Attestations versus audits: what a reserve report proves

A reserve report tells a reader that an issuer's assets equaled or exceeded its tokens outstanding at a particular moment, as reported by the issuer and checked by an accounting firm. Most such reports are attestations rather than audits, and the two are different engagements with different scope, different assurance, and different consequences if the numbers turn out to be wrong. The distinction is the difference between confirming a figure the subject supplied and forming an opinion on a company's financial statements.

What each engagement actually covers

In an attestation the issuer prepares a statement — typically that reserve assets at a stated date and time were at least equal to tokens outstanding — and an accountant performs agreed procedures to check that assertion. The scope is the assertion. In a financial statement audit the accountant plans and performs work to obtain reasonable assurance about the financial statements as a whole, including liabilities that management did not volunteer, and issues an opinion. A reserve attestation and a reserve audit are not two words for the same document.

The four things a point-in-time report cannot establish

First, it says nothing about any other date. An assertion about the last calendar day of a month is silent about the fifteenth, and a firm that could not have met the same test mid-month can still pass at the boundary. This is why frequency, unpredictability of timing, and consistency across reports matter more than a single strong report.

Second, it usually does not test where the assets came from. Assets borrowed shortly before a snapshot and returned afterward would satisfy a narrow assertion. Audits address this through cutoff and related-party procedures; a narrow attestation typically does not.

Third, it says little about encumbrance. Reserve assets pledged as collateral, lent, or subject to rehypothecation may appear as assets while being claimed by someone else in a stress scenario. Whether the assets sit with a qualified custodian in a segregated structure is a separate fact, established by the legal arrangements rather than by an arithmetic comparison.

Fourth, it does not evaluate whether the reserve can be converted to cash at par under pressure. A portfolio of longer-dated instruments can be worth more than tokens outstanding at accounting values and still fall short when sold quickly. Composition, covered earlier in this track, is a separate question from adequacy.

Proof of reserves and the liabilities half of the problem

Proof of reserves is a cryptographic technique, most often applied to exchanges rather than issuers. Customer balances are hashed into a Merkle tree, the root is published, and each customer can verify that their balance is included without seeing anyone else's. Alongside this, the firm demonstrates control of on-chain addresses holding assets, usually by signing a message or moving a small amount.

The technique genuinely improves on a spreadsheet: it makes the asset side publicly verifiable and lets individual customers check their own inclusion. Its limits are equally concrete. It proves control of the addresses, not ownership free of obligations, so borrowed assets and pledged assets both pass. It covers only assets on public chains, so bank deposits and government bills — the bulk of a fiat-backed reserve — sit outside it. And a liabilities tree is only as complete as the operator chose to make it: a customer whose balance was omitted cannot detect the omission, since they only verify their own leaf.

A verification story is only as strong as its weakest half. Assets proven cryptographically and liabilities asserted by the operator is an improvement over both asserted, and it is not the same as an audit of the whole balance sheet. The failures of 2022 turned on liabilities and on assets pledged in several places at once, which is the half these proofs cover least well.

How to read a reserve report

• Identify the engagement type from the accountant's own language, and note that the report is addressed to the issuer, not to token holders.
• Check the date and time of the measurement, and whether the series of reports is regular and unbroken.
• Read the composition table, not just the total, and note anything that is not cash or short-dated government debt.
• Look for statements about segregation, custody arrangements, and whether assets are pledged, lent, or otherwise encumbered.
• Note the accounting firm and whether the same firm and standard have been used consistently over time.
• Treat the absence of a liabilities scope as the default rather than as an oversight; most attestations do not claim it.

None of this is a verdict on any particular issuer. It is the reading protocol that lets a reader tell how much a document is claiming, which is the necessary precondition for judging it at all.

On this site, circulating supply is the liability side of an issuer's ledger as recorded on-chain, and supply hosted per chain shows where that liability sits. Supply change and peg deviation often move before a report is published, because markets price doubt continuously and reports arrive on a schedule.

The next article covers depegs directly: how they begin, why a small deviation is normal, and what distinguishes a liquidity event from a solvency one. See data sources for where the reserve and supply figures used here originate, and methodology for how they are compiled.