🧵2/5
🚨 SybilAdvanced – turning Sybil games into inequalities
Goal: detect "one actor, many wallets" patterns on a token θ (fake distribution, routed exits, pre-rug setup).
1⃣ Fixed-Amount Sybil (SELL side)
We look at sells S = {sᵢ} with sᵢ.TokenIn = θ and sᵢ.AmountIn ≥ 1.
We group by rounded size A* = round(sᵢ.AmountIn, 6).
If a group G has
– distinctWallets(G) ≥ 8
– Δt(G) = t_max − t_min ≤ 300 s
many wallets, same size, same short window… intriguing.
2⃣ Hub Funnel
Transfers F = {fᵢ} with fᵢ.TokenOut = θ are grouped by hub h = TargetWallet.
In any 600 s window W ⊂ F(h), if |sourceWallets(W)| ≥ 5 and the hub or its sources sell θ within 3600 s, we mark a strong funnel.
No sells yet ⇒ pre-rug setup flag.
3⃣ Chain Sybil (buy → hops → sell)
Start from a buy of amount A₀ on θ, then follow transfers and a final sell with volume preserved inside a band:
RelDiff(a, b) = |a − b| / ((a b)/2) ≤ 0.35
and total duration ≤ 3600 s.
If the path spans ≥3 wallets and keeps (almost) the same bag size, it’s a Sybil attack: routed exit instead of a simple degen sell.