Replies: 22 comments 40 replies
-
Idena-Go Hard Fork Implementation (Consensus V13) – Reported Flips Penalty.pdf |
Beta Was this translation helpful? Give feedback.
-
We had discussion about this idea before. Community made also the argument that we should suspend users according to the scheme 2 reports out of 3 flips , 3 reports out of 4 flips , 3 reports out of 5 flips, but looking at the real data it turns out that edge case barely ever happens at all. So i think we dont need to make up even more complicated special rules for that hypothetical edgecase, but suspend identities with two reported flips, no matter if they produced 3,4 or 5 flips. |
Beta Was this translation helpful? Give feedback.
-
I believe it's a bit rude to apply that change, since
In fact, I've been keeping the Human status for a long time with very primitive and time-consuming five FLIP crafting |
Beta Was this translation helpful? Give feedback.
-
One another general concern is that this change may cause negative inncentive for many perticipants or candidates, rather than boost growth of the ecosystem as a whole. Also, there are many anonymous participants other than the group that you assume, or web3 decentaralized system and protocol have to be designed with that way. There must be several other "Bad Flip" whicn may escape the slushing, like hidden symbol in a image frame to indicates good/bad placed in the specific frame sequence position, like "This is the beginning/Ending" Assuming those inclusively, tighten the criteria like this proposal is a bad decision, I beleive. |
Beta Was this translation helpful? Give feedback.
-
bad actors need to be removed, but who cares idena is already dead with communism ideas on some of the community members ;) I am not sure if its safe to make rule in one epoch (due bad luck on ppl reporting on purpose) but defo rule per x epoch time should be there |
Beta Was this translation helpful? Give feedback.
-
I like the proposal and don't see any issue with it. The only minor improvement I would suggest is to make the validation equivalent to a "fail" so the naming of the output remains consistent with the existing outputs. A new "penalty details" such as "Two or more reported flips" should be introduced. |
Beta Was this translation helpful? Give feedback.
-
I support the proposal, but I suggest to consider also this.
|
Beta Was this translation helpful? Give feedback.
-
Some more thoughts on your take @sekisanchi : Bad flip isn’t ambiguous - it’s consensus-based. Current risk is for honest users, not for abusers: Right now, honest participants face the real risk: they get the same mining rewards as those who push out low-effort or intentionally bad flips. That’s the unfair part - not rare accidental slashing, but the lack of meaningful differentiation between honest and dishonest work. Status quo has negative impact, that’s anothrt reason why participation dropped to the point where we are today? Inclusion is not the point here. Yes, positive incentives matter, but only if they’re for something real. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
That's right. For that asset protection view, the proposal does not matter.
Thanks
2025年8月6日(水) 8:40 0JustinMiles0 ***@***.***>:
… I don't want to suffer such risk on my stakes.
I'm sure you have full stake protection by now. Your stake won't be at
risk.
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLQW2S7H3F7KPP6THG33ME6FRAVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBRGIZTKNI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
Agree.
2025年8月6日(水) 9:34 hlolve ***@***.***>:
… If IIP make the validation equivalent to a "fail" the IDs validating with
status "verified" will not de suspended, will be killed. If kill newbie and
verified, the only safe status to submit flips is human, I like it but
seems too extremist.
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLS22P43ABI7NICRBOT3MFERRAVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBRGI2TMMA>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
In short term agree with you, but for long. they are certainly expecting
economic rewards, as most of us.
2025年8月6日(水) 15:14 ubiubi18 ***@***.***>:
… some players seem not to care at all about rewards but just about identity
status. So you dont get them with economical incentives but just with
suspension or kill
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLQBX3N3OAHNR4H5YG33MGMKVAVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBRGQ3DQMI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
It would be the risk in the narrow scope, but it's not proven as it's
positive or negative in a perspective long term ecosystem survival view.
2025年8月6日(水) 21:40 hlolve ***@***.***>:
… I consider this a security weakness, and talked about this with devs more
than a year ago, now is more visible the problem. But if you find a
possible problem in security, fix that as soon as possible.
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLQFLTXO3ALGBLCPUWL3MHZTPAVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBSGA2DKNY>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
I would say that's a stereo type view, especially from years veteran
human's bias, and as current share of types with the human status
domination.
Those bad Flips you referred are allowed and expected in the protocol
assumptions from the very beginning.
The protocol rules and criterias have to be considered from much
perspective and large granularity.
You are not follower or brown nose to dev, but an instructor and an adviser
to them as a member of crowd wisdom.
2025年8月6日(水) 6:32 hlolve ***@***.***>:
… Correct 2 IDs same person will receive in long term half of rewards for a
total stake, and that is not bad if not submitting intentionally bad flips.
But nothing stop that ID to try to pass with bad flips, but if the ratio
of bad flips is increased will be risky to validate as "verified", and the
best for that ID will be to not submit flips and validate alternating
accounts as human/suspended/human without submitting flips. I think
terminating is not required, the risk will make them to terminate by
themselves, unless low stake, and in that case they will be wasting time.
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLWSB3V4H4EBPXBLJEL3MEPF3AVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBRGE3DGNI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
There must be bunch of attack vectors similar to this analysis cut before
and future. The change won't turn down the attacker's intentions.
2025年8月6日(水) 6:13 ubiubi18 ***@***.***>:
… I just realized that a bad player can just double the number of accounts
and still post bad flips at the same ratio as now, so you are right, we
have to downgrade such humans to verified as well to make such behavior
more risky. It needs to be part of the IIP. But if we think it further it
turns out that many identities are not here for rewards at all but mainly
for the human/verified status to get human passport points. So if we think
that attack vector even further, there should be even a termination by
protocol, if the share of bad flips is rising too high over a span of
multiple epochs. Can you propose a addition to the IIP, maybe as
pullrequest? Tho it is not even in official draft status
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLRVWKASGPSN2HSEMVT3MEM55AVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBRGE2TGMA>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
I mean your sample would be only tiny set, assuming possible exploits
especially expected in the future with AI assistance.
2025年8月4日(月) 17:22 ubiubi18 ***@***.***>:
… How is it single-sighted and inefficient to exclude all people who publish
on purpose bad flips? Please show me several addresses where it is
different. I pointed out what i found, listing all addresses, please do so
with examples that make a point, otherwise i see no argument.
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLXD7GTR4LAT6FA7YYD3L4J6HAVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGOJYGU2DAMY>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
That's a veteran bias, which may cause conflict in a coming AI norm age
participants.
There must be a lot of who left. Those are not well considered.
2025年8月4日(月) 17:25 ubiubi18 ***@***.***>:
… I personally never had two reported flips in 165 epochs on my two
identities, but that is annecdotical evidence. So collecting the statistics
is more important,'but it made the point that we see barely any good
identity that would suffer from the proposal.
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLVVDYSUYYVB36VFZJL3L4KIJAVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGOJYGU2DOOI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
Strict reporting penalty is positive for veterans, and negative for new
commers. Please don't be narrow sighted.
2025年8月5日(火) 17:54 ubiubi18 ***@***.***>:
… i think bad luck has to be accepted. I get suspended without intention
maybe once every 30 epochs and dont complain about it. Strict reporting
penalty is equal to higher rewards and higher reputation for good players
at the same time. So we lose nothing in median, we only win.
—
Reply to this email directly, view it on GitHub
<#187 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAMXTLQL6LJQ6BBHOPOHY733MBWNBAVCNFSM6AAAAACCWSNPDGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMBQGI3DOMQ>
.
You are receiving this because you were mentioned.Message ID:
***@***.***
com>
--
Kazunori Seki
|
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Updated graph, (includes only flips that reached consensus) the problem is still prevalent |
Beta Was this translation helpful? Give feedback.
-
Added yellow and orange manually. I view them like
|
Beta Was this translation helpful? Give feedback.
-
@sekisanchi actually i found another fact, in epoch 137 and 138 as well as in epoch 158 and 159, when single report score was at peaks like your point D, those were also the times when this pool had high reporting rewards and even a few rewarded identities in session: https://scan.idena.io/pool/0xee2697e512c90Da18281fA7613Cb102efb72D810#rewards . Often bad players also barely have any report rewards, because they probably vote sometimes randomly skip/report/approve without checking, instead of skipping the whole report session as devs hoped for that case of lazy people. So I guess our bad player pool and a certain share of other users report and approve just randomly. If too many happen to do that, the quality of reporting overall goes down, so those are the times when more legit people get reported unfairly, but also more bad players get session rewards no matter that their flips were shitty. Another good reason to not just suspend bad players, but maybe even set their skips/reports/approval of flips on ignore for the upcoming session? |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Description: Suspend identities who create 2+ bad flips per epoch to defend protocol security.
Abstract
This proposal introduces a new protocol rule: If an identity creates two or more reported (“bad”) flips within the same validation epoch, the protocol will suspend (if Verified/Human) or kill (if Newbie) that identity after the ceremony. Identities with only one reported flip in a session are not affected. This deters repeated low-effort or malicious flip creation, which undermines protocol security and user experience.
Motivation
The share of reported bad flips in Idena ceremonies has increased significantly over the past year, exceeding 16% of all flips per epoch. Data shows only 3 - 5% of flips are reported flips likely published by honest mistakes (one-off, unintentional errors); the majority are produced by identities publishing multiple bad flips in one session - suggesting intent to abuse protocol rules. These actors retain identity and mining rights, harming the protocol. The current penalty - removal of session rewards - is insufficient and unfair compared to accidental single mistakes. Strengthening the penalty for repeated bad flips will discourage abuse, improve overall flip quality, and protect protocol security.
Specification
During each validation ceremony, count the number of flips reported as bad (majority-reported) for every identity.
If an identity creates two or more bad flips in the same session:
Identities with only one reported flip in a session continue under existing penalty (loss of session rewards).
Penalties are applied automatically after validation
The new rules requires a hard fork and take effect at protocol version 1.2.0 (Fork14)
Rationale
Analysis of recent Idena data (see repo) shows most bad flips come from a small group of addresses, each publishing multiple bad flips per epoch (see charts below). At current network size, just 44 such identities per epoch can cause significant protocol damage, while suffering little penalty. In contrast, honest users who make a single mistake are punished almost equally. The change introduces a strong, predictable deterrent: identities repeatedly producing bad flips will be immediately suspended or killed, protecting the network against low-quality or malicious actors.
Alternative designs (e.g., higher reward penalties, weighted reporting) were considered in the community discussions, but would not prevent serial abuse or would unfairly punish honest users. This approach targets only repeat offenders, minimizing collateral damage.
There are good reasons to asume that identities with more than one reported flip per epoch are doing this intentionally, while identities with just one reported flip out of three to five flips with much more attached effort probably got reported unintentionally.
The data show that the share of addresses publishing multiple bad flips per epoch has risen, tho it is important to understand that we are talking currently probably only about 40 to 50 addresses overall, while everyone else would face no negative consequences, but rather profit with better user experience and higher rewards after the implementation of the proposed IIP.
Backwards Compatibility
This requires a hard fork (protocol upgrade) at a specific block/epoch. Nodes running old software will be unable to validate or mine after the fork block.
Reference Implementation
tba
Security Considerations
Prevents protocol flooding: The change directly addresses the risk that attackers could retain identities while flooding the protocol with bad flips, degrading both user experience and protocol trust.
Reduces collusion risk: Since reported flips require a majority committee report, it is statistically difficult for honest users to be wrongly penalized; single honest mistakes are not punished severely.
Minimizes accidental harm: Data shows very few honest users will be suspended/killed; almost all one-off mistakes result in only minor penalties.
Attackers must restart from scratch: Killed identities must be re-invited and validated, making repeated attacks costly and time-consuming.
No increased risk for honest users: Users creating only one bad flip per session are not affected by the new penalty. The change incentivizes consistent flip quality.
Beta Was this translation helpful? Give feedback.
All reactions