# 【女巫攻击】如何预防女巫什么是女巫？看这篇就够了

By [空投指南](https://paragraph.com/@goout) · 2023-09-06

---

一、Connext女巫钱包地址特征分析

**先下结论：**

1、大部分女巫猎人水平较低，主要关注分发和归集这个最容易发现女巫的行为特征上，这个需要耗费大量的时间和精力

2、很小部分女巫猎人水平较高，追踪思路从钱包余额、gasLimit、区块Nonce、单链/多链行为一致化、Tx数量等多维度挖掘深层女巫用户，工具从debank、arkm、nashen等专业化工具演变。

3、用户提交的报告较多，目前看到积压几百条女巫报告未处理。项目方也拒绝了较多链上证据不足/不够直观的女巫报告，说明项目方需要人工审核的工作量巨大，尚未有工具可以一劳永逸。

4、Connext是继Hop后的第二个采用社区举报女巫的项目，注定被社区摒弃唾骂。connext也是继Zigzag后第二个官方明牌认定行为一致化女巫的项目方。这对后面的交互差异化要求更加大。

**本次女巫报告里面的女巫行为：**

1、分发（相同价值的代币）、归集（不限制于某一个链上）相同的代币。例如从币安提现到10个钱包，每个钱包1~1.2个eth； 例如在bsc网络归集SpaceId代币到币安；

2、行为一致化。 不区分任何一条链，具有创建时间相同、相同的交易时间、相同的交易对、相同的金额；例如在arb网络同一天有相同的eth-usdc 1000刀的交易量

3、Gas相同，区块相同，tx相同，账户余额相同等非交易性行为。例如10个钱包每笔交易gas相同，区块临近，tx数量相同

4、链路一致化。这个有点东西了，之前很少提及，即使时间、金额、交易都不同，但是链路相同也被女巫了；

**怎么规避？**

1、多样化充提现

2、交互行为多样化，避免3个钱包以上趋同性交易

3、链路交叉，多链+多项目交叉+多样化交易对+差异化金额

以下选取部分借鉴意义较大的女巫报告（以下女巫行为已被官方接纳）

核心大部分围绕着分发和归集为主，占据80%以上，中间叠加行为一致化（下面的分发归集“病毒图”来源于网络）

![](https://storage.googleapis.com/papyrus_images/f5d95683893750e75817246358f12671f3268cd3c1af2d52d37333fccb080b9e.png)

* * *

![](https://storage.googleapis.com/papyrus_images/1d7dc55c86c0dd70120f805e87dec0bce6c80e44e536d29fc24d25ded12e966f.png)

![](https://storage.googleapis.com/papyrus_images/a01825bb9e5479054576f724e231fd6fcebf690333f86bc325cc30dabdf3ca1c.png)

![](https://storage.googleapis.com/papyrus_images/e5bdd636691752a4e0f9bae9eb1da088b99eea25133f22f80f04cb438d11e362.png)

![](https://storage.googleapis.com/papyrus_images/653bb6de9b52655da3ada4c61d9c9f8e8e4b3001ce6c5867dae3fec30684762b.png)

![](https://storage.googleapis.com/papyrus_images/b0903e68c076ac08927e978f103b9004ab4aa2abf10c9b5d250c0a8de1a746f5.png)

![](https://storage.googleapis.com/papyrus_images/c7e0d613a156445ac4425bb5dc911e8bd02378df898735ce331088221bb71612.png)

![](https://storage.googleapis.com/papyrus_images/6e503e75188079c4c414df49b12db222eda70c075b5f526085bec943f444050b.png)

![](https://storage.googleapis.com/papyrus_images/ba1902f21f4bfe793d5863e6e1896b17aa2ea0d5ec6606b1a504451bea989008.png)

![](https://storage.googleapis.com/papyrus_images/218720129a33e65a5f61f099f7e223d8fe9e1c752b8297b71ed555fa764b647e.png)

![](https://storage.googleapis.com/papyrus_images/26230a1770893d8d9a3c0b91fb3043c91b73f728ed7cdff2674baf499835f844.png)

![](https://storage.googleapis.com/papyrus_images/c2429e9d4b6f0d95ac10073e3d43cd3a64228771523040e76fad143ca9fd5f5b.png)

![](https://storage.googleapis.com/papyrus_images/4ba2818d8abf2612dd130544ea72b5c59375209f3a0aea32dde1c237bddeb87b.png)

![](https://storage.googleapis.com/papyrus_images/105f6c038f7e2271d3757f4327ad1f1a22f8271d07bfca168fbf43df5936a6cb.png)

![](https://storage.googleapis.com/papyrus_images/7d0b4c3710dd802c33dccd9274c1d30039a351bb42af24aede6ab8889a48e630.png)

![](https://storage.googleapis.com/papyrus_images/7d0b4c3710dd802c33dccd9274c1d30039a351bb42af24aede6ab8889a48e630.png)

![](https://storage.googleapis.com/papyrus_images/ce8e80530f15e28ea44928270d5c89c8ec6b430c3b3198bb0b6db8fd6fcb3c0f.png)

![](https://storage.googleapis.com/papyrus_images/af393b06c8d6e500f3dce641f0c2d3035eb3560a75c42b9cab58f729d055e6de.png)

![](https://storage.googleapis.com/papyrus_images/35635f10bc3d16c31615114bb15774a5eff2974422ce2e5fba08de352bb2a423.png)

![](https://storage.googleapis.com/papyrus_images/a0d8f7d6189e54e9f93a18167fb2de94e9522453e48cc07ae251ea6a2ca28b7f.png)

![](https://storage.googleapis.com/papyrus_images/ed650dc463bc1cc4ebd8d5bfc410511f63db54941c50f9698f7488305534b0d6.png)

![](https://storage.googleapis.com/papyrus_images/a90c0ea36cb779eea1cd556490a335acb95e476d70fdca12df8c1672a67350bf.png)

![](https://storage.googleapis.com/papyrus_images/e76445dd05656a461b0c500b69ac7a0d0286c1d933908f15290deab3e6892e6c.png)

![](https://storage.googleapis.com/papyrus_images/9c1c0e61e79a871e78a80ba07687e7ca021f66167dc668a29a3cf71bea72d870.png)

![](https://storage.googleapis.com/papyrus_images/1b8d26c02a779c63ef43c381ac46e34d120c5f674042e4029555e3ee821991d4.png)

![](https://storage.googleapis.com/papyrus_images/a3b3c1bc0254fef464cc64fc8f874d5f2ab98db33ae00b5ea2fab23e1cbe76df.png)

![](https://storage.googleapis.com/papyrus_images/204bed69ac320e8496e57dea60498290720ef7114e1828a7dc8948fabb9f611c.png)

![](https://storage.googleapis.com/papyrus_images/b7f464f79ceb8595424fdef25648643b144bc2a2fb6de01ac8547972b702688e.png)

![](https://storage.googleapis.com/papyrus_images/ff9d31fac73f2bb8f9107b2724f838f65fff892fc20b233f2df8587ebf7d5503.png)

![](https://storage.googleapis.com/papyrus_images/80b9e65df9a50ebac52dc7021a2d54d50a64ea60bc59957f08ce03708e28274c.png)

![](https://storage.googleapis.com/papyrus_images/11ea152bc23550551f90c67ab662bc7575ca109637ffb4c4a4980f78ae361870.png)

![](https://storage.googleapis.com/papyrus_images/ac036f15fedfbed7b16fa750a396d293c507fcdf763d193c2abce6e622c2f513.png)

![](https://storage.googleapis.com/papyrus_images/a413f3b7862daf4c2b8cb9fe792f4cb4fde847f600196dfc26b2253fbf59f24d.png)

![](https://storage.googleapis.com/papyrus_images/f88478aef91df0ce5d5188c75960de95dc05b5770f2d250fa8e9f6c23e84c005.png)

![](https://storage.googleapis.com/papyrus_images/24ec89f69c734af931696febabe56ff0e0c4cc19516c64fae46fc89768069ac0.png)

![](https://storage.googleapis.com/papyrus_images/d79a7e77a559ff0d1fd13d6bc1e6214ad88c7b007556fd61796954235fa59915.png)

![](https://storage.googleapis.com/papyrus_images/37c4657f1a9db81e9de7f315b5756be8b9d9ec9d7409873625b449bc31f27b07.png)

![](https://storage.googleapis.com/papyrus_images/946ab585aae1d51193fa22cd11ace546c3fc05021d004b7cd145b2aaeeb713bb.png)

![](https://storage.googleapis.com/papyrus_images/f69e3e8e97f202c425e08887c329bd767360f1b571d3ce4fb55946ba93e52328.png)

![](https://storage.googleapis.com/papyrus_images/c52c85f9e454531a8b6a37cc06cfab7038807aab72d487e560052a2d4bf40865.png)

![](https://storage.googleapis.com/papyrus_images/f88f8a158a9609db7fbb04a88f46bac4b00999927d3ec048e8ba5b4b356985a1.png)

![](https://storage.googleapis.com/papyrus_images/5b678bd9f3efc618c3fa92a7ad667d9702c50cc91de02a58bcfa22777e878177.png)

![](https://storage.googleapis.com/papyrus_images/837d4b10230336855e4a22c6ca3d369a43b12f7bdea012aa3679111197b306bc.png)

![](https://storage.googleapis.com/papyrus_images/ab0e8a62ba2da91e48d5733696ca8d146fba90a6afcd389a41d772d67ca0faf8.png)

![](https://storage.googleapis.com/papyrus_images/5db7b48559957a22f435db0681dbfbf277569034e2513c1c503a248e6d4ad849.png)

![](https://storage.googleapis.com/papyrus_images/b4addfe2699ce84b16aa54987f64ad2c1275d0cb60740f4924423f7fefebba7f.png)

![](https://storage.googleapis.com/papyrus_images/55f7ed1e8364db5d999669fdaf4fd0cc9b4f3c89664e5a81a9c87f6db9ad3882.png)

![](https://storage.googleapis.com/papyrus_images/35fbaa24323fa529447c4c9d425c4fbd5041c2d21460ac3a96bc5cba2a8c8c5c.png)

![](https://storage.googleapis.com/papyrus_images/a0f541bd874f588643baa7c68c96f3ccb8285d1657471fd48995f3500d04afa6.png)

![](https://storage.googleapis.com/papyrus_images/c92db3250bff5519a7380bf2f4912a5b287736398703646db286efe9c7d6975d.png)

![](https://storage.googleapis.com/papyrus_images/6b415984b50ae4118267c1eb5ed9d06dcb8c59842c32ada33eaef61e36ae65ed.png)

![](https://storage.googleapis.com/papyrus_images/de38579d57c0216cde75aa640cdac4bd6326c774b2c462d5696cb6d15d4f6f28.png)

![](https://storage.googleapis.com/papyrus_images/c30c92949d356d94e239c7103394ee3ca1d19e68ecd5cbf999be0667e0fede35.png)

![](https://storage.googleapis.com/papyrus_images/435f21538a8e66687639b62993b42329dc4de7cf488b4a496ff6f058667712e7.png)

![](https://storage.googleapis.com/papyrus_images/58882981ba8247360dae874e1cfdf19af2e9037f02d26d00c617634f2914c464.png)

![](https://storage.googleapis.com/papyrus_images/f3c797d6203d04ff1025b559b533ee9d1667339d717b4eaff1f60515242afbf4.png)

![](https://storage.googleapis.com/papyrus_images/c61ea535a650c16e4d21d9c14b7a800ce886822c164d768f94cb6c3acbccb7db.png)

![](https://storage.googleapis.com/papyrus_images/fed72fea0364aaf6e1abdea9bc748344b36e6005bcdadc4ff384fa73df6dba2b.png)

![](https://storage.googleapis.com/papyrus_images/4d97e4a2794ffaa8f4a9a15cc4843046da113320919c493a34402744727fe576.png)

**二、关于ok子账户的运转逻辑：**

1、用户建立的子账户，虽然属于是ok的子账户，但是各自没有转账关联。

2、用户充值的资金/划转行为，ok会定期汇集到ok的热钱包里，理论上一次归集是

同一时间多用户的多子账户归集，这个行为是无法区分出来是否是女巫行为的

---

*Originally published on [空投指南](https://paragraph.com/@goout/HCrtSVzuhwbvLq2TGcSD)*