Joystream / joystream

Joystream Monorepo
http://www.joystream.org
GNU General Public License v3.0
1.42k stars 115 forks source link

Elections: `Announcing` grace period / "snipe" attacks #4926

Open mochet opened 11 months ago

mochet commented 11 months ago

Problem

As Joystream has evolved socially, we have seen that many potential council members announce their candidacy in the final moments of the announcing period. This seems to happen for a variety of reasons related to availability and also wanting to make sure their election campaign aligns with the current issues of the DAO -- and also probably because they want to see who else has already applied. It also seems probable that the pool of suitable candidates is likely to remain small given how complex the council member role is, and even in the distant future it is somewhat unlikely we will regularly have dozens of interested applicants.

Depending on the level of activity and interest on the DAO and seasons (i.e. public holidays) there can exist situations in which there are no candidates for an election. Typically this will result in the announcing period failing due to insufficient candidates. However a bad actor can effectively use this lack of candidate interest to "snipe" the final moments of the announcing period and obtain what are effectively uncontested council seats for a very low stake requirement. The current system has Council.minNumberOfExtraCandidates which can somewhat guard against this but it is still not really sufficient as during an attempted "snipe" sybil accounts could still be used to populate the election to meet this requirement.

Solution

This approach would likely safeguard against "snipe" attacks by making last minute applications less effective.