Wormhole discloses Sybil detection method and airdrop reward details, and will review some users

Original author -Wormhole

Compilation - Odaily Nan Zhi

Since its launch in 2020, Wormhole contributors have spent over 3 years building and scaling Wormhole and began planning an egalitarian airdrop program that will maximize the chances of rewarding legitimate users of the protocol. The focus is on two main groups:

• Multi-chain applications and cross-chain users based on Wormhole;

• Key multi-chain community group.

In the past three years, on-chain users have sent more than 1 billion messages from millions of wallets through Wormhole’s messaging protocol, using multi-chain applications on 30 blockchains. These users will receive 81% of this airdrop. , about 549 million W.

Wormhole performs witch analysis on users, examining the ownership clustering and behavioral patterns of interacting wallets, weighting wallets based on transaction volume, usage time, consistency of on-chain activity, and other important factors. The witch analysis is performed byAlliumimplement.

The airdrop is targeted at more than 400,000 wallets in more than 30 chains. The airdrop data is as follows:

• Snapshot time: February 6, 2024 23:59 (UTC+ 8)

• Total number of qualified wallets: over 400,000;

• Airdrop volume: 678,823,000 W, accounting for 6.78% of the total volume.

• Allocation objects: On-chain users account for approximately 81% of the airdrop supply (approximately 549 million W), and community groups account for approximately 19% of the airdrop supply (approximately 129 million W).

Sybil detection rules

Ownership Graph

Ownership clustering is a core aspect of the analysis. Because Wormhole connects many different ecosystems - EVM, Solana, Move, etc., multi-chain airdrops are extremely challenging.

To maximize each users chance of qualifying for airstaking, Wormhole builds an ownership graph that assigns a unique user ID to a set of wallets belonging to that user, including those associated with any of the Wormhole ecosystem applications such as Pike, Wallets that interact with Mayan, Allbridge, Portal and many other DApps.

The ownership graph consolidates all transactions a user may make across different ecosystems under one user ID. This ensures that users are assessed based on all of their transactions rather than piecemeal actions based on activity in any particular ecosystem. This technology is also the first of several steps toward manually tagging contracts, protocol relay hot wallets, and large Sybil ownership clusters with hundreds or, in some cases, thousands of wallets.

Taking the above figure as an example, ownership of each interconnected wallet can be attributed to a user ID. This is used to determine rewards for individual users, although some wallets do not interact with each other. The total rewards for an eligible user are distributed among all wallets in their identified ownership cluster. therefore,The key is to check all wallets that have ever interacted with Wormhole ecosystem applications, whether receiving or sending tokens to redeem full rewards.

Fund source analysis

Sybil typically aims to fund clusters of hundreds to thousands of wallets from a single funding source. Each of these wallets then proceeds to execute its own set of transactions within the protocol. Wormhole checked whether the source funding behavior of each wallet exhibited obvious Sybil characteristics.

The analysis revealed two types of raw funding attacks:

• Diffusion funds:

  Wallet A→Wallet B, C, D...Z

• Sequential diffusion financing:

  Wallet A→B, wallet B→C,…

behavioral cluster analysis

While the Sybil funding source detection is effective, the Sybil strategy has evolved significantly over time.More sophisticated players may independently fund a large number of wallets directly from the exchange, in an attempt to circumvent the funding source detection algorithm. However,Executing this activity at scale requires automation and often exhibits patterns of behavior that distinguish them from legitimate users.. By using on the transaction similarity matrix of ownership clustersLouvain community detection algorithm，Wormhole can distinguish witches based on repeated operations and similar time intervals. The following figure provides a simplified example of this behavior:

(Odaily note: Louvain community detection is a widely used community discovery algorithm. It determines that nodes within the community have dense connections and only sparse connections with nodes outside the community, thereby identifying the dense area as a community, that is, in the Web3 concept of witch attackers.)

The algorithm maps transactions to unique IDs based on time, cadence, and actions to match the same or nearly identical behavior. This separates high-density large-scale automated wallet operations from low-density real user operations. Wormhole contributors only use this identification strategy in conjunction with other Sybil detection mechanisms.

Spam transaction analysis

Another common large-scale action involves rapid succession of transactions for the same token amount, either between two chains or across multiple chains. During a spate of large-scale Sybil activity beginning in December 2023, wallets with transactions matching an unusually high frequency of such activity will be flagged and removed from the shortlist eligibility.

Wormhole said the algorithm will inevitably include some ordinary users. Over the next few weeks,Wormhole will carefully re-evaluate user base eligibility, and rewards for qualified individuals may change。

reward algorithm

Depending on time and amount, some key elements are as follows:

• User activity lasting 3 months or more will receive additional airdrop multipliers;

• User activity before December 1, 2023 will receive additional airdrop multipliers;

• Users during the last bear market (June 2022 to October 2023);

• Users in the first year of mainnet launch;

• Users whose cumulative transaction value exceeds $10,000;

• Transactions involving commonly used chains such as ETH;

• Transactions involving BTC, ETH, stablecoins, and other assets critical to DeFi;

• Transactions involving assets with extremely low or no liquidity on the destination chain,will be given a negative multiplier。

Specific community airdrops

Wormhole allocated 19% of the airdrop to the community, including Wormhole Zealy participants, Pyth stakers, DeGods and y00ts holders, Bad Kids status holders in Discord, Mad Lads holders, and Monad community members.

in conclusion

Wormhole innovatively uses behavior clustering to define addresses, and then detects witches based on funds, operation similarities and spam operations. Basic response points include withdrawing funds from exchanges, transferring funds and operations irregularly or at long intervals, and avoiding single interactive behavior.