It was reported on MSO that it is possible for a user to upvote or downvote more than once on a single post (resulting in reputation changes for the author for each vote).
After some data examination, we were able to confirm that this vulnerability exists (it is happening due to race conditions surrounding vote submission), and has been in the system since literally the first day that the site went live.
While there is some evidence that a few users have knowingly abused this, the spread of votes suggests that in nearly every instance, users submitted duplicate votes by accident.
Duplicated votes exist on every site in the network. Here are the sites that had the highest numbers of duplicate votes before invalidation (after that, the numbers quickly went down to fewer than 100 per site):
- Stack Overflow: ~13K
- Mathematics: ~3K
- Stack Overflow in Russian: ~1K
- Biblical Hermeneutics: ~950
- Stack Overflow in Portuguese: ~940
- MathOverflow: ~550
- English Language and Usage: ~450
- Cross Validated: ~430
- Physics: ~300
- English Language Learners: ~220
Because of the nature of the race condition, the relative infrequency of occurrences, and the potential negative ramifications for performance that could happen if we were to fully eliminate the race condition, we are not going to be changing the way in which votes are recorded on the site. Instead, we have completed a one-time cleanup for all duplicate votes in the database, and a daily cleanup for the small number of duplicate votes that are registered each day has been enabled.
Even with the daily cleanup in place, we will consider intentional usage of this bug to be misuse of Stack Exchange systems. We will be monitoring this, and will consider these to be in the same league as other types of voting fraud, so anyone who was thinking about experimenting with this, please consider yourself forewarned.
If you have any questions or comments, please post them as answers below, and we'll be happy to answer them.