14

I always hear that immutability is one of the great assets of using blockchains in banks. An auditor can come and look at the list of transactions and it will trust them because blockchains are immutable.

But consider the scenario where a bank has its own blockchain and controls all miners. How can an external party then trust anything about the blockchain. The bank could create forks as long as they want in the chain since they control all the miners, right?

Could someone please help me understand if I got something wrong ?

Improve this question

3 Answers 3

Reset to default
7

Private or permissioned? No, a private blockchain owned by one party is by definition not decentralized and therefore pointless. A central authority or a collusion of bank branch managers can anytime decide to change the history of the blockchain. Only if about >50% of blockchain nodes are owned by independent self interested parties blockchains can work.

But! This does not mean that many independent banking businesses can not use a private in the sense of permissioned blockchain to have a neutral trustworthy trading platform.

Improve this answer
7
  • A blockchain system owned by a single company could still be useful, because it can allow multiple separate internal users access, while giving none of them the authority to reset or roll it back - that's an excellent property for an audit logging system.
    – Nick Johnson
    Commented Jun 1, 2016 at 6:57
  • Why would a single company not set up a server for doing this and for example use the event sourcing design pattern to ensure that the system is ought to be write once read many? A CTO that decides to overwrite a database can also overwrite a private blockchain.
    – Roland Kofler
    Commented Jun 1, 2016 at 7:03
  • 3
    Because with a single server, there's always going to be at least one person with root on it. If you create a blockchain across multiple trust domains, with no one person able to access all the machines, it becomes impossible for even privileged users to edit the audit log.
    – Nick Johnson
    Commented Jun 1, 2016 at 8:39
  • @nickjohnson you are right this use case is clearly possible. I wonder if companies will adopt it to a larger extent. For big corporate there are other security measures already in place, approved by governments and certification authorities in the payment industry for example. I used to work in a big gaming company, If you ask me if they would adopt this model I would say, they don't.
    – Roland Kofler
    Commented Jun 6, 2016 at 5:54
  • Something like gaming seems like a perfect example where this would be good; the regulator could maintain one or more nodes. Why do you think they wouldn't use such a system?
    – Nick Johnson
    Commented Jun 6, 2016 at 10:44
6

Theory

All blockchains are immutable. A blockchain (data that is stored in a chain of blocks) is immutable because changing any of the data, no matter how small the data is, will change the hash of a block. When the hash of a single block changes, that invalidates all the blocks after it. That is the essence of a blockchain. A fork is another chain, and it doesn't make the original chain mutable.

Contrast this with a traditional database. When a simple value in a database is changed, the database is still intact (a new database isn't created).

Practice

Here's an example of how auditing might work.

Company X provides its blockchain and asks Auditor Y for an audit for the year 2015. Y audits that the blockchain matches with the books for X for 2015.

In 2016, X must provide Y with a blockchain that continues from the 2015 audit, and no data in 2015 can be tampered with since Y can easily see if the chain is broken.

A reference point is needed to trust/audit anything. In 2015's audit, it was the "books". In 2016, it's the blockchain. Once something has been audited in a blockchain, it never needs auditing again, unless there's a fork. Forks are easy to detect and the data from a fork can also be audited against the original chain.

For real-time auditing, an auditor would have a copy of the blockchain and be a node (otherwise it wouldn't be real-time auditing), and it will know immediately if a fork happens. The auditor can decide if the fork was legitimate or fraudulent.

Improve this answer
5
  • how can an external party detect forks after the latest reference point if one entity controls all the miners
    – dragosb
    Commented Jun 1, 2016 at 7:35
  • Eth, I miss the advantage of a blockchain when decentralization is made impossible by having central authorities. If a company needs to work with an auditor a centralized system at the auditors server would do the same. For realtime auditing all movements in the books have to be cryptographically signed.
    – Roland Kofler
    Commented Jun 1, 2016 at 7:39
  • @dragosb Does ethereum.stackexchange.com/questions/1187/… help? If not, perhaps ask another question to clarify.
    – eth ♦
    Commented Jun 6, 2016 at 5:35
  • @RolandKofler Did Nick's comments to your answer help? I'm also not sure what this point is "For realtime auditing all movements in the books have to be cryptographically signed" because all transactions in a blockchain are signed (and any tampering makes it all inconsistent and obvious).
    – eth ♦
    Commented Jun 6, 2016 at 5:40
  • @eth good question, I shall answer in the comment section where the discussion happend.
    – Roland Kofler
    Commented Jun 6, 2016 at 5:45
0

I have managed to create the mutable contract using the proxy pattern. All you have to do is to deploy new contract and point the main contract to that new address... and there you have it... the code is changed, and the old code sitting dead.

What you cannot change is the history of the data transfers (open ledger), and that is the power you have mentioned. On private block-chains, you can adjust this data (unless it is the network of organizations inaccessible to a public).

Not sure if this answers your question, but I simply felt like there had to be some clarifications.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.