Mechanism, theorem, attack

The Square Root Has Accomplices

Quadratic funding makes one hundred small donors outweigh one rich donor, then lets coordinated identities turn that same square-root bonus against the matching pool. Split $100, run the two-account attack, and apply the 2019 pairwise bound. Every monetary readout is recomputed in the page, and every assumption is stated.

A project supported by many people creates benefits that no single donor can capture. Quadratic funding tries to price that breadth. For contributions cᵢ, its uncapped funding weight is the square of a sum of square roots:

funding weight = (Σ√cᵢ)²
matching subsidy = funding weight − Σcᵢ

The square roots make small contributions unusually consequential when they come from distinct people. They do not, by themselves, establish that the people are distinct or uncoordinated.

Run 0: the promise

Keep the money fixed. Multiply the people.

One hundred dollars goes to one project. The slider changes only how many equal contributions it is split into.

Each contributes

calculating

Donor principal

calculating

Funding weight

calculating

Matching subsidy

calculating

calculating from (Σ√cᵢ)²

Horizontal: donor count, 1 to 100. Vertical: funding weight, $0 to $10,000. Click, press Enter, or press Space to jump between the endpoints.

At one donor, a $100 contribution has $100 of funding weight and asks for no subsidy. At one hundred donors, each giving $1, the same donor principal has $10,000 of weight and asks the pool for $9,900. Breadth is the mechanism's information. The next run asks what happens when breadth is counterfeit.

The theorem's missing person

Buterin, Hitzig, and Weyl show that the rule reaches first-best public-goods provision in their standard model. That result is scoped to quasilinear utility, a complete-information Nash equilibrium, and participants who do not coordinate or multiply identities. Quasilinearity also abstracts from wealth effects, so one dollar is not a clean unit of care.

The coordination assumption is not an implementation footnote. It is the hinge. Let two controlled accounts contribute W each to a fake project. Their principal is 2W. Their funding weight is (√W + √W)² = 4W. The difference is a matching subsidy of 2W.

Run 1: identical accounts, identical project

Turn the collusion dial

The contribution control is logarithmic, from $1 to $1,000,000 per account. Raw subsidy demand grows without bound in the ideal rule. The finite-pool readout normalizes that demand against the labelled demand from all other projects.

Attacker principal

calculating

Raw subsidy demand

calculating

Normalized attack payout

calculating

Normalized pool share

calculating

calculating from (2√W)² − 2W

Both axes are logarithmic. The red line is standard subsidy, 2W. The mint line is the pairwise proposal. The gold line marks the selected finite pool. Activate the plot to flip the patch.

Two colluders

No finite ceiling

Double W and the standard subsidy doubles. In the displayed two-bucket allocation, the attack competes with other projects' raw demand H and receives pool × 2W/(2W+H). Gitcoin describes this normalization across all projects. Round-specific caps and adjustments can change a deployed payout.

Many identities

Keep principal fixed

Split a fixed C across n identities. Total funding weight is nC; matching subsidy is (n−1)C. The distinction keeps the attacker's returned principal out of the subsidy count.

The fixed-pot identity split

One purse, many names

This idealized run assumes every identity is accepted as distinct. It is an algebraic vulnerability, not a simulation of a deployed identity system.

Each identity gives

calculating

Total funding weight

calculating

Includes the returned principal C.

Matching subsidy

calculating

Excludes the attacker's principal.

calculating from (n√(C/n))²

A cap made from suspicion

In June 2019, Vitalik Buterin proposed weighting each donor pair by how much their giving overlaps across projects. For accounts i and j, with pairwise bound M:

overlapᵢⱼ = Σₚ √cᵢ→ₚ √cⱼ→ₚ
κᵢⱼ = M / (M + overlapᵢⱼ)
pair subsidy = 2κᵢⱼ√cᵢ→ₚ√cⱼ→ₚ

For the same two accounts giving W to one project, overlap is W. Their subsidy becomes 2MW/(M+W). It rises with W, but never reaches 2M. The patch does not identify colluders. It discounts pairs whose contribution histories look coordinated, which can include legitimate communities.

Run 2: the identical attack, bounded

Make coordination expensive to imitate

The W value comes from Run 1. Switch the coefficient on, choose M, and add colluders. The number of unordered pairs is k(k−1)/2.

Change W in Run 1, or activate either plot to toggle the patch.

Pair coefficient κ

calculating

Subsidy per pair

calculating

standard rule

k-colluder subsidy

calculating

Pairwise group ceiling

calculating

k(k−1)M, approached but never reached.

calculating pairwise overlap

The standard rule rewards every cross-term 2√cᵢ√cⱼ. The optimality theorem reads those terms as benefits one donor creates for another. The attack reads the same terms as transfers coordinated accounts can manufacture. Nothing in the algebra changes. Only the account relationship does.

The check

All green-panel values below are recomputed from the current controls. The page and the dependency-free Node verifier use separate implementations of the same equations.

calculating base run
calculating attack run
calculating pairwise run

Sourced rule and bounds

The quadratic funding rule and scoped first-best result come from Buterin, Hitzig, and Weyl (2019). The coordination attack, pair coefficient, per-pair limit, and group bound come from Buterin's June 2019 proposal.

Direct algebra

Funding weight, subsidy, overlap, coefficient, normalized finite-pool allocation, and group total are direct outputs of the displayed equations. No empirical estimate enters them.

Diagnostic inference

Overlap is evidence of coordination, not proof. A legitimate community can share contribution patterns; colluders can diversify theirs. The instrument does not classify people.

Free choices and model inputs

You choose W, pool size, competing demand H, n, C, M, and k. Equal contributions, one fake project, accepted identities, and aggregating every other project into H are modelling choices.

Offline check: node research/quadratic-funding/verify-quadratic-funding.mjs

What the first-best theorem does and does not say

The theorem asks whether decentralized contributions can reveal marginal values and fund public goods efficiently under its standard model. It does not prove that identities are unique, coordination is absent, utilities are quasilinear in real populations, or a finite sponsor pool can pay the uncapped deficit. Those are not clerical details. They define the domain in which the welfare result applies.

The matching deficit also grows as society grows, which motivates capital-constrained variants. This page isolates the uncapped rule because its breadth bonus and coordination attack are clearest there, then shows a finite pool normalized between the attack's raw demand and the displayed aggregate demand from other projects.

What production systems changed

The 2019 pairwise coefficient is the canonical first patch studied here. Gitcoin's recent rounds use a descendant, Connection-Oriented Cluster Matching, alongside Passport model-based detection. COCM discounts support from donors who look closely connected and rewards support that crosses clusters. Gitcoin's own mechanism page says these adjustments mitigate but do not eliminate sybil and collusion risk. This instrument does not simulate COCM and makes no claim about a particular round's allocation.