bartschele commented 2 years ago

Related Addresses

10 addresses -- 0x1e164ea811d681acd210462c4cecd37bfa888888 0xbfcd63b944edcec14cb4c3b6c8e02e520a521ad2 0x5d9531fb853e28ef034af3d2ce01e14011a73129 0xd1a1eb00bca683a27e454d117881179b814a6999 0x9c399f76efd9a8db5471f52a6364015972050599 0x3fafa3c56a1a4ebef22c624b560e4997fc2e00af 0xec1efe940e980db2b522897c9e4feab51a2a1fc7 0xeac4228e64780a15c3fdbdda78e4fe218b082a49 0x89316291aba44042001b871ccd4d685aac0a0cd5 0x8e83f599ab852c7f3fb8b880fe9ce72836fc2f0a

Reasoning

The above addresses are connected via Polygon. All of them used the HOP Bridge Polygon <-> Gnosis, bridging back and forth several times in a short period at the end of December. This suggests that it is a Sybil attack.

Example:

All addresses called swapAndSend on Polygon between 1:30pm UTC and 2:30pm UTC on January 9th and then called swapAndSend on Arbitrum between 13:00pm UTC and 14:00pm UTC on January 13th in the exact same sequence. All addresses also interact with Zapper on Polygon and hold a “Governance Toucan" on Arbitrum. -->

Methodology

We used an algorithm to find transactions between eligible addresses and between such addresses we searched for patterns in the use of the HOP Bridge.

Rewards Address

0x516d03de90f3Df147861E8d8001c8EDc79d89Ce7

shanefontaine commented 2 years ago

@bartschele

Thank you for the submission. Unfortunately, this submission does not meet one of the criteria for submissions:

Methodology that has a non-negligible chance of eliminating legitimate users will not be considered

There will need to be additional proof submitted in order to consider this a valid group that does not include any legitimate users. Please consider providing more information about the behavior of these addresses, such as identical types of transactions or similar timing of transactions. Please note that another user that submits an issue with a detailed, non-negligible chance of eliminating legitimate users, their submission will be considered before yours.

You said:

All addresses called swapAndSend on Polygon between 1:30pm UTC and 2:30pm UTC on January 9th

It looks like that might now be true. I do not see a swapAndSend transaction on Polygon on that day from 0x9c399f76efd9a8db5471f52a6364015972050599.

For example, can you show how they are linked by sharing specific transactions or behaviors. Some examples may be:

Identical transactions on the exact same day/time by most or all of the addresses
A similar time/date that all the addresses started transacting on a chain

bartschele commented 2 years ago

I'm sorry, by mistake I forgot to delete the part 'Example:

All addresses called swapAndSend on Polygon between 1:30pm UTC and 2:30pm UTC on January 9th and then called swapAndSend on Arbitrum between 13:00pm UTC and 14:00pm UTC on January 13th in the exact same sequence. All addresses also interact with Zapper on Polygon and hold a “Governance Toucan" on Arbitrum. -->'

I can provide the following additional information:

All of the mentioned addresses have interacted via polygon:

0x18d072a783fae1ac81af576276dc1561cfba1013 sent tokens to 0x29f46a92078f6011a47df128af735208782579bf, 0xd669cce1335664c906ef4d129493678240837411, 0xeae9dcdf5d4f226b4d4bad8950d585aa95761b7b and 0x2186473547fa23d3ab86da9ec53fa56cc55c7e0e,

0x29f46a92078f6011a47df128af735208782579bf sent tokens to 0xee79dc76eb20a2127040fff07df58840c477cec6 and 0x83fe689576ee2c1f40a59b7ffd4af8805b34cc5e

0xd669cce1335664c906ef4d129493678240837411sent tokens to 0x439bcc034917c528eff0e36117088afbb075b2d4, 0x46699fda810305d5f5f7e09f08919edb9451533b and 0x7227ff860eca62dce5f78f8063492cfa92b87b51

All of the above addresses called SwapAndSend on Polygon between 11:21 UTC and 2:32 PM UTC on December 11th and called SwapAndSend on Gnosis between 12:36 UTC and 3:45 PM UTC on December 11th. Most of the addresses used HOP only in the mentioned time period.

shanefontaine commented 2 years ago

Thank you for the additional details @bartschele . There will need to be additional data provided.

You are submitting an address 0x1e164ea811d681acd210462c4cecd37bfa888888, which you do not add any information about in your most recent comment.

Please provide additional details about why every address is connected and why they are Sybil attackers. Please know that simple transactions to each other are not a valid reason and there will have to be additional evidence provided.

bartschele commented 2 years ago

0x1e164ea811d681acd210462c4cecd37bfa888888 interacted on Polygon with 0xbfcd63b944edcec14cb4c3b6c8e02e520a521ad2 and is therefore connected with the other addresses.

The following excerpt of interaction with the HOP Bridge indicate that the addresses are Sybil attackers.

shanefontaine commented 2 years ago

Thank you for the additional details @bartschele .

It looks like more than one address doesn't follow the reasoning you provided:

All of the above addresses called SwapAndSend on Polygon between 11:21 UTC and 2:32 PM UTC on December 11th and called SwapAndSend on Gnosis between 12:36 UTC and 3:45 PM UTC on December 11th. Most of the addresses used HOP only in the mentioned time period.

Please submit consistent reasoning that applies to all addresses.

The latest transaction data you provided is good. However, it does not look like compelling evidence. The transaction dates, amounts, and patterns are very different from each other.

bartschele commented 2 years ago

I agree that the behavior of the first four addresses in the list provided in my latest comment is different compared with the other six.

However, I found a bunch of addresses mimicking the behavior of the last six adresses (and interacting with some of them on 21st of December). Most of these adresses didn't reach the required 1000$, so weren't eligible for the airdrop. However, the behavior proofs that at least the last six adresses are Sybil attackers.

Should I provide a detailed proof how these adresses are connected and how they used the Hop Bridge or is it useless as only six of the adresses are eligible for the airdrop?

shanefontaine commented 2 years ago

@bartschele Thank you for the additional details. Unfortunately they would not be considered, since there are only six of them.

hop-protocol / hop-airdrop

Sybil Attacker Report #447

Related Addresses

Reasoning

Methodology

Rewards Address