scottstirling / bitcloutdao

Decentralized Social Network Money Frauds/Scams including BitClout / DeSo, Twetch, Steemit, PeakD

Decentralized Social Network Money Frauds and DAOs: BitClout / DeSo, Twetch, PeakD, Steemit ...

Updates 9/29/2021:

https://www.theblockcrypto.com/post/118133/bitclout-creator-decentralized-social-blockchain-200-million-funding-a16z-others

https://www.coindesk.com/wyoming-dao-llc-law-passed

https://coingeek.com/wyoming-senate-passes-dao-law/

Other Projects of Relevance and similar macro and crypto structure to BitClout:

• DUST and AlgoRand

• SingularityNET and AGI and Cardano

• many many more

• READ THE WHITE PAPERS

• Look for the actual source code.

• repeat until you give up or wake up

BitClout, PeakD, Twetch and Steemit are all ersatz Twitter-style cryptocurrency DAO platforms so similar in look and concept to one another that they are related, copying code and ideas from each other.

The main commonalities to these frauds is they are centralized and decentralized systems designed for:

• extracting money from users for premium fees to execute blockchain transactions (for rudimentary versions of the same features users have today with Twitter itself and Google's content indexing, storage and delivery networks, for example)
• persuading users or tricking them into downloading and distributing stripped binaries dissimulating as "open source" in a peer to peer dark-net running on laptops, mobile devices, servers, public cloud, etc.
• harvesting unsuspecting users' fiat money and Bitcoin
• remaining anonymous or, in some cases, openly acting to bridge gaps in law (see Wyoming DAO laws upcoming and refer to BitClout's Terms of Service and search for Wyoming)

They mislead users in many fraudulent ways, including promoting overloaded and confusing meanings of "decentralized" and "open source" and "currency." They use public and private blockchain tech and APIs, open source project code produced by companies such as Google, and content delivery and security (for themselves, not their victims) services such as Cloudflare, to perpetrate financial fraud in the open. BitClout has promoted itself as "open source" since launch, when in fact all of its core code remains closed source to this day (the explorer and the "desktop app" available on GitHub are peripheral).

Twetch is based on buying and spending Bitcoin SV and micro-fees for transactions, which themselves have fees and require use of software wallets and keys running in your web browser.

BitClout is based on charging Bitcoin fees and additional costs for any and all transactions involving BitClout (which, as on Twetch with BSV coin, is required to be spent and fees paid to spend it for every action in the app) or their Creator Coin token, and also manages keys and wallets in your web browser.

Both sites are released under the auspicious promise of being alpha or beta quality and the hottest new thing being developed too fast and furiously to be stable, secure or usable. Bluntly, that is bullshit; these are fraudulent scams from tip to toe that completely lack professionalism and security features for users; protecting the BitClout or Twetch operators and their data, not you and yours.

This project gathers BitClout's code and offers analysis of its APIs, 3rd party integrations and architecture.

BitClout is a pay-to-play social network and game. It is a scam if considered, sold or promoted as a financial investment. BitClout should be thought more of as a a game or a vending machine that accepts Bitcoin irreversibly in exchange for a game currency called BitClout and a token called Creator Coin. One can buy a token with BitClout. One can buy either with Bitcoin. But it is impossible to refund or withdraw Bitcoin back from the system, nor is there any declaration of intention to ever make it otherwise in the one-pager pdf or the terms of service (linked on the second screen of the Signup flow, avaialable at https://bitclout.com/terms-of-service, in the source code (in main.js) and documented here). BitClout is a game and it costs Bitcoin (and a valid phone number) to play.

Completing your profile, at minimum, requires a phone number that can receive text messages for confirmation. Allegedly one can pay ~$60 in Bitcoin as an alternative, but I have not tested that.

All image content posted by users is stored in and accessible via public cloud storage on imgur.com.

Registered users can like and follow each other, post their own and promote other accounts' content, and spend Bitcoin on BitClout, then send BitClout to other wallets on the BitClout network, all of which costs, at minimum, a verified phone number and the price of Bitcoin transaction fees at premium market rates plus a percentage increase (BitClout adds 1.5 * priority fee price currently, 4/23/2021) (once Bitcoin has been used to purchase BitClout).

Update 4/9/2021: Reclouting /retweeting functionality appeared overnight after some new code was deployed.

The following functions cost Bitcoin to get started. The prices are set by the current cost of Bitcoin transaction fees:

• posting content
• following an account
• creating and saving or changing a profile image
• creating and saving or updating profile content

All actions are really based on blockcypher.com and other vendors services, technology and APIs, which makes setting up the technology for BitClout primarily an orchestration of services and APIs tied together through a web UI. All of the strongest technical aspects of BitClout are based on Cloudflare, Angular, blockcypher.com, imgur.com, various 3rd party libraries (see below) and GoDaddy's https://domainsbyproxy.com (who have a subpoena policy posted on their public site) obscuring the owners and creators behind BitClout.

Admittedly, the mastery orchestrating the components of the BitClout "solution" and carrying it off so far is respectable.

The BitClout one pager / whitepaper (7 pages) is a masterwork of rhetoric: enthymemes and triggers to encourage readers to jump to conclusions, confirm biases and desired outcomes and act on positive emotional response rather than careful analysis.

Partial list of other projects and services referenced and used in BitClout's Angular code:

GitHub projects:

• https://github.com/bitclout/explorer - BitClout's blockchain explorer user interface
• https://github.com/bitclout/desktop - [Electron|https://github.com/electron/electron] shell around bitclout URLs
• https://github.com/bitclout/run - Scripts and config files to download Docker images with pre-compiled binaries, configure and run (from https://ghcr.io/bitclout/core-obf and https://ghcr.io/bitclout/frontend) on localhost on insecure http ports and without any of the required API or SSL keys.
• https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki - Bitcoin BIP "describes the implementation of a mnemonic code or mnemonic sentence -- a group of easy to remember words -- for the generation of deterministic wallets."
• https://github.com/bitcoinjs/bitcoinjs-lib - "A javascript Bitcoin library for node.js and browsers."
• https://github.com/browserify/browserify - "build a bundle you can serve up to the browser in a single <script> tag."
• https://github.com/crypto-browserify/createHmac - "Node style HMACs for use in the browser" (hash-based message authentication codes = HMAC)
• https://github.com/crypto-browserify/browserify-rsa - "RSA private decryption/signing"
• https://github.com/crypto-browserify/crypto-browserify - "A port of node's crypto module to the browser."
• https://github.com/crypto-browserify/parse-asn1 - "utility library for parsing asn1 files for use with browserify-sign."
• https://github.com/crypto-browserify/randombytes - randombytes from Node js for browser apps.
• https://github.com/google/closure-library - "used by many Google web applications, such as Google Search, Gmail, Google Docs, Google+, Google Maps, and others."
• https://github.com/google/libphonenumber - "Google's common Java, C++ and JavaScript library for parsing, formatting, and validating international phone numbers."
• https://github.com/indutny/bn.js/ - "BigNum in pure javascript"
• https://github.com/indutny/elliptic - "Fast elliptic-curve cryptography in a plain javascript"
• https://github.com/popperjs/popper-core - "Popper will automatically put the tooltip in the right place near the button." (tooltip management)
• https://github.com/sweetalert2/sweetalert2 - "replacement for JavaScript's popup boxes"
• https://github.com/twitter/twemoji - "Twemoji library offers support for 3,304 emojis"

Other products, projects and services used in code and refrenced in code:

• https://amp.bitclout.com - endpoint for gathering analytics about user activity and transactions to send to an Amplitude (https://www.amplitude.com/) account.
• https://api.blockchain.info/mempool/fees - used to obtain premium fees for BitClout transactions
• https://api.blockcypher.com/v1/btc/main/addrs/${e}/full?token=... - see blockcypher public api docs
• https://api.blockcypher.com/v1/btc/test3/addrs/${e}/full?token... - test endpoint for ^
• https://bitcoinfees.earn.com/api/v1/fees/recommended - gets the current price for transaction fees transacted on BitClout.
• https://blockchain.info/ticker - api used to obtain exchange rate of Bitcoin in USD every 1 second in the background.
• https://electrum.org - Bitcoin wallet software mentioned and link in UI
• https://iancoleman.io/bip39/ - menomic code converter for Bitcoin BIP 39 ^
• https://twitter.com/intent/tweet?text= ... - for users to click for "Just setting up my bitclout ..." Tweet
• https://wallet.mycelium.com/ - Bitcoin wallet software mentioned and link in UI
• https://api.imgur.com/3/image/ + 8156989fa971a3b Client-ID (header?) to upload to imgur
• https://i.imgur.com/<name.ext> - images and pics posted by users
• https://fontawesome.com/ - fonts and logos
• https://fonts.gstatic.com/, https://fonts.googleapis.com - fonts

Possible source for BitClout's https://explorer.bitclout.com:

• https://github.com/blockcypher/explorer - BlockCypher's open source blockchain explorer project

TODO - other related sites referenced in code:

• https://api.bitclout.green, https://api.bitclout.blue, https://api.bitclout.navy - different API endpoints.
• megamoons.com - unknown TBD
• https://api.bitpop.dev - protected by CloudFlare, seems to be used for logging activity from the UI (?)
• bitpop.cash - parent domain for potential central organization participants in collecting fees for BitClout transactions.
• bitclout.fun - unknown use/purpose TBD
• bitclout.me - localhost alias

Listing of BitClout's APIs as dervived from main.js: see #20

BitClout Architecture Overview Diagram

Related work (began as a Reddit thread in r/Bitclout): https://www.reddit.com/r/BitClout/comments/mhpwjx/reverse_engineering_bitclout/

Increasing awareness of these scams, selected resources:

BitClout

• https://www.thedailybeast.com/bitclout-is-the-shady-crypto-start-up-selling-shares-in-celebs
• https://www.techtimes.com/articles/258837/20210407/bitclout-removes-singapore-prime-minister-crypto-platform.htm
• https://finance.yahoo.com/news/controversial-crypto-project-bitclout-faces-233043748.html
• https://youtu.be/NBZ4v2-XynU, https://youtu.be/SsERRF39YiM - Coffeezilla Youtube channel episodes on BitClout
• https://en.wikipedia.org/wiki/BitClout

PeakD

• https://peakd.com

Steemit

• https://www.quora.com/Is-Steemit-a-scam

Twetch

• https://medium.com/@Austerity_Sucks/i-signed-up-for-bsvs-twetch-social-media-platform-so-you-don-t-have-to-462f0db8b614

Related scam economy / BitClout ecosystem emerging in regulation vacuum

• https://withdrawbitclout.com/
• https://www.giftclout.com/
• https://github.com/BarryMode/awesome-bitclout (list of lists of BitClout related arcana, much of it links to the site itself)
• https://bitswap.network
  • https://bitswap.network/whitepaper (proposes exchanging BitClout for Ethereum via escrow, plus gas fees)

Other analysis and related info on my Twitter: https://twitter.com/scottmstirling

bitcloutdao's Issues

Notes on domainsbyproxy.com

They are in Arizona, owned by Godaddy.

They have a subpoena policy:
https://www.domainsbyproxy.com/policy/Subpoena.aspx

According to internet records, this company setup the *.bitclout.com domain DNS and probably the CDN and SSL certificate at least.

Who is dan?

This path is compiled into the main.js in 4 places and looks like an artifact from where it was built:

../../../../../../../../../../../home/dan/tmp/node-v10.16.3-linux-x64/lib/node_modules/browserify/node_modules/is-buffer/index.js

TODO: document uses of blockchain.info and bitcoinfees.earn.com

Used to get the price of Bitcoin in USD for display and calculations: https://blockchain.info/ticker

Used to get fee estimate for currency transactions: https://bitcoinfees.earn.com/api/v1/fees/recommended

Angular CLI version 11.1.2

Visible in "view source" after the tag:

<app-root _nghost-blp-c73="" ng-version="11.1.2">

Confirmed via Safari Developer mode that the iPhone / iOS UI is also rendered via Angular (and supports the PWA install option from Angular for iOS).

TODO: describe how logic in main*.js determines the current USD price of $Bitclout coin from the current price of Bitcoin

See subject.

Node management and scaling

Do you think it's possible to have aguess as to gitclout building from scratch + operating +scaling their blockchain node vs them using some big name (https://eos.io/, https://consensys.net/...)

There is https://www.blockcypher.com/ mentioned in your Readme but you seem to think it's only used for transactions and not for the whole blockchain backend...

What's your opinion or intuition on this ?

BitClout's APIs doc

TODO: sort the paths below to their endpoints and POST/GET details

api.bitclout path root:
GET
https://api.bitclout.com/api/v1

POST
https://api.bitclout.com/api/v1/block
https://api.bitclout.com/api/v1/transaction-info

bitclout.com admin paths: https://api.bitclout.com/admin or https://bitclout.com/admin

(the full admin URL paths error HTTP 405 for GETs (vs any other URLs which 404) but will return 200 for OPTIONS, which indicates their presence):

/admin - GET
/admin/get-all-user-global-metadata
/admin/get-mempool-stats
/admin/get-user-global-metadata
/admin/get-username-verification-audit-logs
/admin/get-verified-users
/admin/grant-verification-badge
/admin/node-control
/admin/pin-post
/admin/remove-nil-posts
/admin/remove-verification-badge
/admin/reprocess-bitcoin-block
/admin/swap-identity
/admin/update-global-feed
/admin/update-user-global-metadata

bitclout.com paths:

/404 - GET
/add-stake
/block-public-key
/broadcast-bitcoin-txn
/burn-bitcoin
/buy-bitclout - GET
/buy-or-sell-creator-coin-WVAzTWpGOFFnMlBvWXZhTFA4NjNSZGNW
/buy-or-sell-creator-coin-preview-WVAzTWpGOFFnMlBvWXZhTFA4NjNSZGNW
/check-login-user-stateless
/create-follow-txn-stateless
/create-like-stateless
/create-user-stateless - OPTIONS, POST
/creators - GET
/get-app-state - OPTIONS, POST
/get-block-template
/get-exchange-rate - GET
/get-follows-stateless
/get-messages-stateless - OPTIONS, POST
/get-notifications
/get-posts-stateless
/get-profiles - OPTIONS, POST
/get-single-post
/get-starter-bitclout - GET
/get-txn
/get-user-global-metadata
/get-users-stateless - OPTIONS, POST
/inbox - GET
/log-in - GET
/logout
/miner-control
/notifications - GET (notifications not implemented as of date 4/13/2021)
/posts/new - GET (screen with form input to author new content post)
/send-bitclout - GET (screen to Send $BitClout)
/send-message-stateless
/send-phone-number-verification-text
/settings - GET (currently email is the only updatable setting)
/signature
/sign-up - GET (Sign up screen)
/submit-phone-number-verification-code
/submit-post
/terms-of-service - GET
/u/${profile} - GET (Profile screen)
/u/${profile}/sell - GET (Sell ${profile} coin)
/u/${profile}/trade - GET (Buy ${profile} coin)
/update-bitcoin-usd-exchange-rate
/update-profile - GET (Update Profile screen)
/update-user-global-metadata
/wallet - GET (Wallet screen)

Some of the APIs require a special miner public key parameter unavailable to public users.

Work in progress ...

Unminify: incorporate into a script to automate

Handy utility, undoes common obfuscation techniques and makes the src more readable:
https://github.com/shapesecurity/unminify

Adds about 100k more lines of code to the resulting output of main.js ... but definitely helps.

$ npm install -g unminify
$ npx unminify src/main.js > /tmp/main-unmin.js

TODO: describe use of blockcypher.com APIs

Bitclout's API endpoints for currency transactions seem likely to be wrappers proxying to www.blockcypher.com's APIs.

There are direct calls to blockcypher.com APIs and others to api.Bitclout.com which appear to negotiate IDs and hashes related to blockcypher.com APIs.

If you need help LMK!

Issues with Bitclout one pager / white paper

Document key concerns and doubts:

1. "significantly higher throughput and scale [than Bitcoin]" - experience and observation show this to be false with Bitclout up and down and inconsistent throughout the day when it has high traffic or rolls out core code changes to the Angular app.

2. "Like Bitcoin, BitClout is a fully open-source project and there is no company behind it-- it’s just coins and code." - not at all like Bitcoin in that the source code repository and versioning history is closed/secret as of the publication time of the white paper and to date (4/13/2021). Nor is there any explicit selection of an accepted open source license, such as Bitcoin's MIT license, nor any formal declaration of public domain "unlicense," only the phrase "fully open source" with no further context or clarification.

3. "The price of BitClout doubles for every million BitClout sold. This makes BitClout naturally scarce, resulting in 10 to 19 million BitClout minted in the long run (less than Bitcoin’s max supply of 21 million)." - issue is that doubling the price doesn't make a resource scarce.

4. "the value of someone’s coin should be correlated to that person’s standing in society. For example, if Elon Musk succeeds in landing the first person on Mars, his coin price should theoretically go up. And if, in contrast, he makes a racial slur during a press conference, his coin price should theoretically go down." - conclusions without premises or evidence. "should" is a market prediction here derived from unexplained assumptions or principles.

5. "Thus, people who believe in someone’s potential can buy their coin and succeed with them financially when that person realizes their potential." - more conclusions derived without premises established.

6. "with BitClout you can buy someone’s coin and then retweet them" - "Coming soon! Reclouting is not currently implemented." pops up whenever anyone tries to use the "retweet" or "reclout" function in Bitclout. UPDATE: reclouting function appeared overnight 4/9/2021.

7. "If you know someone with a lot of clout, or if you know someone who knows someone, you can buy a coin and send it to someone else so that they can buy and retweet them." - everyone realizes intuitively after some reflection or having associated BitClout and Black Mirror’s Nosedive episode the absurdities and harm that would also be unleashed by such a platform. Influence peddling is regulated if not prohibited and illegal in many areas of business, technology, healthcare, law, military and politics. Not clear the pros would outweigh the cons but this white paper doesn't go into any depth on such things.

8. "an 'automated market-maker,' and it’s the same concept that powers protocols like Uniswap and Bancor." - TODO: research this claim.

9. "Just like Bitcoin, anyone on the internet can run a BitClout 'node' that serves the BitClout content, and every node on the network stores a full copy of all the data" - Not "just like Bitcoin" because where's the code other than the released version we can see behind Cloudflare? Where is the repository, source code, version history, and organization to manage commits to the codebase that is being deployed live to the Internet via accounts with Cloudflare and other organizations currently?

10. "anybody can build apps on top of the BitClout data without the risk of being de-platformed" - false. The whole platform depends on Cloudflare account setup for DNS and SSL over which someone has control and for which someone is paying. The risk of being de-platformed is high if you choose to build on something over which you have no control and into which you only have access via reverse engineering.

11. "When you visit bitclout.com, you’re using our node, but there are already dozens of nodes on the network, all run by people like you." - There is no proof of this assertion nor definition of what "node" means in that claim. All we have knowledge of, as far as I am sure yet, are several Angular instances (aka “nodes” because they run on Node js in a kubernetes cluster), which we can deduce from unique instance IDs in externally exposed HTTP headers.

Document Logout

Logout shows this screen and message:

TODOs: help the public understand BitClout end to end

TODO: please investigate and document, maybe create separate issues for:

1. There’s a “Sell” link shown next to “Buy” in the Bitclout web UI that I can never seem to find again after registering an account. How is this handled in the code and styling? What conditions determine the presence of the Sell link?

UPDATE 4/10/2021: BitClout code in main.js was updated again since yesterday. The "Sell" functionality has changed and shows up under Creator Coin tab ... works partially, and not going to mess with it more til I update the code here again. Working on it ... DONE. Latest main.js is formatted and checked in.

2. What factors determine the ranking of posted content updates in BitClout’s Global content feed to users?

3. Users of Bitclout often assume (easily observable on Reddit, clubhouse and WhatsApp discussions) that all their posts, content and personal account information is stored in BitClout’s blockchain. According to @HPaulson’s analysis via the explorer API, there are only cryptocurrency transactions between wallets’ public keys. Image data is saved on Imgur. Unsure where the post contents are saved yet.

TODO: describe the use of cookies to carry transaction and public key data.

pull latest code from bitclout domain

Last night the site updated and the reclout function has been implemented.

This implies the code has changed abd there should be some new versions of files to pull down, diff and version.