Introduction

This analysis aims to identify Sybil addresses on LayerZero to ensure a fair airdrop by excluding addresses involved in fraudulent activities. With LayerZero's airdrop approaching, it's crucial to identify Sybil addresses, which are used to manipulate the system by creating multiple addresses. The report will guide through the methodology, findings, and visual proofs to ensure transparency and accuracy in identifying Sybil addresses.

Summary of Findings

A high-level summary of the analysis, including key metrics and outcomes.

Key Metrics:

• Total Wallets Analyzed: Over 3000 wallets initially identified as suspicious.

• Final Suspected Sybil Wallets: 1980 addresses confirmed as engaging in Sybil activities. 830 filtering those previously reported in Layerzero/Nansen/Chaos list. 781 of these final wallets match in all metrics, others show same behavior and the rest were excluded.

• Clusters Identified: Over 20 clusters formed based on transaction patterns and origins of funds.

Methodology

Data Collection:

• Source: Flipside Crypto data integrating LayerZero transactions.
• Columns Used: SOURCE_CHAIN, DESTINATION_CHAIN, VOLUME_MOVED, TX_COUNT, SENDER_WALLET, DATE.

Step-by-Step Process:

• Initial Filtering Criteria: Wallets with more than 5 transactions, 0-100 USD volume, within 24 hours, fewer than 3 unique destination chains.
• Clustering: Grouping by source and destination chains using Python to reveal Sybil activity patterns.
• First Transaction Analysis: Analyzing the origin of funds for each wallet's first transaction, forming subclusters.
• Second Filtering: Ensuring consistency in transaction patterns, volume, and source/destination chains, resulting in the refined list of Sybil addresses.
• Final Filtering: Searching for patterns in wallets previously detected by Layerzero/Nansen/Chaos, to check if some of the detected clusters have common patterns.
• Verification and Proof: Visual aids like Sankey diagrams and cluster graphs, with Python scripts and data sources available for verification.

Initial Detection List:

List of Wallets: Table of 3000+ initially identified suspicious wallets, criteria for identification. Wallets with more than 5 transactions, 0-100 USD volume, within 24 hours, fewer than 3 unique destination chains.

Clustering Analysis:

Cluster Identification: This section provides a detailed description of the clusters identified based on source and destination chains. The analysis focuses on highlighting the main source and destination chains involved in the transactions of suspected Sybil wallets. The data was meticulously processed to categorize the wallets into clusters by examining their transaction patterns. Specifically:

• Source Chain: Represents the blockchain from which the transactions originated.
• Destination Chain: Represents the blockchain to which the transactions were directed.
• Weight: This is a composite metric that combines the number of wallets and the total volume moved from the source chain to the destination chain. This weight helps in understanding the significance of each cluster by considering both the count of wallets involved and the total value transacted.

By grouping the wallets in this manner, the analysis reveals patterns indicative of Sybil activity, such as multiple wallets moving similar amounts of funds between the same chains within short timeframes. This clustering helps in isolating and visualizing potential Sybil attacks, making it easier to identify and verify suspicious activities.

Sankey Diagram: Visual representation of wallet interactions and clusters from the Cluster Identification process.

Visualization of Final Clusters per Chain:

This section delves into the detailed analysis of the final clusters, emphasizing the relationships and transaction patterns for each chain.

• First Transaction Analysis: The first transaction of each suspected Sybil wallet was scrutinized to identify common sources of funds. This step was crucial to determine if multiple wallets were funded from the same origin, thereby confirming their link as part of a Sybil attack.

• Common Source of Funds: Wallets with common sources of initial funds were grouped together, indicating they were likely controlled by a single entity. This grouping is significant as it reveals orchestrated patterns typical of Sybil behavior.

• Criteria for Final Tagging as Sybil Wallets: The wallets were then further analyzed and filtered based on several key criteria:

  • Same Source of Funds: Ensuring that wallets in each subgroup were funded from the same source.
  • Same Destination Chain: Verifying that these wallets transferred funds to the same destination chain.
  • Same Number of Transactions: Ensuring consistency in the number of transactions made by each wallet in the subgroup.
  • Same Volume Moved: Confirming that the total volume of funds moved was similar across these wallets.
  • Same Period of Time Activity: Checking that these transactions occurred within the same time frame, indicating coordinated activity.

• Final Subgroups: As a result, a refined list of subgroups was created for each source chain. These subgroups contain wallets that meet all the above criteria, thus strongly indicating they are part of a Sybil attack. This visualization provides clear and concrete evidence of coordinated malicious activity, helping to tag these wallets definitively as Sybil addresses.

Second Filter List of Sybil Wallets:

After conducting a comprehensive analysis using the described methodology, a final list of 1980 wallets has been identified as being involved in Sybil attacks. These wallets were meticulously analyzed and filtered through multiple stages to ensure accuracy and minimize the risk of false positives. Source of funds that appear in the labels or the contracts table in Flipside's database have been excluded.

The appendix provides additional data and visualizations that detail the activity patterns of the detected Sybil wallets over time. This section is critical to understanding the specific behaviors and temporal patterns that indicate coordinated Sybil attacks. The focus is on demonstrating the short periods of intense activity these wallets exhibited on each chain, aligning with the behavior expected from wallets attempting to exploit the LayerZero airdrop.

The rigorous analysis and filtering process have led to the identification of 781 new Sybil wallets and 49 to be deeply investigated, all grouped into the 21 detected clusters. By comparing these wallets with previously detected patterns from LayerZero, Nansen, and Chaos, we ensured a high level of accuracy and minimized false positives. This ongoing refinement and pattern analysis are crucial for maintaining robust fraud detection measures and enhancing the security and reliability of the LayerZero airdrop. The exclusion of wallets that did not match established patterns further underscores the precision of our approach, reinforcing the integrity of the final list of identified Sybil wallets.

Here again full list of new wallets detected:

• Name: Adrià Parcerisas
• Discord: adriaparcerisas
• Twitter: @adriaparcerisas
• Ethereum Wallet: 0x91707502A8DFDC523f7a6f2c218cC9a52777d5ad
• Date: May 19th, 2024

Final List of Sybil Wallets: Excluding wallets from initial LayerZero, Nansen and Chaos list:

This section presents a comprehensive analysis of newly detected Sybil wallets, based on patterns observed in wallets previously identified by LayerZero, Nansen, and Chaos. The key points of the analysis are detailed below:

1. Final New Sybil Wallets Detected: This section lists wallets newly identified as Sybil wallets in the latest analysis. These wallets exhibit activity patterns similar to some of the clusters detected in previous analyses by LayerZero, Nansen, and Chaos.

2. Filtering Process: The process involved:

• Checking which wallets were previously detected in LayerZero, Nansen, and Chaos analyses.
• Identifying patterns in these detected wallets and forming new clusters based on these patterns.
• Detecting 21 different clusters in total.
• Examining wallets not previously detected by LayerZero, Nansen, or Chaos to see if they matched any of the 21 identified clusters.
• Excluding wallets that did not match any cluster to avoid false positives.

3. Exclusion of Previously Detected Wallets: Wallets already identified in the initial analyses were excluded to highlight newly detected wallets that may have previously evaded detection. This continuous update and refinement process enhances the effectiveness of fraud detection measures.

The final list comprises 830 wallets belonging to all of the 21 clusters. 781 out of these 830 have the same metrics of a specific cluster, while 49 show similar behavior. Wallets that did not match any of these clusters were filtered out to avoid false positives, ensuring the accuracy and reliability of the detection process.

The list of the new wallets detected as sybils by cluster can be found on this google sheet.

In this second section of the appendix, the visualization presents 21 clusters derived from previously detected wallets. Wallets that were identified in earlier analyses by LayerZero, Nansen, and Chaos are highlighted in red. Newly detected Sybil wallets, which have been identified as part of the same clusters based on their activity patterns, are shown in green. This color-coded representation clearly distinguishes between wallets that had been previously flagged and those that are newly identified, providing a clear and intuitive understanding of the clustering results.