some of the shortcomings in the Proof of Reserves process that we’ve identified.
A Proof of Reserves involves proving control over on-chain funds at the point in time of the audit, but cannot prove exclusive possession of private keys that may have theoretically been duplicated by an attacker.
The procedure cannot identify any hidden encumbrances or prove that funds had not been borrowed for purposes of passing the audit. Similarly, keys may have been lost or funds stolen since the latest audit.
The auditor must be competent and independent to minimize the risk of duplicity on the part of the auditee, or collusion amongst the parties.
