In a research post published on November 13, Circle describes Anduin, an experimental ranking system for agentic marketplaces that scores service providers according to who has already paid them — and by whether those payers overlap with a given buyer's own payment history. Its design goal is deliberately narrow: force anyone attempting to fake a provider's popularity to spend money at businesses they do not own.

Fake Customers Cost Almost Nothing to Make

A Sybil attack involves a single operator posing as many independent participants. In an agent marketplace, that means spinning up buyer wallets and using each of them to pay the operator's own service, so a storefront that has never served a real customer appears busy. The transfers are genuine on-chain transactions, but the money never leaves the operator's hands; network fees are the only thing actually spent.

The accompanying research paper puts a figure on how cheap the trick is: under the usage-based metrics marketplaces rely on today, pushing a fake provider's reputation up to the marketplace median costs about $0.0027. Reviews are not a fallback. Across the 66 million payments the researchers examined, fewer than 4,000 carried a voluntary on-chain rating.

Those payments move over the x402 standard, which lets a service return its price in an HTTP 402 response and lets software settle payment inside the request, with no account or checkout step. That is what makes agent-to-service purchasing work — and also what makes a crowded storefront so easy to fabricate. Coindoo has looked separately at what an x402 payment does and does not reveal about who is behind it.

How Anduin Turns Payments Into a Price

The researchers model every buyer and provider as a node in a graph, with payments as the links between them, weighted by how much was paid, how often and how recently. A standard recommender, collaborative filtering, works on that graph by finding buyers who resemble a given user and recommending what those similar buyers purchased. It has no way to tell a cluster of real customers from a cluster of wallets funded by the seller; both look like demand.

Anduin reads the same graph differently. It starts from the providers a buyer already pays and treats them as the buyer's trusted anchors. Suppose an agent regularly pays a translation service. Other buyers also pay that translator, and some of them pay a data provider the agent has never used. The data provider earns a recommendation through that path, and the strength of the recommendation is bounded by the real money flowing along it.

That bound is the whole point. Payments between wallets the attacker controls never touch one of the buyer's trusted providers, so they contribute nothing to the path. To manufacture a connection, the attacker has to pay the translator — a business it does not own — and cannot get the money back. The paper formalises this with three flow-based scoring variants and proves a lower bound on attacker spending for each; the variant Circle highlights is called Amplified Flow. The question that follows is how large that lower bound turns out to be on real data.

$8,259 to Fool Every Buyer, $291 to Fool the One That Matters

The researchers examined a 90-day window of x402 payments ending June 21 and identified 813 buyers who went on to pay a provider they had never used before. Each method was asked to rank providers for those buyers in advance; a hit meant the provider they actually chose next was ranked first. The attack test then asked how much an outsider would have to spend to place a new provider in first position instead.

The full dataset behind the study runs to 66.1 million payments worth about $6.1 million across 16 networks, collected between March 23 and August 26. Cost figures represent modelled attacker spending, network fees included — not recorded losses, according to Circle Research's Anduin paper.

Read across the results and the trade-off is clear: Anduin gave up 0.4 percentage points of prediction accuracy and made the attack roughly 23 times more expensive. Read down the other side and the picture is less comfortable. Topping the ranking for every buyer at once costs thousands — $8,259 in the test — while topping it for a single high-value buyer costs a few hundred dollars: $291. For a dishonest seller, the second number is the one that matters, because one well-chosen buyer is the realistic target.

Whether $291 deters anyone depends on what that buyer is worth to the attacker, and the paper does not estimate that side of the ledger. Its figures capture the cost of moving a ranking, not the revenue a fake provider could extract once it gets there. The deterrent is therefore a condition rather than a result: the scheme works where the reward stays below the price, and Circle's data cannot yet show where that line falls.

Where the Price Stops Holding

The lower bound rests on one assumption: money paid to a buyer's existing providers is gone for good. Circle states that colluding providers, and providers that quietly refund the attacker, fall outside Anduin's guarantee. If the translator in the example above is willing to take a cut and send the rest back, the attacker's real cost collapses to the fee, and the ranking becomes no harder to buy than before. Anduin also assumes the attacker controls none of the providers the buyer already uses; in an open market, that is a condition to verify, not a given.

The second gap is the empty graph. A buyer with no payment history has no trusted anchors, so there are no paths to follow and nothing to rank. Circle points to curated allow-lists as the starting point, while the paper itself notes that registries of vetted providers scale poorly once the volume of services outruns what human reviewers can audit. New providers face the mirror problem: until some buyer in the network has paid them, there is no path through which they can appear in anyone's personalised ranking.

A Ranking Is Not a Review

Even inside its assumptions, the experiment measures something narrower than trustworthiness. It scores a method as correct when the provider it ranked first is the one the buyer paid next — a test of whether the ranking matches purchasing behaviour rather than service quality. Buyers routinely pay for data that turns out to be wrong, translations that are unusable and reports that never arrive; each of those payments would still count as a hit.

“Previously paid” is not “independently reviewed,” and a strong Anduin score verifies neither the identity behind a provider nor the output it returns. The gap Coindoo described between wallet inflows and customer revenue applies here too: the chain records the transfer precisely and leaves its commercial meaning open.

In practice, that places payment-based reputation alongside two other controls rather than above them. Spending permissions cap how much an agent may pay. Rankings like Anduin narrow where it should look. Checking the delivered result is the only step that answers whether the purchase did its job, and a graph that is harder to game does not remove it.

What Would Turn the Experiment Into Protection

Circle labels Anduin research, not a released service, and the evidence that would change that is specific. A deployment would need to show how the ranking holds up when a provider's recommendations have been manipulated, how new buyers get past the allow-list stage, what happens when a trusted provider turns out to be colluding, and whether the providers it ranks highly deliver work that agents actually accept.

The $8,259 figure answers one question well: how much it costs to fake a crowd. The harder questions start once the crowd is real.