Why Proof-of-Personhood Will Fail in Its Current Form

Every major PoP system relies on a trusted third party—be it a biometric device, a centralized validator set, or a KYC provider. This reintroduces the single point of failure and censorship that decentralized identity aims to eliminate.

• Worldcoin's Orb is a proprietary hardware oracle.
• BrightID's social graph depends on trusted community verifiers.
• This creates a regulatory honeypot and undermines credible neutrality.

Systems demand either excessive personal data (biometrics) or pseudo-anonymous data (social graphs), creating unacceptable risks. Leaked biometric hashes are irrevocable; social graphs are linkable and gameable.

• Biometric hashes are permanent identifiers, not revocable keys.
• Social recovery graphs from projects like Idena expose network topology.
• This forces users to choose between privacy and participation, a fatal UX flaw.

To prevent Sybil attacks, PoP protocols must make identity scarce and expensive to acquire, which directly conflicts with the goal of universal, permissionless access. This creates a trilemma.

• High cost/latency (Orb scans, test-taking) limits global adoption.
• Easy acquisition (social vouching) invites Sybil farms.
• The result is either a permissioned club or a compromised network—neither scales to billions.

Most PoP (e.g., Worldcoin, Gitcoin Passport) relies on a handful of trusted validators or biometric devices. This creates a single point of failure and censorship, directly contradicting crypto's decentralization ethos.

• Attack Vector: Compromise the oracle, compromise the network.
• Regulatory Risk: A government can shut down the validator set.
• Example: Worldcoin's Orbs represent a physical and logistical bottleneck.

A one-time verification proves you're human once, not that you're a unique, active participant now. This fails for dynamic systems like governance or UBI.

• Sybil Farm: Acquire credentials, then sell or rent them.
• Zero Ongoing Cost: A Sybil identity, once created, has ~$0 marginal cost to operate.
• Real Consequence: Airdrop farming and governance attacks become trivial post-verification.

To be robust, PoP demands invasive data (biometrics, social graphs). To be adopted, it must promise privacy. These goals are in direct conflict, leading to catastrophic leaks or useless verification.

• Data Breach Risk: Biometric data is irrevocable. A leak is permanent.
• Privacy-Preserving Tech Gap: Current ZK-proofs for biometrics are computationally heavy and not user-proven.
• Result: Systems are either dangerously centralized data silos or too weak to be useful.

True Sybil resistance isn't about identity; it's about making attacks economically irrational. Current PoP ignores stake, reputation, and ongoing cost—the core mechanics of Proof-of-Stake and bonding curves.

• Comparison: PoS imposes a direct, slashable financial cost. PoP imposes a one-time bureaucratic hurdle.
• Vitalik's Vision: Even Ethereum's founder advocates for proof-of-personhood + stake hybrids.
• Failure Mode: Without skin in the game, verified identities have no incentive to act honestly.

Global, permissionless systems require global, permissionless access. Physical verification (Orbs, notaries) or social graph checks (Twitter, GitHub) exclude billions and cannot scale.

• Scalability Limit: ~5 seconds per person for biometric scan vs. ~500ms for a cryptographic proof.
• Geographic Bias: Creates a digital caste system based on location and document access.
• Adoption Ceiling: Inaccessible systems will never achieve the network effects required for universal legitimacy.

Corporations and DAOs are legally recognized 'persons'. A robust PoP system must exclude them, but a naive one may not, allowing Sybil attacks at institutional scale.

• Regulatory Reality: A Wyoming DAO LLC can pass many 'personhood' checks.
• Automation: Legal persons can automate credential creation far more efficiently than humans.
• Consequence: The system is gamed not by individuals, but by funded, legally-shielded entities.

You cannot have a truly Sybil-resistant system without a global, centralized identity provider. Projects like Worldcoin (orb biometrics) and Idena (proof-of-personhood puzzles) sacrifice privacy for verification, creating honeypots of sensitive data. The fundamental trade-off is immutable: strong Sybil resistance requires a trusted third party, which defeats the purpose of decentralized networks.

• Centralized Honeypot: Biometric or social graph data becomes a single point of attack.
• Privacy Erosion: Zero-knowledge proofs (like those used by zkEmail) can mask data but not the initial centralized verification event.
• Regulatory Target: Centralized validators (e.g., Worldcoin's Orb operators) are obvious targets for KYC/AML enforcement.

Real-time, global uniqueness checks are prohibitively expensive and slow on-chain. Services like BrightID or Gitcoin Passport rely on off-chain social graphs and attestations, creating verification latency of hours to days. This fails for real-time applications like governance or airdrop claims, forcing protocols to use stale data or centralized oracles.

• On-Chain Impossibility: Storing and checking a global registry on L1 Ethereum costs >$1M/year for 1M users.
• Verification Lag: Stale attestations allow for Sybil attacks between verification cycles.
• Oracle Dependence: Final Sybil-resistance often depends on a single trusted oracle (e.g., a DAO multisig) signing a merkle root, reintroducing centralization.

PoP systems incentivize the creation of sophisticated Sybil farms, not real user adoption. Attackers are funded by the value of the governance token or airdrop being protected. As seen with Optimism's airdrop, even advanced clustering heuristics fail against determined, well-funded adversaries. The cost of attack scales linearly, while the cost of defense scales exponentially.

• Asymmetric Warfare: A $10M airdrop funds a $2M Sybil attack, yielding an 80% profit margin.
• Heuristic Failure: Social graph analysis and behavior clustering are easily gamed by farms using unique IPs/VPNs and scripted behavior.
• Value Correlation: The security of the PoP system is directly pegged to the value it protects, creating a perpetual cat-and-mouse game.

The viable alternative is to abandon the quest for perfect, one-time uniqueness. Instead, build reputation graphs from persistent, costly-to-fake on-chain and off-chain actions. Systems like EigenLayer's Intersubjective Foraging or Farcaster's social capital measure contribution over time. Sybilling becomes unprofitable when the cost of building reputation exceeds the value of a single attack.

• Costly Signals: Require consistent staking, content creation, or protocol usage over months.
• Intersubjective Security: Leverage the network to identify and slash fraudulent reputation, as proposed by EigenLayer.
• Modular Design: Decouple reputation from a single universal ID; let each dApp weight signals (e.g., Gitcoin Passport stamps) according to its own risk model.