II. A need for meta-trust…

A fair number of websites operate on the internet and claim to be “Dapps”, DAOs and the like. Among others, StorjFootnote ³⁵ operates decentralised cloud storage, LaZoozFootnote ³⁶ decentralised carpooling, CryptokittiesFootnote ³⁷ provides “digital cats” collectibles, KlerosFootnote ³⁸ provides blockchain-based arbitration and OpenBazaarFootnote ³⁹ operates a decentralised online marketplace. For instance, Kleros advertises itself as a “decentralized application” and “autonomous application” providing a blockchain-based arbitration service. “Every step of the arbitration process (securing evidence, selecting jurors, etc) is fully automated. Kleros does not rely on the honesty of a few individuals but on game-theoretical economic incentives” [enshrined in the Kleros protocol].Footnote ⁴⁰ Such “computational courts”Footnote ⁴¹ obviously pose legal challenges arising from their attempt to constitute an alternative to judicial dispute resolution, which are, however, not the subject-matter of this paper: our point here is that blockchain-based decentralisation is a core feature of the service delivered by Kleros. As a result, Kleros users are invited to trust blockchain protocol as enabling “crowdsourced jurors to adjudicate disputes”. Failing that, the users would be left with their dispute being arbitrated by anonymous jurors about whom they have no guarantee.

In a different fashion, CryptoKitties, advertises itself as a “distributed application” and a Dapp which provides users with a game consisting of “breeding and collecting” unique digital cats. The advertising states that, “secure in the knowledge that blockchain will track ownership securely”, a digital cat is “100% owned by you; it cannot be replicated, taken away, or destroyed”. The underlying argument is that of the immutability and tamper-proof character of a public and decentralised blockchain, so that the application’s data stored on it (the second condition for being a Dapp), in this case the data featuring the digital cats, are also immutable because they would not depend upon a third party being a “single point of failure”. The characterisation as Dapp hence also plays a role in the essential features of the service provided. These websites look like any other website,Footnote ⁴² only their marketing highlights their blockchain virtues. The use of blockchain terminology – and especially the signs of “Dapp” or DAO recognised in the blockchain community – triggers expectations of decentralisation and absence of single point of failure on behalf of the users. However, such marketing may simply be misleading.

A user of CryptoKitties argued that “CryptoKitties folks”Footnote ⁴³ retain the ability to alter, duplicate and even destroy the digital cats. In other words, the application would not be as decentralised and autonomous as promoted. Therein, CryptoKitties Terms of Use stipulate that “in addition to the Gas Fee [the cost of running smart contracts transactions on the underlying Ethereum blockchain], each time you utilize the CryptoKitties marketplace Smart Contract to conduct a transaction with another user via the App, you authorize us [namely Dapper Labs Inc] to collect a commission of 3.75% of the total value of that transaction […]”.Footnote ⁴⁴ This tends to confirm that a single legal entity, namely Dapper Labs Inc, would run the application. Except for the Terms of Use referring to a contractual arrangement between the consumer and “Dapper Labs Inc”, the rest of the website, and especially the homepage, is however silent on who is actually running CryptoKitties and refers more profusely and confusedly to “the Cryptokitties team”. Given that CryptoKitties obviously targets individuals, the marketing of CryptoKitties could inter alia constitute an unfair commercial practice within the meaning of Unfair Commercial Practices Directive,Footnote ⁴⁵ and more specifically a “misleading action” in that it would contain “false information and [would] therefore [be] untruthful […] in relation to the main characteristics of the product [in casu: the digital cats] and which is likely to cause [a consumer] to take a transactional decision that he would not have taken otherwise”.Footnote ⁴⁶ Illegitimately promoting one’s application as vested with the decentralised virtues of a Dapp – as alleged with regard to CryptoKitties – would obviously also result in misleading consumers with regard to the trader’s role and rights in the transaction, which constitutes another “misleading action”.Footnote ⁴⁷ Illegitimate promotion of the decentralised character of the structure could even quite simply mislead users as to the very existence of a trader conducting the economic activity.

Users could also simply be led to believe that there is no “trader” in the traditional sense. Even more seriously, the promotion of blockchain magic is likely to blur the issue enough for users, so that they don’t even wonder about the existence of a trader. This is all the more so, given that blockchain decentralisation is sometimes precisely advocated as an alternative to the law under the “code is law” motto.Footnote ⁴⁸ The user would then not even consider that (consumer) law might be applicable to his situation, nor against whom he could invoke it. In this regard, ill-founded promotion of blockchain-based decentralisation – and especially alleged Dapps – may be found not only to constitute unfair commercial practices: they may violate the most basic information obligations provided for in the E-Commerce DirectiveFootnote ⁴⁹ in order to bring trust in e-commerce, such as the obligation falling onto the provider of an information society service to ”render easily, directly and permanently accessible to the recipients of the service and competent authorities, at least the following information: (a) the name of the service provider; (b) [his] geographic address; […] (d) […] the trade register in which [he] is entered and his registration number [where relevant]”. The legal analysis against the Unfair Commercial Practices and the E-Commerce Directives is only provided as a case in point which has the advantage of being harmonised at EU level, while similar conclusions could also be drawn from the analysis of other bodies of legislation, such as the general principles of fairness and fair dealing in contract law as embodied in the respective national legislations.

Our purpose is not to undertake an audit of the websites promoting themselves as blockchain-based decentralised entities. Rather, the imbalance of information between these entities (“operators) on the one hand and their users on the other hand, demonstrably appears to make it possible for abuses to go unnoticed and unchallenged. Blockchain and the marketing on its “magic” act as a screen between (in this case) consumers and the legal protection afforded to them, rendering the whole legal protection inoperable or at the very least inefficient. The same has already been well documented with regard to the sale of “ICOs” to investors unable to ascertain whom they purchase tokens from, and what the tokens actually consist of.Footnote ⁵⁰ By developing the application of blockchain beyond the realm of the financial sector, the second wave of blockchain only makes this very same issue bigger and broader in scope. It disempowers users,who may not even realise the abuse and who would in any case have a hard time claiming their rights, where in theory available. This leads us to an intermediary conclusion: blockchain technology may make it possible to do away with trust in third parties, but this is not enough. It remains to be seen how users can trust that an alleged blockchain-based application or entity is indeed vested with such blockchain characteristics, or – in other words – that it is what it claims to be. The need for trust does not disappear with blockchain; it is shifted to a meta-level: how to trust that a structure is indeed vested with the ‘trustless trust’ features of the blockchain? In other words, how to bring about what we hereby call “meta-trust”? The importance of this requirement should not be underestimated. Failing to address it is likely to result in free riding behaviours. In the medium term, this could result in what is known in economics as “adverse selection”Footnote ⁵¹ and would additionally have a chilling effect on the acceptance of blockchain innovations.Footnote ⁵² Against this background, the rise of private blockchains can be seen as a first reaction to the need for trust and accountability. The fact that this disintermediation technology is operated by big IT companies, who were precisely the targets of disintermediation, is not as paradoxical as it might first seem.Footnote ⁵³ The next section investigates whether the blockchain environment at large might bring meta-trust or, conversely, what are the hurdles to its doing so.

III. … Which cannot be provided by the blockchain

The blockchain environment is not a structured one: it is comprised of a multitude of individual initiatives, brought together by common traits and common believes. As part of the latter, the importance of the open-source character of blockchain code is put forward as a regulatory means. The open-source character of the code is unanimously considered as a sine qua non condition for qualifying as a Dapp (see definition of a Dapp above), a DAO and the like. Blockchain-based decentralised entities are “inspired from the models of open source collaboration”.Footnote ⁵⁴ Among other virtues, the open-source character of the code would enable collaboration of the “community” in the updates and improvements of the code, and also its auditability.Footnote ⁵⁵ In that sense, the open-source character of the code is a transparency or even accountabilityFootnote ⁵⁶ measure viewed as a safeguard and can thus be interpreted as vested with a regulatory function.Footnote ⁵⁷ As a matter of fact, some websites have emerged which display the result of their “audit” on existing Dapps.Footnote ⁵⁸ However, mere auditability of the underlying code of a Dapp is clearly not sufficient to enable users to trust the blockchain virtues of an alleged Dapp. It has already been found that “such [open source] networks present major cognitive entry barriers”.Footnote ⁵⁹ This is particularly problematic in the case analysed here of non-developer individuals willing to purchase goods or services on Dapps, or in other words where the blockchain technology would scale up. Further, mere auditing of the open-source code may not be sufficient to determine the level and scope of decentralisation of an application or entity as, simply, not everything is in the code. For instance, a party may use different devices and credentials to control an entity which makes it difficult to trace, especially because anonymity – or at least pseudonymity, is strongly promoted in the blockchain environment.

Failing to determine the decentralised character of an application or structure, users may turn to reputed websites that have emerged on the internetFootnote ⁶⁰ and provide directories of decentralised applications and entities, especially of Dapps. Such websites can easily be found; they are broadly referred to not only within the blockchain community but also in the scholarship.Footnote ⁶¹ They display Dapps according to criteria such as their field of activity, their popularity, their respective volume of transactions, etc. Users of decentralised applications or entities may therefore want to rely on these directories to be able to determine whether a website is genuinely decentralised, or in other words whether it is a genuine Dapp. As they stand, the directories of Dapps that can be found on the internet are, however, not able to provide such trust service, which is now further analysed by taking a closer look at one of most famous ones, State of the ÐApps. This website claims it has “become one of the biggest reference for the Ethereum ecosystem”Footnote ⁶² and advertises its references (talks, workshops, etc). However, it stipulates in its Terms of Use that “neither the website nor any of the persons or entities involved in any way in respect of the website including its host and its contributors, provide for specific legal, fiscal, economical and/or any other kind of advice or recommendation that may be relied upon. A visitor of the website will therefore act at its own risk in accessing or in any way relying on the content of the website […]”,Footnote ⁶³ especially when investing in cryptocurrencies. Further, State of the ÐApps does not clarify how a website ends up being displayed as a Dapp in its directory. While the State of the ÐApps does not claim to be a Dapp or another blockchain-based decentralised entity itself, it does not allow the user to identify who runs the website.Footnote ⁶⁴ In addition, it provides for specific features that Dapps representatives may choose to purchase – upon payment – to enhance the visibility of Dapps “to attract more users”.Footnote ⁶⁵ As a result, one is led to believe that the displaying of Dapps is probably done without any verification of the genuine character of an application as a Dapp so that the State of the ÐApps would merely be a list of self-proclaimed Dapps. In that it allows for promotion of self-proclaimed Dapps, it can even contribute to further misleading the Dapp users. In this regard, CryptoKitties is, for instance, referred to on State of the ÐApps with much visibility.Footnote ⁶⁶

The scholarship has documented – especially in the case of cryptocurrency wallet service providers – the fact that, by creating a new and complex economic environment, blockchain networks give rise to profitable “edge services”,Footnote ⁶⁷ ie intermediaries taking advantage of the lack of knowledge of users of blockchain “things”, while not being “decentralised” themselves.Footnote ⁶⁸ State of the ÐApps is demonstrably one of those. The very existence of such directories can be viewed as a symptom of the need for reliable information and trust on behalf of users of blockchain things, and in particular alleged decentralised applications and entities.

Eventually, the role of blockchain vocabulary in this regard needs to be touched upon, and especially the role of the taxonomy of blockchain-based decentralised “things” that has been developed. The lack of clarity and reliability of blockchain vocabulary has already been documented.Footnote ⁶⁹ It is paradoxically illustrated by the huge number of websites displaying blockchain glossaries, lexicons or dictionaries.Footnote ⁷⁰ The legal scholarship found that it resulted in further confusing regulators.Footnote ⁷¹ Notably, it leads to the overestimation of the virtues of blockchain, or their actual scope.Footnote ⁷² With regard to blockchain-based decentralisation, it was particularly found to prevent observers from seeing that blockchain networks’ governance is often de facto less decentralised than promoted, to the benefit of the unaccountable but actual managers of the said blockchain network.Footnote ⁷³

To give a taste of the issue with regard to decentralised applications and entities, it can be observed that, although extensively promoted and discussed within the blockchain community and scholarship, the definition of a “DAO” is not yet settled.Footnote ⁷⁴ The concept of the “autonomy” of a decentralised entity – core to its “trustless trust” virtues – is particularly subject to controversy. Inter alia, the degree of autonomy required to be considered genuinely “autonomous” is not clearly settled. As an illustration, “TheDAO”Footnote ⁷⁵ is mostly referred to as the main life example of a DAO; however De Fillipi and Wright classify it as a mere DO for lack of sufficient autonomy.Footnote ⁷⁶ As part of this debate, the technical means by which such autonomy is to be acquired is not clear, namely whether artificial intelligence shall necessarily be involved or not.Footnote ⁷⁷ Although the definition of a Dapp by Johnston et al is relatively unchallenged and massively reused, it also leaves numerous questions unanswered. Should the State of the ÐApps have genuinely tried to conduct due diligence analysis of alleged Dapps, it would have bumped into questions of some importance, such as: does qualification as a Dapp prevent an application from being run by a legal entity at all? In relation thereto, what involvement of the “users” on the changes to the protocol is considered sufficient to qualify as “decision by consensus”? With reference to the application’s “data and records of operation” to be stored on a public blockchain, what exactly shall be “on” blockchain is also unclear. For instance, the Dapp OpenBazaar was found not to “use a blockchain for its core architecture”:Footnote ⁷⁸ can it nevertheless qualify as a Dapp? The list of questions goes on.

The lack of clarity in blockchain vocabulary obviously makes it difficult for users to ascertain what and who they are dealing with when transacting with blockchain-based decentralised applications or entities. Ultimately, where a website claims to be a Dapp, what does it actually claim to be and provide? If a website – say CryptoKitties – claims to be a Dapp as part of its blockchain marketing while the definition of a Dapp is not settled, it obviously also makes it harder for users to lodge a complaint arguing that they were illegitimately deceived. In that sense, blockchain vocabulary – and especially the taxonomy of blockchain-based decentralised entities – does not provide appropriate signals for users to help them cope with the imbalance of information that they suffer vis-à-vis blockchain developers. On the contrary, it worsens it by bringing an additional layer of uncertainty or potential malicious use.

This section has demonstrated that the blockchain environment is unable to provide what we termed “meta-trust” with regard to decentralised applications and entities. In other words, blockchain technology may make it possible for A and B to exchange without trusting each other, based on C blockchain-based application; however, blockchain tools are unfit to provide trust to A and B that C application is indeed “trustlessly trustable”. Against this background, we now need to deduce from the above what is needed in order to bring this absent meta-trust into being, with a view to how the law could play a role in this regard.

IV. The role of the law

Two factors in the blockchain environment have specifically been pointed at as potential tools to bring meta-trust, and have eventually proved to result in the opposite effect: the vocabulary that has emerged in the blockchain environment and especially the taxonomy of blockchain-based decentralised entities on the one hand, and the upsurge of websites serving as (unreliable) directories of the latest on the other hand. The mere conclusion that blockchain vocabulary is vague does not suffice to understand why it is not helpful to bring trust and even why it is so detrimental. After all, legal provisions are also often vague or even unclear; just think of terms largely used in different jurisdictions around the globe such as “reasonable”, “fairness” or “negligence”. How can they nonetheless be entrusted with any value and meaning? The answer is quite obvious: because they are further clarified by judicial authorities, which grant them binding and enforceable interpretation over a given jurisdiction. It is worth noting that the interpretation of unclear blockchain terms is given by what the scholarship has called “benevolent dictators” with regard to the role played by some individuals in bringing “off-chain governance” of the internal blockchain networks but also of the blockchain environment at large.Footnote ⁷⁹ Illustrative thereof is the “post” of Buterin trying to dispel the blur (what he calls the “Daoism”) around the delineation of the various blockchain structures (DAO, DO, Dapp, smart contract …).Footnote ⁸⁰ His quasi-regulatory function in the blockchain community demonstrates the lack of actual regulation, while it certainly does not satisfy the regulatory demand. Not to mention that he could simply be inaccurate, he obviously lacks the legitimacy as well as the authority to make his statements exclusive, binding and enforceable. Against this backdrop, blockchain vocabulary, the emergence of directories and the role of “benevolent dictators”Footnote ⁸¹ appear to constitute a distorted mirror of what legal regulation brings. In other words, they can be interpreted as signs that the law is needed. The remainder of this paper therefore attempts to draw guidelines for how the law could help bring meta-trust.

Werbach invited the legal community to rethink the role of the law in relation to blockchain and especially the deemed “regulation vs innovation” dichotomy. Stating that blockchain needs the law to keep up to its promises, he suggests we should look at how the law can help blockchain.Footnote ⁸² Blockchain invites lawyers to get back to the basics of the law: Werbach identified classification – ie the activity of naming things – as a major part of the role of regulationFootnote ⁸³ that is of acute importance with regard to new technologies, which blur the understanding of traditional regulatory categories.Footnote ⁸⁴ Classification is not only a first step to trigger the application of some substantive obligations, it also makes sense per se in order to bring trust by delineating and authenticating a party or a subject-matter. The obligation for an information society service to disclose his identity as trader – enshrined in the E-Commerce Directive (mentioned above) –not only brings a name: it creates a link between a party and a function (namely trader) enabling the consumer, where available, to hold that party accountable for the activity. Similarly, corporate law aims not only to trigger a certain legal regime to a certain form of company; it primarily enables third parties to authenticate with whom they transact, or – more precisely – what they transact with. Transacting with a natural person, a non-profit association or a company obviously makes a difference from the perspective of the third party.

In view of the foregoing, it appears that there is a need for regulatory classification of blockchain-based applications and entities – not to mention the other aspects of blockchain technology – as well as the means to have this classification enforced. To be clear and in line with the identified need for meta-trust, the purpose is not the regulation of blockchain activities (it would not regulate, for instance, how the blockchain-based decentralised applications or entities should operate), but the identification and authentication of blockchain “things”. Although it is therefore without prejudice to the required regulation of blockchain activities, it is not an unrelated topic. Regulating (blockchain) activities inevitably requires the performance of regulatory classification. Even when classification is stand-alone regulation, it has an impact on the regulation of activities. The lack of reliable information on fast-evolving technologies – and therefore the uncertainty surrounding the potential effect of a regulation – has been identified as a major explanation for the pacing problem.Footnote ⁸⁵ In the case of blockchain, it was found that the opacity around the technology was partly due to the vagueness of blockchain vocabulary. Regulatory classification could in some cases be sufficient, because it would demonstrate that the blockchain “thing” – “Cryptoduck” as named by WerbachFootnote ⁸⁶ – simply proves to be already regulated or in other words to already fall within a regulatory bucket. In that sense, filling the meta-trust gap would empower users and also regulators, by restoring the information asymmetry, if possible ex ante – just as corporate law requires companies to register under a specific legal form before operating. Even more, and subject to the regulatory design, it could shift the burden of proof so that “the blockchain” (although it remains to be seen who and how) would have to prove its alleged virtues.

Any regulatory attempt in this regard would, however, be confronted with at least the following challenges and constraints. Firstly, classification may itself fall into the pacing problem, given the fast pace of blockchain development. Secondly, law-makers may simultaneously want to promote – or at least not prevent – potential positive blockchain innovations.Footnote ⁸⁷ Thirdly, the (alleged) decentralised character of blockchain-based applications and entities makes it difficult to identify which entity(ies) should be subject to regulation. The scholarship has already made clear that decentralisation – to a certain extent – does not mean that no entity can be subject to regulation.Footnote ⁸⁸ A fourth, but related, challenge is the identification of the competent actor(s) to introduce such regulation, as well as where the latter should be positioned in the legal system’s hierarchical structure. The two final challenges at least would depend upon the context and the chosen regulatory purpose.Footnote ⁸⁹ Introducing regulatory classification in the blockchain environment is ambitious and could be performed in various designs and with various scopes. The remainder of this paper merely touches upon a few options.

The most obvious option would seem to be simply to define blockchain terminology in statutory law, which was undertaken by a few US States, especially with regard to the legal recognition of blockchain-based electronic signatures and of smart contracts in e-commerce. The law of Arizona defines “blockchain technology” as “distributed ledger technology that uses a distributed, decentralized, shared and replicated ledger […]”. The law derives from it the legal recognition of certain features of the data stored on it, such as the fact that “the data on the ledger [would] provide an uncensored truth”.Footnote ⁹⁰ These statutory provisions, however, illustrate a severe misunderstanding of the operation of blockchain, as summarised by Walch: “if a false piece of data is put on a blockchain ledger, it remains false, regardless of the fact that it appears on the ledger (the garbage in / garbage out idea)”. More generally, she notes that regulation of blockchain by the law-maker can be hindered by the fact that the law-maker does not have sufficient understanding of the technology.Footnote ⁹¹ Regulation of blockchain vocabulary can therefore rather result in bringing additional confusion to the field,Footnote ⁹² especially given the ever-evolving character of this technology. If no specific mechanism is provided for, the issue mainly arises from the fact that the law-maker and the judicial authority would have to make highly technical analyses of an ever-evolving technology, which they are poorly equipped to do. Should this option be chosen for a certain scope, it would be therefore wise to provide specific mechanisms to account for the technicalities of the technology: for instance, a registration system could be set up in order to provide for trust ex ante (namely before operation) while the analysis of the compliance of a “blockchain thing” with the statutory definition could be delegated to a body having technical expertise. Finally, regulators should pay attention to the principle of technological neutrality, namely the idea that “the law should not pick technological winners and loosers, the law should neither help nor hinder particular types of technological artefacts”.Footnote ⁹³ Although not enshrined in EU primary law itself, so that it does not constitute a legal obstacle as such in EU law, this principle broadly applied in EU secondary law and referred to in EU ICT policies would logically prevent the setting up of a techno-specific regulation.

Based on the observation that blockchain is a complex technology based on decentralisation, self-regulation is being undertaken, especially with regard to the classification of blockchain “things” as part of ISO certification.Footnote ⁹⁴ “Dapp”, “DAO” etc could possibly be part of ISO certification. Certification indeed allows terms to be defined according to standards with authority, certified by external knowledgeable bodies. Displaying the respective ISO standard sign on a website alleging its “Dapp” or “DAO” character could therefore bring trust to users, while the question of “who” would display the sign would be partly left up to the internal organisation of the decentralised entity. ISO certification is voluntary and it is beyond legal expertise to try and guess whether the market would broadly embrace certification. Although the existence of (ISO) standards would help users prove the existence and nature of unfair commercial practices (discussed above), for example, it would not prevent per se other parties from continuing to promote (alleged) virtues of their blockchain-based decentralised applications or entities. In other words, wrongly claiming to be ISO-certified could be sanctioned,Footnote ⁹⁵ but the use of certified terms – eg Dapp – would remain free for use.

In order to achieve legal certainty while acknowledging the complexity and the decentralised feature of blockchain, co-regulation has been called for.Footnote ⁹⁶ With a view to bringing trust into blockchain terminology, it is hereby suggested that certification be taken a step further, by leveraging “certification marks” recently created in EU law.Footnote ⁹⁷ Unlike other trademarks which mainly “aim to distinguish the origin of goods and services”,Footnote ⁹⁸ the certification mark has a guarantee function.Footnote ⁹⁹ “Applied for and […] capable of distinguishing goods or services which are certified by the proprietor of the mark in respect of [inter alia] the quality or other characteristics”,Footnote ¹⁰⁰ the certification mark could guarantee the criteria for qualifying as a Dapp. The certification mark allowsFootnote ¹⁰¹ and even requires Footnote ¹⁰² the proprietorFootnote ¹⁰³ – eg a certifying body – to prevent non-authorised third parties from using the mark (eg the “Dapp” sign(s)).Footnote ¹⁰⁴ Contrary to collective marks, the use of certification marks does not have to be limited to a closed group of members. Subject to the provisions of the regulation governing the use of the mark,Footnote ¹⁰⁵ an “‘open shop’ principle applies”,Footnote ¹⁰⁶ which fits the open nature of blockchain initiatives. With minimal coordination effort, the certification mark could be used to monitor and sanction the use of the “Dapp” sign by applications wrongly self-advertised as Dapps.