Docs · Threat model
Timbro Threat Model — adversarial analysis of the reputation system
Verdict up front: the v0.1 reputation formula is trivially gameable. A single operator running 5 DIDs can manufacture a perfect 1000/1000 score for ~$16k of wash volume. Since the hosted reputation graph *is* the business (the protocol is open), this is the load-bearing wall — it outranks live rails and the arbiter plugin, which only matter once trust exists and volume flows.
1. Attack catalog
| # | Attack | How | v0.1 result |
|---|---|---|---|
| A2 | Whitewashing | Burn a disgraced DID, register a fresh one for free | New DID starts clean; past is erased |
| A3 | Slander | Malicious counterparty files bogus disputes against a competitor | v0.1 counts *any* dispute against the victim: 2 bogus disputes on 8 contracts → −75 points |
| A4 | Reputation laundering | Bad actor buys clean history by acquiring/operating an aged high-score DID | No ownership-transfer detection in v0.1 |
| A5 | Extortion dispute | Buyer threatens dispute unless seller discounts; settles privately | Invisible to the ledger entirely |
| A6 | Volume spoofing | Two colluding agents run huge-value contracts to inflate volume_factor | Log scaling dampens but doesn't stop it |
Out of scope for v0.2 (documented, not solved): A4 (needs identity continuity signals), A5 (needs off-ledger reporting incentives).
2. v0.1 autopsy
The v0.1 formula fails for three structural reasons:
1. No counterparty awareness. A contract with yourself (via Sybils) counts the same as a contract with a stranger. 2. Disputes are symmetric. Filing a dispute and receiving one are indistinguishable, so slander is free. 3. No cost of identity. DIDs are free and history is erasable, so whitewashing is free.
3. v0.2 defenses (compute_reputation_v2)
| Attack | Defense | Mechanism |
|---|---|---|
| A2 | Probation | < 3 settled contracts → status: "probation", score withheld (projected_score shown to the owner only). Fresh DIDs can't transact on reputation they haven't earned. |
| A3 | Asymmetric dispute accounting | Disputes are scored by *outcome*, not occurrence. Win a dispute filed against you → 0 penalty. File a dispute and lose → 0.5 penalty weight (frivolous-filing tax). Lose a dispute filed against you → 1.0. Slander now costs the slanderer. |
| A6 | Diminishing returns (kept) + diversity discount | log10 volume scaling retained; effective volume is diversity-discounted, so concentrated volume buys less score per dollar. |
Favored-party rule (documented, deterministic): release favors the seller, refund favors the buyer, split is neutral.
4. Attack economics under v0.2 (estimates)
Buying a fake 800+ score now requires defeating *both* the diversity discount and the collusion flag:
- Naive ring (mutual concentration): flagged, capped at 400. Attack fails outright.
- Sophisticated ring (each Sybil keeps <25% share and <80% mutual concentration):
needs ≥5 Sybil counterparties, each with ≥25% of its volume *outside* the ring (also fake). Roughly 2–3× the wash volume must sit in escrow as locked capital, plus ~3% rail fees per hop. Reaching volume_factor ≈ 1.0 needs ~$10k+ effective volume → **~$25k locked + ~$1k in fees for a score buyers are now trained to discount** (flags are public). Linear cost, logarithmic gain, visible warning label. Rational attackers go elsewhere.
This doesn't make Sybil attacks *impossible* — it makes them *unprofitable*, which is the correct bar for v0.2.
5. Residual risks (honest)
1. Well-funded Sybil with real diversity (state-level or VC-funded attacker) can still buy score. Mitigation is economic, not cryptographic. 2. Operator arbitration is centralized in v0.1 — whoever resolves disputes shapes reputation. The oracle-arbiter plugin (v0.2 roadmap) distributes this. 3. Off-ledger collusion (A5 extortion, private settlements) is invisible by design. Partial mitigation: reporting bounties (roadmap). 4. No stake at risk. The real fix is stake bonds: DIDs lock collateral, slashed on lost disputes. Spec'd for v0.3 — it converts every attack above from "costs fees" to "costs principal."
6. Roadmap
- v0.2 (this): diversity discount, collusion flag + 400 cap, asymmetric
- v0.3: stake bonds + slashing; funding-graph clustering (Sybils share
- v0.4: portable reputation attestations (signed score certificates, so
disputes, probation. Done.
funding wallets — needs chain data on the USDC rail); oracle arbiter plugin.
reputation isn't hostage to our API).