With the increasing prevalence of airdrops, it has become crucial to identify Sybil addresses that exploit these events for unfair gains. In this research, we aim to uncover and analyze potential Sybil addresses that have received $ARB tokens from the airdrop by employing a two-step methodology.

In the first iteration, we checked all addresses eligible for the airdrop but without any transactions on Ethereum. This method was chosen due to the high transaction costs in L1, which make spinning up multi-accounts more expensive than simply depositing into the Arbitrum network through sub-accounts from FTX (rip), OKx, and other CEXs.

As a result, we found 112,473 addresses without L1 transactions that received over 130 million $ARB tokens.

However, the likelihood of false-positive hits to this list is quite high, so we dig further.

In the second iteration, we decided to search for clusters of addresses that could be more likely attributed to Sybil addresses. Below you will find a report on nine large clusters of account addresses (max 3840 accounts/min 419 accounts), joined by a similar actions algorithm. Clusters are described in descending order of the number of accounts in the cluster. In addition to these, there are smaller clusters, and overall, we were able to group about 15k accounts or more than 2% of addresses that received the $ARB drop.

3840

27

<0.01

• ~15 swaps via uniswap

• couple of swaps via sushi

• Add liquidity to Hop Protocol: USDC Liquidity Pool / bridge to Hop Protocol

{'LINK', 'DBL', 'LPT', 'GMX', 'UMAMI', 'BRC', 'SPA', 'SYN', 'ELK', 'SWPR', 'DPX', 'VSTA', 'JONES', 'USDC', 'MYC', 'PLS', 'HOP-LP-USDC', 'MAGIC'}

https://arbiscan.io/address/0x53858c760621424a475d295dcc7cac6978eeaef2

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/u/1/d/e/2PACX-1vTHxly4GL-PQeGCL58A1Qf_Zn4WmOuYVqPi4iUFnZSytMVYwSONMHJCB-mdgtGd_2mYSQLxCGH3EnIt/pubhtml?gid=1831423096&single=true

2018

28

<0.01

• Multiple swaps

• Add liquidity to Hop Protocol

{'BRC', 'DBL','DPX','ELK','GMX', 'GRG','HOP-LP-USDT','JONES','LINK', 'LPT','MAGIC', 'MYC','PLS’, 'SPA','STG','SWPR','SYN','TCR','UMAMI','USDC', 'USDT','VSTA','gBRC', 'hUSDT'}

https://arbiscan.io/address/0xc3ceb25f8b75619aa70d38ca9ea1a7d55f709847

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/u/1/d/e/2PACX-1vRonuiSAv4b8JWIMtCBnBUsy1zgXYMRWl7ZQRJDc9cyX83sXbi7-ZEwFhkUyMOTfif-6hAnOrf_IXD9/pubhtml?gid=1534485967&single=true

1497

30

<0.02

• batch swap Balancer vault

• Mint And Stake GLP

• Deposit Radiant Lending pool

• Fulfill Basic Order SeaPort 1.1

• Swap via Uniswap

• Add liquidity Hop Protocol

{'BRC', 'DBL','DPX','ELK', 'GLP', 'GMX','HOP-LP-USDC', 'JONES','LINK','LPT','MAGIC','MYC', 'PLS' 'SLP', 'SPA', 'SWPR','SYN', 'UMAMI','USDC','VST','VSTA', 'fGLP', 'fsGLP', 'hUSDC', 'rUSDC'}

https://arbiscan.io/address/0xedcb75bc3c5c341680fd39e37111b24a9dc88e0a

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vQfrdpK01MF27vGqfibJzumvLKTzTwWKoATZ22qjmwmzm_7App5rHUo1HeL6BODArdeJiEqv-M7HtiU/pubhtml?gid=167172711&single=true

1280

15

<0.01

• batch swap Balancer vault

• Mint And Stake GLP

• Deposit Radiant Lending pool

• Stake Dopex Stacking

• Swap via Uniswap

• Add liquidity Sushi

{'DPX', 'GLP', 'MAGIC','SLP','USDC','VST', 'fGLP','fsGLP', 'rUSDC',}

https://arbiscan.io/address/0x1711b4ad51a7b9b3aed21543be0675b3b8edce59

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vSNxnllOun8uuwS1hpagTn-4PjVMkPencAti14V71KGGuf2Tttu6vMdM3xIYW2Cm7kiVCFug6iDJZLZ/pubhtml?gid=1588074497&single=true

1077

30

<0.01

• Multiple swaps

• Add liquidity to Hop Protocol

• Stake GMX

• Swap ETH Stargate Finance

{'BRC','DBL', 'DPX','ELK', 'GMX','HOP','HOP-LP-USDC', 'JONES', 'LINK','LPT', 'MAGIC','MYC','PLS','SPA', 'SWPR', 'SYN','UMAMI', 'USDC', 'VSTA','mUMAMI', 'sGMX', 'sbGMX','sbfGMX'})

https://arbiscan.io/address/0xaa796509043d317a7b62470ce30a59a0efcb25a9

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vSTpjODpgyTUDSLcOrf-gv_6e-EN47BgmRgrx_5YkTdMfK2_eYkXQvIy5-kDUpLI2e3J5bK1yaFiUVN/pubhtml?gid=1182311245&single=true

946

44

<0.01

• Multiple swaps

• Add liquidity to Hop Protocol

• Mint and Stake GLP

• Loop Radiant: Leverager

• Stake Dopex

{'GLP', 'USDC', 'PLS', 'HOP-LP-USDC', 'rUSDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'variableDebtUSDC', 'VST', 'fGLP', 'fsGLP', 'BRC', 'SYN', 'JONES', 'MYC', 'DPX', 'MAGIC', 'LPT', 'GMX', 'ELK', 'SWPR', 'hUSDC', 'SLP'}

https://arbiscan.io/address/0x5e472d3b05dfcbcdafdd0c27476df67ba732ee9f

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vQYhoZBB_Zkr23h-FeVha6a-0K9Me5S3d1LwbidKXDwCo6yiM32EgVhNx04EBAiV7zJB8RDOv4QDsEq/pubhtml?gid=539997082&single=true

680

42

<0.02

• Create Contract

• Swap Exact ETH for Tokens

{'LINK', 'GMX', 'UMAMI', 'BRC', 'SPA', 'SYN', 'ELK', 'SWPR', 'DPX', 'VSTA', 'JONES', 'PLS', 'MAGIC'}

https://arbiscan.io/address/0xfeaa0f8486abe51f09c3992fbfe85e9bc3c9eff8

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vSRThJHEUfeufr5bBqChO0xh4qccDy-5MycGKXBzqIvzu_wuELGgAYyNzLjeBB77vv5VmGR64Fgwddg/pubhtml?gid=759296590&single=true

577

41

<0.02

• MultiSwap Exact ETH for Tokens

{'USDC', 'PLS', 'HOP-LP-USDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'WETH', 'BRC', 'SYN', 'JONES', 'MYC', 'MAGIC', 'RDPX', 'LPT', 'GMX', 'ELK', 'SWPR'}

https://arbiscan.io/search?f=0&q=0x11353c44759beaa80c9fcdd1f6d0abcb2fc645de

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vQXOp-iHUtjwe-P9u4lZb92rjV-2rMPIq1gURPhnGEOX6pEZQz__U3N6KXfTlQpBUL16kSbBtvyUxXv/pubhtml?gid=1598570715&single=true

419

66

<0.02

• MultiSwap Exact ETH for Tokens

• Mint and Stake GLP

• Stake GMX

• Create Lock VotingEscrow

{'GLP', 'USDC', 'PLS', 'HOP-LP-USDC', 'rUSDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'variableDebtUSDC', 'VST', 'fGLP', 'STG', 'fsGLP', 'BRC', 'SYN', 'JONES', 'MYC', 'sbGMX', 'mUMAMI', 'DPX', 'MAGIC', 'LPT', 'GMX', 'sbfGMX', 'sGMX', 'ELK', 'SWPR', 'hUSDC', 'SLP'}

https://arbiscan.io/address/0x70d996d0cdec204b123f1ec9c3ddc87b0f59726a

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vS_plxuvRfVAeFjUC4yRsDgGsttYbBq7-LawDZAMWYBC24fWdRRQ_TXVTDKfry2HE5kq_7lVO7DAkW-/pubhtml?gid=892494530&single=true

Through our research, we have successfully identified nine significant clusters and numerous smaller clusters of potential Sybil addresses that received $ARB tokens from the airdrop. Our findings contribute to a better understanding of the strategies employed by malicious actors to exploit airdrops, helping to inform the development of more robust mechanisms for token distribution in future events.

Original article (Arbitrum team removed our article from the forum)

https://web.archive.org/web/20230322141433/https://forum.arbitrum.foundation/t/sybil-addresses-research/8723

https://twitter.com/FrogTrailio

With the increasing prevalence of airdrops, it has become crucial to identify Sybil addresses that exploit these events for unfair gains. In this research, we aim to uncover and analyze potential Sybil addresses that have received $ARB tokens from the airdrop by employing a two-step methodology.

In the first iteration, we checked all addresses eligible for the airdrop but without any transactions on Ethereum. This method was chosen due to the high transaction costs in L1, which make spinning up multi-accounts more expensive than simply depositing into the Arbitrum network through sub-accounts from FTX (rip), OKx, and other CEXs.

As a result, we found 112,473 addresses without L1 transactions that received over 130 million $ARB tokens.

However, the likelihood of false-positive hits to this list is quite high, so we dig further.

In the second iteration, we decided to search for clusters of addresses that could be more likely attributed to Sybil addresses. Below you will find a report on nine large clusters of account addresses (max 3840 accounts/min 419 accounts), joined by a similar actions algorithm. Clusters are described in descending order of the number of accounts in the cluster. In addition to these, there are smaller clusters, and overall, we were able to group about 15k accounts or more than 2% of addresses that received the $ARB drop.

3840

27

<0.01

• ~15 swaps via uniswap

• couple of swaps via sushi

• Add liquidity to Hop Protocol: USDC Liquidity Pool / bridge to Hop Protocol

{'LINK', 'DBL', 'LPT', 'GMX', 'UMAMI', 'BRC', 'SPA', 'SYN', 'ELK', 'SWPR', 'DPX', 'VSTA', 'JONES', 'USDC', 'MYC', 'PLS', 'HOP-LP-USDC', 'MAGIC'}

https://arbiscan.io/address/0x53858c760621424a475d295dcc7cac6978eeaef2

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/u/1/d/e/2PACX-1vTHxly4GL-PQeGCL58A1Qf_Zn4WmOuYVqPi4iUFnZSytMVYwSONMHJCB-mdgtGd_2mYSQLxCGH3EnIt/pubhtml?gid=1831423096&single=true

2018

28

<0.01

• Multiple swaps

• Add liquidity to Hop Protocol

{'BRC', 'DBL','DPX','ELK','GMX', 'GRG','HOP-LP-USDT','JONES','LINK', 'LPT','MAGIC', 'MYC','PLS’, 'SPA','STG','SWPR','SYN','TCR','UMAMI','USDC', 'USDT','VSTA','gBRC', 'hUSDT'}

https://arbiscan.io/address/0xc3ceb25f8b75619aa70d38ca9ea1a7d55f709847

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/u/1/d/e/2PACX-1vRonuiSAv4b8JWIMtCBnBUsy1zgXYMRWl7ZQRJDc9cyX83sXbi7-ZEwFhkUyMOTfif-6hAnOrf_IXD9/pubhtml?gid=1534485967&single=true

1497

30

<0.02

• batch swap Balancer vault

• Mint And Stake GLP

• Deposit Radiant Lending pool

• Fulfill Basic Order SeaPort 1.1

• Swap via Uniswap

• Add liquidity Hop Protocol

{'BRC', 'DBL','DPX','ELK', 'GLP', 'GMX','HOP-LP-USDC', 'JONES','LINK','LPT','MAGIC','MYC', 'PLS' 'SLP', 'SPA', 'SWPR','SYN', 'UMAMI','USDC','VST','VSTA', 'fGLP', 'fsGLP', 'hUSDC', 'rUSDC'}

https://arbiscan.io/address/0xedcb75bc3c5c341680fd39e37111b24a9dc88e0a

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vQfrdpK01MF27vGqfibJzumvLKTzTwWKoATZ22qjmwmzm_7App5rHUo1HeL6BODArdeJiEqv-M7HtiU/pubhtml?gid=167172711&single=true

1280

15

<0.01

• batch swap Balancer vault

• Mint And Stake GLP

• Deposit Radiant Lending pool

• Stake Dopex Stacking

• Swap via Uniswap

• Add liquidity Sushi

{'DPX', 'GLP', 'MAGIC','SLP','USDC','VST', 'fGLP','fsGLP', 'rUSDC',}

https://arbiscan.io/address/0x1711b4ad51a7b9b3aed21543be0675b3b8edce59

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vSNxnllOun8uuwS1hpagTn-4PjVMkPencAti14V71KGGuf2Tttu6vMdM3xIYW2Cm7kiVCFug6iDJZLZ/pubhtml?gid=1588074497&single=true

1077

30

<0.01

• Multiple swaps

• Add liquidity to Hop Protocol

• Stake GMX

• Swap ETH Stargate Finance

{'BRC','DBL', 'DPX','ELK', 'GMX','HOP','HOP-LP-USDC', 'JONES', 'LINK','LPT', 'MAGIC','MYC','PLS','SPA', 'SWPR', 'SYN','UMAMI', 'USDC', 'VSTA','mUMAMI', 'sGMX', 'sbGMX','sbfGMX'})

https://arbiscan.io/address/0xaa796509043d317a7b62470ce30a59a0efcb25a9

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vSTpjODpgyTUDSLcOrf-gv_6e-EN47BgmRgrx_5YkTdMfK2_eYkXQvIy5-kDUpLI2e3J5bK1yaFiUVN/pubhtml?gid=1182311245&single=true

946

44

<0.01

• Multiple swaps

• Add liquidity to Hop Protocol

• Mint and Stake GLP

• Loop Radiant: Leverager

• Stake Dopex

{'GLP', 'USDC', 'PLS', 'HOP-LP-USDC', 'rUSDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'variableDebtUSDC', 'VST', 'fGLP', 'fsGLP', 'BRC', 'SYN', 'JONES', 'MYC', 'DPX', 'MAGIC', 'LPT', 'GMX', 'ELK', 'SWPR', 'hUSDC', 'SLP'}

https://arbiscan.io/address/0x5e472d3b05dfcbcdafdd0c27476df67ba732ee9f

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vQYhoZBB_Zkr23h-FeVha6a-0K9Me5S3d1LwbidKXDwCo6yiM32EgVhNx04EBAiV7zJB8RDOv4QDsEq/pubhtml?gid=539997082&single=true

680

42

<0.02

• Create Contract

• Swap Exact ETH for Tokens

{'LINK', 'GMX', 'UMAMI', 'BRC', 'SPA', 'SYN', 'ELK', 'SWPR', 'DPX', 'VSTA', 'JONES', 'PLS', 'MAGIC'}

https://arbiscan.io/address/0xfeaa0f8486abe51f09c3992fbfe85e9bc3c9eff8

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vSRThJHEUfeufr5bBqChO0xh4qccDy-5MycGKXBzqIvzu_wuELGgAYyNzLjeBB77vv5VmGR64Fgwddg/pubhtml?gid=759296590&single=true

577

41

<0.02

• MultiSwap Exact ETH for Tokens

{'USDC', 'PLS', 'HOP-LP-USDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'WETH', 'BRC', 'SYN', 'JONES', 'MYC', 'MAGIC', 'RDPX', 'LPT', 'GMX', 'ELK', 'SWPR'}

https://arbiscan.io/search?f=0&q=0x11353c44759beaa80c9fcdd1f6d0abcb2fc645de

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vQXOp-iHUtjwe-P9u4lZb92rjV-2rMPIq1gURPhnGEOX6pEZQz__U3N6KXfTlQpBUL16kSbBtvyUxXv/pubhtml?gid=1598570715&single=true

419

66

<0.02

• MultiSwap Exact ETH for Tokens

• Mint and Stake GLP

• Stake GMX

• Create Lock VotingEscrow

{'GLP', 'USDC', 'PLS', 'HOP-LP-USDC', 'rUSDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'variableDebtUSDC', 'VST', 'fGLP', 'STG', 'fsGLP', 'BRC', 'SYN', 'JONES', 'MYC', 'sbGMX', 'mUMAMI', 'DPX', 'MAGIC', 'LPT', 'GMX', 'sbfGMX', 'sGMX', 'ELK', 'SWPR', 'hUSDC', 'SLP'}

https://arbiscan.io/address/0x70d996d0cdec204b123f1ec9c3ddc87b0f59726a

All address in cluster (full dataset):

https://docs.google.com/spreadsheets/d/e/2PACX-1vS_plxuvRfVAeFjUC4yRsDgGsttYbBq7-LawDZAMWYBC24fWdRRQ_TXVTDKfry2HE5kq_7lVO7DAkW-/pubhtml?gid=892494530&single=true

Through our research, we have successfully identified nine significant clusters and numerous smaller clusters of potential Sybil addresses that received $ARB tokens from the airdrop. Our findings contribute to a better understanding of the strategies employed by malicious actors to exploit airdrops, helping to inform the development of more robust mechanisms for token distribution in future events.

Original article (Arbitrum team removed our article from the forum)

https://web.archive.org/web/20230322141433/https://forum.arbitrum.foundation/t/sybil-addresses-research/8723

https://twitter.com/FrogTrailio