Spoiler: Not nearly as many as we'd like to believe.
**note**: The analysis and graphics presented in this thread are on protocols that are **not** @chaos_labs partners
2/15 With the rise of onchain agents and Sybils increasing, we're facing a crucial question:
What constitutes a real Web3 user? The answer is more nuanced than ever.
3/15 At @chaos_labs, we initially developed a Sybil Detection Platform to enhance our risk models by identifying wallet and whale concentration across applications. Concentration risk is real and heavily skews VaR (value at risk) and downstream parameter recommendations.
4/15 As we refined our model, we realized its potential extended beyond DeFi and that our clustering and labeling heuristics could be used across various verticals, such as social applications.
5/15 Models support two types of heuristics:
1) general heuristics to classify sybil clusters by identical attributes (e.g., funding sources)
2) application-specific rules customized per application.
6/15 This image showcases a simple fund dispersion tracer in action.
Within the same hour, we've identified wallets funded by the same CEX cluster, such as Binance. This is a single heuristic in a model that can support hundreds, if not thousands, of rules.
7/15 We've since adapted our clustering algorithms to assist teams like @LayerZero_Labs and @ether_fi optimize their incentive strategies and explore non-DeFi use cases like social.
Example: How many @farcaster_xyz / @LensProtocol users are **real**?
8/15, the numbers speak for themselves. In some cases, we've flagged application user bases as over 98% Sybil.
But do well-connected clusters necessarily mean Sybil / farmers / bots?
9/15 As AI agent deployment grows, the distinction between Sybils and legitimate user-authorized/intent agents becomes less clear-cut.
10/15 This shift presents new challenges in defining authentic or "intended" usage.
It's evolving into a spectrum that requires context.
11/15 These changes have significant implications for UX design and incentive structures. Teams are now grappling with questions like: How do we encourage valuable user behaviors while accounting for AI-driven interactions?
12/15 There's no universal classifier, and context, i.e., intended or encouraged UX patterns or usage matter.
13/15 We believe every crypto team could benefit from this type of analysis to:
a) Gain deeper insights into their user base
b) Optimize their incentive strategies
c) Adapt to the changing landscape of human and AI interactions
14/15 Encouragingly, while Sybil's sophistication is advancing, we're also seeing growth in organic wallet activity. The key is in thoughtfully interpreting and applying these insights.
15/15 We'll publish reports we've run on various protocols very soon.
If your team wants to better understand users, identify sybil clusters, or optimize incentive spending, we'd love to chat!
• • •
Missing some Tweet in this thread? You can try to
force a refresh
@LayerZero_Labs Sybil Analysis: @chaos_labs Final List
1/ Our original airdrop eligibility scan flagged over 800K LayerZero user wallets as Sybil. We've worked tirelessly with the LZ and @nansen_ai to narrow this down and ensure minimal false positives.
2/ The Chaos Labs final list now features ~440K addresses and can be found here.
The @LayerZero_Labs Foundation selected @chaos_labs and @nansen_ai to lead protocol usage analysis and Sybil detection.
Below, we provide our analysis principles, methodology, and heuristics, showing our commitment to transparency, integrity 🧵
2/ Principles of Analysis
- Real users should not be hurt; we aim to maximize precision over recall
- We aim to focus on industrial farmers and primarily rely on source of funding analysis heuristics
3/ Data Overview
Total Users: 4.82m
Total User-Chain Permutations: 31.55m
Total Unique LZ user funders: 2.18m
Classified Sybil Users: ~14.5%
Note: This interim analysis includes only EVM chains. @Aptos will be analyzed separately over the coming weeks
We've received outreach about today's market manipulation. This incident is isolated to the $TRB market, resulting in a ~2m loss to $SNX stakers. Let’s give some background before diving into the attack.
2/ @synthetix_io powers various perp markets. Asset listing and monitoring are critical - factors like liquidity, volatility, and holder distribution must be monitored to gauge manipulation feasibility. @chaos_labs automates observability w the Risk Portal.
3/ But this is even more critical in leveraged perp markets, where price movements and risk are amplified. For instance, a 1% price increase with 100x leverage translates to 100% gains, making low-volume markets attractive targets for manipulators.
The Portal highlights real-time cost of of TWAP manipulation across V3 pools.
2/ But first, why is Oracle Manipulation an attractive exploit vector for attackers?
TWAP oracle manipulation leads to severe consequences for protocols that consume those price feeds, enabling attackers to distort prices, leading to economic exploits. Examples below 👇
3/ @Moola_Market and @mangomarkets, both suffered significant losses due to TWAP oracle manipulation. In each case, attackers exploited thin liquidity to pump collateral value, leading to under-collateralized loans and substantial financial damage.
The overview page presents top-level protocol metrics such as total GLP pool size, 24-hour fees and volume, and total open interest. The page also displays time series data on GLP pool value, composition, short and long open interest, and daily fees
3/ Markets Page
The markets page showcases all assets supported for opening a long or a short position. In its primary view, the page provides users with market metadata, including data on short and long open interest, short and long leverage, and short and long positions.
3/ Year one of ops has included successful partnerships with major DeFi customers, including @AaveAave, @chainlink, @UniswapFND, @BenqiFinance, and @osmosiszone, to secure protocols against manipulation and black swan market events while offering optimization recommendations.