Two colluding accounts (or one attacker with two identities) can file near-identical fixes under different linked issues and both merge — double reward for one piece of work.
- Copycat detection is off by default:
shouldCollectCopycatEvidence gates on copycatGateMode !== "off" (src/queue/copycat-detection.ts ~14-16), and even when on it compares a bounded MAX_COPYCAT_CANDIDATES = 25.
- Duplicate-winner election keys on linked-issue overlap (
src/queue/duplicate-detection.ts), so simply linking a different issue evades the "duplicate of open PR #X" close.
Since merged PRs earn Gittensor rewards, this is a direct economic leak rather than a hygiene issue.
Fix
Enable cross-issue content-similarity dedupe by default for reward-eligible repos, and raise/paginate the candidate bound. Diff-hash similarity would catch the trivial case cheaply.
Related: https://github.com/JSONbored/loopover/security/advisories/GHSA-5w8q-r748-9j9c (re-roll), #9016.
Two colluding accounts (or one attacker with two identities) can file near-identical fixes under different linked issues and both merge — double reward for one piece of work.
shouldCollectCopycatEvidencegates oncopycatGateMode !== "off"(src/queue/copycat-detection.ts~14-16), and even when on it compares a boundedMAX_COPYCAT_CANDIDATES = 25.src/queue/duplicate-detection.ts), so simply linking a different issue evades the "duplicate of open PR #X" close.Since merged PRs earn Gittensor rewards, this is a direct economic leak rather than a hygiene issue.
Fix
Enable cross-issue content-similarity dedupe by default for reward-eligible repos, and raise/paginate the candidate bound. Diff-hash similarity would catch the trivial case cheaply.
Related: https://github.com/JSONbored/loopover/security/advisories/GHSA-5w8q-r748-9j9c (re-roll), #9016.