Airdrop Strategies That Don't Get Sybil Attacked

We've distributed millions in airdrops across multiple projects. Half got sybil attacked. Here's what we learned the expensive way.

The $500K Sybil Attack

One project we worked with planned a $2M airdrop. 40% went to sybil farmers. That's $800K to people with 10-100 wallets each, who dumped immediately.

How it happened:

Airdrop criteria: Hold NFT + join Discord + complete 5 quests.

Problem: Each criterion was farmable. One person could create 50 wallets, buy 50 cheap NFTs, join Discord with 50 accounts, and complete quests with scripts.

The timeline:

Day 1: Snapshot announcement. Day 2-7: Sybil farmers created thousands of wallets. Day 8: Snapshot taken. Day 30: Airdrop distributed. Day 31: 60% of tokens dumped. Price crashed 80%. Day 60: Project dead.

What we didn't catch:

Wallet clustering. Many sybil wallets were funded from the same source.

Quest timing. Sybil accounts completed quests in identical patterns.

Discord behavior. Fake accounts had no real engagement.

Types of Airdrops (And Their Vulnerabilities)

Points-based airdrops:

How it works: Users earn points for actions. Points convert to tokens.

Vulnerability: Any action that gives points can be automated. We've seen bots earn 10x human rates.

Real example: A points-based airdrop gave 1 point per social interaction. Bots posted 1,000 times per day. Legitimate users posted 5-10 times. Bots got 100x the allocation.

Snapshot airdrops:

How it works: Hold tokens or NFTs at snapshot time. Receive airdrop.

Vulnerability: People borrow or buy right before snapshot, dump right after.

Real example: $5M of tokens were borrowed via DeFi 24 hours before snapshot. Airdrop received. Tokens returned. Dumped immediately.

Engagement farming:

How it works: Complete quests, join communities, interact.

Vulnerability: All actions can be scripted or outsourced to click farms.

Real example: 70% of quest completions came from Southeast Asian click farms. $0.10 per quest. Thousands of fake accounts.

Retroactive airdrops:

How it works: Reward past users who didn't know about airdrop.

Vulnerability: Low vulnerability if truly retroactive. High vulnerability if criteria is leaked.

Real example: Uniswap's airdrop worked because nobody expected it. Blur's airdrop was farmed because criteria was known.

Anti-Sybil Mechanisms That Work

After getting sybil attacked multiple times, here's what actually works.

1. On-chain behavior analysis

Look at wallet history before any airdrop announcement.

Red flags:

• Wallet created recently
• Funded by known sybil source
• Only interacted with airdrop-related contracts
• Transaction patterns match other suspicious wallets

We built a scoring system. Wallets with suspicious patterns got 0-20% allocation. Clean wallets got 100%.

Result: Reduced sybil claims by 70%.

2. Social verification requirements

Require verification that's hard to fake at scale.

Effective methods:

• Gitcoin Passport score (costs money to build reputation)
• ENS name older than 6 months
• Twitter account with real history (not just retweets)
• POAPs from physical events

Ineffective methods:

• Discord role (easily farmed)
• Twitter follow (costs nothing)
• Basic captcha (solved by farms)

3. Gradual vesting with clawback

Don't give tokens all at once. Vest over 6-12 months. Clawback if sybil behavior detected.

How it worked for us:

• 10% at TGE
• 90% vested over 12 months
• If wallet was later identified as sybil, unvested tokens clawed back

Result: Sybils couldn't dump immediately. Many didn't bother farming because ROI took too long.

4. Minimum activity thresholds

Set activity requirements that cost time or money.

Effective thresholds:

• $100+ in protocol fees generated
• 30+ days of activity before announcement
• Multiple types of actions (not just one repeated)

Ineffective thresholds:

• Any transaction counts
• Any amount of holding
• Single action repeated

5. Human review for large allocations

Anyone receiving top 10% allocation gets manual review.

We hired 3 part-time reviewers. Cost: $5,000/month. Saved: $200K+ in sybil claims.

They looked at:

• Wallet history on Etherscan
• Discord/Twitter account quality
• Quest completion patterns

Caught 80% of sophisticated sybils that automated systems missed.

Smart Contract Architecture for Airdrops

Technical implementation matters. Here's what we use.

Merkle tree distribution:

Standard approach. Generate tree of eligible addresses and amounts. Users claim by proving inclusion.

Gas efficient. Secure. Well-tested.

Libraries:

• OpenZeppelin MerkleProof
• Safe distributor contracts

Vesting with clawback:

struct Allocation {
    uint256 total;
    uint256 claimed;
    uint256 vestingStart;
    uint256 vestingEnd;
    bool revoked;
}

Owner can revoke unvested tokens if sybil detected. Already claimed tokens remain with user (avoid legal issues).

Multi-sig control:

Never single-key control of airdrop contracts. Use 3/5 or 4/7 multi-sig.

We've seen projects lose entire airdrops to compromised keys.

Claim windows:

Set reasonable claim window (90-180 days). Unclaimed tokens return to treasury.

Sybils often forget about smaller allocations. We've recovered 15-20% of airdrop through unclaimed tokens.

Distribution Strategies

How you announce and distribute matters as much as who you distribute to.

The stealth approach:

Announce airdrop AFTER snapshot. No time for sybils to prepare.

Works for: Retroactive rewards for genuine users.

Problems: Users don't know to be active. May miss real supporters.

The incentive approach:

Announce criteria. Let people farm. Accept some sybils as cost of growth.

Works for: Growing user base. Getting attention.

Problems: 30-70% goes to sybils.

The hybrid approach (what we recommend):

Retroactive: 50% of airdrop for past activity before any announcement. Prospective: 50% for future activity with strict anti-sybil measures.

Best of both worlds. Rewards genuine users. Allows growth. Limits sybil exposure.

Case Study: Airdrop That Worked

Project distributed $5M to 50K wallets. Sybil rate under 15%.

What they did right:

1. Retroactive snapshot for 60% of airdrop. Criteria never announced publicly.

2. Gitcoin Passport requirement for remaining 40%. Score of 15+ required (costs $50+ to build).

3. Linear vesting over 6 months with clawback.

4. Manual review of top 500 allocations.

5. Claim window of 120 days. Unclaimed tokens went to community treasury.

Results:

• Day 1 dump: 20% (vs 60%+ on typical airdrops)
• 6-month holder rate: 45% (vs 10-15% typical)
• Sybil rate: ~15% (vs 40-70% typical)
• Token price after 90 days: Down 30% (vs 80-90% typical)

Case Study: Airdrop That Failed

Different project. $3M airdrop. 70% to sybils.

What went wrong:

1. Announced criteria 60 days before snapshot. Gave sybils time to prepare.

2. Criteria too easy: Hold any amount of NFT + complete 3 simple quests.

3. No vesting. 100% at TGE.

4. No human review.

5. No Gitcoin Passport or similar verification.

Results:

• Day 1 dump: 65% of all tokens sold
• Token price after 7 days: Down 85%
• 30-day holder rate: 8%
• Project status: Abandoned after 4 months

The Math of Sybil Prevention

Every anti-sybil measure has a cost. Calculate if it's worth it.

Example calculation:

Airdrop value: $2M Expected sybil rate without protection: 50% ($1M lost) Cost of Gitcoin Passport integration: $10K Expected sybil rate with Passport: 20% ($400K lost) Net savings: $600K - $10K = $590K

Anti-sybil ROI:

All measures have positive ROI. Use multiple layers.

Resources

Anti-Sybil Tools:

• Gitcoin Passport - Reputation scoring
• Sismo - Privacy-preserving proofs
• Worldcoin - Biometric verification

Airdrop Infrastructure:

• Merkle Drop - Uniswap's distributor
• Safe - Multi-sig for control
• OpenZeppelin - Contract libraries

Analytics:

• Nansen - Wallet clustering analysis
• Chainalysis - Compliance and analysis
• Dune Analytics - Custom queries

Quest Platforms:

• Galxe - Credential campaigns
• Zealy - Quest platform
• Layer3 - Web3 quests

Development:

• AllThingsWeb3 - Token launch planning
• Hardhat - Smart contract development
• Foundry - Testing framework