In June, Odyssey was on fire in the crypto world. However, Odyssey was forced to be suspended a week after it started due to overcapacity issues. Over 300K addresses participated in this massive rat race event. With the release of the Nitro version and restart of the Odyssey, this article gives deep insights into the on-chain data and indicates the reason behind the vibe of rat race in Odyssey. We summarized three perspectives as follows:

1. Real and Active Users: A large number of high quality users (82%) participated in the GMX project, but the high computational cost of a single transaction in the GMX project caused the Arbitrum network to clog up and was the direct cause of the disruption of the Odyssey.

2. Sybil Attacks: Loads of low quality addresses as well as sybil addresses, total camp up with 60% addresses participated in the first week of the cross-chain bridge campaign, which forced Odyssey to stop and delayed.

3. Professionalism of Econnoisseur: tech parties and studios used multiple addresses for econnoisseur and even promoted the tactics massively on Twitter and Mirror.

At the end of the article, we reveal the largest group of sybil attacks, which contains more than 50K econnoisseur addresses in the group that are pretty much consistent behavior pattern

Arbitrum is the recognized leader in the Layer2 track, with over $2.6 billion TVLs and over 1 million unique addresses, running 300+ dApps till now.

In June this year, Optimism, another mainstream Layer 2 chain, issued an airdrop token for active users, with 250K eligible addresses. With a minimum of 271 OPs and a maximum of 32,420 OPs for a single address, the airdrop was worth a minimum of 433 U based on the OP current market price. In today's bearish environment, the market is full of expectations for Arbitrum's airdrop, and therefore Odyssey event is deemed as an easy way to earn the airdrops.

The Odyssey is an event that promotes users to interact with the Arbitrum eco-projects and complete specific tasks for prizes of 16 different NFTs, with the final arbi-verse NFT being awarded to those who collect more than 13 NFTs. 14 projects are currently part of the Odyssey through community voting. The first week is the cross-chain bridge task; the second week is Yield Protocol and GMX; followed by Aboard Exchange and TofuNFT (week three), Uniswap and Apex (week four), 1inch and Izumi/Yin Finance (week five), Dodo and Swapr (week six), respectively. TreasureDAO and Battlefly (week seven), Ideamarket and Sushi (week eight).

From the start of the Odyssey on 21 June, the number of transactions on Arbitrum soared insanely, peaking on 27 June with 280,000 transactions and 55,000 new addresses in a single day. After the suspension of the Odyssey, the number of transactions and new addresses plummeted dramatically. Until recent news of the Odyssey's relaunch, the participants and transaction are rebuilt and bounced again.

The task of the first week was to let participants familiarize the process of transferring the assets from other chains to Arbitrum with the cross-bridge. The whole process is easy to hands on and the event went well at first.

However, unexpectedly in the second week, the gas fee for the Layer2 chain was much more expensive than the ETH Layer1, even twice as much as the ETH chain. Massive users packed into the GMX project within a short period of time, which caused extreme congestion. The fee was 1 U originally rocketed to 10 U. Heard a dad joke was saying that "I used to hear media blowing Layer2, but I never knew what Layer2 meant. Today I finally got what Layer2 truly means. Layer2 means twice gas as Layer1."

At 10pm on 29 June, Arbitrum urgently tweeted to call a halt to the Odyssey. As the suspension of the event, the fees on Arbitrum returned to normal level.

The current transaction cost of Arbitrum consists of L1 Fixed Cost, L1 Calldate Paid, L2 Computational Paid and L2 Storage Paid. Adding all up is the the cost of each transaction on Arbitrum gas fee. The increase in L2 Computational Paid is the direct cause of the spike in Gas fees. Arbitrum's pricing depends on a floor price and a congestion pricing mechanism. The floor price is set to the estimated L1 Gas divided by 100, and when there is no congestion, the price is the floor price, and when the network is congested, its price starts to spike from the floor, similar to Ethereum. When the number of transactions spikes and the capacity limit is reached, the price will automatically rise until the traffic spike slows down.

We conducted a special analysis of the addresses involved in GMX contract trading and GMX SWAP trading. Nearly 18,000 addresses involved in GMX activity, we identified only 432 addresses as the Sybil groups, representing less than 2.5% of all GMX participants. We therefore deduce that the vast majority of users participating in the GMX campaign were real users. Furthermore, we analyzed the level of activity (based on number of transactions and transaction amounts) of all addresses and 82% addresses were active. Thus, the large number of quality users participating in the GMX project caused real people to compete, and the high computational cost of a single transaction in the GMX project caused the Arbitrum network to clog up, which was the direct reason of the disruption of the Odyssey.

3.1.1 Address Quality Analysis

We selected data from GMX project participating addresses on the ETH chain, before the start of the GMX campaign (June 27th) for analysis. As the graph below shows, more than 60% of the participating GMX addresses had more than 10 transactions on the ETH chain, and more than a quarter of the GMX addresses had more than 100 transactions on the ETH chain. Only 9% of the addresses have not made any transactions on the ETH chain. As can be seen from the graph below, the proportion of addresses with between 1 and 10 transactions is close to 30%, which raises a small question mark on our conclusion that the majority of participating GMX users are active users. We then analyzed the transaction amounts for this group of addresses especially.

For addresses with only 1-10 transactions on the ETH chain, as shown in the chart below, about 80% of the addresses have accumulated more than 100 USD in transactions on the ETH chain, and what is more noteworthy is that the proportion of transactions exceeding 1000 USD is more than 30%. This figure shows that although these GMX users have a low number of transactions, the amount of each transaction is of high quality and these GMX users can also be considered as quality active users.

Approximately, we exclude the 9% of addresses without any transactions and those with less than 10 transactions and less than 100 USD (about 10%). More than 82% of the GMX participating addresses are active.

3.1.2 GMX High Computational Cost

The process of a user opening and closing a position on GMX involves two parts of the transaction, the request to open (close) the position and the Keeper execution. Unlike a typical Dex/Cex which only charges for opening and closing a position, GMX uses the Keeper to call the Chain Oracle to perform a feed to implement the transaction, increasing the computational cost of Layer2.

Specifically, nodes processing transactions in the Arbitrum One network have a bandwidth limit of 120,000 arbgas per second. arbgas is the unit of measurement used for computational and storage of transaction data. The large number of GMX transactions makes the computational cost of each transaction take up too much bandwidth, and the overall network's ability to process transactions decreases significantly with the same number of nodes.

For the first week of the Odyssey's Cross-Chain Bridge campaign, we revealed that the majority of the 330K addresses of projects participating in the Cross-Chain Bridge campaign were low-quality addresses and sybil addresses. Over 110K sybil addresses accounted for approximately 40% of the Cross-chain Bridge participants. Over 190K low-quality addresses have no transaction history on the ETH chain (149,642) or have less than 10 transactions and less than 100 USD in cumulative transactions (40,451). As a result, a large number of econnoisseur users are involved in the cross-chain bridge campaign, bringing a fake boom to the campaign and exacerbating the rat race of the Odyssey campaign.

Addresses need to participate in almost all projects to receive the ultimate Odyssey NFT reward. While the majority of the 18K addresses participating in the GMX campaign are real addresses, it can be expected that sybil and low quality addresses will participate in GMX again when the GAS fee is low and a few days before the campaign ends.

3.2.1 Low Quality Address

To further argue with the conclusion that the cross-chain bridge has low quality addresses, we performed a transaction count analysis on addresses that have transactions on the ETH chain. As shown in the graph below, 45% of users have never had a transaction, and even for those who have transactions on ETH, more than half of the users participating in the cross-chain bridge have less than 10 transactions.

Same as the GMX-specific analysis, we analyzed the transaction amount for addresses that participated in the cross-chain bridge with 10 transactions or less. As the chart below shows, there are over 40K addresses with transaction amounts less than 100 USD, plus 150K addresses with no transaction history. The total number of users of low quality addresses in the Cross-Chain Bridge campaign was 190K, accounting for nearly 60% of the total number of addresses in the Cross-Chain Bridge (obvious contrast to the quality of addresses participating in the GMX campaign). We presume that these addresses were specialized and dedicated to the econnoisseur of the Odyssey.

3.2.2 Sybil Address A Sybil attack is when a group controls a large number of addresses and uses them to participate in an Odyssey in bulk. We conduct deep learning algorithms to identify Sybil addresses. The transaction relationships between addresses on the chain are naturally better characterized by graphs. We therefore construct a large-scale topological graph for the address transaction data on the chain. Based on this, we use a deep learning model, graph neural network (GNN) technique, to learn the topology of the addresses on the chain and to detect potential homogeneous groups. This approach effectively identifies groups of addresses on the chain that behave similarly on a large scale. Combined with interaction data with Odyssey, the corresponding Sybil attack addresses can be pinpointed.

The figure below shows a partially association graph of Sybil addresses, where we have identified the detected witch gang addresses with red boxes and information about their corresponding interaction addresses.

Sybil Attack Example 1：On a large scale perspective，there are many groups that use the same pattern to grip the Odyssey NFT.

• Transfers funds from personal address to the sybil address

• Sybil address completes the task instead

• Consolidates all funds to a personal address finally

Sybil Attack Example 2: On a small scale perspective, sybil groups can control hundreds of addresses and behave similar patterns within a short period of time to bulk grip Odyssey NFT.

Sybil Attack Example 3: Some sybil addresses may not only participate in the Odyssey, but also participate in subsequent events in packs. For this example, this group of sybil addresses both participate in the Odyssey and trade in the tofuNFT marketplace, and all NFTs are collected together at the same address finally.

3.2.3 Professionalism of Econnoisseur

Under the limited investment opportunities in a bear market, the lucrative token incentives of the OP chain, Arbitrum's own market position, and the clear airdrop terms of Odyssey attract lots of participants. The influencers were shouting orders, and econnoisseur tutorials were spread out. The tutorials can be divided into 3 categories as follows.

1. Tutorials for beginners: Through pictures and videos, they teach new users how to participate in the project and interact with the project step by step.

2. Scientist's tutorials: Tutorials on how to participate in an Odyssey project with multiple accounts in practice. By writing code, interacting directly with the project's contracts or calling the project's API.

3. Workshop tutorials: Workshops are advertised on twitter to take the place of users completing tasks during the eight week long odyssey. According to some reports, the studios had thousand addresses participating in the campaign at the same time.

Some tutorial goes further and analyses in detail how to avoid being caught sybil addresses, including device isolation, IP isolation in Web2 and the funds isolation method in Web3. Also mentions that the FTX exchange supports the setting up of up to 50 deposit addresses for a single account, which is ideal as an infrastructure for segregating funds.

3.2.4 An Example of Huge Sybil Attack Group

The chart below shows the largest group found in the cross-chain bridge activity, involving more than 50K addresses and 16K addresses currently receiving NFTs on Arbitrum. there is a clear consistency in the group's behaviour.

1. Same cross-chaining behavior: both cross-chain from Polygon to Arbitrum via the HOP cross-chaining bridge. And both are ultra-small cross-chains.

2. Same source of funds: the cross-chain funds come indirectly from the address: 0x9b8753AC5a975708a654d16F7a1C1fC9a7B98828

3. Same transfer method: the funds are distributed on Polygon all through the contract address of Disperse.app. Disperse supports bulk transfers, and the distribution address can distribute the funds to an average of 150 addresses in a single transaction. This tool is a great tool to improve the efficiency of the wool party. It is worth noting that the group uses both the official contract and deploys a new contract that is identical in functionality to Disperse.app. The reason behind this may be to avoid being tracked for using the official contract.

4. Same destination of the funds & NFT: after collecting the NFT on Arbiturm, the funds as well as the NFT are pooled at address 0xc3638bc458b067f3e6510a631fdcf35af9f1bbe2

   Source of origin funds addresses：
   0x9b8753AC5a975708a654d16F7a1C1fC9a7B98828
   
   Source of distributed funds addresses: 
   0x8c3bda17f97f9d0d2bd45cad274372da2c589833
   0x44d7b054ccbea322a304ba6eabd84a862953cd74
   0xb1a936d931b523e3ec617c1ef89d320717b047cb
   
   Funds & NFT collection addresses:
   0xc3638bc458b067f3e6510a631fdcf35af9f1bbe2  
   

With the launch of the Arbitrum Nitro network, the Arbitrum Odyssey will soon be back in action. In today's climate, the Odyssey is bound to continue to attract users to experience Web3 and participate in Arbitrum's various projects, So the rat race is not only a pressure test for network performance, but also a cornerstone of a healthy ecosystem. However, from the existing data, the presence of a large number of sybil addresses has exacerbated the competition, resulting in a fake boom for the industry and a loss of interest for the normal users.

X-explore has built a comprehensive sybil address identification pipeline, which has already identified 400K high confidence sybil addresses on the Arbitrum chain, and we are continuously keeping updates. Hope we can provide real-time warning of sybil attacks on projects and promote a health industry.

As the Odyssey is about to restart, X-explore and ApeX Protocal, one of the Odyssey projects, have reached a strategic partnership to help continuously acquire high quality users, build a healthy Dex ecosystem and provide a fairer and more equitable opportunity for Dex users.

For more info, please subscribe:

Mirror: https://mirror.xyz/x-explore.eth

Twitter: https://twitter.com/x_explore_eth