Earlier this month, at the EthCC conference in France, Vitalik Buterin put forward a warning view that seemed a bit alarmist, "If Ethereum cannot truly achieve decentralization, its future will face an existential crisis."

To this end, he proposed three key testing standards to measure whether a protocol has sustainable decentralization capabilities: Walk-Away Test, Insider Attack Test, and Trusted Base Test.

Among them, "exit testing" is the most basic and important part, which directly points to a core issue: if the project team is disbanded or the platform loses connection, can users still safely withdraw assets and complete interactions?

01. What is "Exit Test"

In layman's terms, the essence of exit testing is whether the project allows users to exit, withdraw assets, and interact on the chain by themselves when the development team is completely "out of touch".

From this perspective, it is more like a fallback clause that does not emphasize the integrity of daily functions, but rather tests whether a protocol is truly "trustless" under the most extreme conditions.

In fact, as early as 2022, Vitalik criticized the Training Wheels architecture of most Rollups in his blog, saying that they rely on centralized operation and maintenance and manual intervention to ensure safety. Users who often use L2Beat should be very familiar with this. The homepage of its official website shows a related key indicator - Stage:

This is an evaluation framework that divides Rollup into three decentralized stages, including "Stage 0" that is completely dependent on centralized control, "Stage 1" with limited dependence, and "Stage 2" that is completely decentralized. This also reflects the degree of Rollup's reliance on manual intervention for training wheels.

 🔺Image source: L2Beat

One of the most important indicators for evaluating the Stage stage is whether users can withdraw funds on their own without the cooperation of operators.

This question seems simple, but it is actually a fatal one.

To give a typical example, for the current mainstream Rollups, although they all have similar mechanism designs such as "escape pods", a large number of projects still retain "upgradeable contracts" and even "super administrator" permissions. Although they seem to be designed for emergencies, they are actually a window that may evolve into a potential risk.

For example, the team can control the change address of the logic contract through multi-signature. Even if it is emphasized on the surface that it cannot be tampered with, as long as the backdoor exists, once malicious logic is injected into the upgraded contract, user assets can be legally transferred.

This means that if user funds are frozen, it will be difficult to recover them without the help of the project team. The real exit test requires the complete elimination of dependence and intervention paths to ensure that users can operate independently and have independent control at any time. Even if the core team disappears or the platform suddenly closes, users must still have complete control and their assets will not be locked or held hostage by a third party.

In short, exit testing is the touchstone for testing whether a protocol is truly decentralized. It is not just about censorship resistance, but whether users still have sovereignty over their assets in extreme situations.

02. The end of decentralization is "exit capability"

Why BTC and ETH are the first choice for new users and institutions to enter the market.

Because even without Satoshi Nakamoto and Vitalik, Bitcoin and Ethereum can still operate smoothly, so objectively speaking, for incremental users or institutional players, the most core consideration for Web3 entry decision is nothing more than "Can I take my money at any time?"

Exit testing is a direct answer to this question. It is the "last mile" for blockchain to achieve decentralization and a practical test of the concept of "Not your keys, not your coins".

After all, if users must rely on a certain front-end interface or a certain development team to withdraw assets or interact, it is essentially still a centralized trust relationship. For a protocol that has truly passed the exit test, even if all nodes are offline and all operators run away, users can still use on-chain tools and third-party front-ends to complete operations independently.

This is not only a technical issue, but also the implementation of the Web3 concept.

It is for this reason that Vitalik has repeatedly emphasized that many seemingly decentralized DeFi or L2 projects actually contain centralized channels such as upgrade keys, backdoor logic, and freezing mechanisms. Once these mechanisms are abused, user assets will be completely controlled by others.

Exit testing is to verify whether these mechanisms exist and to remove them completely. Only when the user's exit path does not rely on any party, the protocol is truly trustworthy.

03. "Exit test", the watershed of decentralization towards reality

And if we understand it from another perspective, we will find that although "exit testing" is the core criterion for Ethereum, especially Rollup security design, it has already been widely practiced in other areas of Web3:

Taking wallets as an example, as a core tool for asset management, they must have a high degree of security and transparency, which includes key factors such as the randomness of mnemonics and private key generation (true random number generator), firmware security and open source, and almost all mainstream Web3 wallets (such as imToken, etc.) also allow the export of private keys/mnemonics, and users can easily migrate assets to any wallet software or hardware device.

It can be said that this is a natural "exit design": users do not need to trust the wallet company itself, and can always control their funds, so that users are no longer just "experiencers" of Web3 products and services, but "owners" who truly have asset sovereignty.

From this perspective, the three core tests proposed by Vitalik this time are actually a complete closed loop:

• Exit testing: ensuring that users can redeem themselves after the project ceases operations.
• Internal attack test: whether the system can resist internal malicious or coordinated attacks by developers.
• Trusted Computing Base Test: Whether the amount of code that users need to trust is small enough and whether it is auditable.

These three tests together constitute the decentralized "basic framework" for the long-term sustainable development of Ethereum, truly achieving "Don't Trust, Verify".

To put it bluntly, in the Web3 world, "trust" that does not require trust essentially stems from verifiability. Only through transparent mathematics and algorithms can users "Verify" at any time and feel at ease without having to worry about external factors such as the ethical conduct of the project team.

 🔺Image source: CoinDesk

As Vitalik concluded:

"If we can't do this, Ethereum will eventually become a memory of a generation, forgotten by history like many things that were briefly brilliant but ultimately became mediocre."