What happened at ether.camp 2016 Hackathon with HackerGold Voting System?

At the October 2016 ether.camp hackathon, developers from across the planet competed for a prize of $50,000 USD. The event reportedly had 550 registered developers who submitted 200 ideas. Registration for the 2016 event began in July 2016 with ether.camp claiming to have received more than 2000 individual registrations with more than 300 different ideas submitted.

Overview for fast readers:

  • At the October 2016 ether.camp hackathon, developers competed for the prize of $50,000 USD.
  • Voting was decided through a blockchain-based tokenized system.
  • One judge warned of gameable tokenomics.
  • One of the competing teams alleged the system for awarding prize money was hacked.

About the Ether.camp Hackathon

The 2016 hackathon was held remotely, and anyone from anywhere could fully participate and compete for the ultimate prize. Controversy surrounded the event, as a judge warned of gameable tokenomics in the event’s blockchain-based voting system and one of the competing teams alleged the system for awarding prize money was hacked.

“The response is very flattering, and it really inspires us to move forward,” said Ether.camp CEO Roman Mandeleil. “We already see from the 550 registered developers who have submitted some 200 interesting ideas which they are going to try and implement during the event.”

Mandeleil stressed the ether.camp team invited all developers in the Blockchain community and beyond to participate. The team’s hope was that the event’s so-called “virtual accelerator” would help startups and help launch real companies.

The “virtual accelerator” was the <hack.ether.camp> platform, which the team claimed made crowd-diligence possible. As the hackathon teams compete with one another, they would also be competing for the attention of the community.

In order to win the prize they need to attract fans. An audience could watch as the team thought through the initial idea and began developing and releasing the prototype. Each team’s work was transparent. Fans could see how teams progressed.

“We’re using blockchain technology to create the platform as a virtual accelerator,” wrote the team on their blog. “Our goal is to connect people together; developers, entrepreneurs and fans, and remove the traditional barriers for them to be involved.”

The blog continues: “Yes, by casting their votes fans will help choose the overall prize winner for hack.ether.camp 2016. But where things really get interesting is that fans will be able to participate in a value token sale. If a fan feels that a team is up to something special they’ll be able to buy into what that team is doing and by means of smart contracts have a say in how the team’s funding is spent.”

The first edition of Ether.camp in 2015 had been a three-day event that had 30 teams participating. Thomas Bertani’s Camp.iudex won.

The 2016 version was meant to be more than a hackathon. “This time we are making more than just a hackathon. We have designed the full functioning Virtual Accelerator, that over the timeframe of five weeks will help startups to get funded and find partners based on the skills they are going to present,” Mandeleil said.

Erik Voorhees, the Shapeshift Founder and CEO, who was also one of the judges during the hackathon, liked the idea for the hackathon. “Online hackathons are a very cool idea,” said Voorhees. “Especially in this industry when it’s supposed to be global and allow anyone in the world to participate in the new financial system.”

He added: “A lot of the people in the world don’t have the means to fly to some urban center in a western country and participate in front of a bunch of VCs there,” he said. “So the ability to get off the ground from your rural village in Nepal is gonna be, I think, pretty revolutionary.”

HackerGold Token

The hackathon also had an official token hackerGold (HKG), for the event and future blockchains. You can view the now-defunct HKG on CoinMarketCap and etherscan. Mandeleil claimed the token would ensure a secure funding system for startups. The token was designed at the heart of  the company’s crowdfunding apparatus.

“We wanted to build something that’s truly valuable for the whole community,” said Mandeleil.

A Bit of Controversy

Jack du Rose, CEO of Colony, and one of the judges for the hackathon, backed out over concerns regarding the game theory behind the HackerGold token. “I was trying to encourage Roman to postpone the sale to allow time to solve some of the issues,” he wrote. “As it became apparent that would not happen, I hoped at least that my concerns would be acknowledged publicly in the two subsequent AMAs so that people could make their own judgements with full information.”

For that reason, he did not feel comfortable lending his “implicit support to this token sale” by remaining on as a judge. His main concern was that the tokenonomics of HKG did not seem game theoretically secure. HKG was being sold as a means to purchase voting tokens in Ether.camp projects.

“This voting system is fundamentally flawed,” he wrote. “I believe this may lead to backers losing their tokens, and consequent devaluation of HKG.The voting, both to determine winner of the hackathon (and $50k prize!), and on funding decisions within the projects appear to be trivially gameable.”

Du Rose pointed out how “fans” who registered have 10 kudos points to issue, which when combined with each judge’s 1000 kudos points, determines the winner of the $50,000 prize.

“It seems it will be an easy target for a sybil attack,” he thought “It was suggested in the AMA that ether.camp would be watching for people sybiling votes and those teams would be disqualified. In that case competitors should sybil votes against those who appear to be doing well in order to get them disqualified.”

In short, the HackerGold conveyed voting rights, requiring therefore a 55% majority to vet a spending decision.

Among the most pressing design problems du Rose included:

  1. Any competitor can purchase HackerGold, invest it in their own project for at least 55% of the project’s tokens, and then drain the fund. “A subtler attacker would use the first round of funding to lock in control of voting and wait to use the exploit in the second round of funding when they have direct control of Ether, rather than just the HackerGold.”
  2. Although a project’s executive team can be ‘impeached’ and ‘replaced’ by 70% majority vote, there is no legal recourse to uphold this. Token holders could block funding so funds are returned back to them. But a team only needs to control more than 30% of their DST tokens to prevent impeachment.
  3. There is no explicit relationship between an investment of HackerGold and the project to which it is invested. What motivation do token holder’s have?
  4. A malicious competitor team could buy a controlling stake in a competitor’s project to block their access to funding. If the team is impeached, the HackerGold is returned to the backers, including the malicious competitor. The attack did not cost anything.
  5. That HKG invested is intended to represent popularity of the project, a project might just invest in themselves, becoming the most popular project, and therefore winning the $50,000. “The amount of HKG collected by an individual team is a de facto crowd expression of the potential of the project. As such, it provides a baseline for future crowdfunding by the team once the hackathon is over. The teams who collect the most HKG will have the largest acceptance by the crowd and will have the greatest potential.”

Du Rose’s warnings ultimately proved to be well-founded, as ether.camp was accused of rewarding the $50,000 prize money to a cheating team. Artchain, an Ethereum startup managing art assets on the blockchain, accused ether.camp of rewarding $50,000 to a cheating team after garnering sufficient information regarding transaction and the public voting. They arrived at this conclusion after investigating ether.camp’s public voting system.

Was ether.camp’s public voting system hacked?

The hackathon depended upon the public voting system using HackerGold. The idea was individuals could vote for their favorite hackathon startups. The value of one’s vote was increased by 10 to 20 times with a verified Twitter or Facebook account. Voters were also required to initiate an Ethereum wallet and submit a vote for their favorite startups using an Ethereum transaction for voting so that they would be required to pay gas.

Ether.camp administrators turned the gas on and off throughout the event. Whenever the gas switched off, as happened for the first time on December 22, 2016, votes became extremely difficult for the public. Why would event organizers make voting more difficult?

As the event went on, Coindash.io experienced a massive surge in unknown votes at a time when gas was switched off and voting was more difficult. “On 21.12.2016, Coindash.io claimed to be experiencing around 4,000 ‘unknown votes’ from bots in its favour which were then removed by the hack.ether.camp team, taking them from around 12,000 to 8,000 votes on the final evening of the competition,” alleged Artchain.

Adding to suspicions, Coindash.io received many fake votes in coordinated sequences, and the vote count began to spike as soon as the gas was switched off. Whereas for other startups at this point, the vote count decreased, for Coindash.io the vote count drastically increased.

“We allege the use of a bot which hijacks or manipulates real facebook accounts to vote simultaneously being piloted in the final stages of this competition by analysing nonverbal data to identify fraudulent voting practices,” Artchain stated. The mystery, however, and Coindash’s or ether.camp’s involvement, have never been solved.

Aside from hackathons, ether.camp worked on smart contracts for Ethereum and pure Java implementation of Ethereum protocol for live network and for enterprise environments. They hosted their community on Slack. The list of hackathon projects can be seen on Ether.camp’s GitHub page.