CoinList: How Sybil Attacks Can Disrupt Token Offerings

Article source: CoinList; Translation: Golden Finance xiaozou

Token issuance is one of the most important historical moments of a project. If you screw up your token issuance, then your project may face the end.

When it comes to damaging the credibility of token issuance, nothing is faster than a sybil attack, in which a malicious actor creates multiple false identities in an attempt to gain disproportionate influence and token distribution in the network.

No one wants a ghost community.

Below, we will explore how sybil attacks ruin token issuance by looking at data from the two recent zkSync airdrops and LayerZero airdrops.

1. zkSync

zkSync is Ethereum's Layer 2 scaling solution that uses zero-knowledge proof and was one of the most anticipated airdrops in 2024, but has since faced much criticism for its lack of sybil defense measures. For example, here’s what Mudit Gupta, Chief Information Security Officer at Polygon Labs, said on X:

(1) zkSync Network Activity

From the start of the zkSync airdrop (June 17, 2024) to July 17, 2024, the number of active addresses on the network fell by approximately 78.7%. This suggests that a large portion of users were only interested in the free airdrop and left soon after receiving it.

The number of daily depositors also reflects a similar pattern - the indicator peaked at 41,257 on March 25, 2023, but fell to only 32 on July 17, 2024.

After the airdrop, more than 40% of those who received the most zkSync airdrop sold their entire token allocation, and 41.4% sold part of their tokens. Currently, only 17.9% of the top recipients still hold tokens. According to CryptusChrist, 746 sybil attackers are known to be eligible to receive approximately $6.9 million in ZK tokens in the airdrop.

（2）ZK price fluctuations

Unfortunately, the ZK sell-off - likely orchestrated by the sybil attacker - created selling pressure, causing the token price to fall by approximately 39.29% between the start of the airdrop to users (June 17, 2024) and July 23, 2024.

So, what went wrong with zkSync? First, the team’s airdrop qualification criteria was relatively easy for sybil attackers to participate, and lacked measures to prevent sybil attacks. In addition, zkSync seems to have excluded certain legitimate users to some extent, such as projects created on zkSync ERA, which have made direct contributions to their ecosystem.

Their team now needs to work harder to recapture the inflated activity that caused significant price speculation before the launch of sybil.

2. LayerZero

In contrast to the above two examples, LayerZero is an interoperability protocol designed to facilitate seamless communication and asset transfer between different blockchains, and it has strong measures to prevent sybil attacks.

Bryan Pellegrino, CEO of LayerZero Labs, said that their team ultimately identified 1.1 million to 1.3 million unique address sybil wallets during the sybil self-reporting and analysis phase, and the team will continue to encourage and reward the community for sybil reporting.

（1）LayerZero Network Activity

The number of messages on LayerZero dropped by 91.5% between April 30, 2024 (the day before the snapshot date) and July 7, 2024.

Similarly, the number of daily transactions also dropped by more than 92% between the snapshot date and the airdrop date.

This downward trend is partly due to the fact that users often stop activity after the snapshot date, as trading is no longer a requirement to receive the airdrop. However, it is also possible that the team’s sybil prevention measures also have a certain impact, making their airdrop less vulnerable to sybil attacks.

(2) ZRO price fluctuations

Between June 20, 2024 (the airdrop date) and July 18, 2024, the price of LayerZero’s native token ZRO fell from $4.79 to $4, a drop of about 16%, which is significantly lower than the drop of ZK (39%) in a similar time frame after the airdrop. Interestingly, despite LayerZero’s decline in network activity, ZRO’s price ultimately remained above its initial listing price.

While it is difficult to determine all relevant factors for LayerZero’s relative price sustainability, its sybil prevention technology may have played a role.

3. Why should builders pay attention to Sybil prevention?

In the short term, sybils appear to be beneficial to projects because they can artificially boost data and generate direct profits.

However, as shown in the above example, an influx of sybils can lead to token selling pressure and a decline in network activity, both of which can undermine the long-term sustainability of a project.

After a Sybil exit, legitimate participants will have more opportunities to come in and contribute, as the removal of the fraudulent entity frees up valuable slots.

Most teams that have launched via airdrops will need to work harder to recapture the activity that drove price speculation and inflated network activity before the launch. No one wants a ghost community.

At CoinList, we take sybil prevention very seriously, verifying the legitimacy of devices and browsers, analyzing IP addresses, screening for unusual bot-like activity, assessing the legitimacy of email addresses, and ensuring that every participant is a unique and verified individual.