Iseeyou23 commented 2 years ago

Related Addresses

0xe8da3d3823ea3f93edcf0d3d387dc4629d9602cb >0xeeDDFB62cF9cd86AAE74784A5eF33B18678179D4 >0x6296bd898CB887e790aE384Ee839D697916927e6 >0xe8da3d3823ea3f93edcf0d3d387dc4629d9602cb 0xf490f58567fabfc2aee47ffa3a87be29590df3b3 0x07ee3deefffc9e8b94b5603dee0f76dd98db1c26 0x0d15e3c5747c678ad9b6d660d7d6a2dec19f0e76 >0x07966bb7A08181dc659c416cFeB588cA397b394B >0x3FE61420C33b0E41DDd763adaAeB0b638E78b768 >0xb532B491Fa65E40F49703A717506fB652759881d >0xc4EA203E2eb096C4D949B9A64a5D49C0a8a1D8B3 >0xc08eaaf1204ea5e7c71e900c67c41068a01476f4 >0x5Ed2028D2905B143Fe67844bAbd12DB6edEBA2E3 >0x8eA616eBC49722bF93a5fe82816B2fF22f451Fcc >0x1f132D3493A605A1da41B2355E7811B64aB6CA4E >0xbBe6Cc22b0344D00F780576BbB78a3135d514726 >0xE8DA3D3823eA3F93eDCF0d3d387DC4629d9602cb >0xfB2F2C0F1C6fdFec3890E0c76FBF9fe45a6DEff2 >0x8fADfE756bEE48bE880f3D9102A19363e18d130C >0x6FE025Dc79FEF8114e19D3370903E3166A625bB9 >0x9F14F09264723E81d7231551af40f745976D740b >0x35a1c9b1ED12332Be6b1AD5F232C6071acfF2185 >0xfcC4106f974d942F4a1E62E083C1830a7Eadc303 >0xEAbcBF31Cb0dD408b2EEE6e10Eb35636cD7fb5Ae >0xd8ed0Eaea752c4a835E84AdBAa2795cA3cAb5Ba3 >0xBdD95ABE8a7694CCD77143376b0fBea183E6a740 # Reasoning VIRTUALJOHN.ETH 0x6ab133af137fd94294afbc4dfdebb6ded94a572d is the attacker. HE sent funds to 0xca812530a5a97f2cfb321fbd6f40da292e9f2045 , tnxid.eth 0x36678734c5ea45e6fc2815b35ab8945073560f2472a65c6babed0f004aaac7de He then bridged to matic and dispersed matic to other wallets where he used swapandsend. All wallets have almost the same value of bridged funds and they all acted in same timeline. (From 60-90 days ago) , (from 510/550 $ per bridge and some wallets have 5-10k per bridge) # Methodology Im using a script and also manually research wallets that are eligible. I manually followed the multisend transaction and compared the wallets to the eligible ones for airdrop. Then i search for more than one connection and all wallets are also interconnected. They all bridged and used HOP in the same timeline and with the similar value. # Rewards Address 0x82742CC8A0dF025Ff7B6bbdd22429A351FA2DE7c

shanefontaine commented 2 years ago

@Iseeyou23

Thank you for the submission. Unfortunately, this submission does not meet one of the criteria for submissions:

Methodology that has a non-negligible chance of eliminating legitimate users will not be considered

There will need to be additional proof submitted in order to consider this a valid group that does not include any legitimate users. Please consider providing more information about the behavior of these addresses, such as identical types of transactions or similar timing of transactions. Please note that another user that submits an issue with a detailed, non-negligible chance of eliminating legitimate users, their submission will be considered before yours.

He then bridged to matic and dispersed matic to other wallets where he used swapandsend.

Can you please share the transactions where the dispersing occurred? To help you with more data, please see below for the behavior of these addresses on Hop protocol:

address	total	mainnet	arbitrum	polygon	totalVolume
0x9f14f09264723e81d7231551af40f745976d740b	6	4	2	0	$376,991.83
0xc4ea203e2eb096c4d949b9a64a5d49c0a8a1d8b3	5	0	5	0	$284,874.97
0xeeddfb62cf9cd86aae74784a5ef33b18678179d4	15	0	6	9	$172,128.71
0xf490f58567fabfc2aee47ffa3a87be29590df3b3	8	0	8	0	$129,304.06
0x6fe025dc79fef8114e19d3370903e3166a625bb9	3	0	2	1	$102,787.46
0xbbe6cc22b0344d00f780576bbb78a3135d514726	3	0	0	3	$100,315.94
0xeabcbf31cb0dd408b2eee6e10eb35636cd7fb5ae	11	2	5	4	$91,259.76
0xb532b491fa65e40f49703a717506fb652759881d	22	11	9	2	$75,921.97
0xe8da3d3823ea3f93edcf0d3d387dc4629d9602cb	16	8	7	1	$63,213.97
0x3fe61420c33b0e41ddd763adaaeb0b638e78b768	12	8	3	1	$62,254.31
0x07ee3deefffc9e8b94b5603dee0f76dd98db1c26	35	4	1	30	$49,568.86
0xc08eaaf1204ea5e7c71e900c67c41068a01476f4	24	5	4	15	$22,368.39
0xbdd95abe8a7694ccd77143376b0fbea183e6a740	2	0	2	0	$21,582.28
0xfcc4106f974d942f4a1e62e083c1830a7eadc303	4	1	1	2	$16,919.97
0xfb2f2c0f1c6fdfec3890e0c76fbf9fe45a6deff2	15	2	0	13	$13,244.09
0x5ed2028d2905b143fe67844babd12db6edeba2e3	2	0	2	0	$7,964.49
0x0d15e3c5747c678ad9b6d660d7d6a2dec19f0e76	4	2	0	2	$6,183.70
0x6296bd898cb887e790ae384ee839d697916927e6	2	1	0	1	$5,414.16
0x07966bb7a08181dc659c416cfeb588ca397b394b	4	0	0	4	$3,298.28
0xd8ed0eaea752c4a835e84adbaa2795ca3cab5ba3	2	2	0	0	$3,092.58
0x8fadfe756bee48be880f3d9102a19363e18d130c	5	3	2	0	$1,513.82
0x1f132d3493a605a1da41b2355e7811b64ab6ca4e	2	2	0	0	$1,504.51
0x8ea616ebc49722bf93a5fe82816b2ff22f451fcc	3	0	0	3	$1,171.62
0x35a1c9b1ed12332be6b1ad5f232c6071acff2185	2	1	1	0	$1,168.35

Iseeyou23 commented 2 years ago

I manually checked again all the addresses that he dispersed matic too and its proof that this is one attacker and not friends sending each other funds. All wallets recieved 1 MATIC to be able to pay for back bridging fees. Check tnx below. Attacker used disperse ETH 3 times.

Disperse transaction tnx > On matic chain https://polygonscan.com/tx/0xfac0a280dbee4776d1c65a2ea21790af2d7ff2074c60fcb3009fdbbbcc0ccff4 https://polygonscan.com/tx/0xc0a0790a8a068e8e228c354590a89ae3bfc3887fc51ee748ace1980fb533d161 https://polygonscan.com/tx/0x8b3fa7d3abd08cc843ba5ff808465628063cd610825467d15ffd36d4301426d3

shanefontaine commented 2 years ago

@Iseeyou23 We have observed cases of apps sending funds through Disperse to help their users pay for gas on L2s. We have also seen altruistic people and faucets do the same. Because of this, we will need additional evidence. Some potential compelling evidence may be:

Identical transactions on the exact same day/time by most or all of the addresses
A trace of the ERC20 token between addresses (as opposed to native tokens)
A similar time/date that all the addresses started transacting on a chain

Please let us know if you can provide this data. Thank you for your work.

Iseeyou23 commented 2 years ago

PROOF OF ETH CONNECTION.

0x3fe61420c33b0e41ddd763adaaeb0b638e78b768 poof420 tnxid.0x6570409f3bbf036673dff40521e70bfbcc432b4e20ac3800180ddf877e46d86e

0x6f595eeb1da34cc03fe9b898f7bac5c7eac822a2 notel. 0xc08eaaf1204ea5e7c71e900c67c41068a01476f4 tnx.id 0x4c439e6bbd2bddfb2baad2be27ba14cb62e7cca2fab470776dfa2049c95791b5 0xb2d7e5cde14f003762b6c6b3b801343cd9ea76e3 tnxid.0xebf8027fc2f18aec508245c9da6d80103a8085ed0c972a787260cf0d31893de7 0x5590457f96bf80f8b44cc6b506502460d055b2f6 tnxid. 0x828ca96c0ba0d3b49979d6bfbbb00fa2e9696f5fa0b316afeef37b6fd8b03482 0x6ab133af137fd94294afbc4dfdebb6ded94a572d (virtualjohn) tnxid.0xa3b9cd042bc20243b87ad43be9749e2e37026f1c329cbfea0fb41a727fcca762 0xdbc898a01c6b6b9e5f73aa321be32fc5f136c69e tnx 0x2e268eaeb3f1cb2f59aa76dd7686ec4e3a26346a82b0a186c2624b5b92939285 0x2b2c869539188c28c202d086fe99c554493f72dd (glaslu) tnx 0x3008e5cff803646f70e0a64e8aa223fbb9dd23f0b6e0f82506326d07358b477a 0xdd74a5f502167c1bdd88968d058834170175277b (rethurd) tnx 0x3d58575da36652a7b2b1e6e9709d9c28a75131ce7a8ebe2b87e9b0512dcb808b 0xbbe6cc22b0344d00f780576bbb78a3135d514726 tnx 0x57329ff45ca60ff6b46704b06bbc6164d22fdc5cd6330d927f0300a9461c923c 0xcc7cc2e94273e694998ba0b3c80306cf031aedb7 tnx 0x60079fe79787df7ae6ee1924c340097caa6521cccea1b558dac5ef659bfabd80 0x7bbc6f3cdccfcf03cb062856e751b8950dad812b tnx 0xb7481e1baa52dca35c2d7c8cabf86bc7e224572baaa60fe8be41150a30f543f1 0xfccb964c514c12794509ed62fa274f0e284cee82 tnx 0x652a5d0cc0d0472fe0c3a1d4e0c73e332b75f6286a9fd883cbc517024ebc5a4f 0x62d02bdfa853ba3aae25135574979de19a29e92c tnx 0x223dd6766d6007abe736c6d317290c07c56c2e0def6abbdc0cc4ba77ea1fbdb1 0xaf07e85591dc02a6e54604b4313cf2f92f27174f tnx 0x66921a758f8866c15742a5b882791c52d62c8a46d7c2f2e80d4d5615bd642b0b 0xc95240f030c0d914882af2fa29e024d81b22841f tnx 0xf8ea54560aac7cddb30c9a79b094dadf5aca3f4af617010b1c594ae11f8f7334 0xe8da3d3823ea3f93edcf0d3d387dc4629d9602cb tnx 0x0c9a7345dce251b20604659f80d61a4030e88b619ab94203b90fd4bbed25a5f6 0x9482e7044574e056db57de122e8c1db358403d89 tnx 0x0a797d927305711c63d6d4f4844a74d9ea9dfbdfa950e60922ab3426aa6d8b5f

0x01c38875ab789cb12efcd791db91217a00fd01fa b33f tnxid. 0xe3d7b62b9b08e92191efc8c971f4b6dacba27ee6b3f354977844daa949f0942c

Iseeyou23 commented 2 years ago

In upper comment are also some new wallets that are also connected with disperse transaction. Im also getting together a list of time of all transaction from upper list and from this newly added wallets.

I think this attacker is a serious threat. Tell me if you need any more info.

Iseeyou23 commented 2 years ago

NEWLY ADDED WALLETS AND THEIR TRANSACTION TIMES

ATTACKER BRIDGE SAME DAYS AS DISPLAYED ABOVE. if you need any more proof please tell so. I

shanefontaine commented 2 years ago

@Iseeyou23 Thank you for the additional data.

Transactions for the same wallets around the same dates do not guarantee non-negligible probability of eliminating legitimate users. There will need to be very specific proof for this submission.

For example, a sufficient proof would be showing that every address did a Uniswap swap, for example, of ~$1,000 within the same few hours on the same day.

I know you've provided a lot of data, but there is not a way to guarantee accuracy at this time. I hope this makes sense.

Iseeyou23 commented 2 years ago

Yes i spend many hours getting this together. Some attackers are smarter than others so they often use diffrent tacticts of hiding their attack. I provided alot of data on how all wallets interact and they all bridged etc. in the same date range > 90 days /76 days ago.

I dont know how much more proof can i give you. Please check again because this attacker has many many HOP.

Iseeyou23 commented 2 years ago

They are ERC 20 connected They used disperse app on polygon (another connection) They all bridged the same days ( 80 days ago)

shanefontaine commented 2 years ago

@Iseeyou23

They all bridged the same days ( 80 days ago)

That does not appear to be true based on the data you provided. You show:

https://arbiscan.io/tx/0x6c41f5a697abbe9b94a090e0f9b9fddc7573083865d60188cbabcb333bd0127d > 140 days ago https://polygonscan.com/tx/0x0290c6bf9eb847f41ab0ada3c821edca6348730587f181fc51d4d484758c0c7f > 75 days ago https://polygonscan.com/tx/0xca9299b8fc5b53a1267eabfa933ea02815c11a9fe17e6780e30ea668997af7aa > 108 days ago https://arbiscan.io/tx/0x6e48c1609f42de338074c0b58b5f06633b4bfbe90c3f34f6b3f82ec456062e54 > 103 days ago https://arbiscan.io/tx/0x487e10abbf28819da908393da66685bc21d6964cf87598f19b529ee9a98431a2 > 128 days ago

These accounts did not bridge 80 days ago. I understand these are "smart" accounts, but there needs to be a non-negligible probability of eliminating legitimate users.

hop-protocol / hop-airdrop

Sybil Attacker Report #310

Related Addresses