deso-protocol / deso-protocol/core

Centralized Single Point Of Failure - swap_identity

Open
#39 6 comments 5 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
327
Forks
106
PR merge metrics
No merged PRs in 30d

Description

There exist 7 superuser accounts defined in 'ParamUpdaterPublicKeys'.

These accounts can be used to create 'SWAP_IDENTITY' actions that can re-assign any account's username (and coin balances?) to another account. This allows any account on the platform to be cancellable by any of the superuser accounts. Having such a powerful action available undermines BitClout's claim to be a decentralized platform with self-sovereign identity.

Recommendation: Remove swap_identity and superuser accounts as soon as possible.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.