Methodology
Five-Indicator Sybil Detection Framework
1.Overview
HasciDB is a pre-computed sybil detection database covering 3,516,453 eligible addresses across 15 Ethereum L1 airdrop projects. All results are derived from the five-indicator framework validated through Delphi expert consensus (n=12) and published at CHI'26.
HasciDB provides a query interface to this database. It does not perform live on-chain analysis -- all indicator values are pre-computed from finalized Ethereum blocks. An address is classified as sybil if any single indicator exceeds its threshold (OR-logic). The number of triggered indicators (0-5) serves as a confidence measure.
2.Indicators
2.1 Operations Axis
Co-occurring transaction fingerprints within 10-minute windows
Mass wallet activation from single funder within 30-day periods
Transaction concentration in airdrop window (180-day cap)
2.2 Fund-Flow Axis
Token consolidation to single receiver within 30 days post-claim
Circular ETH flow paths (2-hop and 3-hop) with ≥80% value retention
3.Classification Rule
The classification uses single-axis OR triggering: any one indicator exceeding its threshold is sufficient. This is intentionally sensitive -- one strong behavioral signal is considered evidence of sybil activity. The dual-axis structure (operations vs fund-flow) captures both behavioral patterns and financial patterns.
4.Scoring Formula (0-100)
HasciDB adds a continuous score on top of the binary classification:
For addresses appearing in multiple projects, the aggregate score uses the maximum value of each indicator across all projects.
| Score | Level | Meaning |
|---|---|---|
| 0 | Clean | No suspicious signals |
| 1-19 | Low Risk | Some indicators approach threshold but none triggered |
| 20-29 | Medium | 1 indicator triggered, barely above threshold |
| 30-49 | High | 1 indicator significantly exceeded, or 2 triggered |
| 50-69 | Very High | 2-3 indicators triggered |
| 70-89 | Critical | 3-4 indicators triggered, severe excess |
| 90-100 | Extreme | 4-5 indicators triggered, extreme values |
5.Known Limitations
RF and DEX swaps: RF cannot detect consolidation via DEX swaps because exchange filter excludes DEX router addresses. A sybil operator who consolidates tokens through a DEX instead of direct transfer will evade this indicator.
BW first-appearance bias: BW may misclassify old wallets as "new" when first appearance is checked only within the target_txs subset rather than the full address history.
MA and NFT marketplaces: MA shows elevated trigger rates for NFT marketplace projects (e.g., LooksRare: 59.1%) because buy/sell flows through marketplace contracts resemble circular transfers.
Snapshot boundary: All data derived from finalized Ethereum blocks as of the respective project's airdrop snapshot date. Post-snapshot behavior is not captured.
Coverage: Only addresses eligible for at least one of the 15 analyzed airdrops are included. Addresses not in the eligible set cannot be queried.
6.About
Chunyang Li, Hongzhou Chen, and Wei Cai, “From Slang to Standards: Consensus-Driven Airdrop Hunter Definition as a Baseline for Cryptocurrency Ecosystem Security and Governance”, In The 2026 ACM CHI Conference on Human Factors in Computing Systems (CHI'26), Barcelona, Spain, April 13–17, 2026. [CHI'26 Program]
Chenyu Zhou, Hongzhou Chen, Hao Wu, Junyu Zhang, and Wei Cai, “ARTEMIS: Detecting Airdrop Hunters in NFT Markets with a Graph Learning System”, In The ACM Web Conference 2024 (WWW'24), Singapore, May 13–17, 2024.
Sizheng Fan, Tian Min, Xiao Wu, and Wei Cai, “Altruistic and Profit-Oriented: Making Sense of Roles in Web3 Community from Airdrop Perspective”, In The 2023 ACM CHI Conference on Human Factors in Computing Systems (CHI'23), Hamburg, Germany, 2023.