- A ZKSync user creates 21,877 wallets to exploit airdrop rewards.
- The exploit reveals significant vulnerabilities in crypto promotional strategies.
- Solutions like KYC and Worldcoin emerge as potential countermeasures.
Since the crypto industry started picking up steam, airdrops have become popular for projects to distribute free tokens to users. However, a recent incident involving a ZKSync user creating 21,877 wallets to exploit these airdrops has exposed a significant vulnerability in the system. Luckily, there are potential solutions for these types of exploits.
User Makes 21K Wallets to Collect ZKSync Airdrop Rewards
On Monday, September 11, Twitter user lingland09 exposed a sophisticated attempt to game ZKSync’s airdrop system. One user, a likely professional airdrop hunter, created 21,877 Sybil wallets to farm the rewards meant for ZKSync users.
The exploit started with the individual funding each wallet with small amounts of ether. They then deployed a closed-source token Gemstone ($GEM) on zkSync. Using a self-made decentralized exchange, they artificially boosted the token’s value, trading and profiting from these wallets.
Automated by a bot, the transactions were designed to mimic genuine trading patterns, making detection challenging. Despite limitations in tracing tools, Lingland09 identified 10,000 wallets linked to this scheme, highlighting the need for enhanced security in crypto platforms.
Why ZKSync’s Airdrop Exploits Are a Problem
The primary motivation behind the exploit is straightforward: profit. By creating 21,877 wallets, the individual aimed to claim a significant share in the upcoming zkSync airdrop.
Airdrops are a promotional strategy popular among crypto projects. Airdrops aim to drive adoption and reward loyal users by distributing free tokens to wallet holders. The process is similar to a “sample giveaway” in traditional marketing, aiming to attract and engage potential users.
zkSync, a Layer 2 scaling solution, utilizes airdrops as an incentive mechanism to promote trading on its platform. By offering free tokens, zkSync encourages users to engage with its platform, test its features, and experience its benefits firsthand.
Sponsored
However, when individuals exploit this system, it disrupts this cycle. Instead of a broad distribution that reaches many potential users, the rewards are concentrated in the hands of a few, or in this case, one individual with multiple wallets.
This diminishes the effectiveness of the airdrop as a promotional tool and poses risks to the platform’s tokenomics and overall trustworthiness.
The zkSync exploit is far from the only such case. High-profile figures in the crypto world have been called out for similar tactics. Notably, on May 1, 2023, Binance CEO Changpeng Zhao called out Tron Founder Justin Sun for using multiple accounts to farm SUI token rewards on Binance.
Solution to Airdrop Scams: KYC, Worldcoin, or Something Else?
Cases like the zkSync exploit highlight the need for more robust identity verification mechanisms. However, there are some potential solutions, each with its benefits and drawbacks.
Know Your Customer (KYC): Traditional finance (tradFi) relies on KYC processes to verify the identity of its users. Implementing stringent KYC procedures in the crypto space could be one way to ensure that airdrop rewards are distributed fairly. However, this clashes with the decentralized nature of crypto and comes with serious privacy concerns.
Worldcoin: Crypto projects such as Worldcoin offer alternative solutions. The project proposes scanning the irises of every individual to generate a unique proof of identity, serving as a “digital passport.” This biometric approach aims to differentiate between genuine users and malicious bots, ensuring a fair distribution of tokens. However, using sensitive biometric data for verification comes with its risks of misuse.
Personhood Oracles, and more: On July 24, following the launch of Worldcoin, Ethereum founder Vitalik Buterin suggested various alternatives to its biometric model. For one, he proposed “personhood oracles” – communities that can verify the uniqueness of individuals. Another proposal is hardware-backed solutions, where multiple parties must agree on a person’s uniqueness, reducing the risk of system abuse.
All of these proposals come with their unique challenges. However, the crypto industry must develop a way to ensure airdrops reach their intended audience, not just a handful of exploiters.
On the Flipside
- The crypto community is often torn between the principles of decentralization and the need for security. Striking the right balance is crucial to ensure user trust and platform integrity.
- Introducing rigorous identity verification mechanisms could deter potential new users from joining the platform.
Why This Matters
Understanding the vulnerabilities and potential solutions in the airdrop landscape is crucial for crypto traders. As the zkSync incident illustrates, a single exploit can have far-reaching implications, affecting tokenomics, user trust, and platform reputation.
Read more about the pros and cons of biometrics in crypto:
Vitalik Buterin on Worldcoin: What Are the Risks and Alternatives?
Read more about the latest scam plaguing Solana’s discord:
Beware: Solana’s Discord Channels Under Attack By Scammers
