# NDC election manipulation Hey all, I stumbled across something suspicious on near.social. In my sidebar I see the feed of most recent profiles. Many of them have a few things in common: - they follow 1-4 profiles - they have a profile pic of a human. They even have a banner pic with a human - they have a one sentence slogan in their profile Check out the most recent profiles [here](https://near.social/marior.near/widget/LastProfilesImages). This is why wanted to dig into why someone apparently creates these fake profile. Here's a non exhaustive list of suspicious profiles: - shrubbery.near, allusion.near, allotropism.near, glass-cutter.near, anomalyy.near, allisqws.near, zevsus.near, liyana.near, vodopyan.near, robroyn.near, exciseduty.near, logiclogic.near, billhook.near, trifling.near, algeriannational.near, diminutive.near, pinkdress.near, absolutism.near, grotesqueness.near Digging into it further I found additional evidence that there's a planned attack on the decentralized governance of Near: - many of them have been funded via HideYourCash (now [Opact](https://tickets.opact.io/)) - all of them minted the IAH SBT as one of their first tx - they immediately created multiple full access keys - 5c33c6218d47e00ef229f60da78d0897e1ee9665312550b8afd5f9c7bc6957d2 is likely a CEX address and funded the following addresses: - anomalyy.near, allisqws.near, zevsus.near, vodopyan.near, robroyn.near Example txs:  HideYourCash is a mixer similar to Tornado Cash, but fortunately the amount of people using it is not yet that much, which can give us an idea of who _might_ be the person(s) involved with this. For funding the [1 Near mixer address](https://nearblocks.io/address/1near.hideyourcash.near) has been used. The way the mixer works is that everyone can deposit 1 Near into the smart contract. You will then be given a secret that you can use for withdrawal, so every 1 Near deposit can result in a 1 Near withdrawal, but we don't know who used to be the depositor of the account that withdrew the 1 Near to fund their account. By looking at the recent activities on the mixer contract we can identify following addresses of doing multiple deposits: ### onlyonepie.near  - created 10 months ago - [social profile](https://near.social/mob.near/widget/ProfilePage?accountId=onlyonepie.near) - IAH SBT mint Aug 23rd. See [tx](https://nearblocks.io/txns/8QtjRRsDGwGQgFXj56rKrAWL5Y2SV9r7MdeBNMbxYus6) - frequently using LearnNearClub - staking Near via [Near UA Guild](https://near.social/mob.near/widget/ProfilePage?accountId=nearukraineguild.near). See [tx](https://nearblocks.io/txns/3AXfZ9Bi13HPwpQBjvr7GKfQiVDffqaynbkqbpKk8RZB) - sent Aurora to lovelysugar.near. See [tx](https://nearblocks.io/txns/5UzThVoupAraaz4dexji2iu2mJQaMLbqHkcfs4fg1xtD) ### lovelysugar.near  - created 2 years ago - [social profile](https://near.social/mob.near/widget/ProfilePage?accountId=lovelysugar.near) - IAH SBT mint Jul 4th. See [tx](https://nearblocks.io/txns/5YpALQDWhcJJUzFUU8mZryxisf5NDTsaNvGc6Y2rDnb6) - frequent mentioning of [Near Korea DAO](https://near.social/mob.near/widget/ProfilePage?accountId=coineasydao.near) - frequently using LearnNearClub - many posts on the BOS - bought NFT from Near UA Guild. See [tx](https://nearblocks.io/txns/6ivEg4iC9spPNJm2fSb6Qb6HpHw7NnZ3MGD3fikcabEB) ### 81423b2d389fbf3f73ba45e3b62dcc1fdd37cea2d0d383806fdc687822fdb8a6  - created 2 months ago - [social profile](https://near.social/mob.near/widget/ProfilePage?accountId=81423b2d389fbf3f73ba45e3b62dcc1fdd37cea2d0d383806fdc687822fdb8a6) - funded via Keypom - shouting out Near UA Guild candidate [kiskesis.near](https://near.social/mob.near/widget/ProfilePage?accountId=kiskesis.near) with a [post](https://near.social/mob.near/widget/MainPage.Post.Page?accountId=81423b2d389fbf3f73ba45e3b62dcc1fdd37cea2d0d383806fdc687822fdb8a6&blockHeight=98804495) - buying NFTs from Near UA Guild: [tx1](https://nearblocks.io/txns/Fz792LVcfZMePbyKWoTgJu2YLdqSoKawR7YGrSbbv6Cm), [tx2](https://nearblocks.io/txns/AfcRTWUmBPGRYRJwEsWVR7AQZcTVn36SqQds55SLkBGC), [tx3](https://nearblocks.io/txns/8kGbo4GExh5bXPQuNQGRkkx5d4cwBxKNGBB6e7YhkaQ) - staking via Near UA Guild: [tx](https://nearblocks.io/txns/FzqkMKN3orrH2cPki4QgFyzDSwYU5PhcKGrcS3RGWsbg) ### branermusso.near  - created Aug 10th - [social profile](https://nearblocks.io/address/branermusso.near) - multiple mentioning of Near UA Guild for upcoming election on BOS - buying NFTs from Near UA Guild: [tx1](https://nearblocks.io/txns/ENMCwBZjazpqym2Ax4BLPntrqXbWr6p68eLfawfXJKpo), [tx2](https://nearblocks.io/txns/AbXjHf3qPW7jhPts2FtoLmkssKNkMWvacxoCxnkN4rTe), [tx3](https://nearblocks.io/txns/48qJsx3XCJcMmcc5Y7GTgQFxTeTTgaJnhFBxLN2SrPsb) ### vynnykv.near  I think you can clearly see where this is going, so I'll speed things up. Check his [social profile](https://near.social/mob.near/widget/ProfilePage?accountId=vynnykv.near) and you can clearly see the relation to Near UA Guild. ### More accounts - [5635a3ad0974723ee77258502ec86a1e2b9385a4d181371976427d12b05ee4b4](https://near.social/mob.near/widget/ProfilePage?accountId=5635a3ad0974723ee77258502ec86a1e2b9385a4d181371976427d12b05ee4b4) - Maxim from Ukraine - BOS social posts for Near UA Guild - [028521fdcdb25436d59ca93155651d613b6d0312010fea8f69d1fbebeeb91b15](https://near.social/mob.near/widget/ProfilePage?accountId=028521fdcdb25436d59ca93155651d613b6d0312010fea8f69d1fbebeeb91b15) - frequent mentioning of [Aurora Ecosystem News](https://near.social/mob.near/widget/ProfilePage?accountId=auroraecosystemnews.near) - [02e6e413ac337e99ddaf5c16b0935e668b3affb3057ed510a22f118b7e8fa0a9](https://near.social/mob.near/widget/ProfilePage?accountId=02e6e413ac337e99ddaf5c16b0935e668b3affb3057ed510a22f118b7e8fa0a9) - speaks Russian - staking via Near UA Guild: [tx](https://nearblocks.io/txns/F1YHLEvC4jQR6BjncB61ebkFHr9arv3gDGqS5kwx1gt5) - [sanam1027.near](https://near.social/mob.near/widget/ProfilePage?accountId=sanam1027.near) - frequent mentioning of Near Korea DAO - [sebtec.near](https://near.social/mob.near/widget/ProfilePage?accountId=sebtec.near) - mentioning of Near UA Guild on BOS There are many more accounts, but I won't cover all of them as it's quite time consuming. ## Conclusion There are many correlations to Near UA Guild, also a few to Aurora ecosystem and Korea DAO. They've been trying to hide account correlations via HideYourCash, but since it's almost exclusively used by the people who want to manipulate the election, it's really easy to find out who's behind it. The face verification via Fractal doesn't seem to be suitable for a "human verification" as it can be easily circumvented with multiple access keys and letting someone else do the face verification. I don't see how NDC elections can continue with such a deep level of corruption within the ecosystem. You could try to ban all accounts that have been using HideYourCash, but it doesn't defeat the bug of the human verification, so people could just continue creating new accounts. They don't even need to hide it! We won't be able to control this properly.