Author: hitesh.eth

Translation: Shenchao TechFlow

Shenchao Introduction: When the market cycle is dominated by leverage and token price fluctuations for a long time, ordinary participants often compromise again due to a lack of security and accept restricted access and centralized custody. Independent researcher hitesh.eth examines in this article: how should Ethereum hold true to the original intent of free cooperation in the era of institutional technology adoption.

The article traces back to the core theories of Timothy C. May, Eric Hughes, David Chaum, Wei Dai, and Nobel laureate Elinor Ostrom, emphasizing that a liquid market does not equate to a sound social order, and outlines a prototype of a "human commitment market" that combines custodial contracts, confidentiality certificates, and limited reputation.

Please clear the price fluctuations from your mind for a few minutes.

Imagine the crypto world as a city that we rebuild after each earthquake. In every cycle, we invite more people to move in, build taller skyscrapers, and celebrate the expansion of the skyline.

Then, some structures will collapse. Leverage is forced to unwind, and various commitments evaporate. It is then that everyone realizes that the person who sold them the "vision of the future" has long since liquidated their own chips.

A few buildings survive, and we call it "resilience." But we seldom stop to ask: Was the initial design of this city really meant to protect the ordinary people living inside it?

What I worry about is deeper than the next round of a market crash. If an open financial system consistently makes ordinary people feel insecure, they will seek a promise of protection. In exchange for predictability, they may even willingly accept monitoring, entry restrictions, and asset custody.

A movement built around freedom is gradually losing its appeal even though the technology itself has not disappeared.

The technology still exists, and traditional institutions will adopt it, but the original intention of this technology has devolved into an option.

In the past, I summarized this as a divergence between "crypto-anarchism" and "crypto-authoritarianism." While this is certainly an important warning, this distinction needs a more precise definition.

Regulated products are not inherently authoritarian, and permissionless tokens do not inherently represent liberation. A founder holding unrestricted admin keys can exercise tremendous control within a project that claims to be "decentralized."

The real practical question is: Who has the power to change the rules, who can freeze assets, who is watching the participants from the shadows, who can block access, and who can prevent others from exiting?

These questions draw us back to the original meanings of cryptocurrency before it devolved into a pile of token codes. In this context, crypto began with cryptography.

From the Crypto Anarchist Manifesto Back to the Real Trust Issues

In 1988, Timothy C. May envisioned in "The Crypto Anarchist Manifesto" that people could communicate, trade, and enter electronic contracts without exposing legal identities. He foresaw the birth of information markets and the profound transformation of relationships between individuals and institutions.

But one particular statement deserves more attention: "Reputation will be central."

Timothy C. May also acknowledged that anonymous systems could foster severe abuses. He did not provide ready-made mechanisms to eradicate wrongdoers, nor did he claim that Ethereum-style reputation systems could solve all problems.

My personal conclusion from his warnings is this: When ordinary participants cannot distinguish between "trustworthy commitments" and "well-packaged scams," freedom itself becomes difficult to maintain.

We have built a powerful machine for creating markets. But when it comes to deciding "who to trust" in the market, we still need better mechanisms.

Eric Hughes approached this issue from the perspective of privacy. In the 1993 "Cypherpunk Manifesto," he defined privacy as "the power to selectively reveal oneself to the world."

This demands more than "hiding one’s name behind a wallet address." It means autonomously deciding what necessary information to provide in specific interactions while keeping everything else confidential.

A designer should be able to prove they have delivered high-quality work without having to disclose their savings balance. A buyer should be able to prove that payment has been escrowed without exposing every item they have purchased in the past.

A community should be able to verify a qualification requirement without establishing permanent personal profiles for every member.

David Chaum's research laid an earlier foundation in this direction. In his 1985 work on "Security Without Identification," he warned that computerized transaction records could become tools for large-scale surveillance.

His exploration of "credential systems across unlinked pseudonyms" proved that verifying qualifications does not require a universally exposed identity in all places.

This is important because an earlier intuition of mine needs to be corrected: a universally recognized identity that connects all records sounds efficient, but a fully visible universal identity could also become a surveillance infrastructure we desperately want to escape.

What we need are interoperable proof credentials, and the control over information disclosure must rest with the individual presenting the credentials.

Wei Dai brought another critical piece of the puzzle. In his 1998 b-money proposal, he explicitly linked cooperation between pseudonymous groups with currency and contract execution, describing a mechanism where participants pledge collateral and designate arbitrators before contracts take effect.

This was an early attempt to give anonymous cooperation real economic constraints. Of course, it was based on many assumptions and was not a complete social solution that solved the problem definitively.

Piecing together these threads of thought points to a more viable interpretation of crypto-anarchism: people should be able to voluntarily establish cooperative relationships, protect individual privacy, exchange value, and execute bounded contracts without relinquishing excessive power to intermediaries.

Differentiating "Good Crypto-Anarchism" from Predatory Speculation

A liquidity market where everything can be traded is just one possible outcome among many. It is not a complete social order.

Tokens representing tomatoes cannot grow tomatoes; a reputation market does not necessarily cultivate trustworthy individuals; and continuously rising token prices do not prove a community is creating anything beneficial.

If the only way for participants to profit is by selling tokens to new entrants, then the system must forever rely on a continuous influx of new buyers.

A healthier economy would similarly reward people for repairing equipment, teaching skills, writing software, making music, providing storage space, and solving real problems.

This is precisely the line I want to draw between "good crypto-anarchism" and "bad crypto-anarchism."

Good crypto-anarchism can expand our capacity for free cooperation; while bad crypto-anarchism allows a few individuals to abuse this freedom while shifting the costs and consequences to everyone else.

I propose that the foundational institution should include three pillars: commitment, cooperation, and reputation, with privacy protection woven throughout these three pillars.

Commitment makes agreements specific and measurable; cooperation allows people to pool resources under rules they understand; and reputation enables past relevant experiences to inform future decisions.

All three are essential. A deposit without fair arbitration will punish the innocent; cooperation lacking effective exit paths will devolve into control; and a reputation system without privacy protection could slip into a social credit monitoring system.

Multi-Center Governance: We do not need a Single Global Score

Outside the crypto-punk tradition, another thinker relevant to this discussion is Elinor Ostrom. Her research on multi-centered governance challenges an inherent assumption that all collective problems can only be solved through centralized state machinery or single market mechanisms.

Her research tradition examines systems where multiple decision-making centers operate in parallel, including grassroots communities that autonomously make rules, supervise each other, and continuously revise their charter.

It is important to clarify that Elinor Ostrom was not proposing building Ethereum or endorsing crypto-anarchism; the references to her here adapt her governance ideas to the current context.

This has very pragmatic implications for the realities of the crypto industry: we do not need a comprehensive global community, a one-size-fits-all reputation score, or an overarching program applicable to everyone.

We can establish small communities around specific common matters, such as device repair guilds, music creation cooperatives, research groups, learning support circles, or software development teams.

Each small community can define what constitutes "good performance" in its context while allowing members to take relevant performance proofs to other communities for reuse.

An excellent musician does not inherently qualify to be a financial custodian; a stellar coding resume does not qualify someone to adjudicate every dispute in the community. Reputation systems should maintain domain boundaries.

This thinking also changes our understanding of incentive mechanisms. Communities can precisely target subsidies toward verified contributions within their domain without forcing the earnings of members to become locked away in an internal ecosystem.

If an economy must survive by preventing participants from leaving, then its underlying design must have deeper problems.

Paying rent with money earned is not a betrayal of crypto-anarchism. True freedom must include the freedom to exit.

Human Commitment Market: How to Implement on Ethereum

So, how do we build these ideas on Ethereum?

I will start with Human Commitment Markets: In these communities, people come to an agreement on valuable labor, lock remuneration funds, clarify completion acceptance evidence, and pre-set consequences for default before the work begins.

The starting point here is the services people genuinely want. Tokens should appear after the performance obligations they represent, not the other way around.

Imagine a small repair community: customers need repair services, experienced technicians need work orders, beginner apprentices want to learn the trade, some members are responsible for evaluating disputed orders, and the communal treasury is used to fund skill training or purchase equipment.

In such a community, the same person can act as a customer in one agreement, as a service provider in another, and as a contributor to community resources in a third agreement.

Even if ownership or dividend arrangements are introduced later, they must be explicitly defined separately; merely holding a community token does not constitute a claim to the business of every member in the community.

Ethereum can provide useful technical components, but it cannot directly build the entire institutional arrangement.

The standards mentioned below were in final status when the official page was checked on November 10, 2026. Note that this status only represents the solidification of the norms themselves and does not equate to the security of any specific smart contract implementation.

Image: A classification table of important ERC standards on Ethereum covering rental, soulbound certificates, composability, permission, and AI identity issues

It is crucial to distinguish between token standards and the underlying supporting infrastructure. For example, ERC-4337 addresses the issue of account abstraction, while ERC-5564 focuses on stealth addresses; neither is a tool for creating new community currencies out of thin air.

In terms of service points or quota certificates, an initial multi-token standard can be selected. ERC-1155 supports multiple categories of tokens and batch operations, while ERC-6909 provides a more streamlined multi-token interface and refined authorization mechanism.

Both can be used to represent different types of services, but merely relying on contract standards does not automatically ensure that service providers possess the actual delivery capability.

A point might represent a diagnostic service, an hour of training, or a single use of shared equipment. However, these are business meanings assigned at the application layer and are not inherent attributes of the underlying standards.

Credential issuance must strictly match the actual service capacity. Even if there are only five training slots available, selling an unlimited number of points, regardless of the zero-vulnerability token contract code, still fundamentally constitutes excessive commitment; refund and redemption rules must still be backed by real funds and execution mechanisms.

Reputation credentials belong to a completely different category. Participants must never be able to directly purchase the same qualification proof that others have painstakingly earned.

ERC-5484 supports issuing non-transferable credentials with the consent of the recipient and predefined destruction authorization, which is helpful for voluntarily disclosed qualification proofs. However, "non-transferable" does not equate to proving uniqueness, honest behavior, or genuine skills.

Furthermore, completely public on-chain credentials might expose sensitive social relationships, while directly buying and selling control of entire wallet accounts remains a significant risk.

For qualifications requiring confidentiality, the content of the credentials should remain secret, only externally validating a specific statement: for example, "the current participant holds a valid practicing qualification issued by an accredited assessing body."

Future advanced designs could even simply prove that a participant has reached a certain performance threshold, but this statement is only meaningful if the underlying real records, issuing rules, and integrity constraints are reliable.

If a zero-knowledge proof only selects a few positive reviews to display, it cannot prove that there are no unresolved default records under the name of the participant.

For this reason, the system needs an independent credential framework: it must provide timely verification while preventing the same credential from being used repeatedly for claims. Scope-limited nullifiers can prevent a single credential from being reused in the same operation, but they do not equate to establishing a global one-person-one-identity authentication.

The payment process also needs to candidly address boundaries. ERC-5564 allows the payer to derive stealth addresses for the payee, reducing the direct explicit association between the payee's public identity and incoming funds.

However, it cannot hide the transaction amount, nor can it turn a public custody contract into a confidential state, and it cannot automatically protect the recipient's privacy trajectory when spending this money later.

Thoroughly private commitment and fund settlement will require additional privacy infrastructure. Cheap Rollup transactions do not automatically equate to privacy transactions, and cryptographic proof cannot fully guard against various side-channel leaks based on time delays or network layer traffic.

Vitalik Buterin proposed similar views in "The Three Transitions": scalability, smart contract wallets, and privacy must advance in tandem, including the privacy of identity and reputation. No application can treat privacy as a mere afterthought once the data model has exposed everyone.

Operating Specific Commitment Agreements and Dispute Resolution Mechanisms

Now, let’s simulate the operational details of a specific agreement.

Assume a customer is willing to pay 100 units of currency for a repair, and the technician pays a 20-unit performance deposit, while the customer deposits the full 100 units into a custodial contract. Both parties confirm the fault diagnosis process, completion deadlines, quality standards, evidence of acceptance requirements, dispute handling paths, and default penalty caps.

It should be noted that the above numbers are illustrative. When the real system is deployed, it is necessary to carefully choose the payment asset types and fully consider the risks of price volatility or centralized control by the issuer.

Once successful completion is accepted, the contract will release the 100 units of remuneration to the technician and return the 20-unit deposit. If the technician never starts and misses the agreed deadline, the customer will receive a full refund of 100 units and a preset compensation from the deposit. Whether the penalty involves deducting all or part of the deposit must be clearly written before the order is taken.

If the customer raises objections about the quality of the completed repair, the smart contract will not guess who is lying but will automatically enter the pre-agreed dispute resolution process.

An independent evaluator will intervene to verify the acceptance evidence and inspect physical equipment if necessary, and their ruling will determine how funds are allocated within the custodial contract according to the pre-agreed range.

The smart contract enforces the transfer decisions of custodial assets while the independent evaluator provides professional judgment on the real-world situation. These two roles must not be confused.

During the dispute litigation period, relevant evidence should be securely encrypted and only opened to necessary parties, and should be submitted to the chain using a commitment scheme with appropriate random salts when necessary.

If predictable personal information is directly hashed and made public on-chain without salting, it will still leak sensitive information; at the same time, the original evidence files must be ensured to be retrievable for review since a string of hash values alone cannot resolve disputes.

This mechanism must also pre-establish fallback routes: What if the evaluator goes offline? How is the appeal deadline set? What are the final settlement rules when the fallback process fails? If these boundary clauses are lacking, a system advertised as "trustless" could indefinitely lock users' funds.

The same structure applies perfectly to learning assistance agreements: sponsors fund rewards for learners who pass practical assessments, mentors promise to provide scheduled guidance, and learners commit to investing in practical learning.

Teaching and final assessment should be kept separate if feasible; all incentive funds should come from actual pre-planned budgets, downstream customer demands, or openly transparent external subsidies, and should not just magically appear due to a new token issued by the agreement.

While deposits can curb dishonesty, excessively high deposit thresholds will shut out those who need opportunities the most. Therefore, newcomers should start with small orders of low amounts, limited risk exposure, phased allocations, or guarantor endorsements. Any fair system must provide newcomers a path to accumulate their first reputation.

Subsequent reputation records should objectively reflect the actual cooperation relationships among all parties: the technician's delivery quality, the customer's cooperation level, the mentor's attendance rate, and the evaluator's reliability. A unilateral complaint should not instantly become a permanent public conviction; records during disputes, resolved ones, and expired ones need to be treated distinctly.

Even after all this, attackers may still create a multitude of fake accounts to buy and sell among themselves, artificially inflating traffic, or they may first honestly build good reputations then pull a big heist and escape with funds. Simply counting on-chain transaction volumes is far from sufficient.

A pragmatic response is to tightly control risk exposure before sufficient credit evidence has settled: limit upper caps on early order amounts, focus on scrutinizing high-frequency repeat trading partners, introduce independent third-party verification at necessary points, and progressively enlarge trust limits. A track record built upon ten very small successful orders should not automatically qualify someone to manage an entire treasure vault.

In the matter of selecting which type of evidence bears more weight, human judgment will always exist. Each community should publicly outline these evidence acceptance rules and allow for competitive cross-interpretation mechanisms rather than pretending that a single numerical score can reveal the entirety of a person's character.

Community cooperation also needs defined boundaries. The project team cannot unilaterally change rules after securing funding for the agreement; changes to community regulations should only take effect in the future and accompany sufficient notification periods and unobstructed exit windows; emergency management permissions must be strictly limited in scope and remain publicly visible throughout.

Participants, even if they exit the community, must still fulfill the obligations defined previously in signed agreements; however, merely having a differing viewpoint from the core management of the community should never justify confiscating unrelated personal assets.

In fundraising scenarios for project initiation, the principles based on commitment can similarly replace some empty promises: funds can be unlocked in batches according to agreed milestone for research and development, ownership rights to unused balances can be clearly defined in advance, and team contributors' quotas can be unlocked periodically, with modification of fund access permissions set to have a mandatory delay.

The above measures can reduce certain types of arbitrage loopholes but neither can they guarantee business success, nor that token prices will rise, nor ensure contracts will never be hacked. Even if a piece of code is completely immutable, it can still meticulously enforce an unfair set of rules.

Small Pilot Paths, AI Agents Participation, and Real-World Boundaries

For these reasons, the first experimental version should aim for simplicity and restraint: start with a single community, select a single settlement asset, focus on a single type of job, employ a transparent dispute process, and do not issue any governance tokens with speculative attributes.

First, operate custodial contracts and settlement paths on the Sepolia testnet, thoroughly testing various branching scenarios such as timely completion, unilateral cancellation, overdue delivery, dispute review, evaluator absence, and complaint deadlines.

Developers need to verify one by one that assets will never be paid out more than once, and that each end state allows all pledged and custodial funds to reconcile to zero accurately; during the privacy testing phase, synthetic simulated data should be used throughout.

Subsequently, gradually introduce the confidentiality credential layer, testing actual privacy leak boundaries before bringing in any true personal sensitive history. Ahead of a small-scale pilot with real money, independent security audits should be arranged to examine the agreement and privacy scheme design, and only after the empirical system proves effective should expansion to external markets proceed cautiously.

Success or failure should be measured by real indicators: the number of completed orders, returning customer ratio, dispute resolution time, bad debt loss rate, privacy breach failures, and genuine earnings after deducting subsidies. Soaring token prices can never replace these hardcore business outcomes.

AI agents will also eventually participate in this collaborative network. Taking the ERC-8004 standard, which is still in draft form, as an example, it proposes a framework for identity registries, reputation registries, and validation registries for agents.

This standard offers a beneficial reference template for agents to discover and provide feedback on results, but it neither guarantees that the claimed capabilities of agents are entirely accurate, nor is it a payment settlement system.

In practical applications, AI agents can undertake well-defined limited tasks through an account with an expenditure limit, and pledge funds according to the same commitment rules.

When the operating entity behind the AI agent, the underlying large model, or permission settings change, the system's interpretation of its historical reputation record's weight should adjust accordingly: if the entire underlying system controlling the agent has been fundamentally changed, the guarantees provided by its past impressive record will be very weak.

The entire thrust of this thinking is not to claim that software code alone can reshape human society. Real-world violence, coercion, equipment theft, falsification of offline evidence, and extraneous power oppression still exist.

Cryptography can only verify specific statements and constrain specific on-chain actions; it cannot simplify every dispute in the human world into a black-and-white mathematical fact. But it can at least help us reduce human cooperation's reliance on "blind trust."

We can provide ordinary people with a way to make real profits without relying on continuously bringing in new participants, while protecting individual privacy so that not every promise becomes an unenforceable empty talk; we can build a cooperative community with rules that are open to scrutiny, limited powers for managers, and where members can enter and exit freely at any time.

Rather than predicting in which year the government will completely lose credibility, or in which month crypto-anarchism will return to the mainstream, this is a more worthwhile practical ambition to focus our energy on.

The next industry cycle will surely give us another opportunity to rebuild. What matters is whether this time we invite everyone to live in another tower barely supported by market attention or guide them into a real economy that can still persist even after experiencing disappointment shocks.

We have become very adept at creating all sorts of tokens out of thin air. What we truly need to master next is crafting promises of commitment worth upholding, fostering cooperative communities worth joining, and establishing reputational mechanisms that can protect individuals without exposing their life trajectories in detail.

The crypto-punks originally wrote the code to make freedom possible. The task facing our generation is to make that freedom truly stable and livable.

References and Sources of Technical Standards

Note: The original text clearly distinguishes between the historical intellectual thread arrangement and the proposed prototype design of the "Human Commitment Market;" the integration mechanisms discussed in this article represent a design concept and do not claim that the related integrated systems have been fully constructed and operational in reality.

· Timothy C. May, "The Crypto Anarchist Manifesto", 1988.

· Eric Hughes, "A Cypherpunk’s Manifesto", 1993.

· David Chaum, "Security Without Identification", 1985, and the author's official literature homepage (covering research on credential systems across unlinkable pseudonyms).

· Wei Dai, "b-money proposal", 1998.

· Elinor Ostrom, "Beyond Markets and States: Polycentric Governance of Complex Economic Systems", Nobel Prize in Economics lecture, 2009; Mike McGinnis (Ostrom Workshop), "What is Polycentric Governance?”.

· ERC-20: Fungible Token Standard.

· ERC-1155: Multi Token Standard; ERC-6909: Minimal Multi-Token Interface.

· ERC-5484: Soulbound Tokens Based on Mutual Agreement.

· ERC-4337: Account Abstraction Using Alternative Memory Pools.

· ERC-5564: Stealth Address Standard.

· ERC-5192: Minimal Soulbound NFT Standard (another final draft interface suitable for locked NFTs, not a necessary item of the aforementioned technical stack).

· Vitalik Buterin, "The Three Transitions", 2023.

· ERC-8004: Trustless Agents, which was still in draft status when checked in the original text.