On July 15th, zkSync announced an official NFT airdrop for historical NFT users. The first batch of 10,000 addresses have already received the NFT. As a top trending Layer2, this sudden airdrop sparked wide discussion in the community. Many speculate: is receiving this NFT a prerequisite to being eligible for zkSync token airdrop in the future?

To find out the answer, Trusta Labs conducted an analysis on the behaviors of these lucky 10,000 addresses:

Engagement Behavior Analysis

Transaction Number

The average transaction number is 21 per user on zkSync Era. For zkSync NFT airdropped addresses: 70% >=20 transactions; 15% <=10 transactions, 690 users only had no more than 4 transactions.

Transaction Value

The medium transaction value >=44U per user on zkSync Era. For zkSync NFT airdropped addresses: 15.4% transaction value <= 50U, amongst 530 addresses less than 10U (way below average).

Gas Fee

The medium gas fee is 0.002eth per user on zkSync Era. For zkSync NFT airdropped addresses: 12.3% of them contributed less than medium value.

Active period

The average active period per user is 3.6 weeks on zkSync Era. For zkSync NFT airdropped addresses: 25% of them were active less than 3 weeks, 700 of these addresses had only been active within one week.

Special cases

1. Addresses with 0 txn but got airdropped

Three addresses had no transaction record at all on zkSync Era, which are definitely not eligible by official criteria but still got airdropped. We reckon they were official test addresses, and suggest @zkSync make a note to avoid unnecessary speculations。

Address One: 0x200ae0ab4e65bf0a80748cf4ebce814667513ba5 (https://explorer.zksync.io/address/0x200ae0ab4e65bf0a80748cf4ebce814667513ba5)

Address two: 0xa0fdb2f6cf2bf189db73b294a60088fef751bfcd (https://explorer.zksync.io/address/0xa0fdb2f6cf2bf189db73b294a60088fef751bfcd)

Address three: 0xe8bd3908c645dab3ced6b0ca75304ca3a31276c0 (https://explorer.zksync.io/address/0xe8bd3908c645dab3ced6b0ca75304ca3a31276c0)

2. Addresses with only 1–2 txn(s) and got airdropped

In this official NFT airdrop, more than 118 addresses had one single transaction throughout history, and 135 addresses only had two transactions, and they all luckily got the airdrop!

An typical address: only had one transaction 3 months ago and had remained inactive ever since, but still got NFT this time, probably because it starts with 0x0. (https://explorer.zksync.io/address/0x023444e85c568c16a4fc75707d62b75e1fef4494)

3. Clusters of addresses got NFT airdrop this time

Within the 10,000 lucky addresses, intra transactions indicated that there were clusters of addresses controlled by one master account. These clusters got NFT airdrop as well. Examples are:

Cluster one: 0x01bffc8dc41e26d98c3cef8b045726726134d1d3 transferred funds to seven other addresses. And all these eight addresses were airdropped this time.

Cluster two: five addresses had consecutive fund transfers and they all got NFT airdrop this time.

Sybil Behavior Analysis

We examined 10,000 airdropped addresses with two different methods, both indicating existence of sybil risk:

TrustScan Sybil Detection

Query addresses using TrustScan, 1,408 sybils were detected based on Ethereum and Arbitrum behaviors (14% sybil rate within this airdrop list）

1. Sybil address one: 0x014ddd8696562c105b6013b078a45a9fed0bcd75

This address lies in a large cluster of 74 accounts forming a chainlike funding network. Jan 4th, 2022, this cluster organized a serial of funding transactions within 3.5 hours, and on Apr 6th, 2023, the same cluster transferred funds through a chainlike network within 7.8hours.

2. Sybil address two: 0x0d8969db749fa22c8107ff3871e30b2da246984c

This address appeared multiple times in sybil clusters: three times on starlike funding network clusters on Ethereum and another three times on bulk operations on Arbitrum.

668 addresses had been active within only 48 hours

1. Sybil address one：0x05a450c625f31eaf736b69c7f05a9fb89db87fb0 (https://www.oklink.com/cn/zksync/address/0x05a450c625f31eaf736b69c7f05a9fb89db87fb0)

This address made all of its 104 zkSync Era transactions within 48 hours. It repeatedly deposit/withdraw the same amount, with an astonishing 9 seconds time interval between each transaction. This address is highly possible a programatic sybil.

2. Sybil address two：0x06d7101af6e75716b6d2ccbbbd6b95902ea555c7 (https://www.oklink.com/zksync/address/0x06d7101af6e75716b6d2ccbbbd6b95902ea555c7)

This address made all of its 97 zkSync Era transactions within 48 hours. It repeatedly deposit/withdraw the same amount, with extremely short time interval between each transaction. This address is also highly possible a programatic sybil.

3. Low value user: 0x0b93c68d71c807303caecacbcfec018270c6bf3 (https://www.oklink.com/zksync/address/0x0b93c68d71c807303caecacbcfec018270c6bf3b)

This address finished its all 34 transactions on zkSync Era within 48 hours, and most of these transactions had repeatedly 0 transaction amount.

Conclusion

1. zkSync ONLY considered historical NFT transactions for this NFT airdrop, and the engagement and value of the wallet address was out of their mind this time. However, many of zkSync official airdropped addresses made very limited overall contributions to the ecosystem (in terms of txn amount/number, gas fee and active time, or simply being sybils). This NFT airdrop might simply aim to fuel up NFT players and encourage NFT interactions, it’s hard to say owning this airdropped NFT equals to eligibility to future zkSync token airdrop. On the other hand, this NFT airdrop implies that zkSync might take into consideration not only simple transaction metrics but also diversity of engagement to the zkSync ecosystem in the future token airdrops.
2. Trusta will launch a new KYA (Know Your Account) product for zkSync users: it provides onchain engagement and value scoring based on multiple dimensions including monetary, frequency, age, diversity and identity. All users interacting with zkSync will be ranked accordingly. In addition the sybil risk detection by TrustScan will be emmbedded as alerts to the wallet addresses. Diverse and trending projects in the zkSync ecosystem will be handy to interact with safely. Welcome all anons to have a try.