Sybil surge of identical-pattern transactions
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when multiple new EOAs — accounts with no prior transaction history or with very low nonces — submit identical or near-identical transaction patterns to the protocol within a short time window (default: 10 or more new addresses within 15 minutes with the same function selector and similar calldata). The signal is generated by clustering new-address transactions and flagging when the pattern diversity falls below a configurable threshold. Category 6 context: sybil transaction surges are a setup pattern for certain exploit classes — particularly airdrop farming attacks and coordinated pool-manipulation setups.
Why it matters
Rhea Finance NEAR ($18.4M, April 2026) provides the clearest documented example of coordinated multi-wallet exploit setup: 423 wallet fan-out seeded fake liquidity pools, with the oracle accepting spot prices from these newly seeded pools to enable fake-token borrowing. The pattern of many new wallets performing identical transactions is a structural signature of this attack class. Sybil patterns are also documented in flash-loan amplified governance attacks where multiple wallets are used to distribute voting power before consolidation. The signal is P2 due to the high computational cost of real-time clustering across all new addresses.
Green / Yellow / Red
Green is the baseline when new-address transaction patterns are diverse and distributed across different function selectors and calldata values. Yellow fires when a moderate cluster (five to ten) of new addresses submits identical transactions within a short window — plausibly a bot farming but worth monitoring. Red fires when ten or more new addresses submit identical transactions within 15 minutes, particularly if the transactions involve liquidity provision to the same pool or approval of the same contract.
Common gray cases
Gray applies during protocol launches or major incentive events when legitimate sybil-adjacent behavior (airdrop farming) creates high false positive rates for this signal.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect multiple new EOAs submitting identical transaction patterns within a short window (sybil setup pattern).