Author: Trusta Labs
On July 15, zkSync officially announced an NFT airdrop for NFT players in the ecosystem, and the first 10,000 addresses have received the airdropped NFTs. As a highly anticipated top layer2, zkSync's move has attracted heated discussions in the community. Everyone is speculating whether obtaining this NFT is equivalent to the zkSync airdrop token qualification?
To answer this question, Trusta Labs analyzed the on-chain interaction behavior of 10,000 users who have obtained NFTs in the zksync Era:
Interaction behavior analysis
Number of transactions
The average number of transactions for zkSync Era users is 21. For this NFT airdrop, 70% of users have accumulated >= 20 transactions, which is higher than the average. 15% of airdrop accounts have accumulated <=10 transactions, and 690 users have even accumulated <=4 transactions.
Transaction Amount
More than half of the users in zkSync Era have a cumulative transaction volume of 44U. For this NFT airdrop, 15.4% of the addresses have a transaction volume of <=50U, and 530 of them even have a transaction volume of <=10U (much lower than the average).
Gas fee contribution
The median gas fee contribution of the entire zkSync Era network is 0.002eth. For this NFT airdrop user: 12.3% of the gas fee consumption is lower than the median value.
The average number of active weeks for zkSync Era addresses in the entire network is 3.6 weeks. For this airdrop user: 25% of them are active for no more than 3 weeks, and 700 of them are only active within one week.
1. “0” transaction “winning” address
We found the following three addresses, which had no interaction records in zkSync Era, but still received airdrops. According to the requirements of interacting with the top 100 NFTs, these three addresses obviously do not meet the requirements. It is speculated that they may be official test addresses. It is recommended that @zksync officially explain to avoid misunderstandings.
Address 1: 0x200ae0ab4e65bf0a80748cf4ebce814667513ba5 (https://explorer.zksync.io/address/0x200ae0ab4e65bf0a80748cf4ebce814667513ba5)
Address 2: 0xa0fdb2f6cf2bf189db73b294a60088fef751bfcd (https://explorer.zksync.io/address/0xa0fdb2f6cf2bf189db73b294a60088fef751bfcd)
Address 3: 0xe8bd3908c645dab3ced6b0ca75304ca3a31276c0 (https://explorer.zksync.io/address/0xe8bd3908c645dab3ced6b0ca75304ca3a31276c0)
2. Inactive addresses with only 1-2 transactions
In this airdrop, 118 addresses have only had 1 transaction in history, and fortunately, all of them were NFT transactions. 135 addresses have only 2 cumulative transactions in history.
Typical address: There was only one transaction 3 months ago, but still got the NFT airdrop because the address is the nice number 0x0.
(https://explorer.zksync.io/address/0x023444e85c568c16a4fc75707d62b75e1fef4494)
3. There is also capital accumulation in the airdrop address
Among the 10,000 addresses that received NFT airdrops, there was also a concentration of funds between different addresses, possibly multiple accounts controlled by the same entity:
Cluster one: 0x01bffc8dc41e26d98c3cef8b045726726134d1d3 transferred funds to 7 addresses, all of which received this NFT airdrop.
Cluster two: All five addresses received the NFT airdrop, and there were financial transactions between them.
For the 10,000 addresses that received the airdrop, we found that they all had Sybil behavior through two different monitoring methods:
TrustScan Sybil Detection
TrustaScan was used to scan the behavior of the airdrop addresses on the mainnet and Arbitrum, and 1,408 Sybil addresses were hit (Sybil rate > 14%).
Witch address 1: 0x014ddd8696562c105b6013b078a45a9fed0bcd75
This address is in a massive chain funding network consisting of 74 addresses, with mainnet funding preparation occurring within 3.5 hours on January 4, 2022, and funds transfer occurring on the Arbitrum network within 7.8 hours on April 6, 2023.
2. Sybil address 2: 0x0d8969db749fa22c8107ff3871e30b2da246984c
This address has appeared multiple times in the Ethereum mainnet in the Stellar Funding Network (getting funds from the same group of addresses and funneling funds to another group of addresses) among the many Sybil addresses that aggregate. On Arbitrum, it has appeared three times in the group addresses of batch operations.
All transactions of 668 addresses in zkSync Era occurred within 48 hours.
Witch address 1: 0x05a450c625f31eaf736b69c7f05a9fb89db87fb0
（https://www.oklink.com/cn/zksync/address/0x05a450c625f31eaf736b69c7f05a9fb89db87fb0）
This address conducted 104 transactions within 48 hours, repeatedly storing and withdrawing the same amount of funds, with a uniform interval of 9 seconds. It is highly suspected to be a Sybil address operated by a script.
2. Sybil address 2: 0x06d7101af6e75716b6d2ccbbbd6b95902ea555c7
（https://www.oklink.com/zksync/address/0x06d7101af6e75716b6d2ccbbbd6b95902ea555c7）
This address conducted 97 transactions within 48 hours, repeatedly storing and withdrawing the same amount of funds, which is highly suspected to be script operation.
3. Low-value users: 0x0b93c68d71c807303caecacbcfec018270c6bf3
（https://www.oklink.com/zksync/address/0x0b93c68d71c807303caecacbcfec018270c6bf3b）
The entire activity of this address on the zksync Era was 34 worthless transactions with amounts all approximately equal to 0 within 48 hours.
We found that the current round of zkSync airdrop address screening rules are simple, without considering interactive value and activity. Many official airdrop addresses have average overall contributions to the zkSync Era (transaction amount, gas fee and active time contribution are lower than average, or there are obvious witch behaviors). Airdrops are only to encourage users to participate in ecological NFT projects, so getting NFT airdrops is not completely equivalent to getting token airdrops in the future. On the other hand, it is speculated that in addition to common indicators such as transaction number and amount, zkSync's rules for user rewards and airdrops may also refer to the diversity of ecological contributions in the future.
Trusta will soon launch KYA (Know Your Account) user on-chain interaction and value scoring products on zkSync, comprehensively evaluate user value from multiple dimensions such as frequency, amount, loyalty, diversity and identity rights, rank all participating users, and guide users to interact safely with popular and high-potential projects on zkSync Era. At the same time, the unique TrustScan Sybil risk analysis function is embedded to help users prepare for risk warnings. All users are welcome to try it out.