Introduction

The analysis aims to uncover the connections between LayerZero addresses that are suspected of engaging in sybil activities. Sybil attacks involve creating multiple fake identities to gain a disproportionate influence or advantage in a decentralized network. By examining transactional patterns, we can identify potential sybil addresses and their interconnections.

Methodology

The analysis leverages a multi-step approach to identify and refine suspect addresses:

1. Data Aggregation: Transactions from LayerZero are aggregated to compute metrics such as transaction count, total volume in USD, and distinct contracts involved.
2. Initial Criteria Filtering: Addresses are filtered based on preliminary criteria:
   • Transaction count between 1 and 5.
   • Total transaction volume exceeding $1,000.
   • All transactions occur within a 24-hour period.
   • Less than three distinct source contracts used.
3. Refinement with Temporal Correlation and Contract Patterns: Further refinement of suspect addresses includes:
   • Transactions occurring within a single hour.
   • Limited distinct destination transaction hashes.
4. Detailing Interlinked Addresses: Addresses are cross-referenced to find similar transactional patterns across different chains and addresses, indicating possible sybil behavior.
5. Source of Funds Analysis: By tracking the origin of funds, we identify common sources funding multiple suspect addresses, establishing a network of interconnected addresses.
6. Clustering and Final Selection: Addresses are clustered based on their source of funds and transactional behavior. Only clusters with a significant number of addresses (e.g., 20 or more) are considered.

Findings

1. Transaction Patterns: The suspect addresses display a consistent pattern of low transaction counts with relatively high volumes, all within short time frames, often under 24 hours. This rapid and concentrated activity suggests coordinated behavior typical of sybil attacks.

2. Common Funding Sources: Many of the suspect addresses share common funding sources. By analyzing the origin addresses of the first deposit transactions, we found that a small number of addresses funded multiple suspect addresses. This commonality strongly indicates centralized control over multiple addresses.

3. Interlinked Chains: The addresses often participate across multiple blockchain networks (e.g., Arbitrum, Avalanche, BNB Chain, Optimism, Polygon). These interlinked activities across chains suggest an effort to mask their sybil behavior by spreading it across different ecosystems.

4. Temporal Correlation: The timing of transactions among suspect addresses is highly correlated. Many transactions occur within a short period of each other, indicating synchronized activities. This temporal proximity is a hallmark of sybil behavior, where multiple addresses are controlled by a single entity.

5. Distinct Source and Destination Contracts: The limited number of distinct contracts involved in these transactions suggests that these addresses are not engaging in diverse or organic activity. Instead, they are likely using a few contracts repetitively to execute their strategies.

6. Clusters of Activity: By clustering the suspect addresses based on their transactional behavior and funding sources, we identified distinct groups that share similar characteristics. These clusters help pinpoint the potential operators behind these sybil attacks.

Conclusion

The detailed analysis reveals that the suspect LayerZero addresses are highly likely to be engaged in sybil activities. Their behavior is characterized by rapid, high-volume transactions, common funding sources, and synchronized activity across multiple chains. These findings underscore the need for enhanced monitoring and detection mechanisms to prevent sybil attacks and maintain the integrity of the LayerZero network.

Step 1: Initial Wallet Filtering

We began by applying an initial set of criteria to filter out wallets that show suspicious activity patterns. The filters were:

• Transaction Count (tx_count): Wallets with fewer than 5 transactions were selected. This low activity suggests the wallets may not be engaging in regular, organic transactions.
• Total Volume in USD (total_volume_usd): Wallets with transaction volumes greater than $1000 were selected. High volume in a short span can indicate non-organic activity.
• Transaction Time Span: Wallets with transactions spanning less than 24 hours were selected. This short time frame indicates concentrated and potentially automated activity.
• Distinct Source Contracts: Wallets using fewer than 3 distinct source contracts were selected. Limited contract usage suggests the transactions are not diverse, which is unusual for regular users.

Step 2: Identifying Similar Behavioral Groups

Next, we grouped wallets based on similar behavioral patterns:

• Same Source and Destination Chain: Wallets that operate on the same source and destination chains.
• Same Transaction Date: Wallets with transactions occurring on the same date.
• Same Number of Transactions: Wallets with an identical number of transactions.
• Same Transaction Volume: Wallets with identical transaction volumes.

By clustering wallets with these shared characteristics, we identified groups that likely exhibit coordinated behavior.

Step 3: Source of Funds Analysis

We then traced the source of funds for these grouped wallets to see if they originate from the same address. We considered both the date and volume of the initial deposits to establish connections:

• Common Funding Source: We identified if multiple wallets received their initial funds from the same address.
• Consistent Deposit Dates and Volumes: We ensured the deposit dates and volumes matched the transactional patterns observed in LayerZero.

Step 4: Sub-Clustering Based on Source of Funds

We further refined our clusters by examining wallets that:

• Same Source of Funds: Wallets funded by the same source address.
• Same Deposit Date: Wallets receiving their initial deposit on the same date.
• Same Deposit Volume: Wallets receiving the same amount in their initial deposit.
• Matching LayerZero Activity: Wallets whose first deposit date matched their first activity date on LayerZero. This suggests the wallets were created solely to farm airdrops.

Step 5: Visualization of Clusters

Finally, we visualized these clusters to illustrate the connections between the suspect wallets. We used a Python notebook to generate graphs showing nodes representing the source of funds and arrows indicating the wallets clustered by similar behavior. The color of the nodes corresponds to the source chain.

The rigorous analysis and filtering process have led to the identification of 263 new Sybil wallets, grouped into the 4 detected clusters. By comparing these wallets with previously detected patterns from LayerZero, Nansen, and Chaos, we ensured a high level of accuracy and minimized false positives. This ongoing refinement and pattern analysis are crucial for maintaining robust fraud detection measures and enhancing the security and reliability of the LayerZero airdrop. The exclusion of wallets that did not match established patterns further underscores the precision of our approach, reinforcing the integrity of the final list of identified Sybil wallets.

Here again full list of new wallets detected by clusters' group:

• Name: Adrià Parcerisas
• Discord: adriaparcerisas
• Twitter: @adriaparcerisas
• Ethereum Wallet: 0x91707502A8DFDC523f7a6f2c218cC9a52777d5ad
• Date: May 29th, 2024

Final List of Sybil Wallets: Excluding wallets from initial LayerZero, Nansen and Chaos list:

This section presents a comprehensive analysis of newly detected Sybil wallets, based on patterns observed in wallets previously identified by LayerZero, Nansen, and Chaos. The key points of the analysis are detailed below:

1. Final New Sybil Wallets Detected: This section lists wallets newly identified as Sybil wallets in the latest analysis. These wallets exhibit activity patterns similar to some of the clusters detected in previous analyses by LayerZero, Nansen, and Chaos.

2. Filtering Process: The process involved:

• Checking which wallets were previously detected in LayerZero, Nansen, and Chaos analyses.
• Identifying patterns in these detected wallets and forming new clusters based on these patterns.
• Detecting 4 different clusters in total.
• Examining wallets not previously detected by LayerZero, Nansen, or Chaos to see if they matched any of the 4 identified clusters.
• Excluding wallets that did not match any cluster to avoid false positives.

3. Exclusion of Previously Detected Wallets: Wallets already identified in the initial analyses were excluded to highlight newly detected wallets that may have previously evaded detection. This continuous update and refinement process enhances the effectiveness of fraud detection measures.

The final list comprises 263 wallets belonging to all of the 4 clusters. Wallets that did not match any of these clusters were filtered out to avoid false positives, ensuring the accuracy and reliability of the detection process.

Below is the list of the new wallets detected as sybils by cluster. The full work can be found on this google sheet.