# 
Arbitrum sybil addresses research

By [Frog Trail Analytics](https://paragraph.com/@frog-trail-analytics) · 2023-03-27

---

Introduction
============

With the increasing prevalence of airdrops, it has become crucial to identify Sybil addresses that exploit these events for unfair gains. In this research, we aim to uncover and analyze potential Sybil addresses that have received $ARB tokens from the airdrop by employing a two-step methodology.

**Methodology**
===============

In the [**first iteration**](https://twitter.com/FrogTrailio/status/1636767247376039952), we checked all addresses eligible for the airdrop but without any transactions on Ethereum. This method was chosen due to the high transaction costs in L1, which make spinning up multi-accounts more expensive than simply depositing into the Arbitrum network through sub-accounts from FTX (rip), OKx, and other CEXs.

As a result, [we found 112,473 addresses](https://web.archive.org/web/20230322141433mp_/https://twitter.com/FrogTrailio/status/1637073638770847746) without L1 transactions that received over 130 million $ARB tokens.

However, the likelihood of false-positive hits to this list is quite high, so we dig further.

In the second iteration, we decided to search for clusters of addresses that could be more likely attributed to Sybil addresses. Below you will find a report on nine large clusters of account addresses (max 3840 accounts/min 419 accounts), joined by a similar actions algorithm. Clusters are described in descending order of the number of accounts in the cluster. In addition to these, there are smaller clusters, and overall, we were able to group about 15k accounts or more than 2% of addresses that received the $ARB drop.

Cluster #1
----------

### Number of accounts:

3840

### Average number of transactions:

27

### Average value of transactions:

<0.01

### Algorithm of actions:

*   ~15 swaps via uniswap
    
*   couple of swaps via sushi
    
*   Add liquidity to Hop Protocol: USDC Liquidity Pool / bridge to Hop Protocol
    

### Token transfers:

{'LINK', 'DBL', 'LPT', 'GMX', 'UMAMI', 'BRC', 'SPA', 'SYN', 'ELK', 'SWPR', 'DPX', 'VSTA', 'JONES', 'USDC', 'MYC', 'PLS', 'HOP-LP-USDC', 'MAGIC'}

### Examples:

![](https://storage.googleapis.com/papyrus_images/37a455bf555b9e1af5e61aaab5236fb4f6a4b7355b2e3f56680ecf316ec4c0a0.png)

![](https://storage.googleapis.com/papyrus_images/bbdbfadc3ae0d7c7a7fa4c7473247c89dfa665e82dabd649602042635aea845a.png)

[https://arbiscan.io/address/0x53858c760621424a475d295dcc7cac6978eeaef2](https://arbiscan.io/address/0x53858c760621424a475d295dcc7cac6978eeaef2)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/u/1/d/e/2PACX-1vTHxly4GL-PQeGCL58A1Qf\_Zn4WmOuYVqPi4iUFnZSytMVYwSONMHJCB-mdgtGd\_2mYSQLxCGH3EnIt/pubhtml?gid=1831423096&single=true](https://docs.google.com/spreadsheets/u/1/d/e/2PACX-1vTHxly4GL-PQeGCL58A1Qf_Zn4WmOuYVqPi4iUFnZSytMVYwSONMHJCB-mdgtGd_2mYSQLxCGH3EnIt/pubhtml?gid=1831423096&single=true)

Cluster #2
----------

### Number of accounts:

2018

### Average number of transactions:

28

### Average value of transactions:

<0.01

### Algorithm of actions:

*   Multiple swaps
    
*   Add liquidity to Hop Protocol
    

### Token transfers:

{'BRC', 'DBL','DPX','ELK','GMX', 'GRG','HOP-LP-USDT','JONES','LINK', 'LPT','MAGIC', 'MYC','PLS’, 'SPA','STG','SWPR','SYN','TCR','UMAMI','USDC', 'USDT','VSTA','gBRC', 'hUSDT'}

### Examples:

![](https://storage.googleapis.com/papyrus_images/23685fd58e805d898550506c8738a87f591c24014e7a57e935a0408ed5e728e3.png)

![](https://storage.googleapis.com/papyrus_images/5368b2d1f75da9705a2c720fcab0445d7f41b03f8efd6e0ce6011d59117f9557.png)

[https://arbiscan.io/address/0xc3ceb25f8b75619aa70d38ca9ea1a7d55f709847](https://arbiscan.io/address/0xc3ceb25f8b75619aa70d38ca9ea1a7d55f709847)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/u/1/d/e/2PACX-1vRonuiSAv4b8JWIMtCBnBUsy1zgXYMRWl7ZQRJDc9cyX83sXbi7-ZEwFhkUyMOTfif-6hAnOrf\_IXD9/pubhtml?gid=1534485967&single=true](https://docs.google.com/spreadsheets/u/1/d/e/2PACX-1vRonuiSAv4b8JWIMtCBnBUsy1zgXYMRWl7ZQRJDc9cyX83sXbi7-ZEwFhkUyMOTfif-6hAnOrf_IXD9/pubhtml?gid=1534485967&single=true)

Cluster #3
----------

### Number of accounts:

1497

### Average number of transactions:

30

### Average value of transactions:

<0.02

### Algorithm of actions:

*   batch swap Balancer vault
    
*   Mint And Stake GLP
    
*   Deposit Radiant Lending pool
    
*   Fulfill Basic Order SeaPort 1.1
    
*   Swap via Uniswap
    
*   Add liquidity Hop Protocol
    

### Token transfers:

{'BRC', 'DBL','DPX','ELK', 'GLP', 'GMX','HOP-LP-USDC', 'JONES','LINK','LPT','MAGIC','MYC', 'PLS' 'SLP', 'SPA', 'SWPR','SYN', 'UMAMI','USDC','VST','VSTA', 'fGLP', 'fsGLP', 'hUSDC', 'rUSDC'}

### Examples

![](https://storage.googleapis.com/papyrus_images/c897b71b1aa302c521923f217ecd0bf2cd7a12a8274bc3303d0a21d48f40b245.png)

![](https://storage.googleapis.com/papyrus_images/1199a840ecec6838724d76f93ee0109f465e241c8d93a60432e20cc79e1e7701.png)

[https://arbiscan.io/address/0xedcb75bc3c5c341680fd39e37111b24a9dc88e0a](https://arbiscan.io/address/0xedcb75bc3c5c341680fd39e37111b24a9dc88e0a)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/d/e/2PACX-1vQfrdpK01MF27vGqfibJzumvLKTzTwWKoATZ22qjmwmzm\_7App5rHUo1HeL6BODArdeJiEqv-M7HtiU/pubhtml?gid=167172711&single=true](https://docs.google.com/spreadsheets/d/e/2PACX-1vQfrdpK01MF27vGqfibJzumvLKTzTwWKoATZ22qjmwmzm_7App5rHUo1HeL6BODArdeJiEqv-M7HtiU/pubhtml?gid=167172711&single=true)

Cluster #4
----------

### Number of accounts:

1280

### Average number of transactions:

15

### Average value of transactions:

<0.01

### Algorithm of actions:

*   batch swap Balancer vault
    
*   Mint And Stake GLP
    
*   Deposit Radiant Lending pool
    
*   Stake Dopex Stacking
    
*   Swap via Uniswap
    
*   Add liquidity Sushi
    

### Token transfers:

{'DPX', 'GLP', 'MAGIC','SLP','USDC','VST', 'fGLP','fsGLP', 'rUSDC',}

### Examples

![](https://storage.googleapis.com/papyrus_images/28d9384f3938be54fec43bb499dbf55eb4cd33677fe3dcfaf0f0c9203dcd86cd.png)

![](https://storage.googleapis.com/papyrus_images/f7db00d0b3dc5fcffb738109a46d6581b72080f046b6864e87558e2235770958.png)

[https://arbiscan.io/address/0x1711b4ad51a7b9b3aed21543be0675b3b8edce59](https://arbiscan.io/address/0x1711b4ad51a7b9b3aed21543be0675b3b8edce59)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/d/e/2PACX-1vSNxnllOun8uuwS1hpagTn-4PjVMkPencAti14V71KGGuf2Tttu6vMdM3xIYW2Cm7kiVCFug6iDJZLZ/pubhtml?gid=1588074497&single=true](https://docs.google.com/spreadsheets/d/e/2PACX-1vSNxnllOun8uuwS1hpagTn-4PjVMkPencAti14V71KGGuf2Tttu6vMdM3xIYW2Cm7kiVCFug6iDJZLZ/pubhtml?gid=1588074497&single=true)

Cluster #5
----------

### Number of accounts:

1077

### Average number of transactions:

30

### Average value of transactions:

<0.01

### Algorithm of actions:

*   Multiple swaps
    
*   Add liquidity to Hop Protocol
    
*   Stake GMX
    
*   Swap ETH Stargate Finance
    

### Token transfers:

{'BRC','DBL', 'DPX','ELK', 'GMX','HOP','HOP-LP-USDC', 'JONES', 'LINK','LPT', 'MAGIC','MYC','PLS','SPA', 'SWPR', 'SYN','UMAMI', 'USDC', 'VSTA','mUMAMI', 'sGMX', 'sbGMX','sbfGMX'})

### Examples

![](https://storage.googleapis.com/papyrus_images/5fc980ab7c7fb92c6fba270cca86bb5a19ab7280b205b56b80efa3e66d080b61.png)

![](https://storage.googleapis.com/papyrus_images/5f03e9b98f08b3e388c123b89abe6e2653a1c70882409a95a9072906c0c3eb2a.png)

[https://arbiscan.io/address/0xaa796509043d317a7b62470ce30a59a0efcb25a9](https://arbiscan.io/address/0xaa796509043d317a7b62470ce30a59a0efcb25a9)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/d/e/2PACX-1vSTpjODpgyTUDSLcOrf-gv\_6e-EN47BgmRgrx\_5YkTdMfK2\_eYkXQvIy5-kDUpLI2e3J5bK1yaFiUVN/pubhtml?gid=1182311245&single=true](https://docs.google.com/spreadsheets/d/e/2PACX-1vSTpjODpgyTUDSLcOrf-gv_6e-EN47BgmRgrx_5YkTdMfK2_eYkXQvIy5-kDUpLI2e3J5bK1yaFiUVN/pubhtml?gid=1182311245&single=true)

Cluster #6
----------

### Number of accounts:

946

### Average number of transactions:

44

### Average value of transactions:

<0.01

### Algorithm of actions:

*   Multiple swaps
    
*   Add liquidity to Hop Protocol
    
*   Mint and Stake GLP
    
*   Loop Radiant: Leverager
    
*   Stake Dopex
    

### Token transfers:

{'GLP', 'USDC', 'PLS', 'HOP-LP-USDC', 'rUSDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'variableDebtUSDC', 'VST', 'fGLP', 'fsGLP', 'BRC', 'SYN', 'JONES', 'MYC', 'DPX', 'MAGIC', 'LPT', 'GMX', 'ELK', 'SWPR', 'hUSDC', 'SLP'}

### Examples

![](https://storage.googleapis.com/papyrus_images/b472d63a6404c700150346b9b3d2c3f393305a605e878ef95fb9a462f8db373b.png)

![](https://storage.googleapis.com/papyrus_images/677e3fba401306548a9c2dd0f72a5c6b02a2d2014320b7636d6cf25241903973.png)

[https://arbiscan.io/address/0x5e472d3b05dfcbcdafdd0c27476df67ba732ee9f](https://arbiscan.io/address/0x5e472d3b05dfcbcdafdd0c27476df67ba732ee9f)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/d/e/2PACX-1vQYhoZBB\_Zkr23h-FeVha6a-0K9Me5S3d1LwbidKXDwCo6yiM32EgVhNx04EBAiV7zJB8RDOv4QDsEq/pubhtml?gid=539997082&single=true](https://docs.google.com/spreadsheets/d/e/2PACX-1vQYhoZBB_Zkr23h-FeVha6a-0K9Me5S3d1LwbidKXDwCo6yiM32EgVhNx04EBAiV7zJB8RDOv4QDsEq/pubhtml?gid=539997082&single=true)

Cluster #7
----------

### Number of accounts:

680

### Average number of transactions:

42

### Average value of transactions:

<0.02

### Algorithm of actions:

*   Create Contract
    
*   Swap Exact ETH for Tokens
    

### Token transfers:

{'LINK', 'GMX', 'UMAMI', 'BRC', 'SPA', 'SYN', 'ELK', 'SWPR', 'DPX', 'VSTA', 'JONES', 'PLS', 'MAGIC'}

### Examples

![](https://storage.googleapis.com/papyrus_images/dd3042b5b9e876ec74c7f24acf65f31f99d674a24e3a7b5d94b38910da98529a.png)

![](https://storage.googleapis.com/papyrus_images/ddc71eecd8c93f9cfdc018c7a1c29fa8b174d600bf5fe4f26668c13c69214f12.png)

[https://arbiscan.io/address/0xfeaa0f8486abe51f09c3992fbfe85e9bc3c9eff8](https://arbiscan.io/address/0xfeaa0f8486abe51f09c3992fbfe85e9bc3c9eff8)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/d/e/2PACX-1vSRThJHEUfeufr5bBqChO0xh4qccDy-5MycGKXBzqIvzu\_wuELGgAYyNzLjeBB77vv5VmGR64Fgwddg/pubhtml?gid=759296590&single=true](https://docs.google.com/spreadsheets/d/e/2PACX-1vSRThJHEUfeufr5bBqChO0xh4qccDy-5MycGKXBzqIvzu_wuELGgAYyNzLjeBB77vv5VmGR64Fgwddg/pubhtml?gid=759296590&single=true)

Cluster #8
----------

### Number of accounts:

577

### Average number of transactions:

41

### Average value of transactions:

<0.02

### Algorithm of actions:

*   MultiSwap Exact ETH for Tokens
    

### Token transfers:

{'USDC', 'PLS', 'HOP-LP-USDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'WETH', 'BRC', 'SYN', 'JONES', 'MYC', 'MAGIC', 'RDPX', 'LPT', 'GMX', 'ELK', 'SWPR'}

### Examples

![](https://storage.googleapis.com/papyrus_images/1d5e47f193d1fd756454b918ca948077aba9f52d8226a624d7b5043487b43c37.png)

[https://arbiscan.io/search?f=0&q=0x11353c44759beaa80c9fcdd1f6d0abcb2fc645de](https://arbiscan.io/search?f=0&q=0x11353c44759beaa80c9fcdd1f6d0abcb2fc645de)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/d/e/2PACX-1vQXOp-iHUtjwe-P9u4lZb92rjV-2rMPIq1gURPhnGEOX6pEZQz\_\_U3N6KXfTlQpBUL16kSbBtvyUxXv/pubhtml?gid=1598570715&single=true](https://docs.google.com/spreadsheets/d/e/2PACX-1vQXOp-iHUtjwe-P9u4lZb92rjV-2rMPIq1gURPhnGEOX6pEZQz__U3N6KXfTlQpBUL16kSbBtvyUxXv/pubhtml?gid=1598570715&single=true)

Cluster #9
----------

### Number of accounts:

419

### Average number of transactions:

66

### Average value of transactions:

<0.02

### Algorithm of actions:

*   MultiSwap Exact ETH for Tokens
    
*   Mint and Stake GLP
    
*   Stake GMX
    
*   Create Lock VotingEscrow
    

### Token transfers:

{'GLP', 'USDC', 'PLS', 'HOP-LP-USDC', 'rUSDC', 'LINK', 'DBL', 'UMAMI', 'SPA', 'VSTA', 'variableDebtUSDC', 'VST', 'fGLP', 'STG', 'fsGLP', 'BRC', 'SYN', 'JONES', 'MYC', 'sbGMX', 'mUMAMI', 'DPX', 'MAGIC', 'LPT', 'GMX', 'sbfGMX', 'sGMX', 'ELK', 'SWPR', 'hUSDC', 'SLP'}

### Examples

![](https://storage.googleapis.com/papyrus_images/f42143e00b79695a4e5788ba187c68b22169b694c141c71d793d5eb4247defb2.png)

![](https://storage.googleapis.com/papyrus_images/63e284dff4366fd4b542d8ec21710f903d2988b140aaa0b947705e38b2670673.png)

[https://arbiscan.io/address/0x70d996d0cdec204b123f1ec9c3ddc87b0f59726a](https://arbiscan.io/address/0x70d996d0cdec204b123f1ec9c3ddc87b0f59726a)

All address in cluster (full dataset):

[https://docs.google.com/spreadsheets/d/e/2PACX-1vS\_plxuvRfVAeFjUC4yRsDgGsttYbBq7-LawDZAMWYBC24fWdRRQ\_TXVTDKfry2HE5kq\_7lVO7DAkW-/pubhtml?gid=892494530&single=true](https://docs.google.com/spreadsheets/d/e/2PACX-1vS_plxuvRfVAeFjUC4yRsDgGsttYbBq7-LawDZAMWYBC24fWdRRQ_TXVTDKfry2HE5kq_7lVO7DAkW-/pubhtml?gid=892494530&single=true)

Conclusion
----------

Through our research, we have successfully identified nine significant clusters and numerous smaller clusters of potential Sybil addresses that received $ARB tokens from the airdrop. Our findings contribute to a better understanding of the strategies employed by malicious actors to exploit airdrops, helping to inform the development of more robust mechanisms for token distribution in future events.

Original article (Arbitrum team removed our article from the [forum](https://forum.arbitrum.foundation))

[https://web.archive.org/web/20230322141433/https://forum.arbitrum.foundation/t/sybil-addresses-research/8723](https://web.archive.org/web/20230322141433/https://forum.arbitrum.foundation/t/sybil-addresses-research/8723)

[https://twitter.com/FrogTrailio](https://twitter.com/FrogTrailio)

---

*Originally published on [Frog Trail Analytics](https://paragraph.com/@frog-trail-analytics/arbitrum-sybil-addresses-research)*