Anti-abuse: per-guild bridge caps + link-attempt rate limiting for open registration #77

New issue

Closed

opened 2026-07-10 23:51:24 +00:00 by robocub · 1 comment

robocub commented

2026-07-10 23:51:24 +00:00

Collaborator

Anti-abuse controls for open registration beyond the current per-owner tenant cap.

Context

Under open_registration, any Matrix user can DM the bot and link. Present controls: max_tenants_per_owner (per-MXID), owner/guild/room deny-lists, and a mutate cooldown. Two-sided auth already prevents bridging spaces you don't control — these target the residual vectors.

Gap 1 — Sybil resistance (per-guild caps)

max_tenants_per_owner is keyed on the Matrix MXID, but the bridge bot is federation-reachable, so a determined actor can use throwaway accounts on any homeserver to bypass a per-owner cap. nether.im's own registration is invite-code-gated (good Sybil resistance for local users) — but federated owners aren't subject to that. The stronger anchor is the Discord side (Manage Server on a real guild is hard to Sybil at scale). Proposed:

Per-guild bridge cap — limit how many bridges (and/or distinct owners) can target one Discord guild.
Consider a per-Discord-account limit as a complement.

Gap 2 — link-attempt rate limiting

Extend the existing mutate cooldown to a per-owner/per-window link-attempt budget so the link/approve flow can't be hammered (pending approvals already count toward the tenant cap; add a velocity limit too).

New knobs under [limits]. Related: #47, #43.

Anti-abuse controls for open registration beyond the current per-owner tenant cap. ## Context Under `open_registration`, any Matrix user can DM the bot and `link`. Present controls: `max_tenants_per_owner` (per-MXID), owner/guild/room deny-lists, and a mutate cooldown. Two-sided auth already prevents bridging spaces you don't control — these target the residual vectors. ## Gap 1 — Sybil resistance (per-guild caps) `max_tenants_per_owner` is keyed on the Matrix MXID, but the bridge bot is **federation-reachable**, so a determined actor can use throwaway accounts on any homeserver to bypass a per-owner cap. nether.im's own registration is **invite-code-gated** (good Sybil resistance for local users) — but federated owners aren't subject to that. The stronger anchor is the **Discord side** (Manage Server on a real guild is hard to Sybil at scale). Proposed: - **Per-guild bridge cap** — limit how many bridges (and/or distinct owners) can target one Discord guild. - Consider a per-Discord-account limit as a complement. ## Gap 2 — link-attempt rate limiting Extend the existing mutate cooldown to a **per-owner/per-window link-attempt budget** so the link/approve flow can't be hammered (pending approvals already count toward the tenant cap; add a velocity limit too). New knobs under `[limits]`. Related: #47, #43.

robocub referenced this issue

2026-07-11 00:29:12 +00:00

Pre-launch adversarial security + abuse review of the open-registration surface (run on Fable) #79

robocub referenced this issue from a commit

2026-07-11 04:15:25 +00:00

feat(mgmt): anti-Sybil per-guild caps + link-attempt rate limiting (#77)

robocub referenced this issue from a commit

2026-07-11 04:15:25 +00:00

test(e2e): cover #77 per-guild cap + link-attempt rate limit in mgmt scenario

robocub referenced this issue

2026-07-11 06:41:04 +00:00

Self-serve allowlist: an invite-only middle tier between operators and fully open registration #82

robocub referenced this issue

2026-07-11 09:08:05 +00:00

#79 findings 2+3 (HIGH): global cross-MXID rate limiting + fair pending-table admission #84

robocub commented

2026-07-11 16:59:12 +00:00

Author

Collaborator

Done. [limits] max_tenants_per_guild (per-guild anti-Sybil cap) + max_link_attempts (per-owner sliding-window velocity budget, optional link_attempt_window_secs) shipped, both required-when-open_registration as of the #79 hardening. Merged (master 937014b), live-validated (mgmt_self_serve_link PASS), shipped in v0.3.0-alpha.16, deployed. (Also fixed a pre-existing e2e txn-replay harness bug.)

Done. `[limits] max_tenants_per_guild` (per-guild anti-Sybil cap) + `max_link_attempts` (per-owner sliding-window velocity budget, optional `link_attempt_window_secs`) shipped, both required-when-open_registration as of the #79 hardening. Merged (master `937014b`), live-validated (`mgmt_self_serve_link` PASS), shipped in v0.3.0-alpha.16, deployed. (Also fixed a pre-existing e2e txn-replay harness bug.)

robocub closed this issue

2026-07-11 16:59:12 +00:00