The Journal · Finality
A ledger is final only while its operators agree.
Zano, Cronos and Cosmos each rewrote a recent history. Immutability is a governance property. The grown-up response is to publish who can intervene.
Three incidents, close together, retired a slogan. Zano restarted from a block before a broken upgrade, after a bug in its Gateway Address feature let an attacker create on the order of 36.9 million unauthorised ZANO and an absurd quantity of fUSD. Because the illicit coins could not be told apart from the real ones, roughly a month of ordinary transactions went with them.
Cronos halted and rewound about 10,961 blocks, a little under two hours, after the Tectonic exploit. Later accounting put affected borrowing near $120 million, with about $111 million recovered and roughly $9 million already gone. Cosmos Hub validators moved about 1.23 million ATOM from an exploiter’s address after a restart, without that wallet’s signature. These are the figures in the public accounts of the incidents. They are not a reason to say every chain is theatre. They are a reason to say finality is a decision.
Chapter 01 · 1 of 4
Three different uses of the same power
Zano chose the integrity of a fixed supply over the survival of a month of history. Cronos chose recovery of user funds over an hour of settlement finality. Cosmos chose to move assets after the fact. The mechanisms differ. The fact they share is that a coordinated set of operators, exchanges and infrastructure providers can decide that a different history is the one that counts.
A chain is only as final as the willingness of the people who run it, list it and custody it to keep treating one history as canonical. If a small group can halt production, ship an upgrade and bring the venues with them, the network has practical reversibility, whatever the marketing says.
Chapter 02 · 2 of 4
Reversibility is sometimes the lesser harm
Code is law until the people with enough power decide that another outcome is worth more.
Letting an attacker keep an unlimited mint can be worse than deleting recent history. A monetary asset with a broken supply is no longer the asset anyone bought. Recovery of stolen funds can be the outcome users would have voted for, had there been time to vote. None of this is automatically corrupt.
It is also not automatically legitimate. The difference between an emergency fork debated in public and a quiet rewrite by a handful of insiders is the difference between a constitution and a back room. Users should know which one they are in.
Chapter 03 · 3 of 4
Seven questions for an intervention
Was the power written down before the crisis. Did a broad and independent set of validators and stakeholders actually take the decision. Was it technically necessary, and proportionate. Was the scope limited in time and in whose balances moved. Was there a full account afterwards. Would the same rule have been applied if the affected party had been powerful. Can a foundation, an exchange, a validator cartel or a government order capture the process.
A network that cannot answer those questions does not have a finality policy. It has a habit.
Chapter 04 · 4 of 4
Publish a finality and intervention profile
Any chain used for payments, tokenised securities, collateral or a corporate treasury should say, in one place, who can halt it, how many independent entities can coordinate a rollback, which upgrade keys and emergency multisigs exist, whether governance can freeze or redirect assets, how exchanges are expected to treat a contentious fork, and the historical record of having done any of this. The cost of reversing should be stated, not discovered.
The opportunity is not to pretend the incidents did not happen. It is to make the power legible before the next one. A buyer of settlement can then choose a chain the way they choose a custodian: by reading the intervention terms, not the adjective on the homepage.
Illustrative commercial design only. This is not legal, tax, investment, employment or securities advice, and it is not an offer to the public, a solicitation to invest, or a promise of funding, equity or returns. Structures vary by venture and must be drafted for the incorporation jurisdiction by qualified startup, tax and securities counsel. Blockchain Lab does not claim to be a licensed investment manager, broker or bank on the basis of this website.