How Sybil-resistant is this, really?
Every claim Netizen Labs makes, a fair vote, a fair dividend, a currency only real people can mint, rests on one assumption: that one human cannot quietly become two. So the fair question is not whether we talk about Sybil resistance. It is how good ours actually is. Here is our own report card, graded honestly.
The framing that matters most
Röbel has two layers people call Sybil resistance: the citizen verification system, and the Röbel Münzen mint gate. It is tempting to present them as two independent walls. They are not. Layer one is the only real source of uniqueness. Layer two enforces it and contains the damage, but it does not add a second, independent check. Keep that in mind through the grades, because it is the whole story.
Layer one: citizen verification
A resident becomes a citizen through a soulbound credential that existing members must vouch for. The latest hardening, now live on Gnosis, made the vouching thresholds scale with the town and put a two-thirds attester supermajority in front of revocation, so no clique can remove someone against their will, while leaving of your own accord stays free. No documents, nothing to buy, nothing to transfer.
- Human recognition at town scale: members vouch for someone they actually know, so a duplicate gets noticed
- Soulbound, non-transferable, unbuyable, so there is no market for identities
- Document-free, so there is no honeypot of personal data to leak
- Auto-scaling thresholds in v2: admitting a citizen needs a band of attesters, at least two today, plus a separate citizen, and the bar grows with the town instead of staying at two people
- Anti-clique revocation: removing a citizen against their will takes a 67% attester supermajority, while leaving on your own stays free, so no small group can either trap or strip anyone
- No-double-sign: a wallet that is both attester and citizen cannot satisfy both halves of a request alone
- No cryptographic uniqueness yet: nothing technical stops one person using two separate wallets across two attester groups
- It still rests on attester honesty: the collusion bar is higher now, a band rather than two people, but it is still a social bar
- The social root does not scale past the people who can actually recognise a duplicate, even though the thresholds do
- A trusted founding set and a governed gate, so it is not permissionless
The verdict on layer one is that its strength is still, at root, social. Among people who would recognise a duplicate it is close to perfect, and the new thresholds mean a colluding pair is no longer enough to admit a fake or evict a real citizen. But once you leave the circle of people who would notice, it rests on the honesty of a colluding band of attesters, a higher bar than before and still a social one, with no math underneath to catch what they miss.
Layer two: the Röbel Münzen mint gate
Röbel Münzen are a Circles group currency. Only wallets the group trusts can mint, and the group only trusts CitizenNFT holders, now enforced both by an off-chain invite bot and an on-chain membership condition.
- Closes the biggest hole in Circles by binding minting to verified humans
- Enforced on-chain: even if the off-chain bot key leaks, the contract still refuses non-citizens
- Caps the blast radius: demurrage and the balance equilibrium bound what any single identity can extract
- Public and auditable: the gate and the trust graph live onchain
- Not independent Sybil resistance: it inherits layer one, so beating layer one beats it too
- Shared root of trust: compromise the attesters and both layers fall together
- The cost per identity is near-free, self-minted collateral, friction rather than real cost
- A new smart-contract surface: the membership condition is now a correctness dependency
Layer two is excellent at the job it actually does, which is making sure that only citizens mint and that a breach stays small. It is weak at the job people assume it does, which is being a second, separate proof that you are a unique human. It is not that. It is a faithful enforcer of layer one.
The honest verdict
- Defense-in-depth against operators: a leaked service key still cannot mint to a non-citizen, because the on-chain condition backstops the off-chain bot
- Hardened, auto-scaling thresholds: admitting a fake needs a colluding band plus a separate citizen, and revocation needs a two-thirds supermajority, so no two people can admit or evict anyone
- Bounded damage: demurrage and the balance equilibrium cap what any breach can ever extract
- Closes the Circles Sybil hole: the money is bound to verified humans, and the gate is public and auditable
- Privacy-preserving: no documents are collected, and the v2 contract already reserves a no-PII path to cryptographic personhood
- One root of trust: both layers still rest on the same attester set, so a large enough collusion defeats both
- No cryptographic uniqueness yet: one person with two wallets is the open gap until the personhood proof ships
- Layer two adds enforcement, not a second independent check, so it does not raise the uniqueness ceiling
- Strong for a town, not yet proven where faces are not known
What we have is one strong source of uniqueness (social vouching at town scale), wrapped in a robust enforcement-and-containment layer that binds the money to it and limits any breach. That is genuinely good, and it is more than almost any community currency has. It is real defense-in-depth against an operator or a leaked key.
The single thing to be clear-eyed about: it is not defense-in-depth against Sybil itself. Both layers still rest on the same attester set, so a large enough collusion, harder to assemble after the hardening but not impossible, defeats both at once. We would rather write that sentence ourselves than have someone discover it.
Hardening is a ladder, not a switch
The v2 contracts also added a rung that is easy to overlook: a credential carries a validity that lapses if a citizen goes entirely silent, so abandoned and burner identities quietly fall dormant instead of padding the rolls forever. Renewal is cheap, a vote or any real activity re-arms it, so the only thing it prunes is ghosts. It does not stop a fake getting in, it keeps the count of who is real honest over time.
Above that sit cheaper rungs we can climb with no new trust assumption. Assigning attesters to a request at random, rather than letting a pair self-select, means a colluder cannot guarantee they are the one asked to sign. Asking attesters to post a small bond that a justified revocation slashes puts real skin behind a vouch. And because the whole trust graph is public, off-chain analytics can flag suspicious clusters for human review without changing anything on-chain. None of these is a silver bullet; together they raise the cost of gaming the social layer, step by step.
The rung that changes the game
The genuine second layer, the one that is independent of the social graph, is already reserved in the contracts. A citizen will be able to scan a passport's chip and produce a zero-knowledge proof of personhood, through the Self protocol, that mints exactly one credential per real document and reveals no name, photo, or number. Same person, same nullifier, so one human can hold one citizenship with no attester vouching at all. The v2 credential already records which path admitted you, so adding it is a setter and a function, not another migration. That is the orthogonal wall: social vouching and cryptographic uniqueness, where an attacker has to beat both.
Until that lands, the honest grade stands: strong for a town, not yet strong for the world. Which is exactly the right place for a system that is being proven in one town first.