Hello Steemit,
today I learned how easy it is to vote every post or comment twice.
Background
Since Hardfork 18 it is possible to delegate Steem Power (SP) to other accounts.
If you delegate SP, the receiver of the delegation can immediately start upvoting posts or comments with the delegated Steem Power.
If the owner of the Steem Power needs his coins for himself, he can withdraw the delegation. In order to prevent double voting, he can use the Steem Power after a blocking period of 7 days.
Sounds quite good, doesn't it?
Idea of an double vote attack
This morning a german fellow asked me what happens if he votes on a post and delegates his Steem Power to another account after the vote. Is the other account able to vote the same post with the same Steem Power?
TL;DR: The other account can also vote the same post/comment.
The Test Setup
I wanted to test the behaviour with real accounts. My test strategy was:
- Vote a lot of posts and comments with account 1, until the Voting Power of account 1 is near to zero
- Delegate all SP from account 1 to account 2
- Vote the same posts and comments with account 2, until the Voting Power of account 2 is near to zero
- Withdraw the delegation
- Wait 7 days, Voting Power of both accounts will recover
- go back to step 1
The Test Result
I used 2 alt accounts for the test. First I voted a lot of posts and comments in deutsch with the @steem-munich account.
@steem-munich holds around 450 SP, at the start of the test the voting power was around 80%, so a single 100% vote was worth around 6 cent.
Than I delegated around 400 SP to account #2, @steem.map ...
... and startet voting the same posts and comments.
I was able to double the rewards from 6 Cent to 12 Cent for every post / comment voted by both accounts.
Finally I withdrawed the SP delegation.
Ok, double voting with the same Steem Power is possible, but it is also profitable? Keep in mind that both accounts now are not able to vote the next 7 days with the delegated SP. Meantime other accounts can vote 10 times with 100% per day.
Let's do the math ...
Economy Calculation
Let's compare the rewards of selfvoters:
- Selfvoter A votes himself 10 times a day with 100%, and nothing else. By voting not more than 10 times a day the voting power recovers to 100% overnight.
- Selfvoter B votes himself with 2 accounts. He votes multiple of his own posts and comments, until his voting power is near to zero. Than he delegates his sp to the second account and votes the same stuff again.
Selfvoter A
Let's assume that Selfvoter A's 100% Vote at 100% Voting Power is worth $ 1.00 USD. With each 100% vote, his voting power is reduced by 2%.
| Vote Number | Voting Power | Post Reward |
|---|---|---|
| #1 | 100.00% | $1.00 |
| #2 | 98.00% | $0.98 |
| #3 | 96.04% | $0.96 |
| #4 | 94.12% | $0.94 |
| #5 | 92.24% | $0.92 |
| #6 | 90.39% | $0.90 |
| #7 | 88.58% | $0.89 |
| #8 | 86.81% | $0.87 |
| #9 | 85.08% | $0.85 |
| #10 | 83.37% | $0.83 |
| Summary | $9.15 per day |
According to my calculation 10 Votes with 100% will result in $9.15 total post rewards per day or $64.02 per week.
Update July 21th
@halo detected an error in this calculation. If the Selfvoter A scedules all his 10 votes with a period of 2.4 hours, he should be able to have 100% Voting Power in the moment of the vote. So the reward for each vote should be $1.00, or $10.00 per day or $70.00 per week.
Selfvoter B
Let's assume that Selfvoter B's 100% Vote at 100% Voting Power is also worth $ 1.00 USD. With each 100% vote, his voting power is reduced by 2%. Instead of 10 Votes he will vote hundreds of his own comments or posts, until the post rewards is less then 2 Cent (this happens after Vote #208).
| Vote Number | Voting Power | Post Reward | Total Post Rewards |
|---|---|---|---|
| #1 | 100% | $1.00 | $1.00 |
| #2 | 98.00% | $0.98 | $1.98 |
| #3 | 96.04% | $0.96 | $2.94 |
| #4 | 94.12% | $0.94 | $3.88 |
| #5 | 92.24% | $0.92 | $4.80 |
| #6 | 90.39% | $0.90 | $5.71 |
| #7 | 88.58% | $0.89 | $6.59 |
| #8 | 86.81% | $0.87 | $7.46 |
| #9 | 85.08% | $0.85 | $8.31 |
| #10 | 83.37% | $0.83 | $9.15 |
| #11 | 81.71% | $0.82 | $9.96 |
| #12 | 80.07% | $0.80 | $10.76 |
| #13 | 78.47% | $0.78 | $11.55 |
| #14 | 76.90% | $0.77 | $12.32 |
| #15 | 75.36% | $0.75 | $13.07 |
| #16 | 73.86% | $0.74 | $13.81 |
| #17 | 72.38% | $0.72 | $14.53 |
| #18 | 70.93% | $0.71 | $15.24 |
| #19 | 69.51% | $0.70 | $15.94 |
| #20 | 68.12% | $0.68 | $16.62 |
| #21 | 66.76% | $0.67 | $17.29 |
| #22 | 65.43% | $0.65 | $17.94 |
| #23 | 64.12% | $0.64 | $18.58 |
| #24 | 62.83% | $0.63 | $19.21 |
| #25 | 61.58% | $0.62 | $19.83 |
| #26 | 60.35% | $0.60 | $20.43 |
| #27 | 59.14% | $0.59 | $21.02 |
| #28 | 57.96% | $0.58 | $21.60 |
| #29 | 56.80% | $0.57 | $22.17 |
| #30 | 55.66% | $0.56 | $22.73 |
| #31 | 54.55% | $0.55 | $23.27 |
| #32 | 53.46% | $0.53 | $23.81 |
| #33 | 52.39% | $0.52 | $24.33 |
| #34 | 51.34% | $0.51 | $24.84 |
| #35 | 50.31% | $0.50 | $25.35 |
| #36 | 49.31% | $0.49 | $25.84 |
| #37 | 48.32% | $0.48 | $26.32 |
| #38 | 47.35% | $0.47 | $26.80 |
| #39 | 46.41% | $0.46 | $27.26 |
| #40 | 45.48% | $0.45 | $27.71 |
| #41 | 44.57% | $0.45 | $28.16 |
| #42 | 43.68% | $0.44 | $28.60 |
| #43 | 42.81% | $0.43 | $29.03 |
| #44 | 41.95% | $0.42 | $29.45 |
| #45 | 41.11% | $0.41 | $29.86 |
| #46 | 40.29% | $0.40 | $30.26 |
| #47 | 39.48% | $0.39 | $30.65 |
| #48 | 38.69% | $0.39 | $31.04 |
| #49 | 37.92% | $0.38 | $31.42 |
| #50 | 37.16% | $0.37 | $31.79 |
| #51 | 36.42% | $0.36 | $32.16 |
| #52 | 35.69% | $0.36 | $32.51 |
| #53 | 34.97% | $0.35 | $32.86 |
| #54 | 34.28% | $0.34 | $33.21 |
| #55 | 33.59% | $0.34 | $33.54 |
| #56 | 32.92% | $0.33 | $33.87 |
| #57 | 32.26% | $0.32 | $34.19 |
| #58 | 31.61% | $0.32 | $34.51 |
| #59 | 30.98% | $0.31 | $34.82 |
| #60 | 30.36% | $0.30 | $35.12 |
| #61 | 29.76% | $0.30 | $35.42 |
| #62 | 29.16% | $0.29 | $35.71 |
| #63 | 28.58% | $0.29 | $36.00 |
| #64 | 28.01% | $0.28 | $36.28 |
| #65 | 27.45% | $0.27 | $36.55 |
| #66 | 26.90% | $0.27 | $36.82 |
| #67 | 26.36% | $0.26 | $37.08 |
| #68 | 25.83% | $0.26 | $37.34 |
| #69 | 25.31% | $0.25 | $37.60 |
| #70 | 24.81% | $0.25 | $37.84 |
| #71 | 24.31% | $0.24 | $38.09 |
| #72 | 23.83% | $0.24 | $38.33 |
| #73 | 23.35% | $0.23 | $38.56 |
| #74 | 22.88% | $0.23 | $38.79 |
| #75 | 22.42% | $0.22 | $39.01 |
| #76 | 21.98% | $0.22 | $39.23 |
| #77 | 21.54% | $0.22 | $39.45 |
| #78 | 21.11% | $0.21 | $39.66 |
| #79 | 20.68% | $0.21 | $39.86 |
| #80 | 20.27% | $0.20 | $40.07 |
| #81 | 19.86% | $0.20 | $40.27 |
| #82 | 19.47% | $0.19 | $40.46 |
| #83 | 19.08% | $0.19 | $40.65 |
| #84 | 18.70% | $0.19 | $40.84 |
| #85 | 18.32% | $0.18 | $41.02 |
| #86 | 17.96% | $0.18 | $41.20 |
| #87 | 17.60% | $0.18 | $41.38 |
| #88 | 17.25% | $0.17 | $41.55 |
| #89 | 16.90% | $0.17 | $41.72 |
| #90 | 16.56% | $0.17 | $41.88 |
| #91 | 16.23% | $0.16 | $42.05 |
| #92 | 15.91% | $0.16 | $42.21 |
| #93 | 15.59% | $0.16 | $42.36 |
| #94 | 15.28% | $0.15 | $42.51 |
| #95 | 14.97% | $0.15 | $42.66 |
| #96 | 14.67% | $0.15 | $42.81 |
| #97 | 14.38% | $0.14 | $42.95 |
| #98 | 14.09% | $0.14 | $43.10 |
| #99 | 13.81% | $0.14 | $43.23 |
| #100 | 13.53% | $0.14 | $43.37 |
| #101 | 13.26% | $0.13 | $43.50 |
| #102 | 13.00% | $0.13 | $43.63 |
| #103 | 12.74% | $0.13 | $43.76 |
| #104 | 12.48% | $0.12 | $43.88 |
| #105 | 12.23% | $0.12 | $44.01 |
| #106 | 11.99% | $0.12 | $44.13 |
| #107 | 11.75% | $0.12 | $44.24 |
| #108 | 11.51% | $0.12 | $44.36 |
| #109 | 11.28% | $0.11 | $44.47 |
| #110 | 11.06% | $0.11 | $44.58 |
| #111 | 10.84% | $0.11 | $44.69 |
| #112 | 10.62% | $0.11 | $44.80 |
| #113 | 10.41% | $0.10 | $44.90 |
| #114 | 10.20% | $0.10 | $45.00 |
| #115 | 9.99% | $0.10 | $45.10 |
| #116 | 9.79% | $0.10 | $45.20 |
| #117 | 9.60% | $0.10 | $45.30 |
| #118 | 9.41% | $0.09 | $45.39 |
| #119 | 9.22% | $0.09 | $45.48 |
| #120 | 9.03% | $0.09 | $45.57 |
| #121 | 8.85% | $0.09 | $45.66 |
| #122 | 8.68% | $0.09 | $45.75 |
| #123 | 8.50% | $0.09 | $45.83 |
| #124 | 8.33% | $0.08 | $45.92 |
| #125 | 8.17% | $0.08 | $46.00 |
| #126 | 8.00% | $0.08 | $46.08 |
| #127 | 7.84% | $0.08 | $46.16 |
| #128 | 7.69% | $0.08 | $46.23 |
| #129 | 7.53% | $0.08 | $46.31 |
| #130 | 7.38% | $0.07 | $46.38 |
| #131 | 7.23% | $0.07 | $46.46 |
| #132 | 7.09% | $0.07 | $46.53 |
| #133 | 6.95% | $0.07 | $46.60 |
| #134 | 6.81% | $0.07 | $46.66 |
| #135 | 6.67% | $0.07 | $46.73 |
| #136 | 6.54% | $0.07 | $46.80 |
| #137 | 6.41% | $0.06 | $46.86 |
| #138 | 6.28% | $0.06 | $46.92 |
| #139 | 6.15% | $0.06 | $46.98 |
| #140 | 6.03% | $0.06 | $47.04 |
| #141 | 5.91% | $0.06 | $47.10 |
| #142 | 5.79% | $0.06 | $47.16 |
| #143 | 5.68% | $0.06 | $47.22 |
| #144 | 5.56% | $0.06 | $47.27 |
| #145 | 5.45% | $0.05 | $47.33 |
| #146 | 5.34% | $0.05 | $47.38 |
| #147 | 5.24% | $0.05 | $47.43 |
| #148 | 5.13% | $0.05 | $47.49 |
| #149 | 5.03% | $0.05 | $47.54 |
| #150 | 4.93% | $0.05 | $47.59 |
| #151 | 4.83% | $0.05 | $47.63 |
| #152 | 4.73% | $0.05 | $47.68 |
| #153 | 4.64% | $0.05 | $47.73 |
| #154 | 4.55% | $0.05 | $47.77 |
| #155 | 4.45% | $0.04 | $47.82 |
| #156 | 4.37% | $0.04 | $47.86 |
| #157 | 4.28% | $0.04 | $47.90 |
| #158 | 4.19% | $0.04 | $47.95 |
| #159 | 4.11% | $0.04 | $47.99 |
| #160 | 4.03% | $0.04 | $48.03 |
| #161 | 3.95% | $0.04 | $48.07 |
| #162 | 3.87% | $0.04 | $48.11 |
| #163 | 3.79% | $0.04 | $48.14 |
| #164 | 3.71% | $0.04 | $48.18 |
| #165 | 3.64% | $0.04 | $48.22 |
| #166 | 3.57% | $0.04 | $48.25 |
| #167 | 3.50% | $0.03 | $48.29 |
| #168 | 3.43% | $0.03 | $48.32 |
| #169 | 3.36% | $0.03 | $48.35 |
| #170 | 3.29% | $0.03 | $48.39 |
| #171 | 3.22% | $0.03 | $48.42 |
| #172 | 3.16% | $0.03 | $48.45 |
| #173 | 3.10% | $0.03 | $48.48 |
| #174 | 3.03% | $0.03 | $48.51 |
| #175 | 2.97% | $0.03 | $48.54 |
| #176 | 2.91% | $0.03 | $48.57 |
| #177 | 2.86% | $0.03 | $48.60 |
| #178 | 2.80% | $0.03 | $48.63 |
| #179 | 2.74% | $0.03 | $48.66 |
| #180 | 2.69% | $0.03 | $48.68 |
| #181 | 2.63% | $0.03 | $48.71 |
| #182 | 2.58% | $0.03 | $48.73 |
| #183 | 2.53% | $0.03 | $48.76 |
| #184 | 2.48% | $0.02 | $48.79 |
| #185 | 2.43% | $0.02 | $48.81 |
| #186 | 2.38% | $0.02 | $48.83 |
| #187 | 2.33% | $0.02 | $48.86 |
| #188 | 2.29% | $0.02 | $48.88 |
| #189 | 2.24% | $0.02 | $48.90 |
| #190 | 2.20% | $0.02 | $48.92 |
| #191 | 2.15% | $0.02 | $48.95 |
| #192 | 2.11% | $0.02 | $48.97 |
| #193 | 2.07% | $0.02 | $48.99 |
| #194 | 2.03% | $0.02 | $49.01 |
| #195 | 1.99% | $0.02 | $49.03 |
| #196 | 1.95% | $0.02 | $49.05 |
| #197 | 1.91% | $0.02 | $49.07 |
| #198 | 1.87% | $0.02 | $49.08 |
| #199 | 1.83% | $0.02 | $49.10 |
| #200 | 1.79% | $0.02 | $49.12 |
| #201 | 1.76% | $0.02 | $49.14 |
| #202 | 1.72% | $0.02 | $49.16 |
| #203 | 1.69% | $0.02 | $49.17 |
| #204 | 1.66% | $0.02 | $49.19 |
| #205 | 1.62% | $0.02 | $49.21 |
| #206 | 1.59% | $0.02 | $49.22 |
| #207 | 1.56% | $0.02 | $49.24 |
| #208 | 1.53% | $0.02 | $49.25 |
| #209 | 1.50% | $0.01 | $49.27 |
According to my calculation 208 Votes with 100% will result in $49.25 total post rewards for one account per week, or $ 98.50 by using 2 accounts and Steem Power delegation.
If he does the voting and SP delegation automatically with a bot, the whole procedure takes in best case 418 blocks = 1254 seconds = around 21 minutes. If he does it manually, he should be able to do it in 2 hours.
Conclusion
Let's assume that Selfvoter B needs 2.4 hours for the complete voting, so he can repeat this procedure with a period of 7 days and 2.4 hours. In the same timeframe Selfvoter A can vote 71 times (10 votes per day, 70 votes per week and an additionally vote after the 2.4 hours that Selfvoter B needs for his 416 votes.
| User | Total Post Rewards per 7 days and 2.4 hours | Performance |
|---|---|---|
| Selfvoter A | $ 71.00 | 100.00% |
| Selfvoter B | $ 98.50 | 138.73% |
Using 2 accounts and Steem Power Delegation leads to a profit increase of more than 38%!
How can it be fixed
Another blocking period of 7 days at the start of the Steem Power Delegation would fix this attack vector. But I do not recommend this, because if I want to delegate SteemPower to other users like I've done it 3 weeks ago multiple times, I want that the delegation is active immediately and don't want to wait for 7 days.
Instead I recommend an increase of the blocking period from 7 to 10 days when a Steem Power delegation is withdrawn. Why 10 days? If we use my example from above, the Selfvoter A is able to earn $100.00 post rewards within 10 days:
| Day | Post Rewards per Day | Total Post Rewards |
|---|---|---|
| #1 | $10.00 | $10.00 |
| #2 | $10.00 | $20.00 |
| #3 | $10.00 | $30.00 |
| #4 | $10.00 | $40.00 |
| #5 | $10.00 | $50.00 |
| #6 | $10.00 | $60.00 |
| #7 | $10.00 | $70.00 |
| #8 | $10.00 | $80.00 |
| #9 | $10.00 | $90.00 |
| #10 | $10.00 | $100.00 |
If Selfvoter B has to wait 10 days until he can reuse the delegated and withdrawn Steem Power, he has no longer an advantage.