Today, while reviewing high-reward tasks on the Boost Protocol, I came across a task that offered a 100% reward, which turned out to be a great find. For those who haven’t used Boost Protocol before, here’s a brief overview: when you mint the task’s NFT, the full amount you pay is returned to you as a reward. When I saw the task, nearly the entire reward amount was still available (only 4-5 people had claimed, so about 100 spots remained). I quickly claimed the reward and sent the link to my friends, but they told me there were no rewards left when they tried to claim. I was surprised, as Boost Protocol tasks, especially those with a 100-claim limit, don’t typically run out this quickly.

First, for those interested in investigating, here’s the task link:

Mint "Nasty Monster"

Mint exactly 1 "Nasty Monster" from the Monsters collection on Zora

https://dark.boost.xyz

Upon returning to the task page, as my friends warned me, I noticed that all the final transactions were sent at the same minute. This is theoretically possible but unusual, so I decided to investigate further myself. I checked the contract address where the claim was made (0x51a78e78c28c0a1079ed5bd1c2bf66a3387b233). Here are the results:

Token Transfer | OP Mainnet Etherscan

The list of ERC-20 Token transactions in the OP Mainnet Blockchain on OP Mainnet Etherscan.

https://optimistic.etherscan.io

When I checked the last wallet that claimed the reward, I found an empty wallet created 641 days ago, with only $10 and no activity on Boost Protocol or Zora (0x89bf6a906475f9d9b9b1b2d859d8e1e849c4c5aac).

To understand where this might lead, I checked the next wallet, which again led me to another address created 641 days ago with no DeFi activity and only $10. To clarify further, I decided to analyze all the holders of the NFT minted in this task. You can check the NFT holders from the link below (contract address: 0xaf6203f1c23c03b3882d128066187a8af515ef5).

There are 102 holders of the NFT in total, and everyone, except one person, minted exactly one NFT. When I decided to analyze the remaining 101 addresses using the MetaSleuth tool, my suspicions were confirmed. Out of 102 holders, 78 claimed their rewards, consolidating the rewards into a single address (which is one of the addresses that minted the NFT). All addresses are between $5-$10 in value and have no DeFi activity. Their sole purpose is to farm airdrops from Zora and possibly Boost Protocol. You can verify this using the visual from the link below.

I had previously read user complaints about some tasks on the protocol being quickly completed by bots, but I hadn’t realized the severity of the situation. Needless to say, it is almost impossible to complete a task offering a 100% or higher reward if you don't do it immediately. To solve this, I want to suggest a few ideas to the Boost Protocol developers. Of course, I’m not sure which of these are technically feasible.

• **Blacklisting addresses that use bots in a way that harms the Boost community and platform.**This would be ideal if technically possible, with the blacklist mechanism built into a new version of the protocol. In the future, DAO members might be able to vote to block these addresses. Of course, a governance system could be set up, but I realize this would be challenging. Still, at least one preliminary measure should be implemented on the platform.

• **Excluding these addresses from a potential airdrop.**Considering the likelihood of an airdrop and the fact that these addresses might be eligible, it's highly probable that malicious users would affect metrics positively in the short term, but in the long run, they would sell off their tokens and exploit a new project similarly. These addresses do not contribute to the governance because they all belong to one real person.

• **Requiring a minimum wallet balance of x dollars to complete a task.**This could help prevent the registration of low-value addresses, though I understand this might hurt artists with lower budgets trying to showcase their work. The bot accounts complete tasks in seconds, making it challenging for genuine users to participate adequately.

• **Having the minimum wallet balance option checked by default on the task creation page.**It’s not enough to just offer this as an option; it should be checked by default since most users may not notice. The creator should be able to remove this limit if desired, or increase it. Debank data could be used to verify wallet value.

• **Having Boost Protocol maintain its own blacklist.**The Boost Protocol team could compile these addresses into a list and mark them as "not eligible" by default on the task creation page. The task creator should be able to cancel this option if desired, but again, it should be checked by default.

• Tasks that offer around 100% rewards are currently being completed by bots, but if no action is taken, this situation could worsen in the future. Real users who can't keep up with the speed of the bots may leave the platform.

• Nearly all bots use low-quality addresses, which diminishes the value of the rewards for artists and reduces the effectiveness of tasks over time. For an artist, sending NFTs to empty wallets is pointless, as they could do this without any cost. For example, an artist might hope for a 5% engagement rate. If 100 genuine users complete the task and only five engage, the artist gains more from those real users. However, bots remove this possibility by filling up the task slots without genuine interest.

0x00103819d1fad299e81d4bee400f1041da49ea68 0x02c8fadc5fddd14295fc2332cb95c48a64367ba7 0x05278a37afbb47d216976f80cfe27085ccc4e687 0x08cb27f5d61b0023fe599ec4cb43167bcaba114b 0x0cbfbac611e6293859b40805aa49aa44a47f1314 0x117a3f19892a699a4099ac1981937c3ebbd7f050 0x128027059b51ba58f4405a9f6268cfbfbe828d77 0x191f6255fad738eb7cdd22fadce620062ea07e5f 0x1bb7b04bfe17536adda63aa5ace72c607d7c600d 0x23ca95c7babd89dd1b0ed37c3fedf3536e3ee63f 0x24be2110edb7aff92bcfec4c7fb0dacc24e64bea 0x2857969755c600a3620850382f792ef3c146fb6c 0x2a6e8cd6eed3183236952143b9b0d3be202a266b 0x2c1c5c6a546638f65411368c078fe67343b74d0f 0x2e129a092e3eb9dd8437ab037211851419ec7b89 0x2e3daf22dd800c880ba435a37b398043c033e8f3 0x30eb6020f939fe1d3507c7ae3b2524204bf34fba 0x31c201a1c51afc4229f4e06b70989007e607dd12 0x324fd1da89763d9894f42265884666d62b8e76a1 0x3507e209ee4af5a6967435c8e2d9e02e85fd6f48 0x3610964e307418b6222ea94889691523c700a38b 0x39341e2ba117202a3391e18c89b378ad07b62602 0x39fa3705ab8852190f32b89e2e0b3e7a2ac1d8cb 0x449354f7c9cbd870a67de48824851b3fdd0c4a1b 0x498a2ac483dead82ace23536ee0ed80d5d132bab 0x4cf706b69232bd5915c9b27f061ddd4cb51347cd 0x4e588e5f6ef3a18aa8b4dac99aa95f6f3fb0a38d 0x4f70b2f55db3d7b3ca6463d7859f28d33a0f0e6f 0x55c7e07c09f229be20e059540680bf29c1c2a084 0x5b3f3b8c3b2c7e9c256086862709c78a409ec2d9 0x5f6fbe049cf92d79a0483c26f2c8d04de2565969 0x66b62d1285a34eea5c6dbd270103bce22a76fa67 0x69a4885950cf664511e382d89b9493ad7c833b4a 0x6d67c3f168afdeb305141b61e971c1afdcb20d5d 0x71bac78effde9c486292ada763a19af79a6fe9e2 0x76d05faf9b099981e0f13429599ed026bab81036 0x7b759431126afbc1c3ec03c710a7fde261e00883 0x7e65fdbd47eca3ff22f7be71486b3207d9077354 0x810e691480b21f00d51f05dfb7d9e9728ba96628 0x8d9950282e123ca85ac2b92dd9373951ff4db500 0x9113f1a8d4cafdc8ed2b362ea152ba025490e3fe 0x95a9b470c2ab1a8ee8fb6569d34c8b90a3df7b36 0x96d7b38dd1b2a775ecfcc43aa29bd3def56f5624 0x975354f6038cd26e762fb520adf0a06c3b9686fa 0x9d63d138a681e12ef8ac9f79cae7b20de7ef4d6e 0xa46483e85d5b0de0e4b1735fb8282ef0ef71ff3d 0xa48bbc739ee2e7c1bde9a748442b70959ea248e6 0xa62bc2271a1af3d12330c6e81e9b281c4c1a4c03 0xa8bc5956f2b3be682b0e75bdd366ee1b0bd8dce9 0xad48a1bea2a8cef0cc79c2692bf73cd352375877 0xae2731451c05289ccd794b2f9d5215c769e0d917 0xaf6930aeae0e15a59d821db4ac52f4c09e4a105a 0xb40a90d69826c9685f9d2b9fdaf995bf7d6200bf 0xb40e950c709c73c3b114c2498be1d0680a0ab977 0xbaa3585839386c0f269764ce4874027622567d84 0xc07c895fa38d50e4699d0eb51fe09762e5d05c86 0xc46eacede8819f379aa595765afba18f977a1e81 0xca087d9b31e39546719ee7a257ccce158737a304 0xd2630a7004ccc55afec1b99f8d62140cfb0c5627 0xd897205fa55a2d151ed9c0a326c685f99dda3696 0xd9833fd5367cbc6984fae008b31edc2eabbe4efd 0xdd71e8825f86496700e962010a9191d0aca3cf56 0xdeada54deb3a4513f1ce923b3c995246604f5f66 0xdec04b809848549d042a62727f10ce6c953c4b92 0xe1535ce3cda38af5a509d2de062d211203f62ade 0xe1a81f00ea120140b2cf2aca77aa21496b0f9a15 0xe49d26ea415c4c5677165cb2da4ca01d3ec71894 0xe4b06bb73f635eed2708e304b49a8d7be6d59863 0xeaa4842ca9bcb55efdc42b555b974dc110e7186c 0xeb027db3e742fe2e6ee50a62f030274c0ccb9f9a 0xefaf0436badbbe7bca520c1bdecf9b3f6e331598 0xf4afc7e5df2b041de037d6466236fbd0ee3983ec 0xf575cb55b5d89336d3f97f052da226cedd9359e7 0xf578d69a7f27510396588e9190708af2c97ba925 0xf9a8dd08812228f37bbda8ddf7b635c56390887d 0xfa4454907cc6cbdc3bf4dfee9b5135da81fac3f7 0xfafbf10d60927a6987080f3a1497eb10c811de30 0xfd7f19d0ca460c8c955e141feb720ca1b93d0875 0xfd9fb4e942b6074fb71adca6822af3a5cab836d8 0x395c75fa3976e1fd2d51c0d91df843907f9b330f

Today, while reviewing high-reward tasks on the Boost Protocol, I came across a task that offered a 100% reward, which turned out to be a great find. For those who haven’t used Boost Protocol before, here’s a brief overview: when you mint the task’s NFT, the full amount you pay is returned to you as a reward. When I saw the task, nearly the entire reward amount was still available (only 4-5 people had claimed, so about 100 spots remained). I quickly claimed the reward and sent the link to my friends, but they told me there were no rewards left when they tried to claim. I was surprised, as Boost Protocol tasks, especially those with a 100-claim limit, don’t typically run out this quickly.

First, for those interested in investigating, here’s the task link:

Mint "Nasty Monster"

Mint exactly 1 "Nasty Monster" from the Monsters collection on Zora

https://dark.boost.xyz

Upon returning to the task page, as my friends warned me, I noticed that all the final transactions were sent at the same minute. This is theoretically possible but unusual, so I decided to investigate further myself. I checked the contract address where the claim was made (0x51a78e78c28c0a1079ed5bd1c2bf66a3387b233). Here are the results:

Token Transfer | OP Mainnet Etherscan

The list of ERC-20 Token transactions in the OP Mainnet Blockchain on OP Mainnet Etherscan.

https://optimistic.etherscan.io

When I checked the last wallet that claimed the reward, I found an empty wallet created 641 days ago, with only $10 and no activity on Boost Protocol or Zora (0x89bf6a906475f9d9b9b1b2d859d8e1e849c4c5aac).

To understand where this might lead, I checked the next wallet, which again led me to another address created 641 days ago with no DeFi activity and only $10. To clarify further, I decided to analyze all the holders of the NFT minted in this task. You can check the NFT holders from the link below (contract address: 0xaf6203f1c23c03b3882d128066187a8af515ef5).

There are 102 holders of the NFT in total, and everyone, except one person, minted exactly one NFT. When I decided to analyze the remaining 101 addresses using the MetaSleuth tool, my suspicions were confirmed. Out of 102 holders, 78 claimed their rewards, consolidating the rewards into a single address (which is one of the addresses that minted the NFT). All addresses are between $5-$10 in value and have no DeFi activity. Their sole purpose is to farm airdrops from Zora and possibly Boost Protocol. You can verify this using the visual from the link below.

I had previously read user complaints about some tasks on the protocol being quickly completed by bots, but I hadn’t realized the severity of the situation. Needless to say, it is almost impossible to complete a task offering a 100% or higher reward if you don't do it immediately. To solve this, I want to suggest a few ideas to the Boost Protocol developers. Of course, I’m not sure which of these are technically feasible.

• **Blacklisting addresses that use bots in a way that harms the Boost community and platform.**This would be ideal if technically possible, with the blacklist mechanism built into a new version of the protocol. In the future, DAO members might be able to vote to block these addresses. Of course, a governance system could be set up, but I realize this would be challenging. Still, at least one preliminary measure should be implemented on the platform.

• **Excluding these addresses from a potential airdrop.**Considering the likelihood of an airdrop and the fact that these addresses might be eligible, it's highly probable that malicious users would affect metrics positively in the short term, but in the long run, they would sell off their tokens and exploit a new project similarly. These addresses do not contribute to the governance because they all belong to one real person.

• **Requiring a minimum wallet balance of x dollars to complete a task.**This could help prevent the registration of low-value addresses, though I understand this might hurt artists with lower budgets trying to showcase their work. The bot accounts complete tasks in seconds, making it challenging for genuine users to participate adequately.

• **Having the minimum wallet balance option checked by default on the task creation page.**It’s not enough to just offer this as an option; it should be checked by default since most users may not notice. The creator should be able to remove this limit if desired, or increase it. Debank data could be used to verify wallet value.

• **Having Boost Protocol maintain its own blacklist.**The Boost Protocol team could compile these addresses into a list and mark them as "not eligible" by default on the task creation page. The task creator should be able to cancel this option if desired, but again, it should be checked by default.

• Tasks that offer around 100% rewards are currently being completed by bots, but if no action is taken, this situation could worsen in the future. Real users who can't keep up with the speed of the bots may leave the platform.

• Nearly all bots use low-quality addresses, which diminishes the value of the rewards for artists and reduces the effectiveness of tasks over time. For an artist, sending NFTs to empty wallets is pointless, as they could do this without any cost. For example, an artist might hope for a 5% engagement rate. If 100 genuine users complete the task and only five engage, the artist gains more from those real users. However, bots remove this possibility by filling up the task slots without genuine interest.

0x00103819d1fad299e81d4bee400f1041da49ea68 0x02c8fadc5fddd14295fc2332cb95c48a64367ba7 0x05278a37afbb47d216976f80cfe27085ccc4e687 0x08cb27f5d61b0023fe599ec4cb43167bcaba114b 0x0cbfbac611e6293859b40805aa49aa44a47f1314 0x117a3f19892a699a4099ac1981937c3ebbd7f050 0x128027059b51ba58f4405a9f6268cfbfbe828d77 0x191f6255fad738eb7cdd22fadce620062ea07e5f 0x1bb7b04bfe17536adda63aa5ace72c607d7c600d 0x23ca95c7babd89dd1b0ed37c3fedf3536e3ee63f 0x24be2110edb7aff92bcfec4c7fb0dacc24e64bea 0x2857969755c600a3620850382f792ef3c146fb6c 0x2a6e8cd6eed3183236952143b9b0d3be202a266b 0x2c1c5c6a546638f65411368c078fe67343b74d0f 0x2e129a092e3eb9dd8437ab037211851419ec7b89 0x2e3daf22dd800c880ba435a37b398043c033e8f3 0x30eb6020f939fe1d3507c7ae3b2524204bf34fba 0x31c201a1c51afc4229f4e06b70989007e607dd12 0x324fd1da89763d9894f42265884666d62b8e76a1 0x3507e209ee4af5a6967435c8e2d9e02e85fd6f48 0x3610964e307418b6222ea94889691523c700a38b 0x39341e2ba117202a3391e18c89b378ad07b62602 0x39fa3705ab8852190f32b89e2e0b3e7a2ac1d8cb 0x449354f7c9cbd870a67de48824851b3fdd0c4a1b 0x498a2ac483dead82ace23536ee0ed80d5d132bab 0x4cf706b69232bd5915c9b27f061ddd4cb51347cd 0x4e588e5f6ef3a18aa8b4dac99aa95f6f3fb0a38d 0x4f70b2f55db3d7b3ca6463d7859f28d33a0f0e6f 0x55c7e07c09f229be20e059540680bf29c1c2a084 0x5b3f3b8c3b2c7e9c256086862709c78a409ec2d9 0x5f6fbe049cf92d79a0483c26f2c8d04de2565969 0x66b62d1285a34eea5c6dbd270103bce22a76fa67 0x69a4885950cf664511e382d89b9493ad7c833b4a 0x6d67c3f168afdeb305141b61e971c1afdcb20d5d 0x71bac78effde9c486292ada763a19af79a6fe9e2 0x76d05faf9b099981e0f13429599ed026bab81036 0x7b759431126afbc1c3ec03c710a7fde261e00883 0x7e65fdbd47eca3ff22f7be71486b3207d9077354 0x810e691480b21f00d51f05dfb7d9e9728ba96628 0x8d9950282e123ca85ac2b92dd9373951ff4db500 0x9113f1a8d4cafdc8ed2b362ea152ba025490e3fe 0x95a9b470c2ab1a8ee8fb6569d34c8b90a3df7b36 0x96d7b38dd1b2a775ecfcc43aa29bd3def56f5624 0x975354f6038cd26e762fb520adf0a06c3b9686fa 0x9d63d138a681e12ef8ac9f79cae7b20de7ef4d6e 0xa46483e85d5b0de0e4b1735fb8282ef0ef71ff3d 0xa48bbc739ee2e7c1bde9a748442b70959ea248e6 0xa62bc2271a1af3d12330c6e81e9b281c4c1a4c03 0xa8bc5956f2b3be682b0e75bdd366ee1b0bd8dce9 0xad48a1bea2a8cef0cc79c2692bf73cd352375877 0xae2731451c05289ccd794b2f9d5215c769e0d917 0xaf6930aeae0e15a59d821db4ac52f4c09e4a105a 0xb40a90d69826c9685f9d2b9fdaf995bf7d6200bf 0xb40e950c709c73c3b114c2498be1d0680a0ab977 0xbaa3585839386c0f269764ce4874027622567d84 0xc07c895fa38d50e4699d0eb51fe09762e5d05c86 0xc46eacede8819f379aa595765afba18f977a1e81 0xca087d9b31e39546719ee7a257ccce158737a304 0xd2630a7004ccc55afec1b99f8d62140cfb0c5627 0xd897205fa55a2d151ed9c0a326c685f99dda3696 0xd9833fd5367cbc6984fae008b31edc2eabbe4efd 0xdd71e8825f86496700e962010a9191d0aca3cf56 0xdeada54deb3a4513f1ce923b3c995246604f5f66 0xdec04b809848549d042a62727f10ce6c953c4b92 0xe1535ce3cda38af5a509d2de062d211203f62ade 0xe1a81f00ea120140b2cf2aca77aa21496b0f9a15 0xe49d26ea415c4c5677165cb2da4ca01d3ec71894 0xe4b06bb73f635eed2708e304b49a8d7be6d59863 0xeaa4842ca9bcb55efdc42b555b974dc110e7186c 0xeb027db3e742fe2e6ee50a62f030274c0ccb9f9a 0xefaf0436badbbe7bca520c1bdecf9b3f6e331598 0xf4afc7e5df2b041de037d6466236fbd0ee3983ec 0xf575cb55b5d89336d3f97f052da226cedd9359e7 0xf578d69a7f27510396588e9190708af2c97ba925 0xf9a8dd08812228f37bbda8ddf7b635c56390887d 0xfa4454907cc6cbdc3bf4dfee9b5135da81fac3f7 0xfafbf10d60927a6987080f3a1497eb10c811de30 0xfd7f19d0ca460c8c955e141feb720ca1b93d0875 0xfd9fb4e942b6074fb71adca6822af3a5cab836d8 0x395c75fa3976e1fd2d51c0d91df843907f9b330f