hop-protocol / hop-airdrop

Hop Airdrop distribution 🐰
176 stars 218 forks source link

Sybil Attacker Report #293

Open JubileGus opened 2 years ago

JubileGus commented 2 years ago

Related Addresses

(Check this doc too) https://docs.google.com/spreadsheets/d/1NhZlfuzG2nlBiiEiBellCPzq_0mK5NUqbOiaEaUVQxQ/edit?usp=sharing

0x87a87f84DF1C5765d1dF0b6698859175ca9584FF 0x0582137aEE51148aB6a7d5fb337a7f404381222c 0xE517F3dAC4e1A7f0f3b64A321e7d6C367C3386F9 0x4f9C862e69aa4e5d2edcfcad2fe9D3da53E93CE9 0xEF7FCc0Da3430cE03515874547eA5C9141c7CE9D 0xC467370DC17F3428ec620FCa05c33EA647E80EaD 0x1bb4c62BCdA3cb2e48e84B34227a559dca7E2F7a 0x887bFBc2B0Ce4a0535277Baa9eC1cbd6203f98ef 0xd469Ce76ca266dC2B84B2782A1879e6E0743492d 0xc0226dbe488C9E0De8515A16180b030467a3A958 0x23a018f8ffbb9538d3D269a76E210023e7b69Aee 0xCa71b724CD70C83E0468fe8d356191E98270921D 0x5BFB7901230769c8E918e821C4F04bA55DBB7ACd 0xC6A6433107934348e55A16918885aF2ccD821AfB 0x661A2Ec6F71aEaabec8E6fE1a812e5663C132feb 0x0b403Db354093ae6a6718ae119DB0F850E152174 0x1d87e7f2Dc4acc4D54DE5FbCf591194BAc2aE423 0x945F81E348f71A57143594741d55a9EAaD32f506 0xE15427495141b5b961e50885A9B0B6bc15eDc3C2 0xcE4752074d68fddf215b403417baa90FeF31BBA8 0x8450DC9630511500bE6BC9C44F928444B3919231 0xbfc61FafA0fB8a1475A69e71f28f056C00eD62C2 0x33d7863585EDf148f6b0660089590f6e230C6930 0xD5B877E0a977979997C8BAa9AAF8B67C358AB23F 0x9d4a9a7Df229B2E63b883B8FFA69585E59bf16Cb 0xB154ae9DD24E41BB0dDcC0ceaB42B13314F3704f 0x1ce8d99B251A0A7d0748534087659de04Eef2410 0xeB4c341489129843B325E8e77e05206fCB9DF862 0xAc0bc36A46B03457AC8a9314c3cEA59747681092 0x0e024CdBA8377ACF2d83e23090e27f5F8F490497 0xE017bBD299a573A13617514b300685cBBbd6692C 0x951DD053c77c49ef5dB85EC509AC417611a377A8 0xcCe0e1ab3aD9A9935a8B6814A337AFE96b87B759 0xb06EFD8A258C396C19467e4965CE65c8809122A6 0x46b396D3D27466B3B3D6bCa45b7F7358ae84f86A 0x341FfFf810e34920BC15Bc529A5d8E199d0c1194 0xC889265c6593F848f0ecA3C4Efbc8379E223c0C2 0xD97C9fa78AE6F2dAd784cc54D91D43E2ad1AEE6B 0x96bf65532a28631e018bdbd90f4f35ad1f1bd399 0x6C5E0d693668d37031688D4F945707063dd5024e

Reasoning

All green addresses are linked to this address 0x986a2fCa9eDa0e06fBf7839B89BfC006eE2a23Dd (referring to google doc ) Blue addresses are directly linked to the green above it Black addresses are directly linked to blue address above it Over 70% of transfers are made in December Most of transfers under the same address are 1-3 hours apart A lot of address interact with the same group of other, not eligible, addresses All addresses are connected on gnosis chain Most of addresses are connected on polygon Most accounts with higher count of tx are transferring small amounts many times Most of addresses first makes few initial back and forth transactions, within the same day, few hours apart. Number of connected addresses are probably much bigger, i just couldn't find them all due to lack of skills and experience There's few accounts accounts with larger volumes, but there's no indication they belong to someone else. Transaction pattern very similar to other accounts. Most of the addresses are connected through direct transactions (multiple for each), sending each other, mostly, stable coins and gas currency. Nonsense transfers are dominating (send and send right back after few hours) In most cases where more chains are used, transfers are still not making sense. They are just going in circle *The address mentioned before (0x986a2fCa9eDa0e06fBf7839B89BfC006eE2a23Dd) also interacted with other not eligible addresses, but almost every not eligible address is connected to one or more of of eligible addresses.

There's clear attempt to try and make it look like its not an attack, but seeing all these connections in totality i have no doubt its the same person.

I am not not very technical person, but since im not eligible for airdrop, i had to try. Its not like those other beautiful reports, but there's clearly an attempt to farm $Hop. Please, take my silly report seriously Ser :)

Methodology

I am pretty new to crypto, i am not familiar with coding, or tools, so i just scrolled back a little and started checking manually, one by one, until found one worth looking at (0x986a2fCa9eDa0e06fBf7839B89BfC006eE2a23Dd). :)))

It wasn't easy for me, and it took a lot of time. I really HOPe you'll take it seriously :)

Rewards address: 0x192ebF4E59A60A274eBA57a4370360A43504B486

JubileGus commented 2 years ago

Why you need it?

JubileGus commented 2 years ago

What is your telegram or discord?

Your farm? :D:D

JubileGus commented 2 years ago

Apparently this wallet (0x986a2fCa9eDa0e06fBf7839B89BfC006eE2a23Dd) is Ascendex exchange wallet. Still i believe this wallet belongs to one person using that exchange, because almost all eligible addresses connected to it interact with the same group of not eligible addresses.

shanefontaine commented 2 years ago

@visadareikia Thank you for the writeup and the data. Great work!

At this time, it is not possible to verify that there is a non-negligible probability of eliminating legitimate users. Because 0x986a2fCa9eDa0e06fBf7839B89BfC006eE2a23Dd is the Ascendex wallet, this data is rather difficult to verify.

The spreadsheet you posted seems very promising! Would you please try to pick out specific transactions that are near-identical and post a list of those addresses and the related transactions here? It looks like your spreadsheet has most of the data but it is not easy to verify. For example, can you potentially format the data as follows:

0x46b396D3D27466B3B3D6bCa45b7F7358ae84f86A has a transaction for 2886 USDT from Gnosis -> Polygon on Dec 02. 0x341FfFf810e34920BC15Bc529A5d8E199d0c1194 has a transaction for 2686 USDT from Gnosis -> Polygon on Dec 02 ...

Please see below for the breakdown of Hop protocol usage for each of these addresses.

address ensName total mainnet arbitrum optimism polygon xdai totalVolume
0xac0bc36a46b03457ac8a9314c3cea59747681092   3 0 0 0 2 1 $26,527.01
0x0e024cdba8377acf2d83e23090e27f5f8f490497   9 2 1 0 4 2 $13,823.46
0xcce0e1ab3ad9a9935a8b6814a337afe96b87b759   10 3 1 1 3 2 $7,386.55
0x5bfb7901230769c8e918e821c4f04ba55dbb7acd   6 0 0 0 4 2 $7,091.23
0xd5b877e0a977979997c8baa9aaf8b67c358ab23f   10 0 0 0 5 5 $6,693.39
0x945f81e348f71a57143594741d55a9eaad32f506   13 0 1 0 7 5 $6,666.37
0x341ffff810e34920bc15bc529a5d8e199d0c1194   3 0 0 0 0 3 $3,483.05
0x46b396d3d27466b3b3d6bca45b7f7358ae84f86a   3 0 0 0 0 3 $3,482.31
0xc889265c6593f848f0eca3c4efbc8379e223c0c2   3 0 0 0 3 0 $3,466.88
0xc467370dc17f3428ec620fca05c33ea647e80ead   28 0 0 0 19 9 $3,458.96
0xd97c9fa78ae6f2dad784cc54d91d43e2ad1aee6b   3 0 0 0 3 0 $3,455.70
0xb06efd8a258c396c19467e4965ce65c8809122a6   4 0 1 1 0 2 $3,348.58
0xd469ce76ca266dc2b84b2782a1879e6e0743492d   12 0 2 3 5 2 $3,161.77
0x4f9c862e69aa4e5d2edcfcad2fe9d3da53e93ce9   27 0 0 0 14 13 $3,135.04
0xe517f3dac4e1a7f0f3b64a321e7d6c367c3386f9   22 0 0 0 12 10 $2,635.23
0x951dd053c77c49ef5db85ec509ac417611a377a8   11 0 0 0 11 0 $2,520.67
0xef7fcc0da3430ce03515874547ea5c9141c7ce9d   20 0 0 0 10 10 $2,445.13
0x1bb4c62bcda3cb2e48e84b34227a559dca7e2f7a   2 0 0 0 1 1 $2,253.55
0x87a87f84df1c5765d1df0b6698859175ca9584ff   17 0 0 0 9 8 $2,206.90
0x0582137aee51148ab6a7d5fb337a7f404381222c   15 0 0 0 7 8 $1,991.53
0x1ce8d99b251a0a7d0748534087659de04eef2410   5 0 0 0 3 2 $1,636.07
0x33d7863585edf148f6b0660089590f6e230c6930   44 0 4 7 22 11 $1,566.93
0x887bfbc2b0ce4a0535277baa9ec1cbd6203f98ef   7 3 1 3 0 0 $1,449.84
0x1d87e7f2dc4acc4d54de5fbcf591194bac2ae423   3 0 0 1 1 1 $1,386.46
0xb154ae9dd24e41bb0ddcc0ceab42b13314f3704f   4 0 0 0 2 2 $1,372.69
0xe15427495141b5b961e50885a9b0b6bc15edc3c2   3 0 0 0 2 1 $1,363.41
0xc6a6433107934348e55a16918885af2ccd821afb   2 1 0 0 1 0 $1,318.41
0x9d4a9a7df229b2e63b883b8ffa69585e59bf16cb   3 0 0 0 2 1 $1,304.36
0xca71b724cd70c83e0468fe8d356191e98270921d   4 0 0 0 1 3 $1,289.71
0x23a018f8ffbb9538d3d269a76e210023e7b69aee   13 0 1 1 8 3 $1,272.11
0x661a2ec6f71aeaabec8e6fe1a812e5663c132feb   5 0 0 0 3 2 $1,219.96
0x0b403db354093ae6a6718ae119db0f850e152174   6 0 0 0 2 4 $1,200.94
0xc0226dbe488c9e0de8515a16180b030467a3a958   4 0 0 0 3 1 $1,199.39
0xe017bbd299a573a13617514b300685cbbbd6692c   3 1 0 1 0 1 $1,170.42
0xeb4c341489129843b325e8e77e05206fcb9df862 blank1u.eth 6 0 0 1 3 2 $1,087.03
0x6c5e0d693668d37031688d4f945707063dd5024e   4 0 0 0 3 1 $1,047.36
0x96bf65532a28631e018bdbd90f4f35ad1f1bd399   4 0 0 0 2 2 $1,033.45
shanefontaine commented 2 years ago

@visadareikia Please note that I am now going to start considering reports submitted later than yours that might include these addresses. Please feel free to add additional data and I will take a look if they are still eligible addresses at the time of review.

JubileGus commented 2 years ago

@visadareikia Please note that I am now going to start considering reports submitted later than yours that might include these addresses. Please feel free to add additional data and I will take a look if they are still eligible addresses at the time of review.

I have updated spreadsheet the way You suggested, just scroll down a bit :) Theres some inconsistencies amount wise for few addresses. Regarding dates, i believe thats just attempt not to be so obvious, thats why time frame streches throughout whole December. However it turns out, Thank You for being so supportive and encouraging! It is refreshing to see team this professional :)

JubileGus commented 2 years ago
0x87a87f84DF1C5765d1dF0b6698859175ca9584FF | $135 | polygon>gnosis | usdt | dec 19 -- | -- | -- | -- | -- 0xE517F3dAC4e1A7f0f3b64A321e7d6C367C3386F9 | 129 | polygon>gnosis | usdt | dec19 0x0582137aEE51148aB6a7d5fb337a7f404381222c | 136 | polygon>gnosis | usdt | dec19 0x4f9C862e69aa4e5d2edcfcad2fe9D3da53E93CE9 | 130 | polygon>gnosis | usdt | dec19 0xEF7FCc0Da3430cE03515874547eA5C9141c7CE9D | 131 | polygon>gnosis | usdt | dec 21 0xC467370DC17F3428ec620FCa05c33EA647E80EaD | 103 | polygon>gnosis | dai | dec 16 0x1bb4c62BCdA3cb2e48e84B34227a559dca7E2F7a | 1138 | polygon>gnosis | usdc | dec 10 0x887bFBc2B0Ce4a0535277Baa9eC1cbd6203f98ef | 103 | eth>polygon | eth | dec 9 0xd469Ce76ca266dC2B84B2782A1879e6E0743492d | 103 | polygon>op | eth | dec 19 0xc0226dbe488C9E0De8515A16180b030467a3A958 | 302 | polygon>gnosis | usdt | dec 10 0x23a018f8ffbb9538d3D269a76E210023e7b69Aee | 7 | polygon>gnosis | matic | dec 20 0xCa71b724CD70C83E0468fe8d356191E98270921D | 251 | polygon>gnosis | dai | dec 9 0x5BFB7901230769c8E918e821C4F04bA55DBB7ACd | 1206 | polygon>gnosis | usdt | dec 22 0xC6A6433107934348e55A16918885aF2ccD821AfB | 1194 | polygon>gnosis | usdc | dec 10 0x661A2Ec6F71aEaabec8E6fE1a812e5663C132feb | 206 | polygon>gnosis | usdc | dec 9 0x0b403Db354093ae6a6718ae119DB0F850E152174 | 231 | polygon>gnosis | usdc | dec 8 0x1d87e7f2Dc4acc4D54DE5FbCf591194BAc2aE423 | 480 | polygon>gnosis | dai | dec14 0x945F81E348f71A57143594741d55a9EAaD32f506 | 590 | polygon>gnosis | usdc | dec 9 0xE15427495141b5b961e50885A9B0B6bc15eDc3C2 | 245 | polygon>gnosis | usdc | dec 8 0xcE4752074d68fddf215b403417baa90FeF31BBA8 | 95 | polygon>gnosis | dai | dec 19 0x8450DC9630511500bE6BC9C44F928444B3919231 | 4915 | polygon>gnosis | dai | dec 20 0xbfc61FafA0fB8a1475A69e71f28f056C00eD62C2 | 4990 | polygon>gnosis | dai | dec 20 0xD5B877E0a977979997C8BAa9AAF8B67C358AB23F | 681 | polygon>gnosis | usdc | dec 8 0x9d4a9a7Df229B2E63b883B8FFA69585E59bf16Cb | 186 | polygon>gnosis | usdc | dec 8 0xB154ae9DD24E41BB0dDcC0ceaB42B13314F3704f | 245 | polygon>gnosis | usdc | dec 8 0x1ce8d99B251A0A7d0748534087659de04Eef2410 | 483 | polygon>gnosis | usdc | dec 8 0xeB4c341489129843B325E8e77e05206fCB9DF862 | 116 | op>polygon | usdc | dec 26 0xAc0bc36A46B03457AC8a9314c3cEA59747681092 | 10360 | polygon>gnosis | dai | dec 8 0x0e024CdBA8377ACF2d83e23090e27f5F8F490497 | 10360 | polygon>gnosis | dai | dec 9 0xE017bBD299a573A13617514b300685cBBbd6692C | 2024 | polygon>gnosis | dai | dec 16 0x951DD053c77c49ef5dB85EC509AC417611a377A8 | 504 | polygon>gnosis | usdc | dec 8 0xcCe0e1ab3aD9A9935a8B6814A337AFE96b87B759 | 1022 | polygon>gnosis | usdt | dec 7 0x78D4b0f4a44e9e2b5048e0F6421A3B444516106e | 127 | polygon>gnosis | usdt | dec 3 0x46b396D3D27466B3B3D6bCa45b7F7358ae84f86A | 100 | polygon>gnosis | usdt | dec 2 0x341FfFf810e34920BC15Bc529A5d8E199d0c1194 | 201 | polygon>gnosis | usdt | dec 3 0xC889265c6593F848f0ecA3C4Efbc8379E223c0C2 | 470 | polygon>gnosis | usdt | dec 3 0xD97C9fa78AE6F2dAd784cc54D91D43E2ad1AEE6B | 460 | polygon>gnosis | usdt | dec 4 0x96bf65532a28631e018bdbd90f4f35ad1f1bd399 | 232 | polygon>gnosis | usdt | dec 5 0x6C5E0d693668d37031688D4F945707063dd5024e | 185 | polygon>gnosis | usdt | dec 4
JubileGus commented 2 years ago

In some cases i could have gone for different transaction, more closely matching, lets say amount, but with different date, or vice versa

shanefontaine commented 2 years ago

Hey @visadareikia thank you for the continued work. I'm having a hard time finding patterns that exhibit non-negligible probability of eliminating legitimate users.

For example, I see that the following addresses all exist in a chain on Polygon. Additionally, based on the data you provided, they all sent about $130 in a transaction. Finally, they all sent more than 17 Hop transactions on the same networks. That is very good evidence, however, there are only 4 addresses in that group and not the required 20. If possible, please provide groups like this of size 20 or more.

Thank you!

0x4f9c862e69aa4e5d2edcfcad2fe9d3da53e93ce9
0xe517f3dac4e1a7f0f3b64a321e7d6c367c3386f9
0xef7fcc0da3430ce03515874547ea5c9141c7ce9d
0x87a87f84df1c5765d1df0b6698859175ca9584ff