How Viberank Checks Submissions (and the Fake #1 We Removed)

For a few days in October, the #1 spot on Viberank, on both cost and tokens, belonged to a profile with about $25,900 of real usage and one day worth $1,825,000. Two users reported it on GitHub (#182), with numbers that showed the profile didn't add up. They were right. Here is what that day was, why our checks let it in, what we changed, and what any leaderboard built on self-reported usage can and can't prove.

What the day was

Every submission is archived as it arrives, so we could read the original. The day carried 18.25 trillion tokens, all of them cache reads, with zero input or output. It was billed to a model called synthetic-demo-not-a-real-model. The payload said so itself: it was marked "synthetic": true and described as a demonstration fixture where no actual usage occurred. It was sent without a sign-in token, so anyone could have sent it under that name. We don't assume who did.

We deleted that one day and recomputed the profile from its remaining days. The rest of the profile's history is untouched.

Why it got through

The number wasn't random. $1,825,000 is exactly $5,000 × 365, the cap we placed on a report's total cost. Our cost-per-token floor charges each token at least $0.0000001, and 18.25 trillion tokens × $0.0000001 is, again, exactly $1,825,000. The day sat precisely on two limits, and both checks use strict comparisons, so it passed both. Cache reads are excluded from our token ceiling, because heavy honest users legitimately read hundreds of billions of cached tokens, so that check didn't apply either.

The real gap was simpler. The $5,000 figure was meant as a daily limit, but it was only ever applied to the total. Nothing looked at a single day, and nothing checked that a day's cost matched the models it claimed to come from.

What we check now

Every submission goes through these checks before it is stored:

• No single day over $150,000. We replayed all 4,960 archived submissions. The largest honest day on record is about $126,000, so real heavy users are unaffected. The only day this cap rejects is the synthetic one.
• Big days must add up. Any day over $5,000 must carry a per-model breakdown whose costs sum to the day's total within 10%. ccusage always emits that breakdown, so only hand-built payloads fail. Smaller days are exempt, because older CLIs and web uploads omit it.
• Every token must be paid for at its model's price floor. Inflating tokens without inflating cost pushes a report under the floor, and inflating cost without tokens pushes it over the ceiling. Cheap model families (DeepSeek, MiniMax and others) get a lower floor, but only for their own tokens.
• Machine IDs are checked. They can't take names the server uses internally, so a client can't write into slots it doesn't own.
• Re-submits never double count. Each machine's usage for a day is stored once and only ever replaced by a larger reading of the same machine, so running the CLI daily is safe.

What a verified badge means

A profile is verified when its submissions are signed with a token from npx viberank-cli login, which proves the GitHub account owner sent them. Unverified submissions can't write to a verified profile. Use the Verified toggle on the board to see only those.

What no usage leaderboard can prove

Viberank reads usage from your own machine's logs through ccusage. That is the only place the data exists: neither Anthropic nor OpenAI publishes per-user usage. So no check here can prove a number is real. They prove that it is internally consistent and plausible, priced the way ccusage prices it, and signed by the account it's shown under. A careful faker could still spread invented usage over many ordinary-looking days. That's why every submission is archived, why anomalies get a human look, and why reports like #182 matter.

Dollar figures on Viberank are API-equivalent: what the tokens would cost at list API prices. Most heavy users are on flat subscriptions, so this measures usage, not money out of pocket.

If something looks wrong

Open an issue on GitHub with the profile and what doesn't add up. Profiles show per-day and per-model figures, so you can usually check a number against itself, as the two reporters did here. Every report gets read.

The checks are in the open too: validateCcData in the source, with the rules written up in VALIDATION.md.