https://commonwealth.im/layerzero/discussion/17888-sybil-clusters-across-evm-and-aptos
sybil clusters across evm and aptos
Reported Addresses
First of all, I’m sorry that I can only use external files for the several files included in this thread, because if they are all posted here, the thread will be too large to be published. And I use Google Cloud Disk to share external files cuz my github account has been blocked.
Clusters: 94, evm wallets: 8171, Here they are:
and aptos wallets: 5029, Here they are (I don’t know if the aptos wallet is also in this airdrop range, so I provide it as well):
Description
All addresses in this report are generated cross-chain between EVM and APTOS. For example, A of polygon cross-chain to B of Aptos, and then B of Aptos cross-chain to C of Arbitrum, then A/B/ C forms a cluster, and so on.
For all charts below, the red dots are evm wallets that may be eligible for the next airdrop, the blue dots are aptos wallets that are bridged to/from, and the black dots are evm wallets that are connected to aptos wallets but are not in the reporting list .
please note in particular that these Black spots are actually part of the sybil cluster, but they are not within the scope of this report because they may have been discovered or the indicators failed to meet the set standards
I have filtered the evm wallet reported this time in advance. The filtering rules are: 1. layerzero transactions count >=5; 2. layerzero bridge amount($) >= 20; 3. Not in the published list of 803,093.
all thess wallets is clutsters, pls look at the relationship as below:
Special reminder, some of the pictures below are very dense, please be careful if you have trypophobia.
I will provide detailed TX of the interaction between these wallets (including evm wallet and aptos wallet) below:
detail tx here, This csv file contains the following columns: cluster number, cluster size, TX hash, source address, target address, source chain, target chain. We can randomly select TX from this csv for verification，it looks like:
Let us open this csv and take a look at any TX, for example, the first one, hash: 0x64448c0ee359125d8d22d7ef15398e4654e0e2ee2c4cf01f6fac2e3ada3258e1,this is the cross-chain from arbitrum to aptos:
we can see the following picture in layerzeroscan:
Then, the following image can be seen on the arbitrum blockchain browser:
Finally, the following picture can be seen on the aptos blockchain browser:
Let’s look at another one. The hash is: 0x73b31b58811ffde2ff0432a4f8812d1fdab7f6d3e7d63e357bd17896fc16e52f. This is the cross-chain from aptos to polygon:
Then, you can see the following picture on the aptos blockchain browser:
Finally, the following image can be seen on the polygon blockchain browser:
The relationship between all these wallets is found through graph calculation, which leads to the results we have seen so far.
Detailed Methodology & Walkthrough
- [1] I noticed on the blockchain that some Aptos wallets have different incoming and outgoing addresses when transferring to EVM wallet addresses via L0
- [2] I collected all records of cross-chain transfers to Aptos from several chains including Ethereum, BNB Chain, Avalanche, Polygon, Arbitrum, Optimism, and Base, as well as transactions from Aptos to various EVM-like chains.
I used dune to got there data,code here :
evm to aptos dune sql and aptos to evm dune sql
- [3] I conducted a graphical cluster analysis of these transactions and discovered that many wallets use Aptos wallets as intermediaries. In the diagram, the red dots represent EVM addresses, while the blue dots denote Aptos addresses.
#Here load all the wallet addresses that I follow. I have already done the processing before. First, I filtered out the wallet addresses with tx>5 and amount>20U, then removed 803,093 suspected sybil addresses, and then got the watch list.
addr_list = load_addrs_info()
#create graph from jsons,json file from dune, The constructed cluster is a directed graph, with the wallet as a node and each tx as an edge.
G = build_directed_graph(json_list)
#Because it is a directed graph, weak correlation is used to connect it.
clusters = [c for c in sorted(nx.weakly_connected_components(H), key=len, reverse=True) if len(c) >= min_cluster_size]
final_clusters = []
for index,cluster in enumerate(clusters):
subgraph = G.subgraph(cluster).copy() # Create a copy of the subgraph
focus_nodes = [node for node in subgraph if node in addrs] #Filter the following wallets in the cluster
subgraph = remove_isolated_non_focus_links(subgraph, focus_nodes) #Delete some nodes that don’t contribute much to the results
if focus_count >= min_cluster_size: #Check whether the minimum number of nodes of interest is met,here Min_cluster_size=20
split_clusters = split_cluster_if_needed(subgraph, focus_nodes) #Check and split the cluster (if necessary)
for split_cluster in split_clusters:
final_cluster_graph = G.subgraph(split_cluster).copy()
final_clusters.append(final_cluster_graph)
else:
logger.info(f"Cluster {index} has {focus_count} focus nodes,skipping...")
for index,cluster in enumerate(final_clusters):
subgraph = G.subgraph(cluster)
eligible_wallets = [node for node in subgraph if node in addrs]
draw_html(subgraph, eligible_wallets, filename, line_type=0) #Save the cluster as an html file
save_cluster_to_file(G, cluster, filename) #Save the edges within the cluster as a csv file
- [4] The transactions from these wallets were initiated by the wallet owners themselves, both on EVM-like chains and on Aptos. I believe this sufficiently demonstrates that they are part of a Sybil cluster.
Reward Address (If Eligible)
0x000002F8611c59a4d3ee714AD579171c55B00D34
I’m TjdnskEhdksk of github，Unfortunately, the issue I posted on github can no longer be seen.（issue #3360，#3382，#3442，#3515，#3564,#3591,#3647,#3709,#3780,#3990,#4105,#4185,#4264 and #3904)
Only members within the following group(s) can interact with this topic:
Include comments flagged as spam
Sorry for taking up your time, this thread has an error, that is, the dune script of evm->aptos has an error when obtaining the aptos address. I realized this and corrected it. For the new thread, please see:
https://commonwealth.im/layerzero/discussion/20021-sybil-clusters-about-evm-and-aptos