check past votes (legitimacy reasons, manipulation (attempts), ...)

skcin commented 6 years ago

Issue by Erkan-Yilmaz Thursday Jun 29, 2017 at 17:07 GMT Originally opened as https://github.com/Erkan-Yilmaz/Gridcoin-tasks/issues/138

After (A) is fixed, we also need to make sure that there were no manipulation in (important) past polls.

the flaw Tomas found will be fixed
if there are other security flaws still inside, who knows
but important is to make sure that past decisions were legitimate

just out of my head:

voting on foundation funds, poll weight changes, ...

(A) from: https://github.com/gridcoin/Gridcoin-Research/issues/307#issuecomment-302317144

@tomasbrod, commented on 18 May

No, the brackets worked just fine. But I deleted the poll as I don't want to see gridcoin community affected by results of manipulated poll. I already privately contacted developers as well as mentioned that no important polls should be created until a security release. But nothing changed so here it is:

The poll/voting mechanism is insecure:
Anyone can create polls
I can delete polls
I can vote on any poll, multiple times, with whatever share weight I want
And maybe delete legit votes too

Please, do not create or interpret any polls for now.

skcin commented 6 years ago

Comment by tomasbrod Thursday Jun 29, 2017 at 20:10 GMT

The new voting mechanism called Provable Magnitude and Balance may still have security issues. I only read the code once and I suspect it vulneable to Double-spend and Replay attacks. I did not have time to verify. So if it is found secure later, then I appologise.

skcin commented 6 years ago

Comment by Foggyx420 Friday Jun 30, 2017 at 06:32 GMT

id expect my voting stuff will show I got jipped lol. voted on two polls before both used mag and balance. and one I voted and it put my balance and other my actual proper calculation. hopefuly that is fixed.

skcin commented 6 years ago

Comment by Erkan-Yilmaz Tuesday Jul 04, 2017 at 10:44 GMT

the client (e.g. 3.5.9.1) shows only current, still ongoing polls :-(

so do we have to rely on a central place to check this? e.g. gridcoinstats dot eu
the other places that had the info was: gridresearchcorp dot com which is n/a anymore but cold be retrieved via archive dot org
and results posted in the poll announcements on steemit

I am trying if the "Load History" button actually works (from the UI dialog: "Gridcoin Voting System 1.1"

skcin commented 6 years ago

Comment by tomasbrod Tuesday Jul 04, 2017 at 13:37 GMT

Hints execute getlistof poll execute getlistof vote (i was away, therefore the short message)

skcin commented 6 years ago

Comment by Erkan-Yilmaz Tuesday Jul 04, 2017 at 15:37 GMT

thx @tomasbrod

from a quick glance that doesn't seem a complete history, or ? the first command only displays 57 polls

skcin commented 6 years ago

Comment by Erkan-Yilmaz Thursday Jul 27, 2017 at 19:15 GMT

related (e.g. legitimacy):

March 2017, link in forum
July 2017: All whitelist polls in July have ended, but: need to be repeated ?
- we had for weeks problems with the SB which has caused people fromspecific BOINC projects to have magnitude zero (e.g. currently up to 2 weeks time)

grctest commented 6 years ago

I've seen zero evidence to suggest polls have been manipulated (other than being deleted). Create a steemit post or a new task if/when such an incident is discovered.

gridcoin-community / Gridcoin-Tasks

check past votes (legitimacy reasons, manipulation (attempts), ...) #143