Benjamin Klormann - Fighting Sybils & Fraud

Transcript

so hello welcome everybody to my talk about Cil and fraud detection um just a question in the start does anybody know what is a cable is yeah you know you want to say it yeah exactly this is thing so it's a thing that someone uses a computer network to get around the reputation and one indivual creates more indivuals than he have and this is a sentence also from gitcoin and there's a very nice image of what it shows like you have this Al accounts Bots whatever they do and this

is kind of a Cil attack and this happened also before in the rep two so I think everybody knows also like uh a voting system where some of your friends say hey I'm here in this competition can you vote for me and the people have like computer at work computer at home their mobile phone so they use kind of the three things to wrote on the system and what we have here is a very nice example from Spotify uh Spotify was farmed out in s 2015 where someone created 500 accounts free Spotify uploaded his own tracks to Spotify and by this he gained 5,000

bucks per month just playing his own tracks with his own sibles um the thing is here with the repb two this data is not accessible for us so this can only be solved by uh Spotify itself if they know which IP is belonging to them um and this comes now into web three uh in web three this is Cil attacks uh threatening the financial stability frering fraud can happen Mark Mone ation eroding trust in the ecosystem I mean we have this pillars of decentralized Finance where we want to have a fair governance system and especially also with air drops

incentives and all stuff like this you take away somehow this uh Fair claiming rewards from other people and someone gaining a more than he has uh this is also a very nice example where a developer made his own token he split this into seven w 70 wallets and it's increased somehow even the tvl the use activity and so on we will also come later into this again but we see here directly he has 50% of his own tokens distribute into 70 wallets so everybody when someone bought this token he sold it so what is a Cil in detail we have

three different kinds of cble that we can cluster it's a human it's it's a bot or um nowadays they are uh kind of apps especially on telegram they are really known nowadays uh so a human C is mostly that you do this interaction by yourself uh a b is mostly written with a script and this new apps they are a little bit more smarter than Bots because they have also kind of a algorithm behind so they are not showing completely um exactly timestamps uh here is an example of a human he withdraw from binance his day and then spread it over 30 wallets to be part in

this airdrop this is a bot we see here that he sends like uh in nearly every 20 blocks or 10 blocks a new transaction and also the transaction amount was exactly the same this was an example from uh gitcoin from quadratic founding so he tried to go under the quartic funding there um now we coming into some air drops upos uh this is a layer one from uh ex Facebook uh employees this kind of Libra where they had this uh project and upos made an I would say quite easy

airdrop to farm out because they had this test nut and everybody who minted there his uh nft got a reward so they didn't had any civil checks on this and it ended up that 65% of the tokens directly was going into Cil wallets one wallet had like nearly 200,000 uh tokens and what happened here with upos was a sailing pressure so when the first big sible started to sell the price dropped from $15 down to $13 and then more and more people were also selling it and it crashed down to $6.7 next we have arbitrum arbitrum was

kind of smart they checked already made a good civil check but what arbitrum didn't looked into was other layer twos or other layer ones so they only checked the data on etherum Manet and on arbitrum so if I would have made my sibl on optimism and Bridge back to arbitrum I would not be detected So 20% of the tokens ended up as well in Cil wallets next we have optimism optimism has a little bit another way how they made the airdrop they had this kind of four air drops uh so the first one was uh for the

first users of the Manet the second one was for the active users of the main it and every time when you even take part in the governance so you keep your tokens inside you get the multiplier and this is something where they try to achieve this incentive spr much better because so there's also not this kind of massive uh selling pressure and also they use the community and ask if they know some sibles so at the end they removed from 70,000 addresses 40 million optimism tokens before they spread it out uh hop the bridge hop they pioneered

some kind of civil Hunter program uh this data is also still available on GitHub and arbitrum for example used exactly this list to filter out also sibles um this has a good side but also can be a bad side because connects try to make the same like H what was happened with connect that the people was making so many reports that the team was overwhelmed by their submissions and not only this there was one civil attacker he sended to 30,000 wallets of the 65,000 wallets which been around he sended small amounts of eer or even just

one sand and so there was a lot of Cil Hunter they put it in this addresses and say like there's a Cil and there's a Cil but they at the end this was not a civil this was just a civil attacker and someone was using disperser and dispersed quite small amounts and this gives all the connections and also what was later there there was this kind of rumor that civil Hunters have been also civil spiders self so now comes the question who verifies the verifier uh this address was on the Hop positive list and what this guy was doing he sended his ens to a new address and then he come as a Cil

Hunter so I'm coming now into some methods example how you can trace back sibles this can be done by this is very good example same uh Central exchange deposit address then flly trap which is my own technology we can use a gas um detection cross chain Bridges token transfers so directly onchain uh transactions time time stamps the Wallet age chain interactions transaction amounts contract injections and bull transfers from disperses so what we see here is a deposit of two people in the same Central exchange of buit so it is

very clear that is the same person two wallets the same person because who else using the same deposite address and also what you can see here is a withdraw from a central exchange but this needs more factors to calculate in uh so we for example see here this person was using avalanche on the 1st of April to the same time the wallet H has the same time he had the same interactions and also when we look deeper he had also the same contract interactions so by saying this you could even say tracing back that it's from the central exchange withdra the same

person uh here's this fly trap that I explained this is an example from uh a solidly fork so there was also an airdrop and someone made 70 wallets as well and grabbed a lot of this uh air drops incentives from this solidity frog and especially when we speak about solidly there's also kind of a voting mechanism behind that you vote for the next incentives so this could be even they are manipulated if you gain a lot of power over air drops here we have uh the gas and transaction amount this is exactly the same bot that I explained before so here

he send it every time like $10 to gitcoin and also what we see here it's exactly the same gas price every time 9 0 gray so he spots even rating that he's going to exactly 90 gray and this can be traced back here we have an example of a cross Trin Bridge so this guy was farming out the cross train uh he sended over Lifey some token to another wallet and then next month he get the money back he used also some other um protocols and then he sent it out the money to another address and this is kind of a chain link

transfer which we also see like here so he send it also like forwarding this is um also here we have a bull transfer and then he used also kind of this chain link transfers and this is an example from um Gula where someone farmed out also an airdrop and uh he used several wallets and we also see that there was a question about I think pancakes web was a incentive from pancakes web so we can even Trace back uh about the contract interaction this is another chain link token transfer this is a lately happened

on base uh base also had this kind of a Gul competition where you can earn points if you buy a nft and then you claim your points and this guy was very smart he' bought bought just one nft send it to next wallet then he claimed the points there send it to the next wallet claimed another point there and so he only buy one nft and this is not the thinking about this incentiv that you buy with every wallet one nft and so he came around the system quite easy meanwhile Galaxy after I informed them about this they have now a a code

behind also the algorithm where they detect direct transfers and cut them out um also what can do is developing your own contracts and your own tools uh here we have a guy he's called Yuri he used exactly this on Gula that he farmed out very smart over an script that he used here and also what he did on base he was creating his own D disperser contract so he was not using disperser or bulk transfer apps he created his own contract and dispersed small amount of ether in 2,000 wallets and from this 2,000 wallets he also

created some more contracts um so he has I I think he ended up with 3,000 wallets right now on base where he have small amounts of ether inside and he try also to hope that there will be an airdrop on base so how we trace this all back mostly it happened with ESC quaring like um dun analytics footprint non and flip site um but also there are kind of really special apps around like um scope scan um this image before that I showed was for example from scope scan this one so you can see directly on

Scopes and where the people set money to and you can even see um directed clusterings then we have also uh truster laps um arcom and bubble Maps bubble Maps is special specific about all tokens uh developers to find out if they have sub wallets where they send the token tool which I showed in the start and foro foro is kind of a monitoring system uh um and they also have a new technology where can kind of program machine learning inside and the fast detection and what's also around is the open data Community this is kind of um a

Discord group a DA where they come together and build this kind of Legos like Esco cies specific to detect cbls and frauds they was founded out of a gitcoin and get some bounties from gitcoin and grants and and meanwhile they're also working very hard with arbitrum together so now the question how to solve this and this is a massive question because at the end we can only increase economy cost like asking for stake uh get something around that they earn less that they put in like uh I think Tina there was also some people that say oh we have so small airdrop and

the gas fee is too high to claim this air drop so that's a thing if you don't there have like 100 wallets you in the end spend more money to claim the air drop then you get um analytics which is my point really crucial because at the end you can solve this really only by analytics by life tracking uh there's also human verification but I mean also there captures and all the stuff you can still go around if you have a good B for this um also kyc could be something but still a lot of user don't like kyc and this gives a hard barrier um the future maybe there's some

kind of zero uh zero knowledge technology that you have your decentralized ID uh something like gitcoin already has but even then there's no 100% sure that you that you really can detect everybody and I mean even with kyc we see what happened lately that some people were using AI to faking new identities passports and going to Central exchanges and making accounts there so even this stuff with AI there's a discrepant between um now I'm coming also to an example from a digital identity at caliz identity so this is a guy who was on G

coin and even gitcoin later come back to me and ask are you really sure about this findings so this guy has a gitcoin passport with a score of 33 and he even created sub wallets with a score of 16 which in my opinion is even quite High because I have only a kit coin score of 22 so even there with his sibles he was that good that he created Twitter accounts Discord Facebook Gmail and so he get this kind of reputation like a human so any questions around thank you very much um any questions from the

audience the best ATT the best civil attack that ever happened yeah yeah yeah that's a good question I mean there was now a late uh nowadays A guy on Ted case think I think this was probably one of the best smartest one because he created his own token I mean when we look at how incentive will be distributed arbitrum had this kind of uh where they say you need like five Contra interactions you have to bridge into the network Etc so this guy on zkn he was really smart he created his own token he claimed with 20,000 wallets his airdrop he created his own decks which

is not accessible for us all he swept there he swept back he used the bridge with all this 20,000 wallets so this is quite smart I mean if he would beit smarter then he would even use some other technology but uh you can also connect with me if you're also in this field of research and uh then we can speak but uh I mean it's always a little bit tricky to say what is the best Cil attack because it's also now live streaming and everybody could see this and say ah this is a good idea I [Laughter] will whates you to stay on on the light side

sorry what motivates you to stay on the the research side versus the attacker side what state we are why why are you a a civil researcher and not a civil attacker why I'm a researcher not a civil attacker I mean the thing is when you want to think about this then you can you must think like a black but uh somehow I don't want to undergo the pillars of decentralized finance and this is thing um we want to have a fair distribution of air drops and everything so yeah I could be a blackhe hat I could do everything I mean everybody in this room probably has knowledge to be more black than white but why why should I

use it I mean it's still unfair and I'm more really interest into this really deep cases and I I really like to discover this hi uh yeah thanks for the presentation really interesting so uh as an addition to this previous question how do you um obviously we all agree that it's unethical to uh you know create thousands of bots and you know Chase the air drops and um how how like if there's a u any strategy to counter that for example if

we look at like you know PL traditional platforms like hacker one where we would uh Target those same hackers but make them like name them like as ethical hackers to see if we can use their resources to you know give them bounties and have uh you know if there's something specific for this Cil um um strategy to uh are you searching for one of the slides where I probably missed that information so for example Hop was using exactly this so when you was taking part in hop from every Cil that you detected you get I think it was 50% of the tokens you get directly paid out I think it was

10% and the rest of this 30% was staying into a contract also connect had a same like this every Cil that you detected you get 25% from the Cil from what they was elgible to claim you mean like if you found someone who was doing it or if you detected vulner yeah if I found someone yeah yeah but I mean there's always kind of how you know that is a really a Cil hunter or is it even a own Cil that he reports his own veres I mean this is this can be other than the the issue because exactly this unfortunately the

data from Conex was removed but I would really love into this rumor what happens lately there because at the end he could even say his own wallets to save this 25% then instead of getting zero oh take take the cut but uh kind of turn on the uh ethical side of this sorry well I mean yeah all right thank you yeah thanks for the great talk uh I have a question for the first slides you presented you showed some airdrops and you said okay uh 20% were went to sibl

for arbitrum for examples how do you get this uh this number um um so this number is not really 100% sure but I also made some postmortem analysis and lately there was also from arbitrum though a grant where they now do a postmortem analysis but this 20% um I would say quite accurate and this is also something that other researchers found out um this is kind of um what I say it like here this kind of flap flly trap that you look later after claiming where this money flows into like especially when someone claims with 100

wallets there are some sorry to say stupid guys they send it directly to one wallet and then you have all this connection there and see oh 100 wallets send all their claimed air drop into one wallet and this is how you can get this numbers around so it's a lower bound because if someone was smart and didn't do this then you wouldn't detect them right sorry if someone did not send all their funds into a single wallet then maybe it would be yeah yeah yeah but yeah makes sense thanks okay thank you very much we are running out of time but in one hour during the networking session you can ask Benjamin more questions thank you

very much again big round of applause to to Benjamin thanks