With the increasing prevalence of airdrops, it has become crucial to identify Sybil addresses that exploit these events for unfair gains. In this research, we aim to uncover and analyze potential Sybil addresses that have received $ARB tokens from the airdrop by employing a two-step methodology.
In the first iteration, we checked all addresses eligible for the airdrop but without any transactions on Ethereum. This method was chosen due to the high transaction costs in L1, which make spinning up multi-accounts more expensive than simply depositing into the Arbitrum network through sub-accounts from FTX (rip), OKx, and other CEXs.
As a result, we found 112,473 addresses without L1 transactions that received over 130 million $ARB tokens.
However, the likelihood of false-positive hits to this list is quite high, so we dig further.
In the second iteration, we decided to search for clusters of addresses that could be more likely attributed to Sybil addresses. Below you will find a report on nine large clusters of account addresses (max 3840 accounts/min 419 accounts), joined by a similar actions algorithm. Clusters are described in descending order of the number of accounts in the cluster. In addition to these, there are smaller clusters, and overall, we were able to group about 15k accounts or more than 2% of addresses that received the $ARB drop.
3840
27
<0.01
~15 swaps via uniswap
couple of swaps via sushi
Add liquidity to Hop Protocol: USDC Liquidity Pool / bridge to Hop Protocol
{'LINK', 'DBL', 'LPT', 'GMX', 'UMAMI', 'BRC', 'SPA', 'SYN', 'ELK', 'SWPR', 'DPX', 'VSTA', 'JONES', 'USDC', 'MYC', 'PLS', 'HOP-LP-USDC', 'MAGIC'}
https://arbiscan.io/address/0x53858c760621424a475d295dcc7cac6978eeaef2
All address in cluster (full dataset):
2018
28
<0.01
Multiple swaps
Add liquidity to Hop Protocol
{'BRC', 'DBL','DPX','ELK','GMX', 'GRG','HOP-LP-USDT','JONES','LINK', 'LPT','MAGIC', 'MYC','PLS’, 'SPA','STG','SWPR','SYN','TCR','UMAMI','USDC', 'USDT','VSTA','gBRC', 'hUSDT'}
https://arbiscan.io/address/0xc3ceb25f8b75619aa70d38ca9ea1a7d55f709847
All address in cluster (full dataset):
1497
30
<0.02
batch swap Balancer vault
Mint And Stake GLP
Deposit Radiant Lending pool
Fulfill Basic Order SeaPort 1.1
Swap via Uniswap
Add liquidity Hop Protocol
{'BRC', 'DBL','DPX','ELK', 'GLP', 'GMX','HOP-LP-USDC', 'JONES','LINK','LPT','MAGIC','MYC', 'PLS' 'SLP', 'SPA', 'SWPR','SYN', 'UMAMI','USDC','VST','VSTA', 'fGLP', 'fsGLP', 'hUSDC', 'rUSDC'}
https://arbiscan.io/address/0xedcb75bc3c5c341680fd39e37111b24a9dc88e0a
All address in cluster (full dataset):
1280
15
<0.01
batch swap Balancer vault
Mint And Stake GLP
Deposit Radiant Lending pool
Stake Dopex Stacking
Swap via Uniswap
Add liquidity Sushi
{'DPX', 'GLP', 'MAGIC','SLP','USDC','VST', 'fGLP','fsGLP', 'rUSDC',}
https://arbiscan.io/address/0x1711b4ad51a7b9b3aed21543be0675b3b8edce59
All address in cluster (full dataset):
1077
30
<0.01
Multiple swaps
Add liquidity to Hop Protocol
Stake GMX
Swap ETH Stargate Finance
{'BRC','DBL', 'DPX','ELK', 'GMX','HOP','HOP-LP-USDC', 'JONES', 'LINK','LPT', 'MAGIC','MYC','PLS','SPA', 'SWPR', 'SYN','UMAMI', 'USDC', 'VSTA','mUMAMI', 'sGMX', 'sbGMX','sbfGMX'})
https://arbiscan.io/address/0xaa796509043d317a7b62470ce30a59a0efcb25a9
All address in cluster (full dataset):
946
44
<0.01
Multiple swaps
Add liquidity to Hop Protocol
Mint and Stake GLP
Loop Radiant: Leverager
Stake Dopex
{'GLP', 'USDC', 'PLS', 'HOP-LP-USDC', 'rUSDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'variableDebtUSDC', 'VST', 'fGLP', 'fsGLP', 'BRC', 'SYN', 'JONES', 'MYC', 'DPX', 'MAGIC', 'LPT', 'GMX', 'ELK', 'SWPR', 'hUSDC', 'SLP'}
https://arbiscan.io/address/0x5e472d3b05dfcbcdafdd0c27476df67ba732ee9f
All address in cluster (full dataset):
680
42
<0.02
Create Contract
Swap Exact ETH for Tokens
{'LINK', 'GMX', 'UMAMI', 'BRC', 'SPA', 'SYN', 'ELK', 'SWPR', 'DPX', 'VSTA', 'JONES', 'PLS', 'MAGIC'}
https://arbiscan.io/address/0xfeaa0f8486abe51f09c3992fbfe85e9bc3c9eff8
All address in cluster (full dataset):
577
41
<0.02
MultiSwap Exact ETH for Tokens
{'USDC', 'PLS', 'HOP-LP-USDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'WETH', 'BRC', 'SYN', 'JONES', 'MYC', 'MAGIC', 'RDPX', 'LPT', 'GMX', 'ELK', 'SWPR'}
https://arbiscan.io/search?f=0&q=0x11353c44759beaa80c9fcdd1f6d0abcb2fc645de
All address in cluster (full dataset):
419
66
<0.02
MultiSwap Exact ETH for Tokens
Mint and Stake GLP
Stake GMX
Create Lock VotingEscrow
{'GLP', 'USDC', 'PLS', 'HOP-LP-USDC', 'rUSDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'variableDebtUSDC', 'VST', 'fGLP', 'STG', 'fsGLP', 'BRC', 'SYN', 'JONES', 'MYC', 'sbGMX', 'mUMAMI', 'DPX', 'MAGIC', 'LPT', 'GMX', 'sbfGMX', 'sGMX', 'ELK', 'SWPR', 'hUSDC', 'SLP'}
https://arbiscan.io/address/0x70d996d0cdec204b123f1ec9c3ddc87b0f59726a
All address in cluster (full dataset):
Through our research, we have successfully identified nine significant clusters and numerous smaller clusters of potential Sybil addresses that received $ARB tokens from the airdrop. Our findings contribute to a better understanding of the strategies employed by malicious actors to exploit airdrops, helping to inform the development of more robust mechanisms for token distribution in future events.
Original article (Arbitrum team removed our article from the forum)