New research from a team of MIT engineers has found an alarming string of vulnerabilities in a leading blockchain voting system called Voatz. After reverse-engineering Voatz’s Android app, the researchers concluded that an attacker who compromised a voter’s phone would able to observe, suppress, and alter votes nearly at will. Network attacks could also reveal where a given user was voting and potentially suppress votes in the process, the paper claims.

Most troubling, researchers say that an attacker who compromised the servers that manage the Voatz API might even be able to alter ballots as they arrive, an alarming threat that distributed ledgers should theoretically protect against.

“Given the severity of failings discussed in this paper, the lack of transparency, the risks to voter privacy, and the trivial nature of the attacks, we suggest that any near-future plans to use this app for high-stakes elections be abandoned,” the researchers conclude.

Designed as a replacement for absentee ballots, Voatz’s blockchain-based voting project has been met with skepticism from security researchers but enthusiasm from many in the tech world, receiving more than $9 million in venture funding. Under the Voatz system, users would cast ballots remotely through an app, with identities verified through the phone’s facial recognition systems.

Voatz has already been used in a number of minor elections in the US, collecting more than 150 votes in the 2018 general election in West Virginia.

Voatz disputed the MIT findings in a blog post, calling the research methods “erroneous.” The company’s main complaint is that the researchers were testing an outdated version of the Voatz client software and did not attempt to connect to the Voatz server itself.

“This flawed approach invalidates any claims about their ability to compromise the overall system,” the blog post reads.

In a call with reporters, Voatz executives argued that server-side protections would prevent compromised devices from authenticating to the broader system. “All of their claims are based on the idea that, because they were able to compromise the device, they would be able to compromise the server,” said Voatz CEO Nimit Sawhney. “And that assumption is completely flawed.”

The Verge shared this critique with the MIT researchers who did not immediately respond.

Voatz also emphasized measures that allow voters and election officials to verify their votes after the fact. “Every ballot submitted using Voatz produces a paper ballot,” said product chief Hilary Braseth, “and every voter using Voatz receives a ballot receipt once they submit.”

Thus far, security experts have been unimpressed by those explanations. “The device just sends votes to a server,” Johns Hopkins cryptographer Matthew Green observed on Twitter. “The server might put them on a blockchain, but this doesn’t help if either device or server is compromised. Voatz needs to explain how they deal with this.”

In the post, Voatz also points to its ongoing bug bounty program and regular code reviews as evidence of the app’s robust security — but some researchers might not agree. In October, the company came under fire for making an FBI referral over an incident that sources told CNN was originated in a University of Michigan election security course. Others have criticized Voatz’s bounty program as onerous and hostile to researchers, which might explain why the MIT researchers did not take part.

Still, it’s not the first time security concerns have been raised about Voatz or blockchain voting, in general. In November, Sen. Ron Wyden (D-OR) wrote to the Pentagon to raise concerns about Voatz’s security and ask for a full audit of the app. The request was ultimately deferred to the Department of Homeland Security.

In response to the MIT report, Wyden offered harsh criticism. “Cybersecurity experts have made it clear that internet voting isn’t safe,” he said in a statement. “It is long past time for Republicans to end their election security embargo and let Congress pass mandatory security standards for the entire election system.”