$PI Pi: Why do attack and botting risks still exist even if KYC is required for everyone? Many people believe that if all accounts undergo real-name KYC, bots can no longer be used for mining, and open-sourcing means there is no need to fear attacks. Reality is not that simple. KYC itself has many loopholes. It can only reduce cheating, not eliminate it completely. 1. KYC’s biggest loophole: buying someone else’s verified identity (mule accounts) KYC verifies that the “identity document is genuine”; it does not mean that the person operating the account is the holder of that document. 1. The black market can acquire large amounts of ordinary people’s ID information and find people to complete real-name KYC (renting ID cards or paying people to pass KYC). 2. One real person’s identity can be used to operate multiple Pi accounts (depending on whether the project’s KYC verification rules restrict one person to one account). Even with a 100% KYC pass rate, as long as attackers can buy accounts that have already completed KYC, they will possess a large number of “KYC-completed” legitimate accounts. After open-sourcing, attackers can obtain the mining algorithm, directly control this batch of KYC-completed accounts, build Security Circles in bulk, increase mining speed, and generate large amounts of tokens. 👉In this situation, the account’s KYC uses a genuine identity document, but the actual user is not the document holder, which constitutes cheating. KYC cannot stop these “purchased real-name accounts.” 2. KYC cannot eliminate collusive cheating (an inherent weakness of the Security Circle mechanism) Pi mining speed depends on users adding one another to their Security Circles. When 5 KYC accounts add one another to their Security Circles, the mining rates of all the accounts increase. Even if every account has completed real-person KYC: Attackers who control tens of thousands of purchased KYC accounts can form Security Circles in bulk, amplifying mining rewards on a large scale. - The KYC for each account is genuine; - But the entire group of accounts is controlled by the same person, forming a massive cheating cluster; This is not the registration of fake bot accounts; it is the mass manipulation of genuine KYC accounts for malicious purposes. Even if the underlying code is fully open source, this attack will still work. KYC cannot identify that the same person is controlling multiple accounts registered under different real identities. On-chain data can only show individual KYC accounts; it cannot reveal who is operating them in the real world. 3. KYC itself cannot achieve 100% coverage Project reality: among tens of millions of early registered accounts, it is impossible for all of them to complete KYC. - Some people are unwilling to submit identity documents; - KYC channels are not supported in some regions, making verification impossible; Leaving behind a large number of old accounts that have not completed KYC. If the core underlying system is open sourced: ①The mining logic for historical accounts that have not completed KYC will be fully disclosed, and the rules governing historical mining output can be reviewed externally; ②Hackers can study the rules, look for logical vulnerabilities, and exploit loopholes in the rules for old accounts. 4. Even with KYC, contract-level attacks remain possible after open-sourcing (once the DEX goes live) Even if KYC restricts the mining process, after the DEX smart contracts are open sourced: - Slippage attacks and sandwich attacks can be carried out; - Large numbers of worthless ecosystem tokens can be created and used to conduct scams through DEX pools; KYC cannot control attacks against on-chain contracts. Contract vulnerabilities are code-level issues and have nothing to do with whether accounts use real-name identities. 5. KYC is merely an “identity threshold,” not a万能 firewall ✅KYC can defend against: casually registering unlimited empty bot accounts. ❌KYC cannot prevent: 1. Buying existing KYC-completed accounts and manipulating them in bulk; 2. Multiple real-name accounts colluding to form Security Circles and boost mining; 3. Logical vulnerabilities in the contract code itself. This is the key concern for the project team: Even if KYC is mandatory for all accounts, as long as the underlying mining logic is fully open sourced, adversaries can still conduct large-scale arbitrage by purchasing mule accounts, damaging the token economy. Additional real-world contradiction Fully closed source: It can raise the barrier to cheating, but sacrifices the transparency of a public blockchain, leaving users to trust the team for all rules; Fully open source: It is transparent and public, but significantly lowers the cost of cheating and exposes all attack methods to adversaries; KYC can only mitigate this fundamental contradiction, not resolve it.

$PI Pi: Even if KYC is required for everyone, why do attack and account-farming risks still exist? Many people believe that if all accounts undergo real-name KYC, bot mining can be eliminated, and that attacks will no longer be a concern once the code is open-sourced. Reality is not that simple. KYC itself has many loopholes. It can only reduce cheating, not eliminate it completely. 1. The biggest KYC loophole: buying someone else’s verified identity (proxy accounts) KYC verifies that the “identity document is genuine”; it does not verify that the person operating the account is the document holder. 1. The black market can acquire the identity information of large numbers of ordinary people and find people to complete real-name KYC (renting identity documents or paying people to pass KYC). 2. The identity of one real person can be used to operate multiple Pi accounts (depending on whether the project’s KYC rules restrict one person from having multiple accounts). Even with a 100% KYC pass rate, as long as attackers can buy accounts that have already completed KYC, they can acquire a large batch of “already KYC-completed” legitimate accounts. After open-sourcing, attackers can obtain the mining algorithm, directly control this batch of KYC-verified accounts in bulk, build Security Circles in bulk, increase mining speed, and generate large amounts of tokens. 👉In this situation, the account’s KYC uses a genuine identity document, but the actual user is not the identity holder, which constitutes cheating. KYC cannot stop these “purchased real-name accounts.” 2. KYC cannot eliminate coordinated cheating (an inherent weakness of the Security Circle mechanism) Pi mining speed depends on users adding one another to their Security Circles. When 5 KYC-verified accounts add one another to their Security Circles, the mining rates of all the accounts increase. Even if every account has completed real-person KYC: Attackers with tens of thousands of purchased KYC-verified accounts can form groups and build Security Circles, amplifying mining returns in bulk. - Every account’s KYC is genuine; - But the entire group of accounts is controlled by the same person, forming a giant cheating cluster; This is not the registration of fake bot accounts; it is the malicious bulk control of genuine KYC-verified accounts. Even if the underlying code is completely open-sourced, this attack would still work. KYC cannot identify that the same owner is controlling different real-name accounts. On-chain data can only show individual independent KYC accounts; it cannot reveal who is operating them in the real world. 3. KYC itself cannot achieve 100% coverage The reality for the project is that tens of millions of early-registered accounts can never all complete KYC. - Some people are unwilling to submit identity documents; - KYC channels are unsupported in some regions, making verification impossible; Leaving behind a large number of old accounts that have not completed KYC. If the core underlying code is open-sourced: ①The mining logic for historical accounts that have not completed KYC would be fully disclosed, and the rules governing historical mining output could be reviewed externally; ②Hackers could study the rules, look for logic vulnerabilities, and exploit loopholes in the rules for old accounts. 4. Even with KYC, contract-level attacks remain possible after open-sourcing (after the DEX launches) Even if KYC restricts the mining process, after the DEX smart contracts are open-sourced: - Slippage attacks and sandwich attacks can be carried out; - Large numbers of worthless ecosystem tokens can be created and used to conduct scams through DEX pools; KYC cannot control attacks against on-chain contracts. Contract vulnerabilities are code-level issues and have nothing to do with whether an account has a verified real-world identity. 5. KYC is only an “identity threshold,” not a universal firewall ✅KYC can defend against: casually registering unlimited empty bot accounts. ❌KYC cannot prevent: 1. Buying existing KYC-verified accounts and manipulating them in bulk; 2. Multiple real-name accounts coordinating and forming groups to farm mining through Security Circles; 3. Logic vulnerabilities in the contract code itself. This is the key concern for the project team: Even if KYC is mandatory for all accounts, as long as the underlying mining logic is fully open-sourced, opponents can still exploit the system on a large scale by purchasing proxy accounts, damaging the token economy. Additional real-world contradictions Fully closed-source: This can raise the barrier to cheating, but sacrifices public-chain transparency, meaning all rules must be trusted to the team; Fully open-source: This provides transparency and openness, but significantly lowers the cost of cheating and exposes all attack methods to opponents; KYC can only mitigate this fundamental contradiction; it cannot resolve it.

$PI See how hard it is to hold coins.