Arbitrum Airdrop Review: There are four major loopholes, and the witch address earns more than 21% of the airdrop tokens

Original author:first level title

overview

overview

The long-awaited Arbitrum finally released the airdrop news, and subsequently, they also announced the rules for checking Sybil addresses.

According to the described rules, we can infer the project party:

1. Cross-chain bridges, centralized exchanges and smart contracts are excluded when detecting Sybil

2. A relatively lenient detection method is adopted for small-scale and same personal addresses

3. Only data before the snapshot (February 6, 2023) was used for sybil detection

4. Only use Arbitrum and Ethereum data for Sybil detection, while ignoring other Ethereum L2 data such as Optimism and Polygon.

Through our in-house fan/syven address identification model, we successfully identified over 279,328 fannish addresses and 148,595 syven addresses that received the airdrop.

first level title

Doujin address

Fan addresses are addresses that are controlled by the same entity. We run the Louvain community detection algorithm on the subgraph consisting of all 624,136 airdropped EOA addresses (incidentally, there are also 1007 airdropped contract addresses, which we will disclose later). The results showed that a total of 279,328 addresses formed more than 60,000 communities. Since personal addresses in the same community have frequent transfers of funds, they are considered fan addresses. They account for approximately 47.96% of the total 557 million tokens or Arbitrum airdropped tokens.

The following is the size of the fan address group and the distribution of the corresponding tokens that can be collected (unit: token).

first level title

witch address

We further examined these fanfic addresses and established the strictest filtering criteria to identify witch addresses among them. A total of 148,595 Sybil addresses received the airdrop. They account for approximately 21.8% of the total 253 million Arb or airdropped tokens. A Sybil address is made up of two parts:

1. A community with a large number of doujin addresses

2. Highly credible witch addresses identified by X-explore on Ethereum and multiple Ethereum L2 (Arbitrum, Optimism, etc.)

In order to combat sybil detection, the Lu airdrop group uses cross-chain bridges, centralized exchanges, and smart contracts to prevent direct connections between a large number of addresses, and make each address as independent as possible to evade sybil detection. In Arbitrum's sybil removal, the project party also removed physical addresses, such as cross-chain bridges, exchanges, and smart contracts. According to our analysis, some Lu airdrop teams successfully countered the detection rules, and a large number of addresses received this airdrop.

Case 1: CEX Witch

Addresses more than 250 examples of CEX witch identification.

1. From August 24 to August 28, 2022, a total of 2,997 addresses that received airdrops withdrew funds from the Binance exchange (0x b 38 e 8 c 17 e 38363 af 6 ebdcb 3d ae 12 e 0243582891 d). Withdrawal amounts were pretty consistent, between 0.00114 and 0.00116 ETH (about $2). These addresses received a total of 1.83 million airdrop tokens.

2. Between June 3rd and June 4th, 2022, a total of 1001 addresses that received the airdrop withdraw funds from the FTX exchange (0x a 60113 f 7 d 4313091980 2b 0863 abdcdb 956664 f d5). Withdrawal amounts were pretty consistent, between 0.0022 and 0.0023 ETH (about $4). These addresses received a total of 1.04 million airdrop tokens.

3. Between November 27 and November 30, 2022, a total of 645 addresses that received airdrops withdrew funds from Binance (0x b 38 e 8 c 17 e 38363 af 6 ebdcb 3d ae 12 e 0243582891 d). The withdrawal amount is very consistent at 0.05 ETH (~$9). These addresses received a total of 700,000 airdropped tokens.

4. Between October 29 and November 1, 2022, a total of 1,035 addresses that received airdrops withdrew funds from Binance (0x b 38 e 8 c 17 e 38363 af 6 ebdcb 3d ae 12 e 0243582891 d). The withdrawal amount was very consistent at 0.003 ETH (~$5). These addresses received a total of 980,000 airdropped tokens.

5. On February 6, 2023, 294 addresses that received the airdrop withdraw funds from Binance (0x b 38 e 8 c 17 e 38363 af 6 ebdcb 3d ae 12 e 0243582891 d). The withdrawal amount was very consistent at 0.0008 ETH (~$1.5). These addresses received a total of 291,000 airdropped tokens.

6. On December 12, 2022, 273 addresses that received the airdrop withdraw funds from Binance (0x b 38 e 8 c 17 e 38363 af 6 ebdcb 3d ae 12 e 0243582891 d). The withdrawal amount was very consistent at 0.0095 ETH (~$17). These addresses received a total of 242,000 airdropped tokens.

7. On August 19, 2022, 261 addresses that received the airdrop withdrew funds from the FTX exchange (0x a 60113 f 7 d 4313091980 2b 0863 abdcdb 956664 f d5). And the amount of funds withdrawn was very consistent at 0.003 ETH (~$5). These addresses received a total of 189,000 tokens.

We further took out these sybil addresses that withdraw coins from the FTX exchange. In addition to the consistent amount of funds, they also have very consistent smart contract calls.

Note: Nodes in the graph represent addresses, and edges represent interactions between addresses.

Case 2: Cross-chain bridge witch

Examples are as follows:

1. During the period from November 02 to November 07, 2022, a total of 1114 addresses receiving airdrops cross-chain through the HOP bridge (0x 33 ceb 27 b 39 d 2b b 7 d 2 e 61 f 7564 d 3d f 29344020417 ) to Arbitrum. Deposit amounts were very consistent, with a total of 1.08 million tokens received by these addresses.

Case 3: Smart Contract Witch

Address 0x 922008 a 118 feff 7 fb 017 ee 67 eb 3 b 02371 e 559999 Deposit funds via the Disperse contract to 1,274 airdrop addresses. The deposit amount is pretty consistent at 0.0005 ETH (~$8). These addresses received a total of 1.059 million tokens.

Similarly, the number of Sybil addresses that avoid direct connections via the Disperse contract (one address that deposits funds into 50 different airdrop addresses) is 9483. These addresses received a total of 10.98 million tokens.

Case 4: Sybil Funds Imposition After Snapshot

We have selected a representative example from this type of witches. The example witch has a total of 198 addresses and has acquired 174,375 tokens. Although these addresses have obvious pooling behavior, they were not excluded from the airdrop addresses because the collection behavior occurred after the snapshot.

Case 5: Witches on Other Chains (Optimism)

We have selected an example that represents this kind of witch. The example witch contains a total of 202 addresses and has earned 204,250 tokens. These addresses also had very similar transaction records on Arb, but with slightly different transaction amounts and times, so they were not identified as Sybils. However, they also have the same transaction on the OP. It is worth mentioning that X-explore can not only identify witch addresses on Arbitrum, but also supports Ethereum L2 such as Ethereum and Optimism.

We can infer that the rules laid down by Arbitrum were not effective in preventing the following four types of witches:

● witches with less than 20 addresses

● Witch deposits and withdrawals through exchanges, cross-chain bridges, and smart contracts

● Sybils with obvious NFT or fund-sweeping behavior after the snapshot

● Sybil with obvious batching behavior on other chains, such as OP, Ethereum

Smart contracts receive airdrops:

example:

0x 8 c 44 c 0 ab 9 a 15 bacad 7 a 4 b 663 a 89593 c 406 c 6 b 4 ea

0x 44 e 4 c 3668552033419520 be 229 cd 9 df 0 c 35 c 4417 

0x 6 e 87672 e 547 d 40285 c 8 fdce 1139 de 4 bc 7 cbf 2127 

0x 8585 a 10 f 59 fd 4 dd 6 e 7 d5 e 19254 d5 a 791 dc 25 f 3 f 4 

Introduction

Introduction

Witch recognition has always been a hot potato for project parties. On the one hand, the project party needs an army of airdrops to support the popularity of the project, and on the other hand, it has to bear the risk of the witch's profit and the risk of the market plummeting after the witch cashes out. According to X-explore's estimation, the airdrop contains about 150,000 sybil addresses and at least 4,000 sybil communities, and the total profit of sybil addresses exceeds 253 million tokens.