Mechanism, theorem, attack
The Square Root Has Accomplices
Quadratic funding makes one hundred small donors outweigh one rich donor, then lets coordinated identities turn that same square-root bonus against the matching pool. Split $100, run the two-account attack, and apply the 2019 pairwise bound. Every monetary readout is recomputed in the page, and every assumption is stated.
A project supported by many people creates benefits that no single donor can capture. Quadratic funding tries to price that breadth. For contributions cᵢ, its uncapped funding weight is the square of a sum of square roots:
funding weight = (Σ√cᵢ)²
matching subsidy = funding weight − Σcᵢ
The square roots make small contributions unusually consequential when they come from distinct people. They do not, by themselves, establish that the people are distinct or uncoordinated.
Keep the money fixed. Multiply the people.
One hundred dollars goes to one project. The slider changes only how many equal contributions it is split into.
Each contributes
calculating
Donor principal
calculating
Funding weight
calculating
Matching subsidy
calculating
calculating from (Σ√cᵢ)²
Horizontal: donor count, 1 to 100. Vertical: funding weight, $0 to $10,000. Click, press Enter, or press Space to jump between the endpoints.
At one donor, a $100 contribution has $100 of funding weight and asks for no subsidy. At one hundred donors, each giving $1, the same donor principal has $10,000 of weight and asks the pool for $9,900. Breadth is the mechanism's information. The next run asks what happens when breadth is counterfeit.
The theorem's missing person
Buterin, Hitzig, and Weyl show that the rule reaches first-best public-goods provision in their standard model. That result is scoped to quasilinear utility, a complete-information Nash equilibrium, and participants who do not coordinate or multiply identities. Quasilinearity also abstracts from wealth effects, so one dollar is not a clean unit of care.
The coordination assumption is not an implementation footnote. It is the hinge. Let two controlled accounts contribute W each to a fake project. Their principal is 2W. Their funding weight is (√W + √W)² = 4W. The difference is a matching subsidy of 2W.
Turn the collusion dial
The contribution control is logarithmic, from $1 to $1,000,000 per account. Raw subsidy demand grows without bound in the ideal rule. The finite-pool readout normalizes that demand against the labelled demand from all other projects.
Attacker principal
calculating
Raw subsidy demand
calculating
Normalized attack payout
calculating
Normalized pool share
calculating from (2√W)² − 2W
Both axes are logarithmic. The red line is standard subsidy, 2W. The mint line is the pairwise proposal. The gold line marks the selected finite pool. Activate the plot to flip the patch.
No finite ceiling
Double W and the standard subsidy doubles. In the displayed two-bucket allocation, the attack competes with other projects' raw demand H and receives pool × 2W/(2W+H). Gitcoin describes this normalization across all projects. Round-specific caps and adjustments can change a deployed payout.
Keep principal fixed
Split a fixed C across n identities. Total funding weight is nC; matching subsidy is (n−1)C. The distinction keeps the attacker's returned principal out of the subsidy count.
One purse, many names
This idealized run assumes every identity is accepted as distinct. It is an algebraic vulnerability, not a simulation of a deployed identity system.
Each identity gives
calculating
Total funding weight
calculating
Includes the returned principal C.
Matching subsidy
calculating
Excludes the attacker's principal.
calculating from (n√(C/n))²
A cap made from suspicion
In June 2019, Vitalik Buterin proposed weighting each donor pair by how much their giving overlaps across projects. For accounts i and j, with pairwise bound M:
overlapᵢⱼ = Σₚ √cᵢ→ₚ √cⱼ→ₚ
κᵢⱼ = M / (M + overlapᵢⱼ)
pair subsidy = 2κᵢⱼ√cᵢ→ₚ√cⱼ→ₚ
For the same two accounts giving W to one project, overlap is W. Their subsidy becomes 2MW/(M+W). It rises with W, but never reaches 2M. The patch does not identify colluders. It discounts pairs whose contribution histories look coordinated, which can include legitimate communities.
Make coordination expensive to imitate
The W value comes from Run 1. Switch the coefficient on, choose M, and add colluders. The number of unordered pairs is k(k−1)/2.
Change W in Run 1, or activate either plot to toggle the patch.
Pair coefficient κ
calculating
Subsidy per pair
calculating
standard rule
k-colluder subsidy
calculating
Pairwise group ceiling
calculating
k(k−1)M, approached but never reached.
calculating pairwise overlap
The standard rule rewards every cross-term 2√cᵢ√cⱼ. The optimality theorem reads those terms as benefits one donor creates for another. The attack reads the same terms as transfers coordinated accounts can manufacture. Nothing in the algebra changes. Only the account relationship does.
The check
All green-panel values below are recomputed from the current controls. The page and the dependency-free Node verifier use separate implementations of the same equations.
Sourced rule and bounds
The quadratic funding rule and scoped first-best result come from Buterin, Hitzig, and Weyl (2019). The coordination attack, pair coefficient, per-pair limit, and group bound come from Buterin's June 2019 proposal.
Direct algebra
Funding weight, subsidy, overlap, coefficient, normalized finite-pool allocation, and group total are direct outputs of the displayed equations. No empirical estimate enters them.
Diagnostic inference
Overlap is evidence of coordination, not proof. A legitimate community can share contribution patterns; colluders can diversify theirs. The instrument does not classify people.
Free choices and model inputs
You choose W, pool size, competing demand H, n, C, M, and k. Equal contributions, one fake project, accepted identities, and aggregating every other project into H are modelling choices.
- The standard-model welfare result assumes quasilinear utility, no coordination or sybils, and complete-information Nash equilibrium. It is not an unqualified claim of optimality.
- A dollar conflates preference with ability to pay. This page does not call funding weight a democratic vote or a measurement of care.
- The raw standard subsidy is mathematically unbounded in W. The normalized finite-pool payout is pool × 2W/(2W+H), so it depends on the other projects' displayed raw demand and remains below the pool.
- The pairwise model sums overlap over one displayed project. A deployed system would use the full contribution graph and additional identity or clustering signals.
- Pairwise bounding caps the shown attack but does not eliminate collusion. Current Gitcoin rounds use Connection-Oriented Cluster Matching with Passport-based detection, not this exact 2019 formula.
Offline check: node research/quadratic-funding/verify-quadratic-funding.mjs
What the first-best theorem does and does not say
The theorem asks whether decentralized contributions can reveal marginal values and fund public goods efficiently under its standard model. It does not prove that identities are unique, coordination is absent, utilities are quasilinear in real populations, or a finite sponsor pool can pay the uncapped deficit. Those are not clerical details. They define the domain in which the welfare result applies.
The matching deficit also grows as society grows, which motivates capital-constrained variants. This page isolates the uncapped rule because its breadth bonus and coordination attack are clearest there, then shows a finite pool normalized between the attack's raw demand and the displayed aggregate demand from other projects.
What production systems changed
The 2019 pairwise coefficient is the canonical first patch studied here. Gitcoin's recent rounds use a descendant, Connection-Oriented Cluster Matching, alongside Passport model-based detection. COCM discounts support from donors who look closely connected and rewards support that crosses clusters. Gitcoin's own mechanism page says these adjustments mitigate but do not eliminate sybil and collusion risk. This instrument does not simulate COCM and makes no claim about a particular round's allocation.