Skip to content

Latest commit

 

History

History
44 lines (25 loc) · 3.48 KB

File metadata and controls

44 lines (25 loc) · 3.48 KB

Furry Hickory Gazelle

High

Potential Exploitation of Vouching Mechanism Through Minimum Vouch Amounts

Summary

The current design of the vouching system in the platform allows authors to vouch for subjects at the minimum vouch amount (e.g., 0.0001Ξ), thereby placing their credibility at the lowest possible level. This flexibility enables authors to vouch for a subject with minimal stakes, potentially filling slots that are intended for more significant endorsements from credible actors that the subject intended. Authors can exploit this mechanism by selling their vouchers externally, which could undermine the integrity of the credibility system, as subjects can acquire credibility through minimal investment. Additionally, subjects can receive a maximum of 256 vouches or lesser, and this threshold creates an opportunity for authors to strategically manipulate the system with minimal financial involvement, disturbing the credibility model. This creates the risk of devaluing the trust-based reputation system and destabilizing the platform’s trust metrics.

Impact

Reputation Disruption: The ability to vouch with minimal stakes undermines the credibility system by allowing authors to influence a subject’s credibility without substantial financial commitment. This could distort the platform’s reputation model, where credibility should ideally be tied to genuine financial stakes.

Authors could sell their vouchers externally, leading to potential manipulation of the system for profit, without contributing to the platform’s intended trust-building mechanism.

The platform’s philosophy of using stake value for credibility becomes vulnerable to manipulation, as small investments can yield significant control over a subject’s perceived trustworthiness.

PoC

Here are the questions to ask;

1. Did the subject have the power to remove vouches?

No.

  • As per the system’s design, the subject does not have the ability to remove vouches, as vouches are controlled solely by the author.

2. Can authors decide to vouch for the subject with the minimum vouch amount?

Yes.

  • Authors can vouch for the subject with the minimum required vouch amount (e.g., 0.0001 ETH), allowing them to place their credibility at the lowest level.

3. Can a bad author decide to vouch for the subject just to limit their credibility for gain?

Yes.

4. Is there a limit for vouches on a subject?

Yes.

  • The maximum number of vouches a subject can receive is limited to 256. Once this limit is reached, no more vouches can be added for that subject.

Mitigation

The system should permit subjects to create their own required acceptable minimum amount to accept for a vouch, if it is not created, the default amount should be use to ensure at least authors deposits above minimum.