Interpretation and thinking of Gitcoin witch detection scheme Top1
Original title: "Gitcoin witch detection scheme Top1 interpretation and thinking"
Original author: berwinYes
GITCOIN two months ago Hosted the OpenData Community Hackathon! Among them, three key areas were announced, namely:
Sybil detection, optimization analysis of donation incentives, and Dune efficiency analysis, the results of which were also announced recently.
I believe everyone should be most concerned about the issue of witches, because this year, under the stimulation of OP and APT, there has been a group of people who envy everyone The grand occasion of the mao party.
Today, combined with my own understanding of the first open source solution for witch detection, I interpreted the technical direction, and gave some personal thoughts on witch detection at the end of the article . I believe that after reading this article, both the project party and the interactor can gain something.
Note: This article does not represent the official point of view, it is only for personal interest.
Spoiler, this article is long and involves a lot of technical analysis, if you are impatient, you can directly skip to the end of the article to browse the summary and personal thoughts of this article.
Since the author of the question is gitcoin, its main interaction scenario is donation. However, the internal logic is also applicable in other scenarios (transfer, mint and other actions), and the following operations that interact with the project party are collectively referred to as project interaction.
Scheme 1: Batch transfer and interaction
Sybil attack is essentially a user spreading funds To multiple addresses, the process of manipulating these addresses to interact with the project contract.
Then in this process, the whole process can be split into two parts, which are batch fund transfer and contract batch interaction.
1.1 Batch transfer detection
Select data
< br>
The easiest way to transfer money in batches is through smart contracts, because it saves gas costs. Therefore, the author uses tools to extract the tx_hash that has been associated with the project contract and has batch transfer operations on the chain.
Design Indicators
Risk calculation
The author collected 18,926 contributor addresses related to batch transfers. Compress the risk to 0-13 points, after analysis and induction
< img alt="" src="https://image.blockbeats.cn/other/pic404.png" decoding="async" srcset="/_next/image?url=https%3A%2F%2Fimages.mirror-media .xyz%2Fpublication-images%2FGEa5BL4OMUXDOjpH5xxM7.png&w=1920&q=90 1x, /_next/image?url=https%3A%2F%2Fimages.mirror-media.xyz%2Fpublication-images%2FGEa5BL4OMUXDOjpH5xxM7.png& w =3840&q=90 2x">
Auxiliary means of judgment
1. If an address uses the following dapp, even if the score is not high, it should be noted that it is an important signal for sybil.
2. There are suspicious batch operations of interactive addresses on other platforms, such as opensea element Looksrare, etc.
1.2 Batch interaction detection witch hypothesis
For simplicity, the amount of interaction is the same
For economy, the amount of interaction is as small as possible
For convenience, use scripts/tools, Interact with the same parameter settings, such as chain ID, chain layer, token, quantity
For uniformity, interact in a sequential manner, very tightly
< /p>
Interaction address grouping and indicator calculation
The 7 index values are transformed into the witch risk score as shown below:
< b>Witch result display
Scheme 2: Behavior sequence pattern mining
User behavior sequence is a collection of events in order of execution time during user interaction. This detection is mainly aimed at group control players.
The definition of similarity
The behavior sequences of the two wallets Addr are respectively s1= {a1,a2,a3,...,an},s2={b1,b2,b3,...,bm}
The condition of similarity Sim(s1,s2)=1 is:
The length of s1=the length of s2, that is, n=m
For each pair of actions ai, bi, they are the same, only negligible time difference.
The author believes that more complex indicators can be tried in the future.
Similarity screening
In the author's code Addr whose behavior sequence length is 3, similarity is 1, and the number of address sets is 5 is identified as a witch.
< /p>
Similarity clustering
The author also tried to use AI The clustering method is used to calculate the similarity.
Scheme 3: Asset Transfer Graph (ATG)
Delete the exchange address and contract address, leaving only the EOA type Addr and The address of the project party is used as the composition node, and the flow direction of ETH, DAI, USDC, and USDT is used as the edge to construct a directed graph.
Look for chain structures and diamond structures.
Chain structure: Starting from the first EOA address, each time the funds are transferred to another EOA address, the EOA address is manipulated for a project contract address interaction, and the remaining funds are transferred to the next EOA addresses, looping the process until funds are transferred to the last EOA address.
Diamond structure: This is more common. An EOA distributes funds to other EOA addresses for project interaction.
Project Summary
The behavior of witches, summed up two characteristics: batch, unity sex.
Whether it is to use the synchronizer to open more or batch script operation, it is impossible to escape these two properties.
So in anti-witch analysis, most project parties and analysts also follow these two methods to search, but in the selection of individual parameter thresholds and the use of AI Or the scope of the link analysis is different from each other.
In addition, the project party also has information that will not be recorded on the chain, namely IP and fingerprints. At the same time, the project side is now trying to avoid these problems from the source, such as more stringent test token issuance, using twitter and dc for robot filtering and strict KYC certification. After all, the project party wants to send airdrops to real users.
Although countermeasures have been upgraded, witches are still emerging one after another. It is dynamically upgraded. After all, witches are in the face of money, and the technological iteration is definitely the faster one.
Written at the end
Wrote so many witch detection methods, also want to stand From the perspective of a participant who wants to get an airdrop, talk about how to avoid becoming a witch in the eyes of the project party:
Interactive funds do not cross, that is, do not appear in the above funds The chain or diamond type, visualize the capital link, it is clear, EigenTx or other plug-ins can be directly generated with one click, and the detection cost is almost 0;
IP The importance of fingerprints is one of the safest and time-saving filtering methods for some project parties;
Do not use several identical wallets for too many Interact with different projects in batches, the information on the chain is permanently saved, and anyone can see what your wallet has done before
Don’t airdrop for airdrops, you Use your wallet to participate in other activities, such as galaxy missions, alphabot’s NFT lottery, to make the project party believe that your project experience is rich enough, that you are the necessary target for their airdrops, and it is their loss if you don’t give you an airdrop ;
Keep calm, the airdrop is a gift from the project party rather than an obligation of the project party, I hope everyone will not do the task with a smile, and finally RNM will refund the money .
I hope that every project participant can gain something, and every project party can survive the bull and the bear. After all, in 2022, too many things are impossible to subvert our cognition. Do what you can, don't go over your head.
Here is coolberwin's Mirror, it's not easy to create, I hope you can follow my Twitter after watching it, thank you very much.
Original link
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
