cryptokeenz
commented
2 years ago Code
Since the code is too long, you can check it out in my Dune link: https://dune.com/keenz_eth/safehunter75
Closed cryptokeenz closed 2 years ago
cryptokeenz
commented
2 years ago Since the code is too long, you can check it out in my Dune link: https://dune.com/keenz_eth/safehunter75
cryptokeenz
commented
2 years ago My repeated editing is to correct the information, not to copy others. You can view the content through the historical version. At the same time, I did not imitate others. This is all my own analysis.
tschubotz
commented
2 years ago Your list contains Safes such as this one that do more than meaningless transfers. There is a chance that your report would eliminate legitimate usage.
cryptokeenz
commented
2 years ago Please carefully check the transfer time and transfer time. If it is normal use, why is it all transferred out after a few minutes? And the transferred addresses are all 0x5Aeea2eE3D9A6D71b2F2ec9ea0E9A489B3095926, which is obviously not normal behavior. If this can also be judged as normal use, then I have nothing to say, lol
Foreword
Recently, it was our country's Mid-Autumn Festival, which is a family reunion festival. I spent some time with my family, which caused issue#75 to be closed. I'm sorry and hope the reviewers can take a look at my follow-up analysis.🙏
Brief introduction
I set up a Dune to specifically filter this address these days, link : https://dune.com/keenz_eth/safehunter75
You can see 4 messages from this Dune
I will explain in detail in the reasoning
Reasoning
First step
I accurate screened the safe addresses created by 0x29709b7d78d49D7a51bE2eE091fba3b80F1C5D68, I found that there are 192 addresses
Second step
To confirm if this address is a proxy, I referred to tschubotz's code on dune for filtering and finally confirmed that all 192 safe addresses were created properly (thanks again tschubotz!)
Third step
I filtered to get the owner of all safe address addresses, a total of 352 addresses
I tried deduplicating the owner address, but I didn't find any duplication! I was very surprised !
352 Owner Address
I checked the balance of 352 owner addresses on mycointool, and I found that only one owner address has 0.031921253 eth, and all the remaining owner addresses have no ETH and no transaction records! All brand new addresses! This is obviously an operation to get the airdrop!
Mycointool link: https://mycointool.com/BatchQueryBalance
Fourth step
I screened the transaction records of safe address, and I found that almost all safe address addresses are conducting meaningless transfers. Most of the transfers are only 0.01 eth or even 0.001 eth, which is completely inconsistent with normal use. Why would a normal user create 352 new addresses as owners and only transfer a very small amount of eth? This only shows that this user is doing the operation for the airdrop! !
For example
Safe address: 0xa23EC21595cf8aC1aF8dF75C40aB94509b9A07A1
Safe address: 0xc90C15C6096Cd87D0Ee21aeCD680e93E3c9c2AE5
Fifth step
Finally, cross-compared the filtered safe addresses with the official airdrop document https://raw.githubusercontent.com/safe-global/safe-user-allocation-reports/main/safe_user_allocations_reworked.csv, I filter to get these addresses
128 safe address
As a result of the above analysis, we can find that the user behavior patterns of these addresses are completely inconsistent with normal people, and all operations are to obtain airdrops, so I hope they can be canceled rewards
Safe Address
Our safe wallet address :0xcAE0720A267C5062b164FAd99b3E5F283221c12F