Fifth Circuit Lifts Tornado Cash Sanctions

• The court has found that Tornado Cash smart contracts do not constitute a service or property, defining the contracts as tools that are "nothing more than lines of code"
• The court has found that Tornado Cash does not own or control the smart contracts, as the developers revoked any role in the software's operation – making important distinctions between "mutable" and "immutable" software
• The court refuses to participate in Treasury's attempts at "judicial lawmaking", stating that "legislating is Congress’s job—and Congress’s alone."

In an appeal in the Fifth Circuit, a judge has ruled that the Office of Foreign Assets Control has overstepped its authority by placing Tornado Cash on OFAC's Specially Designated Nationals and Blocked Persons (SDN) List, reversing a judgement in the District Court of Texas finding that Tornado Cash software lied within the authority of the Treasury under the International Emergency Economic Powers Act (IEEPA).

The fifth circuit has found that while "OFAC’s concerns with illicit foreign actors laundering funds are undeniably legitimate," "perhaps Congress will update IEEPA [...] to target modern technologies like crypto-mixing software."

"Until then," the court found, "we hold that Tornado Cash’s immutable smart contracts (the lines of privacy-enabling software code) are not the “property” of a foreign national or entity, meaning they cannot be blocked under IEEPA, and OFAC overstepped its congressionally defined authority."

The fifth circuit found that "property has a plain meaning: It is capable of being owned."

In the case of Tornado Cash, the fifth circuit has found that "the immutable smart contracts at issue in this appeal are not property because they are not capable of being owned," referencing Tornado Cash's setup ceremony and the ineffectiveness of OFAC sanctions on Tornado Cash's operations.

"More than one thousand volunteers participated in a “trusted setup ceremony” to “irrevocably remov[e] the option for anyone to update, remove, or otherwise control those lines of code.” And as a result, no one can “exclude” anyone from using the Tornado Cash pool smart contracts."

To evade the requirement of ownership, the fifth circuit has found that "the Department conflates a separate element of the statute, “interest,” with “property” to suggest that “Tornado Cash profits from—and therefore has an interest in—the smart contracts that embody the mixing service it provides”."

However, the fifth circuit has found that "Tornado Cash doesn’t profit from the immutable smart contracts at issue in this appeal. Some relayers and TORN token holders may receive fees from using the mutable relayer-registry smart contracts, but not from the immutable pool smart contracts [...] Nor does the record suggest that Tornado Cash itself, which is the designated “entity,” [sic] receives fees from transactions through either mutable or immutable contracts."

The fifth circuit has found that "none of the immutable smart contracts entitle the smart-contract creators to a benefit."

The fifth circuit notes that, "the Department emphasizes the final catch-all for “any other property”" subject to OFAC authority, noting that "the catch-all is not as expansive as the Department suggests; it still requires that “any . . . property” actually be, well, property. Adding an “any” before a word doesn’t change that word’s meaning."

Speaking to the allegation that Tornado Cash "promoted and advertised the contracts and its abilities and published the code with the intention of people using it," the fifth circuit found that "the district court ignored basic principles of black-letter contract law: Unilateral or not, contracts require “[a]n agreement between two or more parties.” Immutable smart contracts have only one party in play."

The fifth circuit herein makes an important distinction between what it calls "mutable" and "immutable" smart contracts:

"For example," the court argues, "if a mixer was mutable—or in other words, controllable or custodial—the mixer’s operator or owner could offer to mix deposits, which a third-party user could accept by transferring Ether to the operator’s mixer-smart contract. The operator controlling the smart contract would use the mixer- smart contract to fulfill the contract by taking control of the third-party user’s deposit."

"In that case," the court finds, "someone is always handling the Ether."

"When choosing to use or interact with an immutable smart contract," the court argues, "a third-party user could make an offer, but there is no smart- contract operator on the other side of the transaction to accept or make a counteroffer—just software code."

The court argues that unilateral contracts can always be revoked, highlighting that Tornado Cash developers "revoked their offer" and any role in the contract by making the code run independently and autonomously.

"Regardless of whether Tornado Cash advertises the immutable smart contracts on its website, that does not change the simple fact that Tornado Cash does not—and cannot— own or control them."

Going back to the common argument that smart contracts act comparable to vending machines, the court has found that the operator of a vending machine is able to exercise control over the machine, such as by updating or removing inventory, moving, unplugging, or destroying the machine – but Tornado Cash developers "cannot change the code, delete the code, or remove the code from the Ethereum blockchain network. In other words, Tornado Cash cannot “unplug” the immutable smart contracts."

The court concludes that "even if Tornado Cash did not want North Korea, the Lazarus Group, or anyone else, for that matter, using the immutable smart contracts that the Tornado Cash developers created, Tornado Cash—let alone the Department—would be powerless to stop them."

The fifth circuit particularly appears to take issue with the fact that "because the software continues to operate regardless of the sanctions, and the blockchain technology “allows peer-to-peer transfers . . . without requiring the recipient to consent to transfer,” some users may become liable whenever someone transfers them digital assets via Tornado Cash, even without their knowledge or consent."

Referencing the Government's allegation that Tornado Cash smart contracts qualify as a service, the Fifth Circuit makes another important distinction between providing a service and being a service.

The court has found that Tornado Cash contracts "provide services", but are not services themselves, arguing that "service denotes an intangible commodity in the form of human effort, such as labor, skill, or advice," while in the case of Tornado Cash, "no human effort is expended by the immutable smart contracts."

The Fifth Circuit argues that, even by the Government's own definition, Tornado Cash smart contracts are "nothing more than lines of code [...] less like a “service” and more like a tool that is used in performing a service. That is not the same as being a service," noting that the contracts only perform said service when prompted by a deposit or withdrawal key.

While the Fifth Circuit recognizes the challenges posed by "uncontrollable technology falling outside of OFAC’s sanctioning authority," it notes that "the foremost task of legal interpretation is divining what the law is, not what the judge-interpreter wishes it to be.”

The Circuit found that while the language of IEEPA may be outdated, it is not limitless, stating that "mending a statute’s blind spots or smoothing its disruptive effects falls outside our lane."

"We decline the Department’s invitation to judicial lawmaking. [...] Legislating is Congress’s job—and Congress’s alone."

"These smart contracts must now be removed from the sanctions list and US persons will once again be allowed to use this privacy-protecting protocol. Put another way, the government’s overreach will not stand," writes Coinbase Chief Legal Officer Paul Grewal on X.