Encointer BeeDance

How Encointer can grow to deliver proof-of-personhood on a global level within a few months and serve as a potentially secure-enough basis for sybil-resilient quadratic voting.

What is a POAP and why it isn't a proof of personhood

A POAP Proof of attendance is commonly understood as a proof that you attended a physical or virtual event which is issued by the event organizer. Usually, attendants scan a QR code shown to the audience and claim an NFT. While this may be fun for collectors, there's so much more that could be done, would the POAP protocol be harder to game: Participants can claim multiple times for themselves or forward a picture of the qr code to their friends at home who can then claim the NFT as well. Therefore, as soon as POAs should be with something, the protocol will break.

Shortcomings of POAP:

• people who aren't there can claim a POA with just one person leaking the QR code and no one even notices this attack if small-scale with respect to the audience.
• the event organizer is the single trusted authority to issue the POA

How Encointer could do better

With the primitives available in the Encointer protocol, POA could become much more secure and might even serve as a sybil-resilient proof of personhood under some assumptions. That PoP may be weaker and less decentralized than the one obtained in local Encointer communities regularly, but it can be adopted much faster and easier and it may serve reasonably well for many use cases. Under certain circumstances, the security of the suggested protocol might be sufficient to do quadratic voting. (See federated simultaneous POA events)

Starting with the Encointer protocol as-is: Let's pretend that each public Event is its own Encointer community with just one single cycle, asynchronous to the cycle for local communities. A bit like the Encointer Demo at Polkadot Decoded 2022, but much more convenient for the hosts and better UX for participants. We let attendees gather in small randomized groups and let them attest each others' personhood.

Social Capital and Networking Boost

With Encointer's gatherings, we can turn an annoyance (waste time following a protocol to obtain a POA) into a feature: We introduce speed-dating in small groups that most likely wouldn't otherwise talk to each other. This actually increases the value of the event as it is a networking opportunity and could become the thing about an event that people keep in good memory.

Stakeholders

• Event Host: Aims to offer POA to their attendees. Organizes a social meetup, a conference or another event with at least 3 people. May also leverage someone else's Event without the strict consent of the organizers
• Attendees: Aim to obtain a POA
• Attackers: Aim to obtain more than one POA per attending person (sybil-attack - i.e. to increase their voting power on Polkadot Gov) or aim to prevent others from obtaining one (sabotage, censorship, discrimination)
• Polkadot Network Governance: aims to be Sybil-resilient i.e. to perform quadratic voting to be less plutocratic. Needs a secure-enough personhood protocol for this

Success Scenario

1. The Event host announces an Event on the Encointer parachain with location and time range and gets an event ID, eid.
2. At the event, attendees register onchain to be attested until a deadline (defined by host) using the encointer POA mobile app
3. The onchain protocol will assign all attendees to small randomized groups of around 10 people
4. During a specified time window, people gather in their assigned groups and mutually attest their personhood (performing a pseudonym key-signing party) and submit their attestations onchain using the encointer POA app
5. After a short deadline (specified by host), the protocol will evaluate the gatherings and issue POA to all attested attendees

variants

• endow participants with tokens to pay for fees. The host should send a minimal amount of tokens to all attendees. Just enough for them to pay the fees to register and submit attestations
  • We may want to premine the Event's fee-token such that fees to register for that event can only be paid in that currency. This would make it harder for outsiders to hostile takeover. The token will disappear (be purged with the eid) after a certain time after the Event
  • Voucher: All participants receive an individual QR paper voucher (a paper wallet) which can be reaped using the app
  • Faucet: The host shows a QR code on the main screen which attendees scan with the Encointer App. The app will then send the accountid of the attendee offchain to drip a faucet provided by the host.
• gatherings need to be well-organized but flexible
  • The host signposts locations in the event area that each let around 10 people gather and perform mutual attestation of personhood
• additional rewards:
  • NFT: hosts could issue NFT's for each POA
  • event currency: attendees could obtain a conference currency which they can use to pay for swag, snacks or drinks

Extension: Globally Federated Concurrent Events for Unique Proof-of-Personhood

If a global organization (or DAO) needs bounded sybil-resilience (i.e. Polkadot for quadratic voting), such an organization could host events all around the world on the same day, such that people can't attend two events. An do that every quarter or once per year

Technicalities

We may need to introduce some abstractions into the Encointer protocol, but the basics are all there already and are well-tested

Events are like communities, but with the following differences:

• instead of bootstrappers, they have a controller account for the host who has authority to define the cycle phase changes for that event
• no meetup locations needed
• they have no cid, but an eid which share abstract properties

register_participant will register everyone into the newbie category

assign_event_gatherings (callable by host only) will assign all newbies and create as many locations as needed to host all registered participants. The assignment will not involve a geographical location, just an integer index, displayed prominently by the app (Please go to gathering 23). This may be an expensive extrinsic if the event hosts a lot of people (thousands)

As soon as assignments are done, This event goes into ATTESTING phase

ìssue_event_poap (callable by host only) closes the ATTESTING phase, evaluates all attestations and issues a specified reward. The differences to the current protocol are

• we may want to relax the conditions for acceptance
• what is issued may be
  • a new currency for that event only
  • an NFT collectible

A note on compatibility: as there is no need for demurrage in the context of BeeDance, standard types can be used and there's no need for custom wallets. The client could be a web-Dapp or a standalone app or integrated in wallet apps

Security Considerations for Sybil-Resilience

The security assumptions are similar Encointer's current PoP protocol. However, some aspects are weakened: It would be physically possible to attend two gatherings for the same cycle because gathering locations are very close by. Given some social engineering ("sorry, was on the toilet"…"my husband just called me"…), such an attack is feasible.
We still need to assume that >50% of participants are honest. But even if not, the amount of sybils that can be created is bounded. The upside is: we don't rely much on the Event Host to be honest - at least not nearly to the same degree as with POAP.xyz

We claim that the proposed protocol is able to provide reasonable sybil-resilience if applied correctly. In contrast to Encointer communities it is not a grassroots approach but a top down one: Some entity or group needs to coordinate concurrent global events and whitelist the events which are considered secure. Such whitelisting, however, can in principle be crowdsourced and decentralized. Thanks to mutual personhood attestation of attendees, this approach can be combined with other reputation systems to get reasonable trust that events are held according to the rules. Observers can be sent to other events undercover to report on their compliance or a lottery could select a subset of attendees to be hooked on a video call with an attendee in a different location to perform additional attestations (cross-witnessing). Event registration could involve staking based on the number of attendees. The stake would only be released once cross-witnessing reaches a threshold.

Privacy

It has to be ensured that the later use of the obtained POA can be used in unlinkable fashion. Encointer has a solution for this - to be released soon™.

Credits

Using large federated pseudonym parties for digital personhood: Bryan Ford Identity and Personhood in Digital Democracy: Evaluating Inclusion, Equality, Security, and Privacy in Pseudonym Parties and Other Proofs of Personhood
Problem statement and rough idea input for globally synchronized large events specifically for Polkadot governance purposes: Gavin Wood