Sybil Resistance in Reputations for Agentic Marketplaces

Sybil Resistance in Reputations for Agentic Marketplaces

AI agents are starting to spend money on their own. Given a task like “research this industry” or “transcribe and summarize meetings,” an agent finds and pays the services it needs, using x402, an HTTP-native payment standard for agents. What an agent cannot yet do reliably is tell a good provider from one that only looks popular. Today, an attacker can make a fake provider look as reputable as the market median for less than a cent.

Our answer is to read reputation from who pays whom. Every x402 payment leaves a public onchain record. When agents that buy from the same services you do keep paying a provider, that is a signal that may be more costly to fake under the study’s assumptions. To look trusted to you, they must spend real money at the services you already use. Sending payments between wallets they control does not count; that is just moving money between their own pockets.

We call this approach Anduin and tested it on 66 million real x402 payments. It recommends providers about as accurately as the best standard method while being about 23 times more expensive to manipulate.

Today’s default reputation metrics are remarkably cheap to manipulate: an empirical study of onchain agent reputation found that elevating an adversarial provider's rating to the marketplace median costs just $0.0027—roughly 1/259th of what an honest median provider earns.

‍

Why Today's Reputation Systems Break Down

Current mechanisms for agent provider discovery fall into four primary categories, and each introduces trade-offs:

1. Curated Marketplaces and Allow-Lists (e.g., agent marketplaces and registries run by platforms and wallet providers) list providers that a trusted operator has reviewed. Curation can give buyers strong assurance about the providers it covers, and it is the natural starting point for a new agent with no payment history. Its limit is reach: review takes time, so curated lists can cover only part of a fast-growing open market. Payment-graph reputation complements curation by extending trust signals to the long tail of providers no curator has reviewed yet.
2. Per-Transaction Evaluators (e.g., ERC-8183 escrow arbiters) place a third party between client and provider to verify task completion. However, gas fees and arbiter margins create an economic floor of roughly $1.00 per transaction. A system designed for sub-cent micropayments cannot sustain a dollar of overhead per call.
3. Voluntary Onchain Ratings (e.g., ERC-8004 feedback) suffer from extreme data sparsity. Across 66 million x402 payments, fewer than 4,000 voluntary ratings have ever been recorded. Autonomous agents simply do not submit voluntary feedback unless required.
4. Raw Usage and Volume Metrics rank providers by transaction counts, distinct wallet addresses, or total revenue. These metrics are trivial to fake. Because an attacker controls both the sending wallet and the receiving provider, in the study’s modeled attack self-directed payments cost only base blockchain transaction fees (ε ≈ $0.017). A Sybil attack—where one entity uses multiple fake identities—becomes a negligible transaction cost rather than a barrier.

Rather than overlaying an external trust mechanism onto agentic markets, we can look to the existing ledger: the marketplace continuously records its own reputation system, transaction by transaction, directly on public blockchains.

‍

Using Payment Graph as Rating Signals 

Every payment on a public blockchain is a permanent, cryptographically signed record of value transfer. Mapping these payments across a marketplace produces a natural bipartite graph:

• Buyers (b) representing purchasing agents.
• Providers (p) representing service endpoints.
• Edges (e) connecting buyers to providers, weighted (w) by monetary value, transaction frequency, and recency. Unless stated otherwise, the weight w(b,p) is the dollars b paid p in the 90 days before the snapshot, including the network fee on each payment.

Imagine a buyer agent, b,  evaluating an unfamiliar candidate provider, p'. Even without prior interaction with p', b has a settled onchain history of payments to the providers it already uses, its known providers, K(b), such as a translation API or a trusted RPC endpoint. 

Other buyers who pay at least one of b’s known providers are b’s co-users, C(b); the providers they pay that b has never paid are b’s candidates. When a co-user b′ that shares a provider p with b also pays candidate p′, that connection forms a personalized, multi-hop path of trust:

Buyer b → Known Provider p → Co-User b' → Candidate Provider p'

Trust is not a static global score; it is localized and relational, derived from market participants whose actual commercial activity overlaps with your own. Each hop carries the weight of the payment it represents: w(b,p), w(b′,p) and w(b′,p′). The three algorithms below differ only in how they combine those weights across all such paths.

Why Creating Fake Wallets Doesn’t Buy Fake Reputation

Why can't an attacker simply create 10,000 fake wallets and fake a strong reputation?

To understand why this fails, imagine how trust works in the real world when using gift cards or cash:

• Moving Money Between Your Own Pockets is Free: If you transfer money between two bank accounts you own, you aren't spending anything. Similarly, when an attacker sends crypto back and forth between fake wallets they control, the funds stay in their own hands, minus tiny network transaction fees.
• Vouching Requires Real Purchases at Real Stores: To trick a buyer into trusting a fake service, the attacker's fake accounts must prove they share common ground with that buyer. That means those fake accounts must spend real money at independent, legitimate businesses (like real web hosting or data providers) that the buyer already trusts.

Because those third-party businesses are independent, that money is permanently gone. The attacker cannot get it back.

By evaluating trust based on the weakest link along a connection path, self-directed payments provide zero extra reputation. A fake account that spent $1.00 at one of the buyer’s own providers can pass along at most $1.00 worth of recommendation strength to that buyer, no matter how many millions of fake transactions it bounces back to the attacker's endpoint.

Splitting capital across thousands of fake wallets does not help either: dividing $100 across 100 fake accounts can never produce more than $100 of total trust signal. In short, real payment acts as the stake: every dollar of score an attacker shows a buyer must be backed by a dollar it actually paid to that buyer’s own providers.

‍

The Anduin Framework: Three Graph-Flow Rating Algorithms

Bounding trust by graph structure is an established idea. Bazaar (Post et al., 2011) used max-flow over past trades to decide whether a single online transaction was safe. Those systems separate honest from fake nodes, or approve or reject one transaction. A buyer agent needs something different: it must rank hundreds of providers it has never used, and plain max-flow gives many of them the same score. Our contribution is to turn flow into a ranking over settled onchain payments, personalized to each buyer, with two relaxations that recover accuracy while keeping the budget bound, and to measure that trade-off on 66 million real payments. We formalize this as three graph-flow ratings. Each treats b’s co-users as references: a co-user’s endorsement of p′ counts only as much as the real money that links it to b. The three ratings differ in how they combine the endorsements of many co-users:

1. Maximum Flow (flow): The most conservative rule: b never trusts a new provider more than b has itself spent with its known providers, no matter how many co-users endorse it. Every endorsement must pass through b’s own spending, so a fake co-user contributes only as much as it actually paid at b’s providers, and creating more of them adds nothing. The catch is that the same cap also limits honest co-users: once b’s spending is used up, a provider endorsed by ten co-users scores the same as one endorsed by two, so many candidates tie at the top.
2. Summation Flow (sum): Removes the shared cap so that co-users endorse independently. Each co-user’s endorsement counts up to the smaller of how much its spending overlaps with b’s and how much it paid p′, and the endorsements are added, so a provider endorsed by ten co-users now outranks one endorsed by two. Fake co-users still gain nothing for free: every endorsement is backed by that co-user’s own real spending at b’s providers, so the total an attacker can create stays bounded by what it actually paid there. The overlap is computed once per co-user, so each extra candidate is nearly free to score.
3. Amplified Flow (amp): Summation caps each co-user’s endorsement separately, so a co-user that paid p′ a little leaves part of its allowance unused, while one that paid p′ a lot is cut off. Amplified Flow pools these allowances: the more of b’s co-users at a provider also pay p′, the more capacity that provider passes on, and strong endorsers can use what weak ones leave idle. In the figure below, b spent $4 at p, and two co-users of p also pay p′, $8 and $1: Maximum Flow scores p′ at 4, Summation at 5, and Amplified Flow at 8.

In short, Maximum Flow buys the strongest guarantee at the cost of telling good providers apart; Summation and Amplified Flow give honest co-users their full weight while keeping the same budget bound against fake ones. The evaluation below measures that trade-off.

Threat model: the attacker owns a target provider p’. It can create unlimited buyer and provider wallets and move money among them, paying only the network fee on each transaction. It controls none of the providers the querying buyer b already pays, and it cannot alter b’s own settled payments. Under these assumptions we prove two bounds:

• Budget bound (all three algorithms): If the attacker pays a total of m dollars to b’s known providers, its provider’s score in b’s ranking is at most m, however many wallets it uses, and this bound is tight. The bound holds per buyer: one payment at a provider many buyers use counts toward all of them. It also prices only money paid to providers the attacker doesn’t control; a provider that colludes with or refunds the attacker is outside the model.
• Buyer cap (Maximum Flow only): No provider can score more than b’s own past spending with its known providers, whatever the attacker spends. Summation and Amplified Flow trade this cap for accuracy.

‍

Empirical Evaluation: 66 Million Real-World x402 Payments

To see how these concepts perform in practice, we benchmarked Anduin on 66.1 million x402 settlements worth $6.1M over 157 days (23 March – 26 August 2026), across 16 networks (15 EVM chains and Solana). To be clear up front: Anduin does not beat the best standard method, collaborative filtering, at predicting which provider a buyer picks next. Its contribution is making roughly the same accuracy far more expensive to fake.

A great reputation system must excel at two competing goals simultaneously:

• High Utility (Finding relevant services): It must accurately guide buyers to relevant providers.
• High Manipulation Cost (Sybil resistance): It must prevent bad actors from buying or faking top ratings for cheap.
• Achieving either goal alone is trivial. You could make a system 100% immune to manipulation simply by recommending nothing, or make it appear highly helpful by naively trusting every public signal. The real challenge is delivering both at the same time.

‍

Utility: Predicting Where Agents Spend Next

We freeze the graph at 21 June 2026 using the prior 90 days of payments. For each of the 813 buyers who, in the next 30 days, first paid a provider they had never used (one paid by at least two buyers), that provider is the right answer. Each buyer has about 381 candidates. P@1 is the share of buyers whose right answer is ranked first. AUC is the probability that the right answer outranks a randomly chosen other candidate (0.5 = random).
‍

‍

Standard volume-based rankings offer little practical guidance for agents looking for relevant services. Amplified Flow (amp) does not beat standard collaborative filtering on accuracy, but comes close (AUC 0.869 vs. 0.880; P@1 22.8% vs. 23.2%). What it adds is the economic protection that collaborative filtering lacks. As the next section shows, that protection is the real difference: In one modeled attack targeting the top ranking across 813 buyers, Amplified flow amp costs roughly 23 times as much to manipulate than the tested collaborative filtering baseline.

‍

Attack Cost: The Price of Market Manipulation

High accuracy alone is not enough. To price manipulation, we inject a new provider p* into the frozen graph and let the attacker create any number of fake buyers that pay the tested buyers’ known providers and p*. We solve for the minimum total spend that puts p* at rank k or better for all 813 tested buyers at once. That spend counts payments to providers the attacker doesn’t control plus a $0.017 fee per transaction. “% of target buyers’ spend” divides that cost by those buyers’ combined spend in the window, $41,331.
‍

‍

One row looks like an outlier: Usage Ranking appears extraordinarily expensive to attack ($217,539, or 526% of target buyers' spend). But that figure is pure fees: 12.8 million $0.017 self-payments to out-count the busiest provider. It collapses to $310 by rank 25. Usage ranking also shows every buyer the same global list, so it rarely puts the right provider first (3.7% P@1). The flow constructions, by contrast, rank accurately and stay well above collaborative filtering at every rank: at top-25 they cost $494–$898 against $50.

‍

Bringing It All Together: The Utility vs. Security Matrix
‍

‍

Why Both Dimensions Matter

Evaluating a reputation system on just one dimension gives a false picture. A system that recommends nothing is 100% secure against bad actors, while a system that naively trusts everyone looks remarkably helpful until an attacker corrupts its recommendations. The true goal of a production-ready agentic marketplace is landing squarely in the top-right quadrant, accurate and costly to attack at once; only Amplified and Summation Flow land there.

‍

Practical Deployment

Anduin operates with zero changes to underlying protocols:

• No modifications to x402, HTTP payment headers, or ERC standards.
• No requirements for a new token, staking registry, or oracle network.
• Works alongside curated marketplaces; no single party decides which providers are visible.

Each query touches only the buyer’s two-hop neighborhood: its providers, their other buyers, and those buyers’ providers, never the whole graph. Summation Flow costs a one-off pass over the buyer’s co-users and then constant time per candidate; the max-flow variants solve one small flow problem per candidate. Indexers and RPC services that already hold the chain data can serve these personalized queries to lightweight agents.

‍

Discussion and Future Extensions

• Cold Start: An agent with no transaction history has no known providers, so graph ratings are undefined for it. New agents can bootstrap from curated allow-lists. One settled payment is enough to produce a personalized ranking, but protection grows with history: a buyer with $5 of history is cheap to target. New providers likewise stay unrated until a co-user pays them.
• Return Days (wd): Weighting a relationship by the number of distinct days it spans is the strongest predictive signal we measure. Its appeal is that capital cannot compress time—even an adversary with unlimited funds cannot fake months of consistent commercial history overnight, though it can start aging many wallets in parallel well in advance. The catch is that this defense is not denominated in dollars: a day of forced waiting has no clean price, so we report return days as an accuracy result rather than folding it into the dollar-denominated attack costs above. Pricing "patience" as an attack cost is an open direction.
• Limitations: Utility measures which provider a buyer chose next, not whether it served the buyer well. The guarantees assume the attacker controls none of the buyer’s existing providers, so an established provider promoting a new service of its own is outside the model. A wallet shared by several agents blends their histories; per-agent session keys would separate them.

‍

Conclusion: Making Sybils Pay Their Way

This work fulfills the trusted discovery gap highlighted in Circle's Building the Open Agentic Economy vision post.

As autonomous AI agents take on core economic workflows, the systems guiding their capital allocation must be as secure as the cryptography protecting their keys.

Reputation systems that are cheap to fabricate will inevitably be exploited. By deriving trust directly from localized payment flows, Anduin anchors reputation to irreversible economic expenditure.

In an agentic economy built on public blockchains, the payment graph already contains the signal for trust—and Anduin helps ensure that every dollar of reputation a buyer sees is backed by a dollar actually paid to that buyer’s own providers.

Research paper: link

‍

‍

_{Note: This article describes technology developed by Circle Research, a division of Circle committed to public good and open-source contributions to push the boundaries of technology used in crypto, blockchain, and Web3. These projects do not represent completed and released software or services. Unless otherwise stated, content published by Circle Research is open-source and is available for anyone to consume, use, and build upon. Due to their experimental and emergent nature, Circle Research innovations are provided to be tested and evaluated at a developer’s or company’s discretion.}