Flow

x402

mirror

Read

<div class="light-yellow-block">
 <h2 id="strong-key-takeaways-strong"><strong>Key Takeaways</strong></h2>
 <ul>
  <li><strong>Anduin ranks sellers by shared payment history.</strong></li>
  <li><strong>Manipulation cost rose roughly 23-fold in tests.</strong></li>
  <li><strong>$8,259 fools 813 buyers; $291 fools one.</strong></li>
  <li><strong>Still experimental, and silent on service quality.</strong></li>
 </ul>
</div>
<p>In a <a href="https://www.circle.com/blog/sybil-resistance-in-reputations-for-agentic-marketplaces" rel="noopener noreferrer nofollow">November 13 research post</a>, Circle describes Anduin, an experimental ranking system that scores providers by who has already paid them, and by whether those payers overlap with the buyer’s own. The design goal is narrow and specific: force anyone trying to fake a provider’s popularity to spend money on businesses they do not own.</p>
<h2 id="fake-customers-cost-almost-nothing-to-make">Fake customers cost almost nothing to make</h2>
<p>A Sybil attack is one operator posing as many participants. In an agent marketplace that means spinning up buyer wallets and paying your own service from each of them, so a storefront that has never served a real customer looks busy. The transfers are real on-chain, but the money never leaves the operator’s hands; network fees are the only thing actually spent.</p>
<p>The accompanying <a href="https://arxiv.org/abs/2611.05586" rel="noopener noreferrer nofollow">research paper</a> puts a figure on how cheap this is: pushing a fake provider’s reputation up to the marketplace median costs about $0.0027 under the usage-based metrics marketplaces rely on today. Reviews are not a fallback. Across the 66 million payments the researchers examined, fewer than 4,000 carried a voluntary on-chain rating.</p>
<p>Those payments move over the <a href="https://docs.x402.org/introduction" rel="noopener noreferrer nofollow">x402 standard</a>, which lets a service return its price in an HTTP 402 response and lets software settle it inside the request, with no account or checkout step. That is what makes agent-to-service purchasing work, and also what makes a crowded storefront so easy to fabricate. Coindoo has looked separately at <a href="https://coindoo.com/crypto-is-powering-automated-payments-but-is-it-real-ai-spending/" rel="noopener noreferrer nofollow">what an x402 payment does and does not reveal</a> about who is behind it.</p>
<h2 id="how-anduin-turns-payments-into-a-price">How Anduin turns payments into a price</h2>
<p>The researchers model every buyer and provider as a node in a graph, with payments as the links between them, weighted by how much was paid, how often and how recently. A standard recommender, collaborative filtering, works on that graph by finding buyers who look like you and suggesting what they bought. It has no way to tell a cluster of real customers from a cluster of wallets funded by the seller; both look like demand.</p>
<p>Anduin reads the same graph differently. It starts from the providers a buyer already pays and treats those as the buyer’s trusted anchors. Say an agent regularly pays a translation service. Other buyers also pay that translator, and some of them pay a data provider the agent has never used. The data provider earns a recommendation through that path, and the strength of the recommendation is bounded by the real money flowing along it.</p>
<p>That bound is the whole point. Payments between wallets the attacker controls never touch one of the buyer’s trusted providers, so they contribute nothing to the path. To manufacture a connection, the attacker has to pay the translator, a business it does not own, and cannot get that money back. The paper formalises this with three flow-based scoring variants and proves a lower bound on attacker spending for each; the one Circle highlights is called Amplified Flow. The question that follows is how large that lower bound turns out to be on real data.</p>
<h2 id="8-259-to-fool-everyone-291-to-fool-the-buyer-that-matters">$8,259 to fool everyone, $291 to fool the buyer that matters</h2>
<p>The researchers took a 90-day window of x402 payments ending June 21 and found 813 buyers who went on to pay a provider they had never used before. Each method was asked to rank providers for those buyers in advance; a hit meant the provider they actually chose next was ranked first. The attack test then asked how much an outsider would have to spend to put a new provider in first place instead. The full dataset behind the study runs to 66.1 million payments worth about $6.1 million across 16 networks, collected between March 23 and August 26.</p>
<div style="margin: 20px 0; border: 1px solid #c9d3dc; border-radius: 10px; overflow: hidden;">
 <table style="width: 100%; border-collapse: collapse; font-size: 14px; line-height: 1.5; color: #1b2a36; background: #ffffff;">
  <caption style="padding: 12px 14px; text-align: left; font-weight: bold; color: #ffffff; background: #1f3a4d;">
   Ranking manipulation cost, collaborative filtering vs Anduin
  </caption>
  <thead>
   <tr style="background: #e9eff4; color: #1b2a36;">
    <th style="padding: 10px 12px; text-align: left; border-bottom: 1px solid #c9d3dc;" scope="col">Measure</th>
    <th style="padding: 10px 12px; text-align: right; border-bottom: 1px solid #c9d3dc;" scope="col">Collaborative filtering</th>
    <th style="padding: 10px 12px; text-align: right; border-bottom: 1px solid #c9d3dc;" scope="col">Anduin Amplified Flow</th>
   </tr>
  </thead>
  <tbody>
   <tr style="background: #ffffff; color: #1b2a36;">
    <th style="padding: 10px 12px; text-align: left; font-weight: 400; border-bottom: 1px solid #e3e9ee;" scope="row">Cost to rank first for all 813 buyers</th>
    <td style="padding: 10px 12px; text-align: right; border-bottom: 1px solid #e3e9ee;">$358</td>
    <td style="padding: 10px 12px; text-align: right; border-bottom: 1px solid #e3e9ee; font-weight: bold;">$8,259</td>
   </tr>
   <tr style="background: #f5f8fa; color: #1b2a36;">
    <th style="padding: 10px 12px; text-align: left; font-weight: 400; border-bottom: 1px solid #e3e9ee;" scope="row">Cost to rank first for the top-spending buyer only</th>
    <td style="padding: 10px 12px; text-align: right; border-bottom: 1px solid #e3e9ee;">$1.86</td>
    <td style="padding: 10px 12px; text-align: right; border-bottom: 1px solid #e3e9ee; font-weight: bold;">$291</td>
   </tr>
   <tr style="background: #ffffff; color: #1b2a36;">
    <th style="padding: 10px 12px; text-align: left; font-weight: 400;" scope="row">Buyer’s actual next provider ranked first</th>
    <td style="padding: 10px 12px; text-align: right;">23.2%</td>
    <td style="padding: 10px 12px; text-align: right;">22.8%</td>
   </tr>
  </tbody>
 </table>
 <p style="margin: 0; padding: 10px 14px; font-size: 13px; line-height: 1.5; color: #1b2a36; background: #e9eff4; border-top: 1px solid #c9d3dc;"><em>Source: Circle Research, Anduin paper. Costs are modelled attacker spending with network fees included, not recorded losses.</em></p>
</div>
<p>Read across the first row and the trade-off is clear: Anduin gave up 0.4 percentage points of prediction accuracy and made the attack roughly 23 times more expensive. Read down the second column and the picture is less comfortable. Topping the ranking for every buyer at once costs thousands; topping it for a single high-value buyer costs a few hundred dollars. For a dishonest seller, the second number is the one that matters, because one well-chosen buyer is the realistic target.</p>
<p>Whether $291 deters anyone depends on what that buyer is worth to the attacker, and the paper does not estimate that side of the ledger. Its figures are the cost of moving a ranking. They say nothing about the revenue a fake provider could extract once it gets there, so the deterrent is a condition rather than a result: the scheme works where the reward stays below the price, and Circle’s data cannot yet show where that line falls.</p>
<h2 id="where-the-price-stops-holding">Where the price stops holding</h2>
<p>The lower bound rests on one assumption: money paid to a buyer’s existing providers is gone for good. Circle states that colluding providers, and providers that quietly refund the attacker, fall outside Anduin’s guarantee. If the translator in the example above is willing to take a cut and send the rest back, the attacker’s real cost collapses to the fee, and the ranking is no harder to buy than before. Anduin assumes the attacker controls none of the providers the buyer already uses; in an open market, that is a condition to verify, not a given.</p>
<p>The second gap is the empty graph. A buyer with no payment history has no trusted anchors, so there are no paths to follow and nothing to rank. Circle points to curated allow-lists as the starting point, while the paper itself notes that registries of vetted providers scale poorly once the volume of services outruns what human reviewers can audit. New providers face the mirror problem: until some buyer in the network has paid them, there is no path through which they can appear in anyone’s personalised ranking.</p>
<div class="read-more pb-3 pt-3 pt-md-2 px-3 my-4 border bg-light">
 <h5 class="text-uppercase border-bottom mb-3 pb-1 d-none d-md-block">READ MORE:</h5><a href="https://coindoo.com/police-get-help-turning-crypto-traces-into-freeze-requests/" rel="noopener noreferrer nofollow">
  <div class="contentRight col-4"><span><img src="https://coindoo.com/wp-content/uploads/2025/11/crime-police-20139.jpg"></span>
  </div>
  <div class="contentLeft col-8">
   <h4 class="title mb-0">Police Get Help Turning Crypto Traces Into Freeze Requests</h4>
  </div></a>
</div>
<h2 id="a-ranking-is-not-a-review">A ranking is not a review</h2>
<p>Even inside its assumptions, the experiment measures something narrower than trustworthiness. It scores a method as correct when the provider it ranked first is the one the buyer paid next. That is a test of whether the ranking matches purchasing behaviour, and buyers routinely pay for data that turns out to be wrong, translations that are unusable and reports that never arrive. Each of those payments would still count as a hit.</p>
<p>“Previously paid” is not “independently reviewed,” and a strong Anduin score verifies neither the identity behind a provider nor the output it returns. The same gap Coindoo described between <a href="https://coindoo.com/ai-agents-can-receive-crypto-without-earning-revenue/" rel="noopener noreferrer nofollow">wallet inflows and customer revenue</a> applies here: the chain records the transfer precisely and leaves its commercial meaning open.</p>
<p>In practice that puts payment-based reputation alongside two other controls rather than above them. Spending permissions cap how much an agent may pay. Rankings like Anduin narrow where it should look. Checking the delivered result is the only step that answers whether the purchase did its job, and a graph that is harder to game does not remove it.</p>
<h2 id="what-would-turn-the-experiment-into-protection">What would turn the experiment into protection</h2>
<p>Circle labels Anduin research, not a released service, and the evidence that would change that is specific. A deployment would need to show how the ranking holds up when a provider’s recommendations have been manipulated, how new buyers get past the allow-list stage, what happens when a trusted provider turns out to be colluding, and whether the providers it ranks highly deliver work that agents actually accept. The $8,259 figure answers one question well: how much it costs to fake a crowd. The harder questions start once the crowd is real.</p>
<p>The post <a href="https://coindoo.com/why-fake-crypto-buyers-are-about-to-get-expensive/" rel="noopener noreferrer nofollow">Why Fake Crypto Buyers Are About to Get Expensive</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

Why Fake Crypto Buyers Are About to Get Expensive

Table of Contents

Coindoo.com

Other articles published on Nov 14, 2026

Join our free newsletter for daily crypto updates!