# **Sybil Detection and Community Analysis Report**
## **1. Introduction**
This report summarizes an analysis conducted to identify patterns among wallets that participated in a recent airdrop.
The goal was to understand how these wallets might be connected and whether some of them were created or funded by the same sources. A behavior that can indicate attempts to claim multiple rewards under different identities (Often called Sybil).
To achieve this, we used two input lists:
* **`mantle.csv`** – containing wallet addresses that received or were eligible for the Mantle airdrop.
* **`bsc.csv`** – containing wallet addresses from the Binance Smart Chain (BSC) airdrop.
Each list represents individual accounts that interacted with the airdrop.
By analyzing how these addresses were first funded and how they connect to one another, we aimed to uncover groups or “communities” of related wallets.
## **2. Methodology**
### **Data Preparation**
The analysis began by consolidating the wallet lists and preparing them for network construction.
Each address was normalized to a consistent lowercase hexadecimal format with a leading "0x" prefix.
```python
def normalise(addr: str) -> str:
addr = addr.strip().lower()
return addr if addr.startswith("0x") else f"0x{addr}"
```
Also, duplicate entries were dropped to avoid redundant nodes, and only valid hexadecimal addresses were retained.
### **Network Construction**
For each blockchain network (Mantle and BSC) we examined how every wallet was **first funded.**
In simple terms, we looked at *who sent the first transaction* that provided funds to each wallet.
This allowed us to map out a **relationship network**, where:
* Each node represents a wallet.
* Each arrow represents a transfer of funds (from the sender to the recipient).
Formally:
> If Address A’s first inbound transaction came from Address B,
an edge B → A was added to the graph, labeled "kind": "fund".
This network gives a picture of how wallets are related, especially when a single sender funds many different accounts.
And isolates external funding sources.
## **3. Clustering and Community Discovery**
After constructing the funding graphs, a Louvain community detection algorithm was applied independently to each network.
The method we applied, known as the ***Louvain algorithm*,** is widely used in social and financial network analysis.
It groups wallets into “communities” based on how closely they interact with one another.
Think of it like identifying circles of friends in a social network: even if the overall group is large, people who talk or interact more often end up in the same smaller group.
Technically:
1. The directed graph was converted into an undirected version (G.to_undirected()),
1. The partition was computed via community_louvain.best_partition(), and
1. Each node received a louvain_cluster attribute.
```python
partition = community_louvain.best_partition(G.to_undirected())
nx.set_node_attributes(G, partition, "louvain_cluster")
```
### Network Topology
Beyond the main clustering, the analysis also identified three characteristic structures within the networks:
* **Star clusters** – wallets (hubs) that fund many others (≥10 outgoing edges), potentially representing automated funders or airdrop farms.
* **Thin chains** – long linear funding sequences (wallet A funds B, B funds C, etc.), suggesting serial wallet creation patterns.
* **Tree-like structures** – funders with broad descendant networks (≥5 direct children and ≥10 total descendants).
In addition, we marked certain wallets as **“parent accounts.”**
These are addresses that:
* Sent funds to others, but
* Were not part of the original airdrop lists.
They often represent external funders or sources that might have created or activated multiple participant wallets.
By separating Mantle and BSC into their own analyses, we could compare how clusters form on each network independently.
---
## **4. Results and Visualization**
To dynamically visualize the behavior of clusters, we developed an interactive [Streamlit application](https://cmmaya-mantle-sybil-detection-streamlit-louvain-plot-eltx28.streamlit.app/). The app allows users to adjust the minimum number of members per cluster and instantly see how this affects the total number of clusters detected.
The table below compares the Mantle and BSC networks. Mantle shows fewer wallets but larger, more connected groups, while BSC has more wallets distributed across many smaller clusters. Both networks contain parent accounts (wallets that funded others outside the original list) and several star hubs, which sent funds to many addresses, indicating possible coordination or shared control.
| Chain | Total Wallets | Number of Clusters | Average Cluster Size | Parent Accounts | Large Clusters (≥10) | Members in Large Clusters (≥10) | Star Hubs (<10) |
|:-------|---------------:|------------------:|---------------------:|----------------:|---------------------:|--------------------------------:|----------------:|
| MANTLE | 307 | 36 | 20.33 | 23 | 10 | 217 | 7 |
| BSC | 401 | 92 | 9.59 | 85 | 16 | 218 | 11 |
*Fig. 1 BSC communities for a minimum cluster size of 10 members*
*Fig. 2 Largest cluster for BSC (29 members)*
*Fig. 3 Mantle communities for a minimum cluster size of 10 members*
*Fig. 2 Largest clusters for Mantle (>35 members)*
## **5. Analysis**
For each chain, we analyzed the main hubs (the center of a star or the start of a line) and checked if they are likely Exchange wallets. This helps remove large centralized actors before studying user patterns.
### **Mantle (10 hubs)**
| Cluster Number | Address | Cluster Type | Number of Members | Is Exchange |
| :------------: | :----------------------------------------- | :----------- | :---------------- | :---------- |
| 1 | 0x8080AC04B397127b501049298413C6BB330d1329 | Star | > 50 spikes | NO |
| 2 | 0x2e150ECE5448185b04571D6D65E529E2aFa58D3F | Star | 17 spikes | NO |
| 3 | 0x7e2E2aa967E0b1d9F518b55a5ded50a5784B1d5C | Star | 20 spikes | NO |
| 4 | 0x0d070963952f2fba59dd06f2b425ace40b492fe | Star | 34 spikes | YES |
| 5 | 0xb4b9a45be688032d74b0d5a63072ad047071c116 | Star | 15 spikes | NO |
| 6 | 0xc868d0ea71243f1580f934cdc59620603bf9f1f1 | Star | 12 spikes | YES |
| 7 | 0xD809688C5A1A4bd6104b74F9C79abB22a3b99dA4 | Star | 10 spikes | NO |
| 8 | 0x588846213a30fd36244e0ae0ebb2374516da836c | Tree | 6 branches | YES |
| 9 | 0xEC6CEda15421f1a6f9ae1Bb621039f1d6f748248 | Line | 11 nodes | NO |
| 10 | 0x9bff968154D9c5d3e6e8e0551AF20b2f5333cc22 | Line | 20 nodes | NO |
---
### **BSC (16 hubs)**
| Cluster Number | Address | Cluster Type | Number of Members | Is Exchange |
| :------------: | :----------------------------------------- | :----------- | :---------------- | :---------- |
| 1 | 0x8080AC04B397127b501049298413C6BB330d1329 | Star | > 50 spikes | NO |
| 2 | 0x73f5ebe90f27B46ea12e5795d16C4b408B19cc6F | Star | 11 spikes | YES |
| 3 | 0x515b72ed8a97f42c568d6a143232775018f133c8 | Star | 10 spikes | YES |
| 4 | 0xdccf3b77da55107280bd850ea519df3705d1a75a | Star | 10 spikes | YES |
| 5 | 0x8894e0a0c962cb723c1976a4421c95949be2d4e3 | Star | 10 spikes | YES |
| 6 | 0xF12F1b2023f669902CB5F9613C5b3394D4476C58 | Star | 15 spikes | NO |
| 7 | 0x1fbe2acee135d991592f167ac371f3dd893a508b | Star | 16 spikes | YES |
| 8 | 0xa180fe01b906a1be37be6c534a3300785b20d947 | Star | 14 spikes | YES |
| 9 | 0xe2fc31f816a9b94326492132018c3aecc4a93ae1 | Star | 11 spikes | YES |
| 10 | 0x29bdfbf7d27462a2d115748ace2bd71a2646946c | Star | 10 spikes | YES |
| 11 | 0x161ba15a5f335c9f06bb5bbb0a9ce14076fbb645 | Star | 16 spikes | YES |
| 12 | 0xEB2d2F1b8c558a40207669291Fda468E50c8A0bB | Star | 12 spikes | YES |
| 13 | 0x3b5a23f6207d87b423c6789d2625ea620423b32d | Star | 20 spikes | YES |
| 14 | 0xBD612a3f30dcA67bF60a39Fd0D35e39B7aB80774 | Tree | 7 branches | YES |
| 15 | 0x3c783c21a0383057d128bae431894a5c19f9cf06 | Star | 10 spikes | YES |
| 16 | 0x0bdac0661befea50e33e72cc749fcc8045c043fc | Star | 10 spikes | NO |
---
### **Filtered Clusters (after removing exchanges)**
After removing exchange hubs, Mantle keeps a larger number of active clusters (7 vs 3) and over twice the number of members (142 vs 56).
| Chain | Total Wallets | Large Clusters (≥10) | Members in Large Clusters (≥10) | Star Hubs (≥10 outgoing) |
| :----- | ------------: | -------------------: | ------------------------------: | -----------------------: |
| MANTLE | 267 | 7 | 142 | 5 |
| BSC | 245 | 3 | 56 | 2 |
*Fig. 5 Filtered clusters for Mantle (>10 members)*
*Fig. 6 Filtered clusters for BSC (>10 members)*
### **Insights**
Based on the filtered clusters:
* **Mantle** shows 142 potential Sybil members out of 267 total wallets (about **53%**).
* **BSC** shows 56 potential Sybil members out of 245 total wallets (about **23%**).
## **5. Summary**
This process helps reveal potential patterns of coordination between wallets, providing a clearer picture of how funds circulate during an airdrop.
Although the analysis does not confirm malicious intent on its own, it highlights groups that merit further review, such as those funded by the same external source or displaying similar transaction patterns.
Sign in with Wallet
Connect another wallet