importScore() in IexecMaintenanceDelegate can be used to wrongfully reset worker scores  Acknowledged
The import of worker scores from the previous PoCo system deployed on chain is made to be asynchronous. And, even though the pull pattern usually makes a system much more resilient, in this case, it opens up the possibility for an attack that undermines the trust-based game-theoretical balance the PoCo system relies on. As can be seen in the following function:\\n```\\nfunction importScore(address \\_worker)\\nexternal override\\n{\\n require(!m\\_v3\\_scoreImported[\\_worker], "score-already-imported");\\n m\\_workerScores[\\_worker] = m\\_workerScores[\\_worker].max(m\\_v3\\_iexecHub.viewScore(\\_worker));\\n m\\_v3\\_scoreImported[\\_worker] = true;\\n}\\n```\\n\\nA motivated attacker could attack the system providing bogus results for computation tasks therefore reducing his own reputation (mirrored by the low worker score that would follow).\\nAfter the fact, the attacker could reset its score to the previous high value attained in the previously deployed PoCo system (v3) and undo all the wrongdoings he had done at no reputational cost.
Resolution\\nUpdate from the iExec team:\\nIn order to perform this attack, one would first have to gain reputation on the new version, and lose it. They would then be able to restore its score from the old version.\\nWe feel the risk is acceptable for a few reasons:\\nIt can only be done once per worker\\nConsidering the score dynamics discussed in the “Trust in the PoCo” document, it is more interesting for a worker to import its reputation in the beginning rather then creating a new one, since bad contributions only remove part of the reputation\\nOnly a handful of workers have reputation in the old system (180), and their score is low (average 7, max 22)\\nWe might force the import all 180 workers with reputation >0. A script to identify the relevant addresses is already available.\\nCheck that each worker interacting with the PoCo system has already imported his score. Otherwise import it synchronously with a call at the time of their first interaction.
```\\nfunction importScore(address \\_worker)\\nexternal override\\n{\\n require(!m\\_v3\\_scoreImported[\\_worker], "score-already-imported");\\n m\\_workerScores[\\_worker] = m\\_workerScores[\\_worker].max(m\\_v3\\_iexecHub.viewScore(\\_worker));\\n m\\_v3\\_scoreImported[\\_worker] = true;\\n}\\n```\\n