Sybil Attacker Report

[defienjoyer]

Addresses	hash
0x03f3344a01a7697db1ec51066ed43cc080483a73	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0x0b4ecf28692614c10deb7d8579f4878be3fd2de9	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0x0ffd670749d4179558b6b367e30e72ce2efea28f	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0x3b96f28e3b45a19fa3e89232d0680e54872d3d58	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0x729fc2d1ed7b062a3f6723c2565932fb4498a77d	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0x7941ea24dcec35b6929aa08f5c9ce5c7fe17cf02	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0x879f20f3905703fbc35b515ca0830248a5b3f6ee	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0xaba0f5cccbe1299b72b340ba735a164ab867389a	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0xb46092195614d3d715010f47e301ee8b4608d166	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0xc0d3a8d939d8653f0fd8fe7a0646dd3884293466	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e
0xf2a50bcbc9e2622b3c694a478cdf15dd8c79876f	0x76ade0c0dc3376a0be66d92ef2d1ad97e20e7c069149d3ee01b31692560a480e

Reasoning

All addresses are related via one disperse transaction

Methodology

I created a script to link disperse address with eligible addresses document.

Rewards Address

0xCBd39631F4fb359cA966424B622aee0A5c1DaAa1

[defienjoyer]

1. 0x03f3344a01a7697db1ec51066ed43cc080483a73 low amount of txs, interacts with airdrops
2. 0x7941ea24dcec35b6929aa08f5c9ce5c7fe17cf02 infrequently used, interacts with some airdrops.
3. 0x879f20f3905703fbc35b515ca0830248a5b3f6ee large amount of tx 174 days ago showing sybil
4. 0xaba0f5cccbe1299b72b340ba735a164ab867389a interacts with aidrops, not frequently used
5. 0xc0d3a8d939d8653f0fd8fe7a0646dd3884293466 previously perform sybil (https://etherscan.io/tx/0xb25a2574ca9d685d4af89e3a67417fda1734a5897d08bee8f3a9d6f5aeb1b332)
6. 0x046d05c025aa76452bafc566ff69ef65c06973df shown to have interacted with previous address
7. 0xd0486dc1cb36fd7c265f63d659b74e362748ec43 interacted with 5/blatant sybil.
8. 0xeba1891a6228ba59e09e5118a76abde35fcbc8b6 interacted with 5 and not used often.
9. 0x97Cd05ee9f47c6AbA029c5ed4Fbce8CE817586e3 interacted with 5 and interacted with many airdrops.
10. 0xd201ecbe85a32944464964a1e1c02f923e7c4dfe interacted with 6 and not used often.
11. 0xf42b7a30cca2627b26e3167cff1d9282213c5a04
12. 0xeba1891a6228ba59e09e5118a76abde35fcbc8b6
13. 0x0c430e78c46e9d60c1de628cdcccfa1cf6a20478
    11/12/13 all interact with same sybilor (banditen.eth)

[shanefontaine]

@defienjoyer We have observed cases of apps sending funds through Disperse to help their users pay for gas on L2s. We have also seen altruistic people and faucets do the same. Because of this, we will need additional evidence. Some potential compelling evidence may be:

• Identical transactions on the exact same day/time by most or all of the addresses
• A trace of the ERC20 token between addresses (as opposed to native tokens)
• A similar time/date that all the addresses started transacting on a chain

Please note that there will need to be much more data provided for this submission. Per the rules, the data will also have to be easily verifiable. The additional data you provided does not show how the all the addresses are related to each other, which is another rule. The data in that comment is not extremely conclusive.

Please let us know if you can provide this data. Thank you for your work.