4 ms·

Sybil attacks on airdrops

42 points by rckrd 4y ago

droffel 4y ago
I'm reminded of this scene from It's Always Sunny in Philadelphia. In theory, the goal of the airdrop is to create new users, but in practice the airdrop receivers just cash out their chips and go home. https://youtu.be/cyxxE1AcUSM https://youtu.be/cyxxE1AcUSM
- xbar 4y ago
  Yup. That was the Divergence Ventures/Bridget Harris play listed in the article. To their credit, they returned the money when called out on it.
paulpauper 4y ago
cheap transactions also makes mixing crypto cheaper
- droffel 4y ago
  Why use a mixer at all? The technology is fundamentally centralized/trust-based, and even assuming a perfectly trustworthy mixer, vulnerable to many forms of analysis (the list of which will only grow as time passes). If you want privacy, use something that actually gives it to you, like Monero.
  - paulpauper 4y ago
    no one accepts monero you don't have to use an actual mixer. just set up 1000s of addresses and just cycle many tiny transactions
    - cowtools 4y ago
      On the contrary, no one accepts bitcoin. Alphabay2 is the only market left and it's monero-only.
game-of-throws 4y ago
I think at this stage it's impossible to fairly distribute a coin to new users. Bitcoin was born into a unique environment. The world did not know what to think, and largely ignored it, so it was able to spread organically for years, detached from any notion it would ever be worth anything. Because it had no value, it could grow without having to worry about these kinds of attacks. Only once it spread far enough did it begin to take on economic value and an exchange rate, reaching one penny and beyond. Airdrops these days do the exact opposite. They're premined, listed day 1 on exchanges, and the creators try to pump the exchange rate in order to finance later development. The entire process is corrupted by users viewing projects through an economic lens, and creators trying to extract value before delivering value. Now that the cat is out of the bag, it's likely the conditions of bitcoin's creation will never happen again.
- aluminaient 4y ago
  Are you saying you think bitcoin was fair? That seems hard to support.
  - aaaaaaaaata 4y ago
    They're saying it's as close to fair as they think we're going to see succeed.
- drexlspivey 4y ago
  grin started a couple years ago same as bitcoin, the day of the v1.0 release the devs hardcoded the latest bitcoin block hash in the genesis block (to prove there was no premine) and as soon as they pushed the commit people were able to build the code and start mining
  - yieldcrv 4y ago
    people dont consider instamines any less unfair than premines there is zero consensus on fair and therefore it is impossible to have a fair launch all outcomes result in consolidation unless inflation/dilution is extremely high and uninteresting
1-6 4y ago
The attack surface of Apple’s products grow day-by-day with features meant to make life convenient.
- JumpCrisscross 4y ago
  > attack surface of Apple’s products Cryptocurrency airdrops [1]. Not Apple’s AirDrop feature. [1] https://www.investopedia.com/terms/a/airdrop-cryptocurrency.asp https://www.investopedia.com/terms/a/airdrop-cryptocurrency....
- sahkopoyta 4y ago
  Apple's products? This is not about them
- katbyte 4y ago
  This has nothing to do with apple and is about a crypto thing.
- aaaaaaaaaaab 4y ago
cinquemb 4y ago
Seems like if protocols don't provide any liquidity for their tokens, but the tokens can be used to have access to a protocol revenue, I don't see the problem. Except for most tokens/protocols don't have any revenue they can share with token holders…
syzygyhack 4y ago
It's an interesting problem and one that many decentralized applications will be forced to contend with, beyond simple airdrops. Many on-chain protocols and primitives simply don't need to differentiate between human user and program, but the ones that do are usually crippled if they fail to adequately do so. Quadratic funding mechanisms, for example. I believe we're still very early on this front, there's lots of opportunity for innovation in terms of Sybil defense. Dox Your Customer is the easiest and naturally the most at odds with the Web3 paradigm, but there are others that make fewer compromises which have been tried with varying levels of success. Vouch networks/social graphs, attestation or reputation systems, video identity registries, recurring cost, time-coordinated Turing tests, etc. I am certain novel approaches will continue to emerge until we land on something robust without sacrificing decentralization or the right to privacy.
pjdkoch 4y ago
I'm partial, because I work for them, but maybe use https://fractal.id/ https://fractal.id/?
plopilop 4y ago
Another funny example is the one of Juno: a whale Sybil-ed the airdrop, and gathered 10% of the tokens. Then, the community voted to strip the whale of most of their tokens. I find the example interesting because it shows that Layer 2 protocols can very much strip you away from your coins, just like banks/governments can. (https://beincrypto.com/juno-community-votes-to-reject-tokens-from-whale/ https://beincrypto.com/juno-community-votes-to-reject-tokens...)
JaggerFoo 4y ago
I'm suprised that Gitcoin was not mentioned, they have dealt with sybil attacks and have processes to try and detect it.
0xjepsen 4y ago
I am a research engineer at a Defi company and we wrote this script. That being said we don't intend on an airdrop at this point in time. But it's an easy to use to tool to quantify sybil interactions if anyone is curious. https://github.com/primitivefinance/sybil-detection https://github.com/primitivefinance/sybil-detection
deleted 4y ago
[deleted]

42 points by rckrd 4y ago

I'm reminded of this scene from It's Always Sunny in Philadelphia. In theory, the goal of the airdrop is to create new users, but in practice the airdrop receivers just cash out their chips and go home. https://youtu.be/cyxxE1AcUSM https://youtu.be/cyxxE1AcUSM

xbar 4y ago
Yup. That was the Divergence Ventures/Bridget Harris play listed in the article. To their credit, they returned the money when called out on it.

paulpauper 4y ago

cheap transactions also makes mixing crypto cheaper

droffel 4y ago
Why use a mixer at all? The technology is fundamentally centralized/trust-based, and even assuming a perfectly trustworthy mixer, vulnerable to many forms of analysis (the list of which will only grow as time passes). If you want privacy, use something that actually gives it to you, like Monero.
- paulpauper 4y ago
  no one accepts monero you don't have to use an actual mixer. just set up 1000s of addresses and just cycle many tiny transactions
  - cowtools 4y ago
    On the contrary, no one accepts bitcoin. Alphabay2 is the only market left and it's monero-only.

game-of-throws 4y ago

I think at this stage it's impossible to fairly distribute a coin to new users. Bitcoin was born into a unique environment. The world did not know what to think, and largely ignored it, so it was able to spread organically for years, detached from any notion it would ever be worth anything. Because it had no value, it could grow without having to worry about these kinds of attacks. Only once it spread far enough did it begin to take on economic value and an exchange rate, reaching one penny and beyond. Airdrops these days do the exact opposite. They're premined, listed day 1 on exchanges, and the creators try to pump the exchange rate in order to finance later development. The entire process is corrupted by users viewing projects through an economic lens, and creators trying to extract value before delivering value. Now that the cat is out of the bag, it's likely the conditions of bitcoin's creation will never happen again.

aluminaient 4y ago
Are you saying you think bitcoin was fair? That seems hard to support.
- aaaaaaaaata 4y ago
  They're saying it's as close to fair as they think we're going to see succeed.
drexlspivey 4y ago
grin started a couple years ago same as bitcoin, the day of the v1.0 release the devs hardcoded the latest bitcoin block hash in the genesis block (to prove there was no premine) and as soon as they pushed the commit people were able to build the code and start mining
- yieldcrv 4y ago
  people dont consider instamines any less unfair than premines there is zero consensus on fair and therefore it is impossible to have a fair launch all outcomes result in consolidation unless inflation/dilution is extremely high and uninteresting

1-6 4y ago

The attack surface of Apple’s products grow day-by-day with features meant to make life convenient.

JumpCrisscross 4y ago
> attack surface of Apple’s products Cryptocurrency airdrops [1]. Not Apple’s AirDrop feature. [1] https://www.investopedia.com/terms/a/airdrop-cryptocurrency.asp https://www.investopedia.com/terms/a/airdrop-cryptocurrency....
sahkopoyta 4y ago
Apple's products? This is not about them
katbyte 4y ago
This has nothing to do with apple and is about a crypto thing.
aaaaaaaaaaab 4y ago

cinquemb 4y ago

Seems like if protocols don't provide any liquidity for their tokens, but the tokens can be used to have access to a protocol revenue, I don't see the problem. Except for most tokens/protocols don't have any revenue they can share with token holders…

syzygyhack 4y ago

It's an interesting problem and one that many decentralized applications will be forced to contend with, beyond simple airdrops. Many on-chain protocols and primitives simply don't need to differentiate between human user and program, but the ones that do are usually crippled if they fail to adequately do so. Quadratic funding mechanisms, for example. I believe we're still very early on this front, there's lots of opportunity for innovation in terms of Sybil defense. Dox Your Customer is the easiest and naturally the most at odds with the Web3 paradigm, but there are others that make fewer compromises which have been tried with varying levels of success. Vouch networks/social graphs, attestation or reputation systems, video identity registries, recurring cost, time-coordinated Turing tests, etc. I am certain novel approaches will continue to emerge until we land on something robust without sacrificing decentralization or the right to privacy.

pjdkoch 4y ago

I'm partial, because I work for them, but maybe use https://fractal.id/ https://fractal.id/?

plopilop 4y ago

Another funny example is the one of Juno: a whale Sybil-ed the airdrop, and gathered 10% of the tokens. Then, the community voted to strip the whale of most of their tokens. I find the example interesting because it shows that Layer 2 protocols can very much strip you away from your coins, just like banks/governments can. (https://beincrypto.com/juno-community-votes-to-reject-tokens-from-whale/ https://beincrypto.com/juno-community-votes-to-reject-tokens...)

JaggerFoo 4y ago

I'm suprised that Gitcoin was not mentioned, they have dealt with sybil attacks and have processes to try and detect it.

0xjepsen 4y ago

I am a research engineer at a Defi company and we wrote this script. That being said we don't intend on an airdrop at this point in time. But it's an easy to use to tool to quantify sybil interactions if anyone is curious. https://github.com/primitivefinance/sybil-detection https://github.com/primitivefinance/sybil-detection

deleted 4y ago

[deleted]