Gnonsis Safe Airdrop Farming Report by SixdegreeLab #427
Labels
Valid report
Report accepted
Comments
|
One of the address |
|
Thanks a lot for this elaborate report. Compared to many of the other low quality submissions this really stands out. 1 address was already found by another report and 1 Safe was used to deploy another contract which seems to be legit usage, however we've found the following to be related to airdrop farming: |
Closed
|
@SixDegreeDev @tschubotz I'm surprised this report is passed. What do you think about people completing the task of the rabbit hole? This report does not analyze the owner's association at all, but only sets a stricter standard. https://app.rabbithole.gg/skills/intro-to-daos/GNOSIS_SAFE_OWNER |
Closed
|
|
|
This is absolutely not true statistics, I have a personal account, I went to try Gnosis Safe on Eth , I managed to make a few transactions, then I went to test on Arbitrum. It's kind of stupid. I have a personal account with ens name more than 100 transactions. 0x9f2FCaf1f8D8A8370faf40a4FE04911ACD221d66 <---- GNOSIS SAFE WALLET |
|
I don't know why my safe address is in the list, 0x4eF094315961F4C9F0Bb3d385E0B6dF4b5DA2343, i did not break any community rules. I checked out these reasons:
Clearly my address does not meet reason 3 “All interactions with a Safe wallet are from the same account” because i set up my account with my own personal address, transaction "from" and transaction "to" are not the same account.
https://etherscan.io/address/0x4eF094315961F4C9F0Bb3d385E0B6dF4b5DA2343
|
|
This report has a large list of errors |
|
@tschubotz I only had 1 airdrop account and then was identified as an airdrop farmer. My example has been discussed by many, and SAFE has evolved from what started as a "witch hunt" to a "purge of inactive users". ;It's ridiculous that this report was even passed! |
|
I have only one safe created and still counted as farmer. Wtf are you doing guys. Please check again my safe address - 0x7Df0030A28474e08472E4e74a84daEd235afCb9F |
|
This is my safe address 0 xf95949e6701b6ea2c2e56f0d1eb86afcff31e2fd because I was created to complete the rabbit hole, rabbit hole task light after I get out, but I should be qualified, I will attend each task, I don't understand why I was excluded. Please check it again！I don't understand why I am judged as a bear farmer. I only have one account, which is unfair to real users
|
|
0xe47F75DD5dB061Ac1629219F34611aB61f9f2ACF This is my SAFE address I only have this one account, do not understand why it will be regarded as the name of the airdrop farmer, can not be regarded as the airdrop hunter because of the short deposit time, so it will let the real user wronged, hope the project side to check |
0xe47F75DD5dB061Ac1629219F34611aB61f9f2ACF This is my SAFE address I only have this one account, do not understand why it will be regarded as the name of the airdrop farmer, can not be regarded as the airdrop hunter because of the short deposit time, so it will let the real user wronged, hope the project side to check |
|
Now your safe deposit box is really good. I am a Chinese. I hated those hackers who stole assets because my private key was stolen. I learned from a friend about the function of your safe deposit box to protect user assets. I can't wait. I researched a few times, and it feels good. I am currently using 7 wallet addresses to bind the safe. I have used it back and forth more than 10 times. Although it is troublesome in the process of use, the sense of security fills my body. I hope you can develop it. Come up with better functions, I will always use your Safe. If possible, my future assets will be entrusted to your Safe project to protect, haha My safe is: 0xf9838151c776eD9995e85c03E13a474fb7B2cf62 |
|
@longluwang10 your safe appears to be on Binance Smart Chain - only safes on Ethereum Mainnet qualified, assuming they were apart of the airdrop farming lists. |
|
Hi Safe, it seems this specific statistics hasn't really identified real use case and farmer use case! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
and others
Uh oh!
There was an error while loading. Please reload this page.
Related Safe Addresses
Reasoning
TL;DR
We profiled the characteristics of airdrop farmers in this report and cracked them down into several typical on-chain behaviors. Then we analyzed on-chain data on Dune to discover the suspicious accounts that satisfy all airdrop farmer assumptions at the same time.
Accounts with the following features are suspicious: created after GIP-29; having more than 3 but less than 30 transactions(transactions include creating Safe account); all transactions were interacted with the single account(usually the creator) and happened within 6 hours after the Safe account was created; holding no NFTs and very few tokens(less than 0.02).
Satisfying only one behavior mentioned above is not enough to be strong evidence, while satisfying all of the following items
at the same time strongly indicates airdrop farmers.
Detail Rules
In this report we intend to distinguish airdrop farmers from real users. Here we focus on users' on-chain behaviors.
We think that airdrop farmers and sybil attackers intersect but are not totally identical. Fund-tracking method is usually used in cracking sybil attackers. However, here we are going to crack down on a typical airdrop farmer's behavior and then find the accounts that have similar behaviors. In this process, we will set all numeric parts used in our method as parameters to dynamically modify our strategy.
We take the intersection of all the following conditions to extract airdrop farmers' accounts:
1. Safe accounts created since 2022/02/10
We track the Safe accounts created after the "GIP-29: Spin-off safeDAO and launch SAFE Token", which is the proposal on launching
$Safe token(2022/02/09). This potentially gives way to airdrop hunters and tempts them to take action.2. Total transaction counts more than 1 but less than 30
Two cases are excluded: Txn=1 and Txn>30.
In the case of Txn = 1, there are two typical behaviors: 1\ Deposite certain amount of money and leave it alone; 2\ Call functions such as adding owners. We regard these two behaviors as real usage and relayer app.
In the case of Txn > 30, we assume these accounts are super active accounts with frequent usages. Of course they are not 100% innocent . We will check later.
Note that "transaction" here is a universal concept that refers interacting with the contract or transferring wealth. The "transactions" in our method include the action of creating the account, so for our code running on Dune, the limitation of transactions is set > 3.
3. All interactions with a Safe wallet are from the same account
This says, transaction "from" and transaction "to" are the same account.
4. Interaction in a very short period of time (All TX in 6 hours since wallet account setup)
If the interval between the very first transaction and the last ever transaction is less than a very short time (we use 6 hours here), it is likely to be a task-completing behavior, which indicates an airdrop farmer.
Note that in our method, the first transaction is creating account. So it can be understood as the last transaction happened within 6 hours after the account was created.
5. Current token balances of the Safe account are less than 0.02
Balances of all tokens in Safe wallet are less than 0.02 (For example, if the account has ever transferred USDC and ETH, it's balance match <0.02 USDC & <0.02 ETH). One typical behavior of airdrop farmers is to transfer all the money after finishing the interactions. As airdrop farmers, they would love to interact with as many protocols as possible. Liquidity is vital to them, so they won't leave much money in the Safe accounts.
In some cases, users transferred no ERC20 tokens but NFTs to their Safe accounts. In order not to miss any type of assets, we first check whether the Safe account holds any NFTs in our method.
Methodology
Our method is to translate the airdrop farmer's portrait into programming language via Dune.
Firstly, we establish a database containing the $Safe airdrop addresses on Dune. Then we extract suspicious accounts that satisfy all types of behavior at the same time from this database.
In other words, an account created after 2022/02/10, having few(5-20) transactions with only one account in a short time(6 hours), leaving no money(<0.02) now, sharing same owners with several(>10) brother/sister accounts from a same parent account(creator) , is most likely to be an airdrop farmer's account.
Furthermore, we track not only ERC20 tokens, but also NFTs, in order not to mistakenly hurt real users.
Based on that, an algorithm was used to identify potential airdrop farmers' accounts. The details of algorithm can be found in the query listed below. All the numeric parts in our method are set as parameters to dynamically modify our strategy. Just simply input the rational parameters and run the query.
Let's randomly pick an address for verification:
0xFD9a4EfA3e2cBC4c35fea9ee9743F1dc4c52240dhttps://etherscan.io/address/0xfd9a4efa3e2cbc4c35fea9ee9743f1dc4c52240d
Input this address to etherscan, we can see that the creator
0x84c972b299a1ccaf524ced7f2cbb5064b65ba664created this Safe account. Then he transferred 0.001 ETH into 0xFD and transferred back to 0x84 within 12 mins.Safe Address
0xD3D51AE08141509A40CF0bD52639678E8775C998The text was updated successfully, but these errors were encountered: