Ethereum 2.0 and the Prospect of Reverse Mutation

Introduction

In 2008, the anonymous Satoshi Nakomoto introduced the concept of Bitcoin, a decentralized system of peer-to-peer transactions that operates on a blockchain.[1] Bitcoin is today considered a “digital asset,” which the ABA defines as “an electronic record in which an individual has a right or interest.”[2] After bitcoin, the cryptocurrency token[3] with the second highest market cap is ether.[4] Ether is used to interact across the Ethereum blockchain, which Vitalik Buterin launched in 2015.[5] The Ethereum blockchain provides more functionality than the Bitcoin blockchain.[6] Ethereum originally operated through a proof-of-work algorithm, in which miners add new blocks (which represent transactions and other actions) to the blockchain by solving a computationally intensive problem.[7] The successful miner receives some of the token as a reward.[8]

Digital assets have historically operated with minimal government oversight, but recent events in the industry have resulted in calls for more comprehensive regulation.[9] For example, cryptocurrency exchange FTX filed for bankruptcy on November 11, 2022.[10] Several months prior, the coins UST and LUNA significantly declined in value, becoming almost worthless.[11] These failures arose in the context of a complex regulatory landscape with multiple United States agencies vying for jurisdiction over digital assets.[12]

The Securities and Exchange Commission (“SEC”) has been active in enforcing securities laws against actors involved with digital assets. Section 2(a)(1) of the Securities Act contains a long list of enumerated types of securities under the SEC’s purview, such as “stocks,” “notes,” and “options.”[13] Since the Securities Act give the SEC authority to regulate transactions involving securities, whether an asset is a security for purposes of the Securities Act is crucial.

One such security from section 2(a)(1), an “investment contract,” has acted as a means for the SEC to acquire jurisdiction over less traditional instruments.[14] The test to determine whether an asset is an investment contract comes from the Supreme Court case SEC v. W.J. Howey Co., 328 U.S. 293 (1946). The case involved a firm, W.J. Howey Co., that sold land contracts for plots of land planted with citrus trees.[15] To obtain a land contract, a purchaser also had to purchase a service contract with a company that would cultivate and sell the oranges, which could be Howey or another firm.[16] Since the purchasers were not experts in cultivating oranges and would therefore not know about alternative firms, Howey effectively became the service operator for the landowners.[17] The service operators (primarily Howey) would then pick the oranges, sell them, and distribute the proceeds to the landowners.[18] The Court determined that this enterprise was an investment contract within the meaning of the Securities Act.[19]

The Howey test, as it has come to be called, consists of four main elements, with a fifth overarching element.[20] An investment contract is a contract, scheme, or transaction (the overarching element) whereby a person (1) invests his or her money (2) in a common enterprise (3) with a reasonable expectation of profits (4) to be derived from the efforts of others.[21] The SEC’s Strategic Hub for Innovation and Financial Technology (“FinHub”) has produced its own analysis of the Howey test in the context of initial coin offerings (“ICOs”), which involve the initial sale of a digital asset.[22]

In 2020, the SEC instituted an action against Ripple Labs for distributing XRP without a valid registration statement (Securities Act Section 5) or exemption.[23] On July 13, 2023, District Judge Analisa Torres partially held against the SEC, finding that XRP is sometimes a security.[24] The crux of the court’s decision rested on whether XRP is a security within the meaning of the Securities Act.

Judge Analisa Torres’ holding in the Ripple case entirely relied upon Howey.[25] While she analyzed each element, the most important part of the case was element (4).[26] The court divided its analysis between institutional investors and people who bought XRP on an exchange. According to Torres, XRP was a security when Ripple sold it to institutional investors because “reasonable investors, situated in the position of the Institutional Buyers, would have purchased XRP with the expectation that they would derive profits from Ripple’s efforts.”[27] However, when Ripple sold XRP on exchanges, XRP was not a security.[28] These transactions, called “Programmatic Sales,” were blind, meaning that the purchaser did not know that Ripple was selling the tokens.[29] As such, a reasonable investor would not have known that it was Ripple’s efforts that would produce the expectation of profit.[30]

While the Ripple case aids in applying Howey to digital assets, it is not a panacea. Though the Southern District of New York is undeniably an essential court district for digital asset jurisprudence, this single opinion is not binding on any other courts.[31] Regardless, it provides a detailed application of Howey to one token and demonstrates the fact-specific nature of the Howey test.

The analysis relating to securities and investment contracts also applies to the Exchange Act, which regulates secondary market transactions. The Exchange Act has its own section that defines a security, section 3(a)(10), but the analysis is identical to that of Securities Act Section 2(a)(1).[32] The Exchange Act is particularly relevant for the world of digital assets because the nature of the assets themselves can change over time. So, a digital asset could fail to satisfy Howey during the ICO stage (when the Securities Act is more relevant) but later become an investment contract (when the Exchange Act is more relevant). Or, a digital asset could be a security during its ICO stage but later become sufficiently decentralized such that it is no longer an investment contract.

The idea of “mutation,” where a digital asset mutates from a security to a non-security, comes from the former director of the SEC’s Division of Corporate Finance, William Hinman.[33] In a speech, Hinman noted that as of that date, June 14, 2018, Bitcoin and Ethereum were sufficiently decentralized such that they were no longer investment contracts.[34] Since the SEC has not provided much other guidance in analyzing digital assets under Howey, this language has become essential for issuers of digital assets.[35] The Crypto Rating Council, which relays its own opinions as to whether certain digital assets are securities, has created a methodology using factors from Hinman’s speech and the state of Bitcoin and Ethereum as of June 14, 2018.[36]

Hinman’s speech also provides for the possibility of “reverse mutation.”[37] In other words, a security could theoretically become sufficiently decentralized so as to become a non-security but then regain security status as it reverts to a centralized scheme. Alternatively, an initial non-security could become sufficiently centralized throughout its life such that it later becomes a security. Considering the high costs of compliance with the Securities Laws,[38] reverse mutation could effectively kill a digital asset project. Therefore, understanding when such a process may occur and how to avoid it is instrumental for individuals interested in digital assets.

The rest of this Essay will focus on Ethereum 2.0, a uniquely germane project through which to examine reverse mutation for several reasons. First, Ethereum was one of the subjects of Hinman’s speech.[39] So, according to Hinman, Ethereum was sufficiently decentralized as of June 14, 2018. Second, since that date, Ethereum has undergone a major change via Ethereum 2.0. If those changes were brought about through a centralized quasi-governance structure, it is possible Ethereum 2.0 could be a security. The conclusion will depend on exactly how centralized actors contributed to Ethereum 2.0.

The stakes are particularly heightened as professional investors implicitly assume that the SEC has recently accepted Ethereum as a commodity.[40] When the SEC approved an ethereum[41] futures fund in October 2023, it did not object to the Commodity Future Trading Commission (CFTC)’s characterization of ethereum as a commodity on the CFTC’s fund application.[42] This Essay will demonstrate that this industry assumption is likely correct, at least from a purely legal perspective.

I.         Ethereum 2.0

No single organization or individual runs the Ethereum protocol.[43] In fact, the entire source code of the Ethereum protocol is available on GitHub.[44] The main developers of the Ethereum protocol are called “protocol developers” or oftentimes “core developers.”[45] There is no process to become a protocol developer; the term merely refers to people who “provide significant contributions” to the protocol.[46] In reality, though, there is some gatekeeping. The Ethereum Foundation, “a non-profit organization dedicated to supporting Ethereum and related technologies,” runs weekly meetings for protocol developers.[47] Therefore, in a real sense, one becomes a protocol developer when The Ethereum Foundation starts inviting them to the meetings.

The protocol developers are at the heart of Ethereum’s governance mechanisms.[48] To propose a change to the Ethereum protocol, one must submit an Ethereum Improvement Proposal (EIP).[49] Anyone can create an EIP, which “contain[s] technical specifications for the proposed changes.”[50] This process is not new; it has been used to govern Ethereum since 2015 (before Hinman’s speech).[51] Once someone submits a proposal, the EIP editors review it “for technical soundness [and] formatting issues” and “correct[] spelling, grammar, and code style.”[52] From 2015 to late 2016, there were several EIP editors (including Ethereum’s founder, Vitalik Buterin).[53] There are currently five EIP editors.[54] EIP-5069 describes the process to become an EIP editor.[55] People with experience in the EIP process and developing on the Ethereum blockchain may apply to become an EIP editor, but the current editors must approve the application.[56]

The Ethereum Cat Herders, an independent group of 11 individuals who work as product managers on the Ethereum network, facilitate meetings between the editors and those proposing an EIP.[57] Notably, the Ethereum Cat Herders arose in January 2019, after the Hinman speech recognizing Ethereum’s decentralization.[58] Once the editors decide that the EIP should proceed, the proposer presents it to the protocol developers in one of their meetings.[59] After several rounds of edits to the proposal, the protocol developers may agree to implement the EIP in the next network upgrade.[60] Ultimately, the crux of EIP implementation is that protocol developers must agree to implement the EIP. If there is disagreement among the developers, and only some choose to implement the EIP, then some clients could be running different versions of the Ethereum protocol. Such a scenario is called a “fork.”

Ethereum 2.0 was the result of a major upgrade (and fork) called The Merge.[61] The upgrade added a multitude of different functionalities to the Ethereum protocol, but the most important aspect was the migration to proof-of-stake.[62] In a proof-of-stake system, token holders can “stake” their tokens and become what is called a validator.[63] A validator runs various pieces of software (called clients) that can create new blocks and allow the validator to vote on whether the new block is valid.[64]

The upgrade was called The Merge because it resulted in the merging of two separate blockchains.[65] Nevertheless, the resulting blockchain is still based on the original blockchain from 2015.[66] For this reason, the Ethereum community no longer prefers the term Ethereum 2.0; modern Ethereum is still the pre-Merge Ethereum but with new functionality.

II.         Ethereum 2.0 Is Not an Investment Contract Under Howey

Despite the changes in functionality to Ethereum since 2018, the governance of the protocol has not drastically changed. While Ethereum 2.0 was a major upgrade to the network, and there will continue to be other such upgrades, each is just that—an upgrade, which does not necessarily entail an increase in centralization. That is not to say Ethereum is perfectly decentralized; there are centralized entities that could raise the interest of the SEC. Regardless, while examining Ethereum 2.0 under the Howey test, it is important to remember: “[T]hat which we call a rose/ By any other name would smell as sweet.”[67] In other words, “form should be disregarded for substance and the emphasis should be on economic reality.”[68]

A.   A Contract, Scheme, or Transaction

While an oft-forgotten aspect of Howey, identification of the “contract, scheme, or transaction” at issue begins the analysis. It is essential to frame this analysis around the entire scheme at issue, not just one aspect of it. In other words, Howey did not hold that oranges are investment contracts.[69] It held that the entire scheme, consisting of the land contract, the service contract, and the connections between them, were collectively an investment contract. Therefore, under Howey, if the whole of Ethereum is a security, the entire protocol must satisfy its test—not just a single transaction undertaken through the protocol.[70]

An example of this analysis is the SEC’s evaluation of one particular decentralized autonomous organization (DAO) known as The DAO.[71] A DAO is “a ‘virtual’ organization embodied in computer code and executed on a distributed ledger or blockchain.”[72] In other terms, a DAO is a completely decentralized business organization whereby participants vote on changes to the associated system.[73] In May 2016, The DAO began selling DAO Tokens, which “granted the DAO Token holder certain voting and ownership rights” in The DAO.[74] Funds raised by selling DAO Tokens would support various profit-seeking projects and pay token holders their proportional share of the return on investment. In July 2017, the SEC determined after examining the entirety of the system, not just the tokens themselves, that The DAO engaged in an unlawful securities offering via its native tokens.[75] As such, there is precedent for analyzing an entire digital asset scheme, and the SEC should continue this approach outside the context of DAOs in the digital asset space.

B.   Investment of Money

According to the FinHub framework,[76] this prong is “typically satisfied in an offer and sale of a digital asset.”[77] Ethereum certainly satisfies this prong: participants exchange fiat currency or other digital assets for ether to participate in the network.[78] The case law supports this interpretation. In Ripple, the court quickly dismissed a contrary argument, citing Howey itself.[79]

C.   In a Common Enterprise

Traditionally, this prong of the Howey test has been rather complicated. The complexity stems from disparate analysis by various federal courts regarding the possible types of common enterprises. For example, courts have recognized horizontal commonality, broad vertical commonality, and narrow vertical commonality.[80] Horizontal commonality involves “the pooling of assets from multiple investors in such a manner that all share in the profits and risks of the enterprise.”[81] “Broad vertical commonality requires that the well-being of all investors be dependent upon the promoter’s expertise.”[82] Finally, “narrow vertical commonality requires that the investors’ fortunes be interwoven with and dependent upon the efforts and success of those seeking the investment or of third parties.”[83]

The SEC’s FinHub, however, spends little time discussing this prong, merely stating that digital assets typically satisfy it.[84] FinHub’s analysis is most likely correct if one sufficiently divorces the common-enterprise prong from the “derived from the efforts of others” prong because digital assets are inherently based on some sort of common enterprise. Horizontal commonality, which is the most common analysis courts use under this prong, aligns with this approach.[85] Indeed, the Ethereum network almost certainly satisfies horizontal commonality because users exchange fiat currency or other coins for ether, which fluctuates in value. If the Ethereum network becomes more popular, demand for ether could expand, increasing the value of ether. The opposite could also occur.

If one were defending Ethereum against the SEC in court, the best argument would be one of vertical commonality. As of Hinman’s speech, Ethereum was sufficiently decentralized. Since Hinman’s speech, while external organizations like the Ethereum Cat Herders have sprung into existence, they do not possess much power beyond product management. They may offer expertise, but the well-being of investors is not dependent upon that expertise. If the Ethereum Cat Herders were to suddenly disappear, the network would still function. There may be less frequent updates, but developers could still make changes to the network, especially if some massive flaw or bug in the system became apparent. The SEC could counter that the network would work better with the assistance of a centralized organization, but there would be a factual question regarding whether the well-being of investors is dependent on such assistance.

Thus, while there is likely horizontal commonality, there may not be vertical commonality. Regardless, because FinHub uses horizontal commonality and most courts do as well, Ethereum probably satisfies this prong.

D.   A Reasonable Expectation of Profits

According to FinHub, this prong and the “efforts of others” prong are where most of the analysis for digital assets occurs.[86] This prong generally differentiates between what are called “utility tokens” and other tokens. A utility token is “intended to provide access digitally to an application or service by means of blockchain-based infrastructure”[87] and carries no expectation of profits. The SEC has provided some guidance on the distinction between utility tokens and other tokens via no-action letters. In one no-action letter, for example, the SEC approved of how a utility token was restricted to internal wallets, its funds were not used to develop the platform, and its promoters marketed the token by emphasizing its use on the platform rather than any increase in the token’s price.[88]

While one could perform a more thorough analysis of utility tokens, it is not necessary here because ether is clearly not a utility token by the SEC’s current definition. In some sense, ether provides digital access to various applications on the Ethereum blockchain, but it does not meet other factors for classification as a utility token: one can transfer ether to an external wallet, the price of ether is not pegged to one dollar, there is no centralized authority that will redeem the token for one dollar, and so on.[89]

Nevertheless, this prong is usually associated with consideration of the initial coin offering (ICO) for a particular currency. Since ether’s ICO was before Hinman’s speech, and he focused on decentralization (the “efforts of others” prong), it was likely he assumed there was some expectation of profits with ether.[90] Intuitively, one’s participation in the Ethereum ecosystem may reasonably include the expectation of profits. The price of ether is incredibly volatile.[91] And the average time ether is held in one wallet resembles an investment more than a token one keeps solely to participate in a game or other application.[92] Therefore, both by applying the SEC’s no-action letter factors and considering why one would reasonably hold ether, it seems correct that participation in the Ethereum network involves the reasonable expectation of profits.

Finally, and perhaps most crucially, is the issue of staking. Since Ethereum 2.0 now utilizes a proof-of-stake algorithm, users can stake tokens in exchange for ether in a manner akin to earning interest on a bank deposit.[93] The ability to stake one’s tokens has therefore opened more opportunities for casual participants to profit from the Ethereum network. While one must technically hold at least 32 ether to become a validator and earn rewards, there is a major alternative. Even without official delegator functionality, people can still pool together ether to one validator.[94] Exchanges like Coinbase allow users to simply hold ether in their exchange wallet and allow the exchange to stake their tokens.[95] So, staking is an option for people with any amount of ether, and people can therefore expect to profit off of their ether regardless of the coin’s fluctuation in value (as one would with dividends).

In a proof-of-work algorithm, in contrast, people can earn rewards for securing the network, but doing so requires extensive computational power.[96] Such a requirement is the entire point of a proof-of-work algorithm: making block verification costly prevents unscrupulous actors from unilaterally forging the path of the blockchain.[97] These verifiers, called miners, can admittedly pool together computational power and share the rewards.[98] Still, to participate in a so-called “mining pool,” one must continuously operate client software on some sort of computational device and expend a substantial amount of electricity.[99] Electricity usage and the small payouts from mining pools often result in money loss.[100]

The point of this exposition is to demonstrate that staking does allow more people (particularly those without the money to invest in expensive mining devices and computers) to earn rewards for securing the network (albeit indirectly). Staking rewards can be substantial; Coinbase offered 6.85% APY as of the beginning of December 2022.[101]

For all these reasons, SEC Chair Gary Gensler argues that all networks using proof-of-stake, including Ethereum, are securities.[102] His view comes as no surprise. Gensler has been harsh on digital assets and bullish about the SEC’s jurisdiction over them.[103] Whether or not Gensler’s view is correct, he has substantial power to bring enforcement proceedings, and his opinions therefore require attention. Nevertheless, Gensler is mistaken. First, even if staking satisfies the “reasonable expectation of profits” prong, it has no relation to the other prongs. In fact, staking will likely result in more decentralization, as people can run nodes without massive computational power.[104] Second, while staking rates can be high, it is not clear what differentiates a staking return from interest on a bank deposit (unless the high rate is the sine qua non of this prong). Finally, this prong, even in Hinman’s speech, has never been the issue in the Howey analysis. As aforementioned, Hinman likely assumed Ethereum met this prong in 2018. Gensler’s claim disregards the “derived from the efforts of others” prong in his quest to declare that Ethereum is a security.

The prevailing view, ultimately, will be a determination of the courts.[105] Regardless, litigation is expensive, so if the SEC takes a position, people in the digital asset community must take heed.

E.   Derived From the Efforts Of Others

This prong is central to any reverse mutation inquiry because it directly relates to the idea of sufficient decentralization. The phrase “sufficient decentralization” comes from Hinman’s speech and arises when “purchasers would no longer reasonably expect a person or group to carry out essential managerial or entrepreneurial efforts.”[106] In other words, when a blockchain is sufficiently decentralized, token holders lose the expectation of profit “derived from the efforts of others.” Some organizations, such as the Blockchain Association, have created entire guidelines based on Hinman’s factors related to sufficient decentralization.[107] In analyzing Ethereum 2.0, however, there is no need to examine all the factors. The so-called Hinman standard is based on Bitcoin and Ethereum as of June 14, 2018. In addition, Hinman never indicated that Bitcoin and Ethereum were minimally decentralized, so it is possible that some more centralization would not transform them into securities.[108] Therefore, if Ethereum 2.0 is not much more centralized than Ethereum from 2018, it is likely not a security.

Ethereum 2.0 was a massive undertaking, so it necessarily involved major development. However, Ethereum had developers in 2018, and the developers are not strictly necessary for the day-to-day functioning of the network. Since 2018, the Ethereum Cat Herders began to act as project managers, facilitating discussions between EIP proposers and protocol developers.[109] Even so, the Ethereum Cat Herders hardly seem to be akin to centralized managers. On the contrary, they represent the increasing decentralization of Ethereum since 2018. As Ethereum has evolved, there has been less need for people like founder Vitalik Buterin to constantly monitor the protocol. The Ethereum Cat Herders are members of the community who assist other community members in proposing changes to the network. Anyone can propose an EIP; the Ethereum Cat Herders are not gatekeepers to implementing one.

In addition, through the migration to proof-of-stake, Ethereum should become more decentralized.[110] To operate a node, one only needs to download client software and run it on a computer. While one must hold 32 ether to propose new blocks to the blockchain, one can help secure the network with no ether at all.[111] Proof-of-work algorithms, in contrast, require a significant amount of computational power.[112] Right now, however, the Ethereum network does not reflect this hypothesis. The only way to find the number of nodes from 2018 (the year of Hinman’s speech) is to find posts and articles from that year that happen to mention the number of nodes. One article from December 6, 2018, maintains that there were over 11,000 nodes across six continents on that date.[113] Since November 2019, there was a high of over 12,500 nodes in February 2021 and a low of roughly 1,500 nodes in April 2020.[114] As of January 11, 2024, there were about 7,050 nodes on the Ethereum network.[115] People are running nodes across the world, but around 3,300 of them (as of January 11, 2024) are in the United States.[116] Ethernodes.org, which estimates the number of nodes and provides some historical data, only provides data beginning from November 2019.[117]

From the numbers alone, it appears that Ethereum is becoming more centralized. Such a conclusion, though, is not necessarily warranted. The numbers are volatile: while at this current moment, there are fewer nodes than in late 2019, the number could quickly change.[118] Furthermore, Hinman never actually mentions the word “node” in his speech.[119] As such, while it is a helpful proxy for some sense of decentralization, it is not the sole nor primary inquiry in making the decentralization determination. Finally, The Merge only occurred somewhat recently. It will take time for people to learn that one does not need an extremely high-tech computer to meaningfully operate a node, after which we may see growth in the number of nodes operating on the network.[120]

Ultimately, there are still thousands of node operators, and there is no centralized authority that runs Ethereum. The Ethereum Foundation exists, but it only provides funding to developers.[121] Otherwise, it is difficult to imagine how Ethereum could become more decentralized. There, of course, could always be more node operators. Even so, there will need to be developers for there to be improvements to the protocol. While some potential fixes could have been pre-programmed at the protocol’s launch (and instituted upon a vote of token-holders), new issues inevitably arise that the founders could not have anticipated. Currently, there are formal mechanisms to propose changes and to develop on the protocol, but those methods are not strictly required. Anyone in the world can contribute to alterations in the protocol. Because the network is sufficiently decentralized,  whatever profits one may reasonably expect from Ethereum are not “derived from the efforts of others,” at least not within the meaning of Howey.

Conclusion

Whether Ethereum is a security has tremendous implications for the entire protocol. Indeed, if the SEC concludes it is a security, Ethereum would likely not exist for much longer due to the high costs of compliance with securities laws.[122] It seems that the SEC, using the Howey test, will determine that Ethereum is an investment contract, though it will be up to the courts to approve or deny this interpretation.[123]

Such a determination could affect not only those people most involved in the protocol, but any ether holders or node participants. For example, the CFTC recently commenced an enforcement action against Ooki DAO, charging in its complaint that any person who ever voted as part of the DAO’s governance process could, in the future, be individually liable for violations of the Commodity Exchange Act.[124]

Even if an agency determines that Ethereum or another protocol is a security, practical challenges in acting upon that classification abound. For example, since there is no centralized agent, the agency would have to devise a way to serve the Ethereum protocol itself. In the case of Ooki DAO, the CFTC served the DAO through an online discussion forum.[125]

Finally, while this Essay argues that the Ethereum protocol, even after Ethereum 2.0, is not a security, the world of digital assets is complex and quickly changing. Regulators and courts may not be able to fully sift through the meaning of staking and what differentiates those returns from dividends, or other major developments may meaningfully push Ethereum and other protocols toward more or less decentralization. The SEC may have implicitly answered this Essay’s questions with its approval of an ethereum futures fund in October 2023, but the agency has not been entirely clear. The future is uncertain, and whatever the results of the Howey test, the SEC is full of surprises.

Dustin Hartuv is a third-year law student at Cornell Law School. The author is grateful to Patrick D. Daugherty, partner at Foley & Lardner, for interesting the author in the various issues impacting crypto law in the United States.