Introduction

To maximize the fairness and integrity of Linea's airdrop eligibility process, we conducted an extensive Sybil detection analysis on all eligible wallets with non-zero LXP balance. This initiative aimed to identify and remove “disingenuous” wallets created solely to “exploit the system.” Our work aims to reward genuine users and community members by focusing on transparency and accuracy.

Linea has conducted initial identity verification for users who completed specific on-chain activities to earn LXP tokens and later completed Proof of Humanity (PoH) attestations. From there, we have 1,297,203 unique eligible EVM addresses to check.

Key Results

Our initial flagging raised 50.45% of addresses as Sybils, or 654,443 unique addresses. These included smaller operations such as casual farmers and other closely related wallets. The flagging included addresses related to multiple other addresses through their on-chain behavior. Given the assumption that most users have multiple wallets by default and use them for certain reasons, we did not want to penalize users for having a healthy on-chain presence through multiple wallets. So we moved the thresholds higher and eased the restrictions, intending to catch only larger and more automated operations. We tolerated smaller farmers and primarily targeted larger, more automatized sybil operations, typically those with around 20 connected wallets though this number is not a strict threshold, it was the typical.

In the end, the high-level results included:

• Total Addresses Reviewed: 1,297,203 unique EVM addresses
• Sybils Identified: 516,960 Sybil addresses
• Percentage of Sybils: 39.85%
• Remaining Eligible Addresses: 780,243 addresses

Our Process

We used a multi-step, data-driven approach to identify and remove Sybil addresses while preserving genuine users.

Initial Screening

• Clustering Analysis: High-level on-chain analysis is used for initial clustering.
• Outcome: Identified initial clusters of potentially related wallets.

Behavioral Analysis

• If the address “looks and acts” like a Sybil on-chain, odds are it's likely a Sybil. This behavioral analysis defines and tracks behavioral patterns.
• We performed a detailed analysis using Linea-specific data and broader cross-chain data points. This included wallet activity patterns, transaction history, counterparties, and more. In other words, this model surfaced wallets that acted the same way, likely representing some level of automation or a strong correlation based on their on-chain footprint.
• To remove potential false positives, we focused on identifying coordinated, automated behavior within clusters by only retaining higher levels of similarity (the higher the similarity, the more correlated the behavior between an address pair). We have set our threshold to a high degree, to favor precision over recall.

Manual Spot-Checking

• Validation: Random sampling of clusters to verify the accuracy of behavioral patterns and ensure alignment with our goals of rewarding real users.
• Outcome: Final refinements were made to reduce false positives and confirm Sybil wallets.

Example Sybils

To illustrate what highly correlated addresses look like on-chain, we can look at the example set of addresses below. These are addresses with very high similarity scores, with many overlapping contexts (on-chain links):

We can spot: the nearly identical chain and net worth allocation, along with the same transaction behavior on Linea (noted by counterparty entity, values, timestamps, actions (methods), and other cross-chain data points not captured in the above screenshots.