A Bounty to make Polkadot Sybil-Resilient

Governance
1

Sybil-Resilience and Proof-of-Personhood are essential:

However, Sybil-resilience is one of the most challenging problems of web3. It is not yet obvious, which solution will work best. Therefore, this bounty shall follow a pluralistic approach and fund various promising approaches to solve the problem.

The following values shall focus the selection of funded projects:

  • Permissionlessness: No reliance on central authority attestations (excluding KYC)
  • Inclusivity: Minimize captital and infrastructure requirements to participate (no direct or indirect PoS)
  • Privacy: The solutions shall aim to be privacy-preserving by design
  • Digital Alias Fluidity: It should always be possible to drop an alias and obtain a new one without linkability between the two (Effectively excluding biometric approaches)

Goal of this bounty (series)

Polkadot shall become the leading platform for decentralized sybil-resilience.

While Ethereum has a few approaches (i.e. GitcoinPassport, CirclesUBI, BrightId), I believe Polkadot’s technical advantages (like decentralized decoupling of gas fees and effective sharding) can make Polkadot the leading platform for inclusive protocols and tools for sybil-resilience.

Targeted Outcomes

By funding different teams pursuing various approaches, a plurality of FOSS tools and sybil-resilience mechanisms shall be designed, developed, deployed and evaluated, catering to the needs of the Dotsama ecosystem and indeed the entire Internet. Expect to see the fruits of this bounty to be concretely applied to

  • “AI free” Web3 social media platforms
  • Bot-free reviews / webs-of-trust
  • UBI projects
  • mixnet privacy enhancements
  • efficiency enhancements of Polkadot’s validator selection process for parachain validation
  • more variety in onchain governance voting systems e.g. quadratic voting or 1p1v to strengthen democracy, participation and community empowerment and, more generally, the feeling to be enfranchised on onchain governance.

Expect nothing less than mass adoption of Polkadot due to added real-world utility.

Why a bounty?

So far, Polkadot Treasury has followed a bottom-up approach where individual teams propose spending and defend their own cause each for themselves. As a consequence, the selection of funded projects is rather opportunistic than strategic. Similar to Towards a Treasury Budget, I propose a top-down approach: If we agree that sybil-resilience is a strategic goal for DotSama, we should define a budget as a fraction of treasury influx. The more one DOT can buy, the higher the budget will be for this bounty, the faster can we reach our goals.

If each project struggles for themselves to get approved by OpenGov, a lot of energy is wasted on all sides and there’s no planning security. Even if the project delivers good work, there is no guarantee to get funded, even retroactively. On the other hand, even if the treasury has decent funding, the current process won’t systematically allocate funds to the important topics of our time.

This bounty is a statement that the network wants the problem tackled and is prepared to allocate reasonable funding to get work done.

How much?

I propose to dedicate a 1% of treasury influx to the sybil-resilience topic.

Polkadot OpenGov currently only allows individual spending of a fixed amount. Streaming influx to various topics is not (yet?) possible. We can, however, calculate the expected influx over a fixed timeframe and set the bounty amount accordingly. In order to provide some planning security for strategic development, we propose to set the timeframe to at least one year. Fluctuations of DOT buying power will still require cautious planning.

So, I propose a bounty over 1% of the treasury influx over one year. After one year, the bounty shall be dissolved, remainders returned to the treasury and a fresh bounty shall be set up. This allows to adjust amounts, curators and scope and it also incentivizes curators to really spend available funds during one year.

The Personhood Trilemma

Proof-of-personhood approaches all come with their tradeoffs. There can be no solution which is maximally scalable, decentralized and sybil-resilient at the same time.

842Ă—456 31 KB

This bounty shall explore the design space of decentralized approaches

Candidate Projects and Subtopics

existing teams:

  • within DOtsama
    • Encointer: the OG in Sybil resilience for Polkadot. based on concurrent in-person pseudonym parties
    • Prosopo: based on reverse turing tests: Proof of Captcha
    • Jur: DAOs. may directly benefit and could be an interesting testing ground
    • substrate mixnets
  • outside Dotsama (but might be motivated to integrate or even move)
    • BrightId (currently linking to Ethereum addresses, but could be integrated in principle). based on social graph
    • CirclesUBI based on social graph backed by trust in personal currency
    • IDENA based on globally concurrent reverse turing tests
    • ProofOfHumanity: based on optimistic peer-validated biometry
    • Trustlines mutual credit system
  • who else?

core:

  • various proof-of-personhood protocols
  • privacy-enhancing technology in the scope of above protocols

frontends and use cases:

  • wallet teams
  • Dapp developers

interoperability:

  • bridging sybil-resilience tools to chains, dapps, smart contracts

experiments:

  • quadratic voting for onchain governance
  • social media sybil-resilience

research:

  • data analytics of experiments and field trials
  • security analysis of various approaches
  • economics and tokenomics analysis
  • political philosophy on personhood-based governance

Curators

The set of curators should be diverse and made up of people who care about the topic and are determined to invest time and effort to evaluate child-bounty proposals.

7 Likes
2

Thanks for the write-up, brenzi. Prosopo is indeed interested in pursuing bounties to tackle the problem of sybil resistance on polkadot and dapps in general. There are clearly different types of protection required depending on the value at stake. For social networks, voting on a poll should not require KYC or an in-person meetup. This is where some sort of decentralised bot detection methods could work.

At the other end of the spectrum, votes on governance proposals should not be game-able and will require a higher level of protection than captcha. This is where I see Encointer’s personhood strategy proving valuable, especially in regions where KYC related identities are simply not possible.

To develop the bounty goals further, perhaps there could be some kind of real-world usage deliverables included. There is clear value delivered to polkadot if a project can demonstrably show that it is being used by people worldwide, not necessarily within the blockchain community.

2 Likes
3

@brenzi
can you state the goal or intended outcome of the bounty?

4

I expanded the OP to state goal and expected outcomes

1 Like
5

I’d like to mention an interesting discourse about a particular danger of sybil-resilience, started by @giotto : Quadratic Voting for Polkadot Governance - #5 by giotto

1 Like
6

Another one to add to the list from outside dotsama

Proof of Humanity is a system combining webs of trust and dispute resolution to create a sybil-proof list of humans, powered and trusted by Coopérative Kleros and Democracy Earth. The identity registry on ethereum has created the first democratic DAO on Ethereum, and the largest Universal Basic Income experiment using cryptocurrencies to date, with a monthly allocation in UBI to each member of the registry.

3 Likes
7

I think Jur as an operating system for governance, might be a good fit. I think sybil-resilience is not their primary focus, but in order to build a meaningful operating system for governance, sybil-resilience will be key.

Further, Trustlines uses a social graph approach to a credit-based monetary system. They are solving for sybil-resilience as a side product.

2 Likes
8

I think person-hood parties provide a useful community activity anyways, even the benefits wind up much weaker than claimed, aka people simply rent out the identity, which kills quadratic voting.

We’d ideally have meet ups between nominators and validator operators, along with parachain projects doing stuff. Tor runs operator meet ups, where folks discuss practices, etc. Crypto-parties were useful forever. etc.

I’m unsure about the funding level, but an identity system itself could provide an incentive to come, so then the parties need not be fancy.

Ideally, we’d figure out how these meetups could be general crypto as in cryptography, not crypto-currency shilling: You can talk securing networks, like nominators and validators operators making friends. You can discuss cool technical aspects of your parachain. We ideally have some shilling boundaries to not antagonize the anti-capitalist types who’d come to Tor meetings, crypto-parties, etc. I’d expect some communities already found these, due to bitcoiners presence.

1 Like
9

I thought mass adoption was a goal? This sounds like the plan for a niche special-interest hobby club–is that the aim of nPOS?

Those questions are sort of rhetorical, I admit, but I don’t mean to ask them combatively. I also understand what you’re getting at, the ideation of a sort of functional, non-gameable personhood, an actual social network. I just don’t think that’s a path forward for anything trying to be big. And if Polkadot is going to be that small, there’s not going to be much of a need for sybil resistance since its value will not be worth attacking.

2 Likes
10

If I understand correctly, this decentralized solution aimed at proving the individuality of a controlling entity, and thereby enhancing sybil resistance, rely on other individuals confirming identity at in-person social events with a token incentive and anchored to a mobile phone. This approach establishes a weak, recurrent and randomized social gathering structure, using mobile phones instead of government-issued attestations with legal implications. Scaling this method appears challenging and its effectiveness is rather questionable.

Perhaps we should consider a more pragmatic approach, moving away from the extremes of centralization and decentralization. We could examine the assurance structure within the context of the specific problem being addressed. An event-based, randomized, in-person check-in linked to a phone doesn’t truly represent a decentralized solution. True decentralization would involve individuals having the autonomy to decide whom to trust, such as by adding their public key to their trusted keyring (like in a PGP web of trust).

For scalable sybil resistance improvements aimed to secure the network, it makes sense to rely, though not exclusively (here, for instance, designated trusted authorities could issue verifiable credentials, not necessarily requiring an inconvenient in-person event like it is required by governmental bureaucracy), on existing national or international assurance structures. These could include valid electronic certificates with proof of signature onchain. This approach gains significance given the legal consequences associated with impersonation.

However, there is always a risk of collusion. It might be more practical to acknowledge that there is, at best, a trust-minimized solution dependent on the sociotechnical context in which the system operates. Thus, the challenge lies in striking the right balance between minimizing trust and utilizing assurance structures that enhance trustworthiness.

11

Not sure if you talk about in-person meetups or virtual ones here. I’d have concerns about privacy and even safety here. You’d be asking people to link their physical presence to their wealth and influence. If we go for virtual meetups instead, the security guarantees diminish.

12

Even if I disagree, the proposed bounty in the OP is meant to explore your preferred approach as well and shall not be restricted to randomized in-person pseudonym key signing alone. AFAIU what you suggest is what BrightId does which is listed as potential project in the OP

1 Like
13

BrightId does not appear to provide sybil resistance. How does it link a unique individual to an unforgeable or hard-to-forge provable identifier? Is it solely reliant on the memory of the human host performing remote verification? One can register multiple times without any linkage apart from the memory and goodwill of the human host/seed. We’ve read about their new “solution” called Aura; unfortunately, it seems more like a gamified patch.

We want to highlight two key characteristics essential for a system to offer sybil resistance at scale. Firstly, a unique, unforgeable identifier linked to an individual, as provided by national IDs and their derivatives such as e-passports and driving licenses. This assurance structure is trusted because it is essential for daily activities and is highly likely to be connected to one’s birth event. Secondly, legal consequences in cases of impersonation, a criterion met by government-issued personal unique identifiers. In our view, the first characteristic is a condition sine qua non for sybil resistance.

We are also surprised by your classification of biometric scans as a centralized technology. In theory, biometric techniques provide a unique personal physical identifier that, precisely, could be the basis for a decentralized sybil resistant identity system. This is because you have a strong physical identifier produced by a unique human that does not depend on any certification authority. The challenge lies in protecting the privacy of such sensitive data, potentially through zero-knowledge proofs or similar methods, and ensuring the hardware is secure and works properly.

14

I don’t see this as black-an-white. It’s a spectrum on the tradeoff between security and accessibility. BrightId is certainly more on the easy-accessible side rather than the very secure/sybil-resilient side IMO. Still, it probably does introduce reasonable friction to Sybil attacks which at least bounds practical attempts.

We already see this with KILT&Deloitte KYC and this certainly could be one possible way to go. But privacy guarantees are very minimal there (yet) and as far as I’m informed, regulated KYC providers will require more control over the use of credentials than what I would call “self-sovereignty”: I was actually surprised to learn that Deloitte will enforce whitelisting of credential verifiers and therefore restrict what the credentials can be used for. Not exactly self-sovereign nor unstoppable. It’s challenging to combine highly-state regulated primitives with a decentralized network. I’m not saying it shouldn’t be attempted, but I’d propose to rule it out for the sake of this bounty - TBH also because it would employ more lawyers than builders.
The proposed bounty shall aim for a more decentralized, more inclusive solution, including those who don’t even have a state-issued identity document (anymore).

My reasoning is that biometric scanning requires scanners, which are trusted hardware, which requires centralization of a PKI certificate system: more detailed thread

2 Likes
15

I don’t want to divert the original intention of the post, but since it is quite interesting, I want to reply.

A simple solution, yet to prove its security (it would be amazing to prove whether it is secure or not), is to use Proof of Signature Knowledge. There is even an old implementation in the UBIC repository, referenced in a previous post.

The problem of revocation is actively addressed by revocable/cancellable biometric schemes. I see the problem with the root of trust in the hardware, as it is effectively adds a chain of trust, similar to government-issued certificates. It is a highly complex problem to decentralize; perhaps using Physically Unclonable Functions as a RoT and implementing some “magic” of enrollment protocol for the devices… (just thinking out loud) :smile:

Anyway, a lot of research is going on in the intersection of PUFs and biometrics, so it seems quite premature to classify it in the intrinsically centralized quadrant.

16

for the record. I added potential uses of sybil-resilience to the OP which were previously missing mentioned by @burdges here

  • enhance mixnet privacy
  • enhance Polkadot parachain validation efficiency (and therefore scalability of Polkadot)
2 Likes
17

here’s one more team that should be added to the list of potential targets for this bounty: