This webpage serves as a comprehensive record of the fraudulent activities that took place during the election of councilors for the NEAR Digital Collective's Regional DAO. It aims to provide detailed information regarding the various instances of fraud that occurred during the election process.

Introduction

In recent days, an unusual surge in voter registrations was observed in the South American region during the councilor election for the NEAR Digital Collective. Upon closer examination, it became evident that these new registrations displayed suspicious characteristics that raised concerns about potential electoral fraud.

Instances were discovered where wallets, registered under English names, not commonly used in the region, were involved. These wallets had empty profiles and showed no activity on the Near-Social platform. Further investigation revealed a pattern of sequential voting by these wallets, all tied to a single "attacker wallet".

In a sampling of transactions associated with the attacker wallet, it became evident that funds were distributed to the suspicious wallets for voting purposes and returned to the master wallet afterwards.

These findings strongly suggest a coordinated effort to manipulate the election results by registering fake voters and orchestrating a systematic voting pattern using controlled wallets.

This document provides a comprehensive overview of the investigation into the electoral fraud, shedding light on the evidence collected and calling for further examination of the activities surrounding the attacker's wallet and its connections.

Research Process

On Wednesday, while checking the voting totals, we noticed that there were several candidates with almost the same number of votes, increasing at the same speed. It was curious that in South America there were two candidates who shared this growth, while in all the other regions there was only one candidate.

We checked the smart contract of South America south-america.sputnik-dao.near and found about 150 voters, half of whom had English wallet addresses and the exact same behavior. They were precisely the voters who were voting for all the candidates who were increasing their number of votes simultaneously as if the candidates had agreed, but we found out that the candidates had not agreed on this happening.

We also found out that all these wallets were shared about three months ago and funded by the same wallet (Attacker Wallet). They also had no photos or social networks, completely anonymous, except that they all have readable addresses in English, which we also found strange being South America a Latin-speaking region. Then we verified a systematic behavior in the vote as they voted one after another in batches of about 15 wallets at a time, and all the wallets reversed the extra funds to the wallet that created them. This is another important fact since if someone receives money to be able to vote; it is unlikely that they will return the surplus and much less that they will share the exact behavior with all the other wallets.

Because of this, we decided to start an investigation that points out fake voters those with the following characteristics:

  1. Voting Scheme: 911, 916, 926, 928, 931, 937
  2. Created by: 6350f50a993f2b799e16497a3448620a3942dcf2cd62d132bedcc0c94c33ce88
  3. Created three months ago with the only specific purpose of voting
  4. No profile pic, no social interactions on near.social
  5. Reversed funds after voting to the Attacker Wallet 6350…ce88
  6. Voting in Batch
  7. Random English legible addresses

Out of all the evidence, the fact that these wallets are returning what’s left after voting to the Attacker Wallet indicates control, undermining the paramount principle of "one person one vote”, which is of course not allowed in a free open voting process.