Data indicates that 6 EOS Block Producers are really just one team https://cointelegraph.com/news/eos-block-producer-claims-centralized-misconduct-on-the-network via @cointelegraph

This is a simple Sybil attack. And the whole episode shows three serious failures.

First, EOS relies on human processes for sybil control, in contrast with Bitcoin's electricity consuming POW or the PoS solutions used by recent chains. Human processes are inherently fragile. Their recovery will also involve much human bickering and fighting.

Second, EOS has only 21, far too few, block producers (BPs), which makes attacks like this devastating. Compromising a third (that is 7 of 21) of the BPs/miners can cause security violations for most blockchains, and is not to be taken lightly. This attack came close.

Finally, EOS relies on a relatively tiny number of BPs. 21 is a pretty small, and therefore a pretty vulnerable, number.

To put centralization in EOS in perspective:

21 is a tiny number, but all blockchains based on Classical and Nakamoto protocols suffer from such small numbers. There isn't a single existing system that can handle more than 100 active participants.

That's why you see blockchain designs where there are large pools of validators, and there are constructs like "random beacons" and "committee subselection." It's because older protocols do not scale well in the number of active participants and need to create small groups.

There is only one protocol family that does scale well in the number of active participants, and that's the recently unveiled Avalanche protocol. It can support thousands to millions of actively participating validators, without committee subselection.

Protocols where an existing small group of validators vote to select entrants into that tiny group are subject to cabal formation. The rewards that go solely to those nodes provide an incentive for the group to turn into an exclusive club.

And not surprisingly, people will game the system by pretending to be N different people. That's what we allegedly saw here.

Overall, episodes like this remind us all why protocol design is **absolutely essential**. People will, and constantly do, try to game vulnerabilitirs in system design. The protocols used are not all the same, and some are inherently more centralized and less secure than others.

The entire episode was uncovered simply through the attacker using the same address in multiple DNS registrations. The next attacker will not be as naive. https://twitter.com/eosnewyork/status/1199813240307568641?s=19