224

It was reported on MSO that it is possible for a user to upvote or downvote more than once on a single post (resulting in reputation changes for the author for each vote).

After some data examination, we were able to confirm that this vulnerability exists (it is happening due to race conditions surrounding vote submission), and has been in the system since literally the first day that the site went live.

While there is some evidence that a few users have knowingly abused this, the spread of votes suggests that in nearly every instance, users submitted duplicate votes by accident.

Duplicated votes exist on every site in the network. Here are the sites that had the highest numbers of duplicate votes before invalidation (after that, the numbers quickly went down to fewer than 100 per site):

  1. Stack Overflow: ~13K
  2. Mathematics: ~3K
  3. Stack Overflow in Russian: ~1K
  4. Biblical Hermeneutics: ~950
  5. Stack Overflow in Portuguese: ~940
  6. MathOverflow: ~550
  7. English Language and Usage: ~450
  8. Cross Validated: ~430
  9. Physics: ~300
  10. English Language Learners: ~220

Because of the nature of the race condition, the relative infrequency of occurrences, and the potential negative ramifications for performance that could happen if we were to fully eliminate the race condition, we are not going to be changing the way in which votes are recorded on the site. Instead, we have completed a one-time cleanup for all duplicate votes in the database, and a daily cleanup for the small number of duplicate votes that are registered each day has been enabled.

Even with the daily cleanup in place, we will consider intentional usage of this bug to be misuse of Stack Exchange systems. We will be monitoring this, and will consider these to be in the same league as other types of voting fraud, so anyone who was thinking about experimenting with this, please consider yourself forewarned.

If you have any questions or comments, please post them as answers below, and we'll be happy to answer them.

Improve this question
33
  • 6
    Will this also correct the extra down vote caused by spam flags? I always assumed that was deliberate. (I think is caused by spam flags; it's also likely spammy posts just collect down votes very quickly and it's co-incidence.)
    – BSMP
    Commented Jun 24, 2022 at 8:10
  • 4
    @MadScientist It's possible for a user to place multiple close or reopen votes on a question. Those votes age away after a time (time varies, depending on the number of views and existence of other such votes by other users). 14 days after the vote ages away, the user is allowed to place another, potentially identical, vote. This can be repeated any number of times. So, no, that's not sufficient to make them unique.
    – Makyen
    Commented Jun 24, 2022 at 14:33
  • 13
    @BSMP Downvotes resulting from spam flags should not be affected by this change.
    – Slate StaffMod
    Commented Jun 24, 2022 at 15:57
  • 165
    It's great to clean up the duplicate voting from this bug. +2, I mean, +1.
    – rgettman
    Commented Jun 24, 2022 at 18:47
  • 5
    I've seen many reports of this here. In all those cases, it was because two accounts had voted on the same post and were later merged.
    – Sonic the Anonymous Hedgehog
    Commented Jun 24, 2022 at 19:05
  • 7
    @SonictheSaveUkraine-hog Yeah, that does sometimes result in duplicate votes appearing on the same post from the same post-merge account. Those votes will also be removed by this cleanup.
    – Slate StaffMod
    Commented Jun 24, 2022 at 20:22
  • 12
    Reminds me of this: instead of fixing the roof, place a bucket to collect the water. This is still much better than having the water ruin the house. :)
    – Shadow Wizard
    Commented Jun 26, 2022 at 8:47
  • 2
    Unintented clickbait title mentioning "duplicate votes"... but I guess it worked because I'm here ;) Thanks for the heads-up.
    – Andras Deak -- Слава Україні
    Commented Jun 26, 2022 at 23:08
  • 21
    @MartinZeitler everything has its tradeoffs. Preventing this from ever happening would require a good deal more work than what we ended up doing (especially since the issue is triggered in a number of different ways). And the issue happens infrequently enough that adding additional queries after every vote, or locking posts completely while processing a vote in order to prevent duplicate votes (frequency: approximately 1:20K votes) is adding on a good deal of additional processing to a very common action where the benefit is barely felt (but the impact of the additional queries can be felt).
    – Yaakov Ellis StaffMod
    Commented Jun 28, 2022 at 6:31
  • 2
    @MartinZeitler: If it were my system I would insist on an atomic solution, but I don't have a problem with stackexchange deciding that a daily cleanup is good enough.
    – Joshua
    Commented Jun 28, 2022 at 21:51
  • 3
    We have many legitimate cases that would violate a constraint. To avoid these cases would require re-engineering a number of unrelated voting scenarios, and would force us to clean up data that we want to keep. It is not an option.
    – Yaakov Ellis StaffMod
    Commented Jun 29, 2022 at 16:52
  • 5
    Currently it is possible to vote on a post on one site and then if it is migrated (with votes preserved) then vote again on it on the target site. Will this sort of duplicated vote also be affected?
    – Martin Smith
    Commented Jun 30, 2022 at 11:26
  • 4
    @MartinSmith that type of thing will be cleaned up by the daily job
    – Yaakov Ellis StaffMod
    Commented Jun 30, 2022 at 11:58
  • 2
    @T.J.Crowder it was done last week. Was edited in then, and I just updated it to try to make this more clear.
    – Yaakov Ellis StaffMod
    Commented Jun 30, 2022 at 13:19
  • 2
    Does this mean that users can potentially lose a lot of reputation?
    – ᴇɴᴅᴇʀᴍᴀɴ
    Commented Jul 1, 2022 at 18:05

6 Answers 6

Reset to default
86

so anyone who was thinking about experimenting with this, please consider yourself forewarned.

I don't intend to use this maliciously, but I do have a habit of pressing buttons twice (or more) when they don't succeed before the system registers it. How will you distinguish abuse from mindless fortuitous clicking?

Improve this answer
10
  • 3
    I suspect other than rep loss, there won't be a penalty for this?
    – Journeyman Geek Mod
    Commented Jun 24, 2022 at 9:10
  • 5
    @JourneymanGeek I'm asking about the voters not the users receiving the vote.
    – bad_coder
    Commented Jun 24, 2022 at 9:12
  • 30
    My mouse does this by itself, just saying. Prefer not to be penalised, but will take my lumps for buying something that glows rainbow colours rather than being technically efficient.
    – W.O.
    Commented Jun 24, 2022 at 9:54
  • 59
    Looking at the actual data, there is a small number of users that stand out very blatantly as likely having abused this (target of many many votes). These are distinguishable from users where it accidentally happens every so often. If you are in the second group, I wouldn't worry about it.
    – Yaakov Ellis StaffMod
    Commented Jun 24, 2022 at 10:23
  • 2
    @YaakovEllis so you're looking at recipients of the votes to determine abuse? That seems safer.
    – AncientSwordRage
    Commented Jun 24, 2022 at 14:25
  • 14
    @AncientSwordRage both recipients and casters, we'd look at both :)
    – Cesar M StaffMod
    Commented Jun 24, 2022 at 20:49
  • 3
    @YaakovEllis just now, I upvoted Jiminy and your comment once, and it registered as two upvote each. Is this duplicate vote really rare?
    – Vylix
    Commented Jun 28, 2022 at 11:52
  • 18
    @Vylix: Unlike upvotes on questions and answers, comment upvotes do not get updated in real time. So someone likely upvoted the comments while you had this page open. So after you upvoted the comments, the number of upvotes on the respective comments was updated.
    – Justin
    Commented Jun 28, 2022 at 16:45
  • 1
    @YaakovEllis In terms of casters, I think poor network connection might be a distinct possibility, entirely benign due to POST requests being received by the server but the response not arriving back. So the caster just tries again.
    – Charlieface
    Commented Jul 10, 2022 at 5:43
  • I did that on your post and nothing happened:) seems i cant reproduce the bug.
    – D. Sikilai
    Commented Jul 13, 2022 at 11:56
30

There's no difference in the achievement inbox and the profile page between 'regular' serial voting reversals and duplicate voting reversals, or I assume so?

enter image description here

enter image description here

Then it's probably worth mentioning this as a special case in the Help Center page, which starts with "When a single user continually votes (up or down) on many of your posts within a short period of time". Another case to consider would be invalidation of 'random' votes cast by badge hunters.

Improve this answer
5
  • 13
    Correct, it will show up with the same "voting corrected" label as serial voting invalidations.
    – Yaakov Ellis StaffMod
    Commented Jun 27, 2022 at 10:25
  • 11
    I've made an internal note to update the Help Center page.
    – Slate StaffMod
    Commented Jun 27, 2022 at 16:28
  • 3
    Thanks @Slate. Here is some inspiration: meta.stackexchange.com/a/379864/295232
    – Glorfindel Mod
    Commented Jun 27, 2022 at 16:39
  • 2
    @Glorfindel Thanks, very helpful. I've pushed an edit through network-wide (translations pending).
    – Slate StaffMod
    Commented Jul 5, 2022 at 23:48
  • "duplicate voting reversals" What is that?
    – convert
    Commented Jan 5, 2023 at 19:07
24

I had seen a prior report about duplicate votes, but in those cases, it was not due to a race condition, but rather because two profiles had voted on the same post and were later merged.

Two questions here:

  1. The same issue here (with account mergers) also formerly affected bookmarks and follows, as mentioned here. While that issue was fixed for future mergers (bookmarks and follows coming from the source account would be deleted), will this task fix it for the previous cases?

  2. One thing I've seen anecdotal reports of is users who upvoted the same post from one profile and downvoted it from another profile, which was later merged into the first. In that case, the system would show both the up and down arrows glowing on the same post. Will this task fix those cases as well?

Improve this answer
2
  • 18
    I'm answering this by reading unmerged code, so take this with a grain of salt. My understanding is that (1) will not be fixed by this change, and (2) will always preserve the vote with the lowest integer ID. (Since it's a race condition, I don't know if there's a good way to predict whether the upvote or downvote will be preserved.)
    – Slate StaffMod
    Commented Jun 24, 2022 at 20:31
  • 9
    I can confirm the veracity of what Slate wrote. This fix is not addressing either of the other two issues listed here.
    – Yaakov Ellis StaffMod
    Commented Jun 25, 2022 at 18:21
8

Although it will likely be small, this will still affect some users who will lose reputation during the cleanup. How will the system communicate the change to those users? Will it be reported in the reputation section of their profiles? How will it be labelled there? Will the label contain a link to this explanation?

Improve this answer
6
  • 5
    probably the message will be: "voting corrected"
    – Luuklag
    Commented Jun 27, 2022 at 7:42
  • @Luuklag true, but since this one here is much more rare, there's chance there won't be any notification or message.
    – Shadow Wizard
    Commented Jun 27, 2022 at 7:50
  • 16
    It will show up with the "voting corrected" label (see Glorfindel's answer for a screenshot). There will not be a link to this explanation.
    – Yaakov Ellis StaffMod
    Commented Jun 27, 2022 at 10:26
  • I got a voting corrected message a couple of days ago and 10 points taken away.
    – Dexygen
    Commented Jun 29, 2022 at 7:20
  • @Dexygen yeah, same here. Looks like Yaakov was telling the truth. :-)
    – Shadow Wizard
    Commented Jun 29, 2022 at 7:35
  • See meta.stackexchange.com/a/379854/213957
    – PM 77-1
    Commented Jul 1, 2022 at 15:02
5

In the bug report "Double booked - User bookmarking question recorded twice" (asked Sep 11, 2020 at 3:53) this double voting was reported and confirmed for Bookmarks, and acknowledged for all types of voting:

"Ultimately we might want to handle duplicate votes of all types, but those have a higher potential for edge cases (for example, how far would we want to or need to go to reverse any effects that those votes had - deleted posts, post owner's reputation, etc), so for now, we're going with the two simplest cases - bookmarks and follows.

Future user merges will take care of duplicate bookmarks and follows by soft-deleting the ones coming in from the merged user, and I've also removed the duplicate bookmark for this specific user.

Thanks for the report!

answered Oct 15, 2021 at 20:06 - Adam Lear"

Improve this answer
-3

I don't understand what is the point in "punishment" if there's nothing left to exploit after you've added a daily cleanup?

Why even bother with monitoring anything, "punishing" people and then dealing with inevitable false positives if there's nothing to exploit now?

If there are technical solution to the problem, drop all "political" ones. As long as technical is 100% working, it is always better.

Improve this answer
2
  • 3
    The bug allowing more than one vote by same user on same post was not fixed. Doing this (voting more than once on same post) is still against the rules and should be dealt with, even if it's being cleaned up. I'm not sure what makes you want to let users vote several times on same post, and also your last sentence is totally unclear and weird. What on Earth politics got anything to do with a voting bug???????
    – Shadow Wizard
    Commented Jul 13, 2022 at 7:05
  • 1
    You could make this argument about all bad behavior on the site though: spam, defacing posts, serial voting, etc. All of it is cleaned up and undone but we still punish the people who do these things. I don't see a benefit in allowing bad actors to keep acting badly.
    – BSMP
    Commented Jul 14, 2022 at 17:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .