Aptos Airdrop Analysis
A Safe, Scalable, and Upgradeable Web3 Infrastructure
— — Aptos White Paper
We were commissioned by the community to perform on-chain data analysis during the launch of the Aptos public chain mainline, and we got the permission from the community to disclose data analysis related to the airdrop.
Terminology explanation
Witch behavior: A witch attack (Sybil Attack) means an attack that mimics multiple identities, which can be simply understood as a witch attacker controlling many accounts with false identities aiming to illegally gain some power and benefit by pretending to be the real unique user.
On October 18, 2022, 22:50 UTC, the Aptos Foundation announced an airdrop of APT tokens to 2 types of participants, participants running the Incentive Test Network Node and users minting the Test Net NFT (APTOS: ZERO). According to statistics, more than 110,000 community participants were expected to receive over 20 million APT tokens in total.
Data Overview
Snapshot start block number: 1,040,000
Snapshot end block number: 4,000,000
Snapshot start time: 2022–10–18 19:02:11 (UTC)
Snapshot end time: 2022–10–27 09:58:50 (UTC)
Airdrop vault address: 0x9c5382a5aa6cd92f38ffa50bd8ec2879833997116499cc5bcd6d4688a962e330
Airdrop contract address: 0xcf8a27bb49491e65ad2ce1c48c098473e3340f45ed5a267a0d3ad8ee3eee5e35
Total number of airdrop tokens: 21,393,900 APT
Number of airdrop pickups: 111,806
Number of airdrop collection addresses: 111,718
Faucet vault addresses: 251 address collections
Number of Faucet pickups: 980,913
Airdrop basic situation analysis
1. Airdrop Vault Funding
Aptos officials used two addresses (215f and 11be) to inject a total of 22,500,600 APT into the airdrop vault (e330) during the airdrop season.
The first injection of 300 APT on 2022–1–18 20:31:07 and the last injection of 6,500,000 APT on 2022–10–19 06:13:54 are shown in Figure 1. The 300 APT injected on 2022–10–18 20:37:15 was suspected to be a test of the airdrop function, collected from 11be and then transferred to the vault, combining with the data analysis, the actual amount Aptos officially injected to the airdrop vault was 22,500300 APT.
2. Daily Airdrop and Faucet Collection Trends
The trend of daily airdrop and Faucet collection is shown in Figure 2, with the blue bar indicating the number of test network NFT (APTOS: ZERO) involved in, and the green bar indicating the number of running incentive test network nodes involved in, and the line graph indicating the number of Faucet collection. The number of airdrops and the number of Faucet collected reached the peak on Oct. 19 (NFT: 63,408, Node: 25,959, Faucet: 558,690), and the number of airdrops that day accounted for 80% of the total airdrops, after which the trend reversed.
3. Percentage of airdrop types
Due to the high threshold of running incentive test network node regarding both the node building and identity verification, the number of airdrop-receiving eligibility is much lower than the test network NFT (APTOS: ZERO). The ratio of the two airdrop types is about 3:7. Among them, 30,820 airdrops were received for the incentive test network node type and 80,986 airdrops were received for the Test Network NFT (APTOS: ZERO) type.
4. Airdrop traffic destination and exchange correlation analysis
After 3 rounds¹ of tracking the flow of funds sent from the airdrop vault, it was found that about 87% of the airdrop funds went to exchanges, with the exchange of 9c70² accounting for about 66 % of the total airdrop funds. Only 13 % of the airdrop funds stay on the chain.
5. Airdrop and Faucet Collection Analysis
Using the Aptos airdrop contract trigger fee for new users as a baseline, a combination of Faucet and airdrop pickup data analysis revealed behaviors suspected witchcraft. Of these, there were 901,576 Faucet claimed but not airdrops, accounting for 91.91% of the total number of Faucet claimed; 32,654 airdrops were claimed but no Faucet, accounting for 29.21% of the total number of airdrops claimed.
6. Percentage of Witch behavior and real users
Through an in-depth analysis of all airdrop and Faucet pickup addresses, combined with the correlation analysis of airdrop pickups and fund flow to exchanges, the number of real user addresses³ in this airdrop season was about 54,377, accounting for no more than 50% of total airdrop-pickup addresses; the number of real user addresses for Faucet pickup is about 214,927, accounting for only 20% of the total Faucet pickup addresses. The data shows that there were a lot of witch behaviors in both airdrop and faucet, with the Faucet more serious.
Witch behavior analysis
Through deep tracking of airdrop fund flow, some addresses were found to perform a temporary pooling operation in the second round⁴. After excluding exchange addresses, the pooling situation of these addresses was analyzed.
Addresses listed in Table 1 are the top 10 addresses⁵ in terms of the number of times that received pooling fund from airdrops; accordingly, Table 2 shows the top 10 addresses in regard to Faucet.
- Airdrop flow of Witch behavior and exchange correlation analysis
The comprehensive analysis of the aggregation addresses reveals that the funds from witch acts eventually flow to the exchanges, and the Figure 7 below shows the journey of those funds from the vault to the aggregation⁶ addresses and then to the exchanges.
2. Faucet Witch Behavior Money Flow and Exchange Correlation
Figure 8 below shows the flow of funds from the Faucets to the aggregation addresses and then to the exchange.
Note 1: 3 rounds of tracking. Round 1: e330 — User 1, Round 2: User 1 — User 2, Round 3: User 2 — User 3. e330 indicates the address of the airdrop vault, User 1 indicates the user who received the transfer from e330 (airdrop), User 2 indicates the user who received the transfer from User 1, and User 3 indicates the user who received the transfer from User 2
Note 2: After desensitization of the exchange information, the exchange identifier is exchange_ plus the last 4 bits of the address.
Note 3: After in-depth analysis, no address set with an attribution status is found.
Note 4: Transferring funds from multiple addresses receiving airdrops to the same address, which does not belong to the exchange.
Note 5: Address information after desensitization.
Note 6: Wool_cb0e: indicates addresses ending with cb0e; Wool10_9c70: indicates the set of addresses sent to Exchange_9c70 times less than or equal to 10, Wool20_9c70: indicates the set of addresses sent to Exchange_9c70 times greater than and less than or equal to 10, Wool50_9c70: Indicates the set of addresses sent to Exchange_9c70 times greater than 20 and less than or equal to 50.
