We present a scalable architecture for electronic retail payments via central bank digital currency and offer a solution to the perceived conflict between robust regulatory oversight and consumer affordances such as privacy and control. Our architecture combines existing work in payment systems and digital currency with a new approach to digital asset design for managing unforgeable, stateful, and oblivious assets without relying on either a central authority or a monolithic consensus system. Regulated financial institutions have a role in every transaction, and the consumer affordances are achieved through the use of non-custodial wallets that unlink the sender from the recipient in the transaction channel. This approach is fully compatible with the existing two-tiered banking system and can complement and extend the roles of existing money services businesses and asset custodians.
Citation
G Goodell, D Toliver, and H Nakib. "A Scalable Architecture for Electronic Payments." In: S Matsuo et al., Financial Cryptography and Data Security. FC 2022 International Workshops. FC 2022. Lecture Notes in Computer Science, volume 13412, Springer, Cham, July 2023.
Nations around the world are conducting research into the design of central bank digital currency (CBDC), a new, digital form of money that would be issued by central banks alongside cash and central bank reserves. Retail CBDC would be used by individuals and businesses as form of money suitable for routine commerce. An important motivating factor in the development of retail CBDC is the decline of the popularity of central bank money for retail purchases and the increasing use of digital money created by the private sector for such purposes. The debate about how retail CBDC would be designed and implemented has led to many proposals, which have sparked considerable debate about business models, regulatory frameworks, and the socio-technical role of money in general. Here, we present a critical analysis of the existing proposals. We examine their motivations and themes, as well as their underlying assumptions. We also offer a reflection of the opportunity that retail CBDC represents and suggest a way forward in furtherance of the public interest.
Citation
G Goodell, H Nakib, and T Aste. "Retail Central Bank Digital Currency: Motivations, Opportunities, and Mistakes." International Journal of Political Economy, 55(1), pp. 109–143.
In recent years, electronic retail payment mechanisms, especially e-commerce and card payments at the point of sale, have increasingly replaced cash in many developed countries. As a result, societies are losing a critical public retail payment option, and retail consumers are losing important rights associated with using cash. To address this concern, we propose an approach to digital currency that would allow people without banking relationships to transact electronically and privately, including both internet purchases and point-of-sale purchases that are required to be cashless. Our proposal introduces a government-backed, privately-operated digital currency infrastructure to ensure that every transaction is registered by a bank or money services business, and it relies upon non-custodial wallets backed by privacy-enhancing technology such as blind signatures or zero-knowledge proofs to ensure that transaction counterparties are not revealed. Our approach to digital currency can also facilitate more efficient and transparent clearing, settlement, and management of systemic risk. We argue that our system can restore and preserve the salient features of cash, including privacy, owner-custodianship, fungibility, and accessibility, while also preserving fractional reserve banking and the existing two-tiered banking system. We also show that it is possible to introduce regulation of digital currency transactions involving non-custodial wallets that unconditionally protect the privacy of end-users.
Citation
G Goodell, H Nakib, and P Tasca. "A Digital Currency Architecture for Privacy and Owner-Custodianship." Future Internet 2021, 13(5), May 2021.
Cryptocurrencies offer an alternative to traditional methods of electronic value exchange, promising anonymous, cash-like electronic transfers, but in practice they fall short for several key reasons. We consider the false choice between total surveillance, as represented by banking as currently implemented by institutions, and impenetrable lawlessness, as represented by privacy-enhancing cryptocurrencies as currently deployed. We identify a range of alternatives between those two extremes, and we consider two potential compromise approaches that offer both the auditability required for regulators and the anonymity required for users.
Citation
Goodell G and Aste T "Can Cryptocurrencies Preserve Privacy and Comply With Regulations?" Frontiers in Blockchain 2(4), May 2019.
Digital currency is a novel form of money that could be issued and regulated by central banks or other actors, offering benefits such as programmability, security, and privacy. However, the design of a digital currency system presents numerous technical and social challenges. This article presents the design and prototype of a non-custodial wallet, a device that enables users to store and spend digital currency in various contexts. To address the challenges of designing a digital currency system, we conducted a series of workshops with internal and external stakeholders, using methods such as storytelling, metaphors, and provotypes to communicate digital currency concepts, elicit user feedback and critique, and incorporate normative values into the technical design. We derived basic guidelines for designing digital currency systems that balance technical and social aspects, and reflect user needs and values. Our work contributes to the digital currency discourse by demonstrating a practical example of how digital currency could be used in everyday life and by highlighting the importance of a user-centred approach.
Citation
R Bowler, G Goodell, J Revans, G Bizama, and C Speed. "A non-custodial wallet for digital currency: design challenges and opportunities." Working paper, October 2023.
As global governments intensify efforts to operationalize retail central bank digital currencies (CBDCs), the imperative for architectures that preserve user privacy has never been more pronounced. This paper advances an existing retail CBDC framework developed at University College London. Utilizing the capabilities of the Comet research framework, our proposed design allows users to retain direct custody of their assets without the need for intermediary service providers, all while preserving transactional anonymity. The study unveils a novel technique to expedite the retrieval of Proof of Provenance, significantly accelerating the verification of transaction legitimacy through the refinement of Merkle Trie structures. In parallel, we introduce a streamlined Digital Ledger designed to offer fast, immutable, and decentralized transaction validation within a permissioned ecosystem. The ultimate objective of this research is to benchmark the performance of the legacy system formulated by the original Comet research team against the newly devised system elucidated in this paper. Our endeavour is to establish a foundational design for a scalable national infrastructure proficient in seamlessly processing thousands of transactions in real-time, without compromising consumer privacy or data integrity.
Citation
W Macpherson and G Goodell. "Benchmarking the performance of a self-custody, non-ledger-based, obliviously managed digital payment system." Working paper, April 2024.
This article builds upon the protocol for digital transfers described by Goodell, Toliver, and Nakib (WTSC at FC ’22), which combines privacy by design for consumers with strong compliance enforcement for recipients of payments and self-validating assets that carry their own verifiable provenance information. We extend the protocol to allow for the verification that reissued assets were created in accordance with rules prohibiting the creation of new assets by anyone but the issuer, without exposing information about the circumstances in which the assets were created that could be used to identify the payer. The modified protocol combines an audit log with zero-knowledge proofs, so that a consumer spending an asset can demonstrate that there exists a valid entry on the audit log that is associated with the asset, without specifying which entry it is. This property is important as a means to allow money to be reissued within the system without the involvement of system operators within the zone of control of the original issuer. Additionally, we identify a key property of privacy-respecting electronic payments, wherein the payer is not required to retain secrets arising from one transaction until the following transaction, and argue that this property is essential to framing security requirements for storage of digital assets and the risk of blackmail or coercion as a way to exfiltrate information about payment history. We claim that the design of our protocol strongly protects the anonymity of payers with respect to their payment transactions, while preventing the creation of assets by any party other than the original issuer without destroying assets of equal value.
Citation
D Friolo, G Goodell, D Toliver, H Nakib. "Private Electronic Payments with Self-Custody and Zero-Knowledge Verified Reissuance." Financial Cryptography and Data Security, FC 2025 International Workshops, FC 2025. Lecture Notes in Computer Science, vol 15754. Springer, Cham.
Decentralization is understood both by professionals in the blockchain industry and general users as a core design goal of permissionless ledgers. However, its meaning is far from universally agreed, and often it is easier to get opinions on what it is not, rather than what it is. In this paper, we solicit definitions of 'decentralization' and 'decentralization theatre' from blockchain node operators. Key to a definition is asking about effective decentralization strategies, as well as those that are ineffective. Malicious, deceptive, or incompetent strategies are commonly referred to by the term 'decentralization theatre.' Finally, we ask what is being decentralized. Via thematic analysis of interview transcripts, we find that most operators conceive of decentralization as existing broadly on a technical and a governance axis. This informs a two-axis model: network topology and governance topology, or the structure of decision-making power. Our key finding is that `decentralization' alone does not affect ledger immutability or systemic robustness.
Citation
A Lynham and G Goodell. "Decentralization: A Qualitative Survey of Node Operators." In: Proceedings of the FCiR25 - Financial Cryptography in Rome 2025. (pp. pp. 27-41). De Cifris Association: Rome, Italy.
Immutability is a core design goal of permissionless public blockchain systems. However, rewrites are more common than is normally understood, and the risk of rewrite, cyberattack, exploit, or black swan event is also high. Taking the position that strict immutability is neither possible on these networks nor the observed reality, this paper uses thematic analysis of node operator interviews to examine the limits of immutability in light of rewrite events. The end result is a qualitative definition of the conditional immutability found on these networks, which we call Practical Immutability. This is immutability contingent on the legitimate governance demands of the network, where network stakeholders place their trust in the governance topology of a network to lend it legitimacy, and thus manage ledger state.
Citation
A Lynham and G Goodell. "Defining DLT Immutability: A Qualitative Survey of Node Operators." Defining DLT Immutability: A Qualitative Survey of Node Operators. In: Pal, S., Biswas, K., Kanhere, S., Myers, T., Muthukkumarasamy, V. (eds) Distributed Ledger Technology. SDLT 2025. Communications in Computer and Information Science, vol 2892. Springer, Singapore.
In this paper, we introduce Sark, a reference architecture for transferring unforgeable, stateful, oblivious (USO) assets. We describe the motivation, design, and implementation of the core subsystems of Sark, Porters, which accumulate and roll-up commitments from Clients, and Sloop, a permissioned, crash fault-tolerant (CFT) blockchain system. We analyse the operation of the system using the `CIA Triad': Confidentiality, Availability, and Integrity. We then introduce the concept of \textit{local centrality} and use it to address design trade-offs related to decentralization. Finally, we point to future work on Byzantine fault-tolerance (BFT), and mitigating the local centrality of Porters.
Citation
A Lynham, Z Li, D Alesch, and G Goodell. "Sark: Oblivious Integrity Without Global State." Working paper, under review, December 2025.