There is a special kind of fraud that quietly destroys almost every "one person, one vote" system ever built for the internet. It has a name out of a psychology case study: the Sybil attack. Sybil was a patient famous for multiple personalities. The attack is exactly that — one entity wearing a thousand faces.
And here's why it should keep you up at night: on the open internet, creating a new identity is free. Spinning up a thousand wallets, a thousand accounts, a thousand "people" costs almost nothing. So the instant a system tries to give power to people instead of money, the attacker's move is obvious. Become a crowd. Vote a thousand times. Win.
Every democratic mechanism on-chain lives or dies on one question: can you tell a thousand real humans from one human wearing a thousand masks?
Why it kills the thing you actually want
Follow the logic and you'll see how deep this cuts.
The reason we criticize "one token, one vote" is that it lets money buy outcomes. The fix seems simple: weight by person, not by wallet. One human, one vote. Now the whale's fortune buys nothing extra — everyone counts once.
Beautiful. Also, undefended, completely broken.
Because in "one person, one vote," the attacker's job is no longer be rich. It's be many. And on the internet, being many is trivial. Generate ten thousand fresh addresses — a script does it in seconds — and cast ten thousand votes. The system thinks a crowd showed up. It was one person and a for-loop.
This is the cruel twist. Every mechanism designed to escape rule-by-capital walks straight into rule-by-fakery unless it's defended. Quadratic voting? Sybil kills it — split your credits across fake identities and the quadratic tax vanishes. Airdrops "to the community"? Sybil farms drain them. Governance "by the people"? Which people, and how do you know they're distinct? The move that beats plutocracy hands victory to whoever can fake the most humans — and faking humans is cheap.
Our record. Isfet is the parasite that wears the mask of the many. This is not metaphor stretched thin — it is the literal shape of the Sybil attack. One will, draining a system, cloaked in a thousand false faces so the theft looks like the crowd's own choice. The Scales of Maat weigh true beings; they cannot weigh phantoms. When Isfet floods the count with hollow masks, it is not adding voices — it is forging souls to tip the balance. The whole art of defense is the art of telling a real Ba, a real living soul, from a mask with nothing behind it. Name the phantom and it loses its vote.
The defense: proof of personhood
The answer has a name: proof of personhood. Prove that behind each account stands one distinct, living human — no more, no less. If you can guarantee that, one-person-one-vote finally means what it says, and the whale's thousand wallets collapse into the one vote its one owner deserves.
Simple to state. Brutally hard to do without breaking something else. Here are the honest approaches and their honest costs:
- Biometric uniqueness. Scan something no two humans share — an iris, say — and check it against everyone already enrolled, so no person registers twice. It's strong against duplication. But it means someone builds a global database of human biometrics, and that is a privacy nightmare with its own gravity well of risk. You trade Sybil resistance for a honeypot of the most personal data that exists.
- Social-graph / web-of-trust. Real humans vouch for real humans; fake accounts struggle to earn genuine vouches. Decentralized, privacy-friendlier. But vouching networks can be gamed by collusion, and they tend to exclude the isolated and the newcomer — the very people who most need a voice.
- Government ID. Cheap and familiar. But it re-centralizes the whole thing under the state, excludes the undocumented, and hands your legal identity to whoever runs the check. It solves Sybil by deleting the pseudonymity that made crypto worth building.
- Proof-of-unique-cost. Make each identity expensive enough — stake, work, a scarce credential — that faking thousands stops being cheap. This doesn't prove personhood; it prices Sybils out. It also quietly re-privileges those who can afford the cost, sliding back toward rule-by-capital.
See the pattern? Every method trades one thing for another: privacy for uniqueness, decentralization for reliability, inclusion for security. There is no clean solution. Anyone who tells you proof of personhood is solved is selling something. This is an open frontier, and honesty demands we say so.
The lever
So — is it hopeless? No. Here's the thing worth carrying.
The Sybil attack is powerful because identity is free. That's the whole engine. Every real defense works by making fake identities costly — in biometrics, in earned trust, in stake, in scarce credentials. You will never make faking a human perfectly impossible. But you can make it expensive, and expensive is a real wall against the automated, spin-up-ten-thousand-wallets attack that guts undefended systems. The goal isn't a perfect gate. It's a gate that costs more to fake than the vote is worth.
What to do with this, practically:
- Interrogate personhood before you trust any "democratic" DAO. Ask flatly: how do you stop one person from voting a thousand times? If there's no clear answer, "one person one vote" is theater, and the vote belongs to whoever farms the most accounts.
- Weigh the tradeoff each project chose. Biometric? Social graph? ID? Stake? Each buys Sybil resistance with a different currency — your privacy, your inclusion, your decentralization. Know which one you're paying.
- Reward projects that are honest about the limits. A team that says "here's our personhood method and here's where it's weak" is more trustworthy than one that claims the problem is solved. In this field, humility is a security feature.
One person pretending to be a thousand is Isfet's oldest trick with a new coat of paint. But the trick only works in the dark. Demand proof of personhood, price the fakes out, and the thousand masks fall back into the one face behind them.
Weigh souls, not masks. Everything downstream depends on getting that one thing right.