Credential Revocation On-Chain vs Off-Chain Registries

Guaranteed state: Revocation status is a smart contract state change (e.g., an Ethereum SBT registry). Once mined, it's globally verifiable and tamper-proof. This is critical for high-value credentials like KYC attestations or regulatory compliance where audit trails are mandatory.

Expensive to update: Each revocation requires a blockchain transaction. On Ethereum Mainnet, this can cost $5-$50+ in gas and take ~12 seconds for finality. This scales poorly for mass revocation events or high-frequency credentials, making it unsuitable for high-volume, low-value attestations.

Near-zero marginal cost: Status is managed in a centralized database or decentralized storage (like IPFS or Ceramic). Revocations are instant and free to issue, ideal for high-frequency use cases like daily work badges, event tickets, or gaming achievements where speed and volume matter.

Requires active verification: Verifiers must query an external registry (e.g., a REST API or The Graph indexer). This introduces trust in the operator and downtime risk. If the registry goes offline, credentials cannot be verified. This is a critical weakness for mission-critical systems like financial access or property titles.

Tamper-proof record: Revocation status is written to a public ledger (e.g., Ethereum, Polygon), creating a single source of truth. This eliminates reliance on a third-party's uptime for verification. This matters for high-stakes credentials like KYC/AML attestations or legal documents where auditability is non-negotiable.

Smart contract automation: Revocation can be tied to on-chain conditions (e.g., time-locks, governance votes). Protocols like Ethereum Attestation Service (EAS) or Verax enable complex status rules. This matters for DeFi credentials or DAO membership where revocation logic must be transparent and autonomous.

Higher base cost: Every status update (revoke/reinstate) incurs a gas fee. On Ethereum L1, this can be $5-50+, making frequent updates prohibitive. Slower finality: Must wait for block confirmation (~12 sec on Optimism, ~2 sec on Solana). This matters for high-volume, low-value credentials (e.g., event tickets) where cost dominates.

Near-zero marginal cost: Status is managed in a traditional database or a service like AWS RDS. Updates are instant and free, supporting massive scale. This matters for consumer-scale applications like social media logins or loyalty programs issuing millions of credentials.

Registry operator risk: The status list's integrity depends on the operator's honesty and availability. If the service goes down, all credentials become unverifiable. This matters for decentralized identity (DID) purists who prioritize censorship resistance over cost.

Best of both worlds: The W3C standard uses a cryptographically-signed, compressed bitstring hosted off-chain. Verifiers fetch the list once and check status locally. This balances low cost with cryptographic integrity. This matters for issuers using Verifiable Credentials (VCs) who need a standardized, scalable revocation method.

Unforgeable Audit Trail: Revocation actions are permanent, timestamped entries on a public ledger (e.g., Ethereum, Polygon). This provides a cryptographically verifiable history essential for high-stakes compliance (e.g., KYC/AML credentials) and regulatory audits. Verifiers can independently prove a credential's status at any point in time.

Variable, Unpredictable Fees: Revoking a credential requires a blockchain transaction, incurring gas fees (e.g., $2-$50+ on Ethereum Mainnet). Throughput is limited by base layer TPS, causing delays during congestion. This model is cost-prohibitive for high-volume, ephemeral credentials (e.g., event tickets, session tokens).

Sub-Second Updates at Near-Zero Cost: Hosting a revocation list (e.g., a signed JSON file on AWS S3, Cloudflare R2) allows for massive scale (millions of revocations/sec) without transaction fees. Ideal for consumer-scale applications like login credentials or frequent membership updates where cost and speed are paramount.

Single Point of Failure: The registry's operator controls availability and data integrity. If the hosted endpoint goes down (downtime risk), all credential verification halts. This introduces trust assumptions counter to decentralization goals, requiring careful design with redundancy (IPFS, CDNs) and attested timestamps.