{"action":"created","issue":{"url":"https://api.github.com/repos/steemit/steem/issues/602","repository_url":"https://api.github.com/repos/steemit/steem","labels_url":"https://api.github.com/repos/steemit/steem/issues/602/labels{/name}","comments_url":"https://api.github.com/repos/steemit/steem/issues/602/comments","events_url":"https://api.github.com/repos/steemit/steem/issues/602/events","html_url":"https://github.com/steemit/steem/issues/602","id":191214801,"number":602,"title":"Throttle mechanism for opening accounts with cli_wallet","user":{"login":"dragosroua","id":1648447,"avatar_url":"https://avatars.githubusercontent.com/u/1648447?v=3","gravatar_id":"","url":"https://api.github.com/users/dragosroua","html_url":"https://github.com/dragosroua","followers_url":"https://api.github.com/users/dragosroua/followers","following_url":"https://api.github.com/users/dragosroua/following{/other_user}","gists_url":"https://api.github.com/users/dragosroua/gists{/gist_id}","starred_url":"https://api.github.com/users/dragosroua/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dragosroua/subscriptions","organizations_url":"https://api.github.com/users/dragosroua/orgs","repos_url":"https://api.github.com/users/dragosroua/repos","events_url":"https://api.github.com/users/dragosroua/events{/privacy}","received_events_url":"https://api.github.com/users/dragosroua/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-11-23T08:49:11Z","updated_at":"2016-11-23T16:07:49Z","closed_at":null,"body":"At the current moment, there is no limitation in opening accounts using cli_wallet (other than the account fee). In a potential scenario where the STEEM value goes very low and the account fee becomes irrelevant from a financial point of view, a potential attacker can open a very large number of accounts. \r\n\r\nIf the STEEM value goes up again, the attacker controlling that very large number of accounts can manipulate the platform in order to take control of the reward pool and of the witness queue.\r\n\r\nSuggestion: throttle the number of accounts that can be created using cli_wallet in a given timeframe (a day), based on the user SP. The levels could be between 10 and 100 accounts / day and the actual number will be in direct correlation with the amount of SP of the creator (regardless of the account_fee_creation, which will be set up by witnesses)."},"comment":{"url":"https://api.github.com/repos/steemit/steem/issues/comments/262557814","html_url":"https://github.com/steemit/steem/issues/602#issuecomment-262557814","issue_url":"https://api.github.com/repos/steemit/steem/issues/602","id":262557814,"user":{"login":"dragosroua","id":1648447,"avatar_url":"https://avatars.githubusercontent.com/u/1648447?v=3","gravatar_id":"","url":"https://api.github.com/users/dragosroua","html_url":"https://github.com/dragosroua","followers_url":"https://api.github.com/users/dragosroua/followers","following_url":"https://api.github.com/users/dragosroua/following{/other_user}","gists_url":"https://api.github.com/users/dragosroua/gists{/gist_id}","starred_url":"https://api.github.com/users/dragosroua/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dragosroua/subscriptions","organizations_url":"https://api.github.com/users/dragosroua/orgs","repos_url":"https://api.github.com/users/dragosroua/repos","events_url":"https://api.github.com/users/dragosroua/events{/privacy}","received_events_url":"https://api.github.com/users/dragosroua/received_events","type":"User","site_admin":false},"created_at":"2016-11-23T16:07:49Z","updated_at":"2016-11-23T16:07:49Z","body":"I am aware of the bandwidth cost. But in the unlikely, but possible, scenario when value of Steem decreases dramatically in a very short period of time, the creation of user accounts can become very cheap, to the extent that one account with sufficient funds in it will create tens of thousands of accounts in a very short amount of time, with all the bandwidth constraints enforced. \r\n\r\nThe White Paper states that an attacker holding 1% of the coins (which atm should be around 25mil STEEM) could spam the network for 30 seconds every hour. At a rate of 1000 transactions / s, that will still mean at least 30k accounts created every hour (taking into account network latency). If the price stays very, very low for a few hours, a significant amount of user accounts can be created. \r\n\r\nWether it does this by creating 1000 accounts and then have those 1000 accounts creating each 100 accounts, or does it by creating 1000 accounts from the same main account every hour, is irrelevant.\r\n\r\nIf a plain, time-based throttling mechanism is not suitable, for political reasons, the fractional reserve model could be adapted to take into account a scenario in which the very low value of the currency could allow an attacker to execute a very large number of transactions.\r\n\r\nAs it is right now, the \"attack surface\" is still very large and can be exploited in many ways, not only by creating fake user accounts. For instance, a relatively low number of accounts could execute thousands of white spamming operations, clogging the blockchain with meaningless content, the way Ethereum was attacked recently because of the low cost of gas."}}
{"actor":{"display_login":"dragosroua"}}