the sybil attack is still possible, but using some kind of  recaptcha would indeed make a sybil attack much harder and more expensive for the attacker. Maybe even some decentralized authentication is possible for transactions? https://medium.com/@linonetwork/proof-of-human-engagement-on-decentralized-networks-6a87f50d7d55