As Airdrops Continue to be a Challenge, Reputation-based Proof-of-Value May Bring Hope

Introduction Berachain recently concluded a highly anticipated airdrop for testnet users, distributing BERA tokens based on various participation categories such as testnet activity, RFA, community engagement, Twitter, and Discord. However, despite the best efforts of the team, inconsistencies in the distribution process have cropped up and some real contributors have missed out. This research highlights a specific case where a high-ranking testnet participant, Moroz, did not receive the expected airdrop, despite significantly higher engagement than another wallet that did receive the allocation. Further investigation reveals potential exploitation patterns and suggests that airdrop farming strategies may have been used to game the system. The Moroz Case: A Clear Discrepancy Moroz's tweet (link) Moroz’s Activity & Missing Airdrop Wallet Address: 0xe6666cd611439a9a3500e8c0e14670dfbb5027c5 Testnet Activity: Described by Moroz (link) Total Transactions: 1,500+ (link) BGT Farmed: 10,000+ BGT Validators Delegated: 200+ DApps Used: Nearly all available testnet dApps Airdrop Received: 0 BERA for testnet category Total Airdrop Breakdown: verify at checker.berachain.com RFA: 512.22 BERA Ecosystem: 337.98 BERA Twitter: 425.12 BERA Discord: 413.22 BERA A Lower Ranked Wallet That Received Testnet Airdrop Wallet Address: 0x13aa4fb6f83045927fb9e21f355738fda2ece61f Testnet Activity: Total Transactions: < 380 (link) Airdrop Received: 348.048 BERA for testnet category Total Airdrop Breakdown: verify at checker.berachain.com RFA: 5.94 BERA Testnet: 348.048 BERA Ecosystem: 36.514 BERA This discrepancy suggests that the airdrop distribution may not have been solely based on genuine testnet engagement. Identifying Airdrop Exploitation Patterns Further investigation into the wallet 0x13aa4fb6f83045927fb9e21f355738fda2ece61f and similar addresses revealed suspicious patterns linked to a known airdrop farming operation. Master Airdrop Farmer & Exploitation Strategies Primary Wallet Identified: 0xd5C342AcBEedeF81Ab8e6072323bfDa76172D05F Observed Farming Techniques: Mass Wallet Farming: Creation of numerous wallets interacting minimally with the testnet to qualify for rewards. Middleware Contracts for Fund Forwarding: Transactions were routed through multiple intermediary addresses to obscure the true source. Example Transaction Flow: Wallet A → Middleware 1 → Middleware 2 → Master Wallet Private Key Exploitation: Scraping GitHub repositories for exposed private keys. Claiming airdrops using compromised wallets before the rightful owners. Suspicious Transactions Supporting This Theory Example 1: Wallet (bot/victim)0xeBd95358C748Ca384078f8cfF16170bb45270711 → (middleware)0xDEb81c441c1793BFD649A4C85e8683304939D1f3 → Master Wallet Transaction Link 1 Transaction Link 2 Current Holdings of Master Wallet Total BERA: 329,614.32 BERA as of 7th Feb 2025. List of Additional Master Airdrop Farmer wallets (not limited to these) 0xf8B4256122369C48EB8c3d901875d62458a675e8 0xf89d7b9c864f589bbF53a82105107622B35EaA40 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 many more.... Potential Solutions Reputation-Based Airdrop System (zerufinance): Track user wallet creation history and link them to their primary wallet address. Reward wallets based on actual value-generating transactions by looking at their reputation score. Discourage mass wallet farming and script-based interactions. Few ways to find airdrop farming master wallets Go to https://berascan.com/accounts Look for accounts with large number of txs Look for those accounts which has lot of IN txs compared to OUT, example 1000:1 ratio, (although this pattern will change after some time) Look for partern I showed in the above example to find the middleware contracts and victims/bots. Value being sent by each bot seems very less but when enough of these bots, the value is significant. Conclusion The case of Moroz’s missing testnet airdrop reveals significant challenges faced by protocols in their distribution methodology. More concerningly, a pattern of airdrop farming through middleware contracts and mass wallet creation suggests that malicious actors may have exploited the system to unfairly claim rewards. For airdrops to be fair and sustainable, future distributions must prioritize: Reputation-based validation over raw transaction counts. On-chain verification mechanisms to prevent farming abuses. Without addressing these issues, legitimate users will continue to be sidelined while airdrop farmers profit from the loopholes in the system.

Feb 9, 2025 - 18:50

As Airdrops Continue to be a Challenge, Reputation-based Proof-of-Value May Bring Hope

Introduction

Berachain recently concluded a highly anticipated airdrop for testnet users, distributing BERA tokens based on various participation categories such as testnet activity, RFA, community engagement, Twitter, and Discord. However, despite the best efforts of the team, inconsistencies in the distribution process have cropped up and some real contributors have missed out.

This research highlights a specific case where a high-ranking testnet participant, Moroz, did not receive the expected airdrop, despite significantly higher engagement than another wallet that did receive the allocation. Further investigation reveals potential exploitation patterns and suggests that airdrop farming strategies may have been used to game the system.

The Moroz Case: A Clear Discrepancy

Moroz's tweet (link)

Moroz’s Activity & Missing Airdrop

Wallet Address: 0xe6666cd611439a9a3500e8c0e14670dfbb5027c5
Testnet Activity: Described by Moroz (link)
- Total Transactions: 1,500+ (link)
- BGT Farmed: 10,000+ BGT
- Validators Delegated: 200+
- DApps Used: Nearly all available testnet dApps
Airdrop Received: 0 BERA for testnet category
Total Airdrop Breakdown: verify at checker.berachain.com
- RFA: 512.22 BERA
- Ecosystem: 337.98 BERA
- Twitter: 425.12 BERA
- Discord: 413.22 BERA

A Lower Ranked Wallet That Received Testnet Airdrop

Wallet Address: 0x13aa4fb6f83045927fb9e21f355738fda2ece61f
Testnet Activity:
- Total Transactions: < 380 (link)
- Airdrop Received: 348.048 BERA for testnet category
Total Airdrop Breakdown: verify at checker.berachain.com
- RFA: 5.94 BERA
- Testnet: 348.048 BERA
- Ecosystem: 36.514 BERA

This discrepancy suggests that the airdrop distribution may not have been solely based on genuine testnet engagement.

Identifying Airdrop Exploitation Patterns

Further investigation into the wallet 0x13aa4fb6f83045927fb9e21f355738fda2ece61f and similar addresses revealed suspicious patterns linked to a known airdrop farming operation.

Master Airdrop Farmer & Exploitation Strategies

Primary Wallet Identified: 0xd5C342AcBEedeF81Ab8e6072323bfDa76172D05F
Observed Farming Techniques:
1. Mass Wallet Farming:
  - Creation of numerous wallets interacting minimally with the testnet to qualify for rewards.
2. Middleware Contracts for Fund Forwarding:
  - Transactions were routed through multiple intermediary addresses to obscure the true source.
  - Example Transaction Flow:
  - Wallet A → Middleware 1 → Middleware 2 → Master Wallet
3. Private Key Exploitation:
  - Scraping GitHub repositories for exposed private keys.
  - Claiming airdrops using compromised wallets before the rightful owners.

Suspicious Transactions Supporting This Theory

Example 1:
- Wallet (bot/victim)0xeBd95358C748Ca384078f8cfF16170bb45270711 → (middleware)0xDEb81c441c1793BFD649A4C85e8683304939D1f3 → Master Wallet
- Transaction Link 1
- Transaction Link 2

Current Holdings of Master Wallet

Total BERA: 329,614.32 BERA as of 7th Feb 2025.

List of Additional Master Airdrop Farmer wallets (not limited to these)

0xf8B4256122369C48EB8c3d901875d62458a675e8
0xf89d7b9c864f589bbF53a82105107622B35EaA40
0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23
many more....

Potential Solutions

Reputation-Based Airdrop System (zerufinance):
- Track user wallet creation history and link them to their primary wallet address.
- Reward wallets based on actual value-generating transactions by looking at their reputation score.
- Discourage mass wallet farming and script-based interactions.

Few ways to find airdrop farming master wallets

Go to https://berascan.com/accounts
Look for accounts with large number of txs
Look for those accounts which has lot of IN txs compared to OUT, example 1000:1 ratio, (although this pattern will change after some time)
Look for partern I showed in the above example to find the middleware contracts and victims/bots.
Value being sent by each bot seems very less but when enough of these bots, the value is significant.

Conclusion

The case of Moroz’s missing testnet airdrop reveals significant challenges faced by protocols in their distribution methodology. More concerningly, a pattern of airdrop farming through middleware contracts and mass wallet creation suggests that malicious actors may have exploited the system to unfairly claim rewards.

For airdrops to be fair and sustainable, future distributions must prioritize:

Reputation-based validation over raw transaction counts.
On-chain verification mechanisms to prevent farming abuses.

Without addressing these issues, legitimate users will continue to be sidelined while airdrop farmers profit from the loopholes in the system.