> However, no mention is made of a way to ensure the user attention data reported is legitimate.

Exactly. Looks like a race problem, again. Just looking at the diagram on their site (user gets tokens for attention), I immediately thought "Write and deploy attention signaling bots" ...