owner 0x0d0051608c23c64533d10fef230f96bd31341a54 and 0xe062084d2fec1c9334e67a9dcd7b4a12af98bc55, add and remove same

[skyonedot]

Related Safe Addresses

0x05f4b2e7e1395858895c0657a572b54e43c7e129
0xd4858e1f5498f2bc89a7caa1a47616c009545be7
0x21f5d99f674112b0f8132e6ed35f7d0008e074a8
0x305311938fc814ec29cf89c7c945f64af6262bbc
0x74a63af60e2a13b4dc87554daec3e67529fdcbb0
0x7c8017cf8b8a5b14de6105500a758e39f57de068
0xbb7e9c0503191f7337a9b32dd6613ddcc70afe89

0x009f78ef7f7433d8d3b6ea51fed051361626d556
0xe1db59e43c414abca9ba1fc784eeb1a79a5cd10c
0x2d0325c5daf57ca5e4fef23d22073a9f94eee057
0x73da4f5fc3bcdbb94349c4bfa2be473f8e43a7d7
0xb1399667a1dffb6edf091a8b46e4b5ba3829a115
0xdd5726f504f2fa242f545fc29467be03082ade10

Reasoning

There is an abnormal behavior that is understandable 🍄

However, if there are many abnormal behaviors, then there is enough reason to determine that these addresses are airdrop farmer.

1. All of group1 the owner is same 0x0d0051608c23c64533d10fef230f96bd31341a54, only this address

2. All of group2 the owner is same 0xe062084d2fec1c9334e67a9dcd7b4a12af98bc55, only this address

3. All of the multi-sign address, the behaviour is always same and stange .

   • 99% of the group1 multi-sign adddress addOwner and removeOwner transaction took place from 2021-02-03 to 2021-02-15.(at the same tx, no exception)

   • 99% of the group2 multi-sign adddress addOwner and removeOwner transaction took place from 2021-06-29 to 2021-06-30.(at the same tx, no exception)

   • The group1 and the group2 , All of them execute 1 transactions, add owner and remove owner in 1 tx, always the same tx.

   • the group1 add owner address is always 0x0d0051608c23c64533d10fef230f96bd31341a54 , remove owner address is always 0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D

   • the group2 add owner address is always 0xe062084D2FEc1C9334E67A9dcd7b4A12AF98bC55 , remove owner address is always 0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D

   • Please Check Table

     • Address -- multi-sign address
     • Execute transactions -- The number of execute transactions by multi-sign address
     • AddOwnerTxAmount -- The number of add owner
     • AddOwnerAddress -- The Address of add owner
     • AddOwnerTx -- The tx of add owner
     • AddOwnerDate -- The date of add owner
     • RemoveOwnerTxAmount -- The number of remove owner
     • RemoveOwnerAddress -- The Address of remove owner
     • RemoveOwerTx -- The tx of remove owner
     • RemoveOwerDate -- The date of remove owner

Address	Execute transactions	AddOwnerTxAmount	AddOwnerAddress	AddOwnerTx	AddOwnerDate	RemoveOwnerTxAmount	RemoveOwnerAddress	RemoveOwerTx	RemoveOwerDate
0x05f4b2e7e1395858895c0657a572b54e43c7e129(group1)	1	1	0x0d0051608c23C64533D10feF230F96Bd31341a54	https://etherscan.io/tx/0x99b822eed52364a9db8b18738fda2522598920f022579799e15966e2270ca117	2021/02/15T00:28:02.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x99b822eed52364a9db8b18738fda2522598920f022579799e15966e2270ca117	2021/02/15T00:28:02.000Z
0xd4858e1f5498f2bc89a7caa1a47616c009545be7(group1)	1	1	0x0d0051608c23C64533D10feF230F96Bd31341a54	https://etherscan.io/tx/0x843088b2268bd6e103f88e45fcc232164e0a076251870f394949153395657066	2020/10/28T02:58:02.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x843088b2268bd6e103f88e45fcc232164e0a076251870f394949153395657066	2020/10/28T02:58:02.000Z
0x21f5d99f674112b0f8132e6ed35f7d0008e074a8(group1)	1	1	0x0d0051608c23C64533D10feF230F96Bd31341a54	https://etherscan.io/tx/0x64867b636518d5d2f64dae4e738f15298a51681e4966f0afb46e59035c535873	2021/02/15T00:49:28.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x64867b636518d5d2f64dae4e738f15298a51681e4966f0afb46e59035c535873	2021/02/15T00:49:28.000Z
0x305311938fc814ec29cf89c7c945f64af6262bbc(group1)	1	1	0x0d0051608c23C64533D10feF230F96Bd31341a54	https://etherscan.io/tx/0x2efec5d45a316dd9ca88f218cb1527e8a57b461b186ba78273b4f711a27fda39	2021/02/15T00:03:36.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x2efec5d45a316dd9ca88f218cb1527e8a57b461b186ba78273b4f711a27fda39	2021/02/15T00:03:36.000Z
0x74a63af60e2a13b4dc87554daec3e67529fdcbb0(group1)	1	1	0x0d0051608c23C64533D10feF230F96Bd31341a54	https://etherscan.io/tx/0x3bfda7425c1eebd33a1675e3124ee2fe2563f0327b07bf383691752dbbcbfa49	2021/02/13T22:11:38.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x3bfda7425c1eebd33a1675e3124ee2fe2563f0327b07bf383691752dbbcbfa49	2021/02/13T22:11:38.000Z
0x7c8017cf8b8a5b14de6105500a758e39f57de068(group1)	1	1	0x0d0051608c23C64533D10feF230F96Bd31341a54	https://etherscan.io/tx/0x821070da114640980698fdd7c0751811fa98c8af51d072355e213b0121107fc7	2021/02/15T00:05:31.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x821070da114640980698fdd7c0751811fa98c8af51d072355e213b0121107fc7	2021/02/15T00:05:31.000Z
0xbb7e9c0503191f7337a9b32dd6613ddcc70afe89(group1)	1	1	0x0d0051608c23C64533D10feF230F96Bd31341a54	https://etherscan.io/tx/0x2d655e576621faa006274750774abee065253526cb05510c498259e893b3818d	2021/02/03T21:58:29.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x2d655e576621faa006274750774abee065253526cb05510c498259e893b3818d	2021/02/03T21:58:29.000Z
---	---	---	---	---	---	---	---	---	---
0x009f78ef7f7433d8d3b6ea51fed051361626d556(group2)	1	1	0xe062084D2FEc1C9334E67A9dcd7b4A12AF98bC55	https://etherscan.io/tx/0x522709d01f8c707502505666b773c361ced9380deafee407ca95ee8302091bcb	2021/06/30T05:05:56.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x522709d01f8c707502505666b773c361ced9380deafee407ca95ee8302091bcb	2021/06/30T05:05:56.000Z
0xe1db59e43c414abca9ba1fc784eeb1a79a5cd10c(group2)	1	1	0xe062084D2FEc1C9334E67A9dcd7b4A12AF98bC55	https://etherscan.io/tx/0x86bab65f9d762ff4e8d524183ed4969c47b38f08e29bb5d12dd899c6993c27bd	2021/06/30T03:51:35.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x86bab65f9d762ff4e8d524183ed4969c47b38f08e29bb5d12dd899c6993c27bd	2021/06/30T03:51:35.000Z
0x2d0325c5daf57ca5e4fef23d22073a9f94eee057(group2)	1	1	0xe062084D2FEc1C9334E67A9dcd7b4A12AF98bC55	https://etherscan.io/tx/0xd426f8b813c70d11867f2408bd9ddc855815d659441829a563b005a42459589e	2021/06/30T01:56:54.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0xd426f8b813c70d11867f2408bd9ddc855815d659441829a563b005a42459589e	2021/06/30T01:56:54.000Z
0x73da4f5fc3bcdbb94349c4bfa2be473f8e43a7d7(group2)	1	1	0xe062084D2FEc1C9334E67A9dcd7b4A12AF98bC55	https://etherscan.io/tx/0x75ba2aac4aaf4ce7c9b4b692d3af4608685aafcbe0a13a8be2506ab4f4be2782	2021/06/30T05:57:12.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x75ba2aac4aaf4ce7c9b4b692d3af4608685aafcbe0a13a8be2506ab4f4be2782	2021/06/30T05:57:12.000Z
0xb1399667a1dffb6edf091a8b46e4b5ba3829a115(group2)	1	1	0xe062084D2FEc1C9334E67A9dcd7b4A12AF98bC55	https://etherscan.io/tx/0x688e333bce7d07773aa0830612efc582aa722cac60da310043f1fc7fb6e99658	2021/06/30T01:23:32.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0x688e333bce7d07773aa0830612efc582aa722cac60da310043f1fc7fb6e99658	2021/06/30T01:23:32.000Z
0xdd5726f504f2fa242f545fc29467be03082ade10(group2)	1	1	0xe062084D2FEc1C9334E67A9dcd7b4A12AF98bC55	https://etherscan.io/tx/0xbf3b268dbc5dd23a3c78aad3b81c4ea7346615a358978f8b55c9d7be846b82b5	2021/06/29T21:23:16.000Z	1	0x66A0FF664f8509370C5D718A0f69AC1DC01f5c3D	https://etherscan.io/tx/0xbf3b268dbc5dd23a3c78aad3b81c4ea7346615a358978f8b55c9d7be846b82b5	2021/06/29T21:23:16.000Z

---

Methodology

Addresses are reported by retrieving information from the chain, using bitquery's graphql, and detecting abnormal behavior, such as empty wallets, mutual transfers, etc.

When only some of the anomalous behaviors are present, we can consider the address reasonable, but when an address has all the anomalous behaviors, we have good reason to suspect that the address is false. Especially if the multi-signature address and the owner address have obvious exceptions both, then it is obvious that this is airdrop farmer.

Abnormal behaviors include

• For Multi-Sign Address

  • Few transactions were executed
  • There is a lot of overlap in the interactions, such as the destination address, and the time
  • The owner of multiple multi-signature addresses is exactly the same, and never changes from start to finish

• For Owner Address

  • Empty address
  • The first source of funds is the owner.
  • Mutual transfer
  • Behavior similarity

If the verification is passed and my strategy is great, I can provide my source code, but for now it is not conveninet

Safe Address

0xce495858e36c95f491b5a32ca2664405cf10ab76

Thanks

[tschubotz]

Thanks for the report. All of these Safes except for one have been found by a previous report, unfortunately.

0x74a63af60e2a13b4dc87554daec3e67529fdcbb0