TEMP CHECK - Sybil Resistant Forum

Title: TEMP CHECK - Sybil Resistant Forum
Authors: @Jengajojo @Icedcool
Squad: Governance Department
Date Created: 25.05.2023
Date Posted: 25.05.2023

TLDR:

  • BanklessDAO needs a Sybil resistant forum to support more efficient governance!
  • Options
    • Migrate forum to another platform
    • Keep Discourse
      • Native discourse voting (likely additional charge)
      • Non-native discourse voting (no additional charge)

Summary:

This tempcheck explores the spectrum of options available at our disposal as a DAO when it comes to making our governance resistant to sybil attacks. Based on our analysis we suggest a way forward focused on stages and we’d like to hear from the community about this approach.

Background:

We are in the build market and DAOs are getting exploited left-right-and-centre! In the last 6 months banklessDAO suffered from two sybil attacks:

In the latest attempt, the Sybil tried to game our governance. Since a lot of our operations are manual today, we were able to identify and mitigate this threat, however, there is a need to update our tools and processes to be able to resist similar attempts in the future.

What is a Sybil attack?

A Sybil attack is a type of attack on a computer network service in which an attacker subverts the service’s reputation system by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence.

Specification:

The Governance department has been brainstorming various ways to mitigate this issue, however we have to be mindful of the fact that sybil resistance is a never-ending cat and mouse game. As the tools for resisting sybils evolve, so do the Sybil themselves evolve to coordinate better attacks, hence

  • Sybil resistance is a journey and not a destination.
  • Sybil resistance is a spectrum and not an absolute measure.

Broadly we have identified 3 possible ways to proceed:

  1. Migrate forum to another platform
  2. Keep Discourse
    1.Native discourse voting (likely additional charge)
    2.Non-native discourse voting (no additional charge)

Below is an overview of the list of tools and avenues at our disposal along with possible pros and cons with each approach

  1. Migrate forum to another platform

The forum is currently hosted on discourse.org which, while being a web2 forum tech leader, is not a web3 native governance solution and hence lacks native integration with many web3 features such as token-gating, token weighted voting etc.

There are several alternatives to discourse such as Charmverse, Commonwealth, Disco.xyz, Spect, Guild.xyz, wonderverse etc. From all these solutions, Commonwealth has a well built platform that has been adopted by several DAOs, while many of the other solutions seem to still be under construction or like charmverse have costs associated with their usage.

Zooming in on most platforms, they offer several features that we are interested in and do not have any costs associated with them today, however this may change over time. Additionally, many users experience these platforms as buggy. This is an important point to consider when dealing with new software. It often comes with bugs and takes some time for a stable version to perform consistently across use cases.

For our use case, we think that the cons of having a new platform which is yet to be tested with bull market level energy outweighs the pros of its features. We want a robust, battle tested and stable solution.

  1. Keep Discourse

Discourse’s emphasis on user experience, mobile-friendliness, gamification, moderation tools, search functionality, customizability, and active development makes it a popular choice for hosting forums. Its innovative approach to online discussions has contributed to its reputation as a great platform for community-based interactions.

  1. Non native discourse voting (no additional charge)

One option is to keep using discourse for proposing and commenting, but move voting to a third party solution such as governator.xyz or snapshot.org . While both these options offer the solutions we are looking for, governator suffers from the same issues as commonwealth, new software awaiting battletests, snapshot does not suffer from the same flaws.

There is a risk of drop off from forum proposals to snapshot voting while hopping between platforms.

  1. Native discourse voting (likely additional charge) with plugins

Any plugin, self-built or a third party integration will result in more costs for DAO. We can either self host the forum which will significantly increase our costs in terms of resources and money, or upgrading the discourse tier will result in banklessHQ paying more to host our forum on discourse.

Assuming BanklessHQ continues to cover our discourse upgrade(or the DAO pays), we are left with the option of:

  1. Self-built plugin solution
  2. Third party solution such as Gitcoin passport

Gitcoin passport is an identity verification application developed by GitcoinDAO on the Ceramic Network. It enables users to collect verifiable credentials (called "stamps’, from web2 and web3 authenticators all in one place) that prove their identity and trustworthiness without exposing personally identifying information.

Passport does not currently support discourse integration, however this update will be available by the end of next month(June), which gives us sufficient time to integrate this solution in our approach. Passport is widely accepted by the greater crypto community as the leading sybil resistance solution, we believe that this is the best approach and long term solution against sybil attacks

In conclusion, we suggest a staged approach, first with gating discourse with Gitcoin passport and using the default scorer settings to kick off forum sybil resistance.

As we continue to work on this, we will move towards token gating with the BANK tokens or tlBANK.

Next Steps:

  1. Collect feedback from the community
  2. Post bDIP based on feedback
  3. Integrate passport

What do you think about this approach?

  • Yeah! Let’s do this
  • I vote ‘naye’, and will tell you why in the comments
  • Maybe, I have some suggestions

0 voters

1 Like

I understand why we’d use Gitcoin passport, but I have found the default threshold to be high for people new to web3. It’s heavily weighted towards web3 use cases. For instance, I could connect Discord+Facebook+Github+Google+LinkedIn+Twitter and STILL not have enough juice to vote.

I might suggest reducing the requirements and also coupling with a guide on how to get more Gitcoin juice (i.e. attend a CC and get the POAP)

1 Like

Lol, yea agreed.

We can set the threshold so it is a few of those, like discord and… brightid or something.

Honestly even just tieing to discord would be a large leap forward.

3 Likes

Recommend first gating discourse with Gitcoin passport

This would require self-hosting Discourse, right? I wasn’t aware that hosted version allowed for this integration.

1 Like

Yea, either upgrade to business plan OR self hosting.

I posted a temporary check in another thread regarding the BanklessDAO forum’s transition from Discourse to Metaforo.io. Metaforo was specifically designed to safeguard DAOs against Sybil attacks. For more detailed information, please refer to this thread.

In addition to offering all the traditional features of Discourse, Metaforo encompasses the functionalities of a Web3 forum, including Token Gating and Token Weighted Voting. We are fully receptive to any customization requirements from Bankless DAO, considering ourselves an integral part of your development team. Our aim is to make Metaforo the ultimate destination for your governance process.

We kindly request the opportunity to provide a demo of Metaforo during your DAO Tooling meeting, enabling us to showcase its capabilities firsthand.

I just want to elaborate a little bit more on what Metaforo can do to prevent Sybil attacks. Metaforo incorporates robust protection mechanisms, ensuring a secure and trustworthy governance process both before and after the voting process.

Preventing Sybil Attacks Before Voting:

Secure Member Registration:
Metaforo empowers administrators to enforce specific criteria for member registration.
Users are required to hold a certain amount of BANK tokens or possess a designated NFT or POAP to join the forum.
This stringent requirement guarantees that only eligible users with a unique wallet address can participate, effectively thwarting potential Sybil attacks.

Protection During the Governance Process:

Snapshot Strategy for Proposal Voting
Metaforo integrates the Snapshot strategy into the proposal voting mechanism on the forum.
During the voting process, the system meticulously verifies the block height of each user’s assets at the time of casting their vote.
Any user who did not have enough BANK tokens at the time of the voting commencement but acquires additional BANK tokens later in the hope of voting is automatically disqualified from voting.
This proactive measure ensures that only users with the appropriate token holdings at the start of the voting process are eligible to participate, preventing token transfers between members after voting has begun.

Set SBT requirement in Voting
The community establishes the specific SBT requirements for each voting instance.
Only users who possess the designated SBT are granted participation rights in the voting process.
Since SBTs are non-transferable, the integrity of the voting system remains intact, providing a robust defense against potential abuse or manipulation.

1 Like