Thread by @sethforprivacy

1/ I'm really tired of responding to lots of comments from DERO people claiming they've solved the worlds problems and scamming people with false marketing, so here's a thread breaking down all of their grandiose claims 👇

2/ DERO claims to be using "fully-homomorphic encryption" to prevent nodes from being able to see transaction information.

Not only is this nonsensical (zk-proofs allow verification without revealing data simply) FHE is absolutely unusably inefficient:

anandtech.com/show/16533/int…

3/ For DERO to claim that they're using something that is thousands of times less efficient than more common encryption methods, and that has yet to be implemented in any other fashion due to this inefficiency should discount the rest of their claims off the bat.

4/ DERO also claims to solve all of the problems/tradeoffs with cryptocurrency without any tradeoffs.

*Immune* to 51% attacks and double spends?!? Do you really think this tiny project solved the hardest security problems today with no tradeoffs?

5/ DERO claims that smaller and more rapid block generation solves 51% attacks, something that makes absolutely no sense.

A miner with >51% of the hashrate will still be able to mine the same proportion of the blocks and rewrite history just as easily.

6/ Somehow preventing wallets from spending more than one transaction at a time prevents double spends, which is asinine as double-spends can (and are usually) performed via 51% attacks, not a wallet trying to spend the funds twice (consensus rejects double-spends)

7/ DERO has a 2mil/21mil pre-mine owned solely by the founding team.

This is an absolutely absurdly large pre-mine and gives massive financial incentive for the centralized dev team to inflate their claims and dump on new entrants to DERO.

8/ DERO either knowingly (or unknowingly) claims that transaction data must be decrypted to be verified, something that is absolutely false.

Monero, Zcash, etc. all do verification without revealing amounts or transaction details -- verification on encrypted data is quite easy.

9/ Maybe best of all as someone who has a networking background, DERO claims to do TLS over UDP instead of TCP, something that is literally impossible and pointless.

TLS (read: comms encryption) can only be done via TCP as you have to have a handshake and state for encryption.

10/ Side-note -- their code seems to just do TLS over TCP contrary to their claims.

There is a rarely used way to do a form of TLS via datagram packets, DTLS, but they do not mention DTLS in their repositories or docs.

11/ Their example of "TLS over UDP" shows a Wireshark screenshot of a TCP packet (one using TLS and one using regular HTTP over TCP), yet again showing they have no idea what they're talking about:

12/ Their whitepaper link 404s, so I couldn't even view it:

dero.io/attachment/Whi…

13/ They claim their network has no soft/hard-forks, but they are in the process of a "coin swap" to their new network, something far worse than a soft/hard-fork as it's an entirely new chain:

docs.dero.io/rtd_pages/basi…

(Also have to love the myriad misspellings and poor grammar)

14/14 Enough of my time wasted on this, but if you see projects claiming to solve all known issues with encryption, privacy, smart contracts, security, etc. you should run as fast you can.

Grandiose claims are *always* massive red flags and inevitably money grabs.

Fun extra tidbit -- all of their repos still say that their new "Stargate" FHE blockchain is in testnet, but they're simultaneously telling people to swap funds through centralized services to this new testnet today:

github.com/deroproject/de…

Make it make sense!

*most of their grandiose claims

They make far too many grandiose claims for me to spend to time refuting every one, but I covered the most obvious ones here.

Excellent additional details and tested aspects of the lies of DERO here, very helpful to get a picture of a few of the other outlandish claims (read: lies):

https://twitter.com/reubenyap/status/1499655175954640896?s=20&t=NTu6gYtHPuiuHLFYKi2ItQ

Thanks for digging in as well, @reubenyap!

One clarification -- the docs and website are misleading, and apparently DERO does not use FHE, but instead uses PHE, taken from AnonZether without credit or attribution:

github.com/ConsenSys/anon…

Thus their HE approach does seem viable in theory, though I can't validate impl.

Also:

https://twitter.com/sethforprivacy/status/1517467824058515457?s=20&t=Z5KBAEnd1vYIn-mmTQRZaQ