Is there anything stopping someone from making 1000 accounts or bots to artificially upvote posts on the Lemmy network?

I guess a single instance can moderate its users using captcha etc. but since it’s federated an evil actor could setup an instance without these restrictions.

An instance could maybe protect its users against this by blocking the domains of evil instances, but does this approach scale?

A solution might be to add a limit to the number of upvotes to accept from a single instance in a certain time frame, but that wont work if the other instance is very large and the upvotes are legitimate.

I’d like to hear if this issue has already been thought out or what ideas that you might have.