Sybil Attack

The name comes from a 1973 book about a woman with multiple identities, and the underlying result is older than most of the systems now rediscovering it. John Douceur's 2002 paper for Microsoft Research established the uncomfortable part, that without a trusted authority to certify identity, a sufficiently resourced entity can always manufacture enough identities to overwhelm a peer-to-peer system. Not usually, but always.

Crypto meets that result wherever it allocates per person, because the thing being counted is addresses, and addresses are free. Airdrops, governance votes and activity-based rewards all assume a population of distinct participants that nothing in the protocol establishes.

Every defense trades something away. On-chain heuristics that cluster wallets by funding source and timing catch casual farmers and miss well-funded ones. Proof-of-personhood systems add a genuine identity check and, in doing so, reintroduce precisely the trusted authority Douceur said was required. Token-weighted voting sidesteps the problem by making influence cost money, which substitutes plutocracy for a solution.

The banking analogue is know-your-customer, which exists in part because any system that allocates or restricts per person has to first establish that a person is one person. That problem has never had a cheap answer, on-chain or off.