Hackathon challenge: Decentralized Reputation System

[HenrikJannsen]

Reputation Systems in Bisq: Challenges and Directions

Building a reputation system within Bisq—in the context of a decentralized system with a strong focus on privacy—is a particularly difficult challenge.

Core Challenges

Here is an incomplete list of the key problems:

• Lack of a single source of truth: In decentralized systems, there is no central authority to establish or verify the “truth” of a user’s reputation.
• Sybil resistance is hard without identity: In Bisq v2, users can freely create new identities with minimal cost (only a small proof-of-work requirement). Malicious actors can exploit this to generate fake identities and build mutual reputation networks.
• Tension between identity and privacy: The more data that is associated with an identity, the more metadata and contextual information is exposed—undermining user privacy.
• No central reputation verifier: Without a trusted authority, it's difficult to verify or consolidate reputation information in a privacy-preserving and decentralized way.

Existing Reputation Mechanisms in Bisq

Despite these challenges, Bisq has successfully developed several context-specific reputation systems:

• Account Age (Bisq 1): A simple time-based heuristic to build trust over time.
• Signed Account Age Witness (Bisq 1): Primarily used to prevent stolen bank account scams. It involves peers signing attestations of account age after having received Fiat funds.
• Reputation System in Bisq 2: Used in "Bisq Easy," it leverages mechanisms like burning or bonding BSQ and optionally incorporates prior reputation data from Bisq 1.

Relevance to Bisq 2 MuSig Protocol

In the upcoming Bisq 2 MuSig protocol, reputation plays a role in protecting against stolen bank account scams. One path forward is to port the Signed Account Age Witness system from Bisq 1. Another is to extend or evolve the current reputation system in Bisq 2. However, those options remains underexplored and requires more analysis.

A more flexible and robust reputation system could significantly strengthen the protocol and enhance the user experience in Bisq Easy. For the MuSig protocol it could allow to reduce the required amount for the security deposits if reputation can be added as security enhancement. Reputation can serve as more cost efficient security feature.

---

Ingredients for a Reputation System Design

Potential elements to consider when designing a privacy-preserving, decentralized reputation system include:

• Financial Cost: Reputation can be earned through burning BSQ or bonding funds over time. Proof-of-work can also be used but is generally too weak for high-security applications.
• Time as Proof of Patience: Scammers tend to avoid long-term investment. Time-based factors like account or bond age can signal commitment.
• Activity Proofs: Metrics like number of trades could indicate trustworthiness. However, verifying this without compromising privacy remains a challenge.
• Chained Proofs: Similar to the Signed Account Age Witness approach, these can incrementally build a verifiable reputation over time.
• Peer-based Verification: In trades, peers already know some private data (e.g., the trader’s real name in fiat trades). This context can be leveraged for verification without further exposing private information.
• Negative Reputation Only: Unlike positive feedback, which can be gamed via Sybil attacks, negative feedback (e.g., published from mediators or arbitrators) is harder to exploit. Since mediators are already involved and privy to trade issues, their input adds no privacy issues—but introduces questions around centralization and liability.
• External Identity Proofs: In some jurisdictions (e.g., EU countries), governments offer digital ID infrastructure. If such a system allows third parties to verify a user’s name without exposing trade activity, it could be leveraged for fiat trades where real names are already visible to the trade peer.

---

References

• [Payment Account Age Witness](https://bisq.wiki/Payment_account_age_witness)
• [Proposal #78: Account signing](Distributed reputation system proposals#78)
• [Proposal #27: Reputation system](Negative reputation tied to payment account proposals#27)
• [Proposal #93: Bisq Easy reputation model](Implementation of protection tools: strengthening Account Age by requiring payments from 2 Bank Accounts proposals#93)