HN Explorer

Tell HN: FluenceLabs are pushing out crypto tokens to FOSS devs, unclear if scam

7 points by tetris11 ↗ HN
I got an email this morning reading:

    > Hello, tetris11
    >
    > I'm writing in regards to your github profile.
    > Fluence Network have been awarding their tokens to developers
    > who have made commits to open source web3 repositories in
    > 2023.
    >
    > According to my research, your GitHub profile is eligible to
    > claim <number> FLT tokens due to your web3 contributions.
    
    > As of the current market value, these tokens are approximately
    > worth $<value>. Please, note that you can exchange them for Ethereum
    > or USD in two months after claiming them. These  tokens can be
    > exchanged on any exchange platform.

    > For verification and to claim your tokens, you can visit Fluence's official Twitter profile:
    > https://x.com/fluence_project/status/1775354001955151999 where
    > they have posted the official claim link. Also you can find some
    > instructions on their GitHub repo: fluencelabs/dev-rewards
    
    > If you do collect your tokens, it would be appreciated if you
    > could share a percentage with me as a finder's fee. My Eth
    > wallet address: <some long hex>
    
    > Feel free to reach out to me on my social networks -  telegram:
    > @<sometelegram>, twitter: @<sometwitter>, primary email address: <someemail>@gmail.com
    
    > best regards
    > <NAME>
I guess I have to ask. This is a crypto scam, right? One that requires you to sign with the same SSH keys you use in Github?

10 comments

[ 3.7 ms ] story [ 39.0 ms ] thread
laken
hadn't heard of this project before, but their github does include instructions on how to claim it even in a network-less dedicated docker container if you're truly paranoid.

https://github.com/fluencelabs/dev-rewards/blob/main/MANUAL_...

cedws
I wouldn’t trust it. I got the same email as OP and checked it out. I suspect they somehow embed the user’s private key in the output “proof” so that they can then start pushing malicious code to all your GitHub repositories. I wasn’t able to confirm that this is what actually happens, but it is definitely fishy.

If they genuinely wanted proof of account ownership there are other ways to do it. OAuth, for example.

KomoD
> I suspect they somehow embed the user’s private key in the output “proof” so that they can then start pushing malicious code to all your GitHub repositories.

> I wasn’t able to confirm that this is what actually happens

So it's a baseless accusation, you can see exactly what happens.

tgrecojs
"baseless accusation" is wild. have you not observed the result of 99.999999999999999999999% of emails that randomly tell people you are eligible for receiving some token allocation?