LayerZero and the hunt for sybil before the airdrop: caught the user “Ruslan”

The story of “Ruslan” begins when the anonymous user, in order to farm the best LayerZero airdrop and obtain the largest possible allocation of ZRO tokens

The LayerZero airdrop is getting closer and closer, and the crypto community is abuzz with anticipation. Rewards in the form of the ZRO token are expected to arrive in June.

One Web3 user, known as “Ruslan,” is going all out to maximize his potential allocation. With hundreds of wallets at his disposal, Ruslan is actively hunting airdrops from upcoming projects.

However, despite his impressive setup, Ruslan made a crucial error that could cost him dearly.

Let’s dive into the story and uncover Ruslan's mistake.

Ruslan's Airdrop Hunting Strategy

Ruslan's goal is to farm the best LayerZero airdrop and obtain the largest possible allocation of ZRO tokens. To achieve this, he is using hundreds of different addresses to execute various types of on-chain transactions.

Ruslan began farming the airdrop with each of these addresses in 2023, using the Stargate bridge and other dapps that are based on LayerZero's omnichain technology.

Despite the high number of entities connected to each other (having exchanged funds with each other to finance the interactions), Ruslan still finds an idea to manage to evade the anti-sybil checks and make each address appear as standalone.

Maybe under some advice from another user X, decides to associate an ENS domain with every address he had interacted with to position himself for the LayerZero airdrop, convinced that the on-chain analysis systems would identify his wallets as authentic.

In fact, sybil addresses are usually characterized by a low quality in the history of tx, with few low-value transactions, often advanced by bots and managed by automated scripts: an ENS domain can therefore increase the quality of its portfolio by adding a cryptographic component usually excluded from the economic operations of bot farming.

To carry forward this hedging strategy, Ruslan also spends a considerable amount, exceeding 3000 dollars between registration costs at Ethereum Name Service and Ethereum blockchain commission costs, in addition to obviously all the fees paid for farming.

Ruslan's Brilliant (or Not So Brilliant) Idea

The problem is that Ruslan comes up with the brilliant idea of sequentially naming all the domains he bought, going in order as follows: ruslan002.eth, ruslan003.eth, ruslan004.eth, ruslan005.eth, ruslan006.eth, ruslan007.eth, ruslan008.eth, etc.

One forgets that by sequentially identifying its addresses, these could be considered as connected to each other, being in fact linked by a fairly obvious logical thread that sees a progressive on-chain identifying name.

Ruslan's Misfortune

After the LayerZero team and its CEO Bryan Pellegrino kicked off the “sybil bounty” phase, inviting the crypto community to report improper behavior by other users, it didn’t take long before Ruslan was identified and marked under the sybil list on Github.

Most likely Ruslan and his addresses will not receive any reward from the LayerZero airdrop, and indeed, a portion equal to 10% of the allocation that would have been due to him will go to the address 0xc37395f3aca821f1f85D897Ee541BCdB4C5B7c7E, owned by the user who reported him with a detailed report.

A Closer Look at Ruslan's Behavior

Observing more closely the behaviors of Ruslan, we realize how the user is not exactly a newcomer in the crypto world.

Recently, he managed to become eligible for various airdrops such as AltLayer, Eigenlayer, Omni and Renzo, bringing home decent earnings.

The poor Ruslan simply made a serious distraction error, or he was excessively superficial in thinking that the insiders at LayerZero would never consider the progressive ENS domains.

The Aftermath: Ruslan's ENS Domains Up for Grabs

In the blink of an eye, the entire community turned Ruslan into a viral meme, which spread across all the X boards of the airdrop farmers.

There are even those who have come to his defense, pointing out to Bryan Pellegrino of LayerZero that the addresses in question could belong to a long list of family members of the reported user and that it is not fair to identify them as sybil a priori.

Ruslan's Misfortune Continues

Poor Ruslan, he was farming LayerZero more than a year ago and it seems he bought ENS Domains for his wallets less than 2 months ago (check the examples). You can see clear sybil activity as he for example bridges 0.09 usdc using stargate. Poor Ruslan pic.twitter.com/QZ0D5uEEcP

Meanwhile, Ruslan has put his ENS domains up for sale at 5 ETH