1. Snapshot & Airdrop Indicators

Snapshots capture many on-chain features: timestamps, account balances, smart contracts, and on-chain activity

Therefore, when taking airdrop snapshots, you will generally pay attention to the following indicators:

- Token balance

- Smart contract interaction

- Transaction activity

- Trading volume

Taking the arb airdrop standard as an example, the requirements for the above four indicators are:

- Minimum balance 0.005 eth

- Minimum 4 interactions, 4 different contracts, maximum 100

- Interaction in different months 2, 6, 9

- 3 levels of transaction volume: 10,000, 50,000, and 250,000 knives

Regarding transaction volume, L0’s CEO proposed the idea of ​​average transaction volume

It may be used as the airdrop standard for L0

2. Witch determination

Key patterns to identify potential Sybil behavior from a Dapp perspective are:

Mode 1: No funds reserved

Typical characteristics: Empty the wallet immediately after completing the exchange task

Mode 2: Quick transactions in a short period of time

Typical characteristics: All transactions occur within a short period of time and are not continuous

Arbitrum has a standard: all transactions of airdrop recipients occur within 48 hours, and 1 point will be deducted

Pattern 3: Multi-account focus and observable clustering

Sybil attacker with multiple accounts needs funds to pay for gas

There is a witch risk when multiple accounts receive funds from a single source

This pattern can be observed on blockchains forming clusters

Mode 4: Exchange Witch

Issues may arise when depositing funds back to CEX from multiple accounts

For example, using 50 different wallets for airdrop mining and ultimately transferring funds back to a single deposit address on CEX

This creates a clear cluster of transactions

To bypass the witch problem when making a deposit, you can follow these steps:

- Use sub-accounts

Sub-accounts allow you to generate additional deposit addresses, thus avoiding witch wallet issues

- Have accounts with different addresses on multiple exchanges

3. To avoid Sybil attacks, consider the following strategies:

- Fund wallets from centralized exchanges

- Transferring funds between 2-4 wallets is acceptable

- Avoid completing all tasks in one day and then not using your wallet anymore

- Keep some funds in your wallet

- Improve wallet legitimacy by providing liquidity and staking funds, do not remove liquidity immediately

- Improve gitcoin passport score

- Maintain at least 1-2 interactions per week

- Focus on average trade volume, it’s better to do 5 trades at $50 each rather than 50 trades at $5 each