EigenLayer threatened by Sybill attack with up to 50% fake delegations

EigenLayer, the leading re-staking protocol for Ethereum (ETH), is facing the problem of impersonation during its Season 2 airdrop. Clusters of wallets are flocking to certain validators, and are claiming more than 2B EIGEN tokens.

EigenLayer seems to have a security problem, as well as unfair distribution during its Season 2 airdrop. Analysis by Artemis shows that some delegators have received up to 50% Sybil delegations, which originate with clusters of connected wallets.

EigenLayer operates as a token-incentive protocol, awarding EIGEN for engaging with validators and staking. Yet just as in Season 1 of the airdrop back in May, some of the delegations turn out to belong to clusters of wallets.

Also Read: EigenLayer enhances EigenDA security to counter Sybil and DDoS attacks

The presence of Sybil wallet clusters takes away value from real users that use EigenLayer for ETH delegation. Instead, Sybil wallet clusters have taken away an estimated 2M EIGEN tokens unfairly, depriving the community.

EigenLayer has added whitelisting to EigenDA, but other services such as Swell or Blur readily interacted with Sybil wallet clusters. Conversely, some real users were barred from airdrop farming activities.

So far, CoinSummer is the operator with the biggest inflow of Sybil wallet activity. More than 54% of all calls and actions originate with Sybil wallet clusters. For the purposes of the airdrop, that activity is sufficient. However, EigenLayer is reneging on its promise to increase the security of Ethereum by fair delegation and staking.

@eigenlayer security at risk?

A massive Sybil attack went unnoticed, leading to 2 out of the top 15 operators receiving ~50% Sybil delegations.

Among interesting findings is a cluster of 1860 addresses.

More about estimated total 20 000 Sybil claimers in the thread ⬇️ pic.twitter.com/GxZ58Fu4Qv

— Artemis the Sybil Hunter (@artemis_rsch) July 9, 2024

Sybil wallet owners try to claim legitimacy on social media

One of the tricks of Sybil attackers is to claim they are legitimate users. In other airdrops, new social media accounts would appear to claim that the wallets from the identified cluster were actually legitimate.

However, the social media campaign was too on the nose. Deliberate messages were spread to Discord or through X reposts. The big problem was that the Sybils also went on to cash out quickly, crashing the respective reward token.

In the case of Eigen’s current airdrop season, a similar denial of Sybil wallets is expected. However, the presence of Sybils may also affect the performance of the EIGEN token. The presence of Sybils has crashed the new assets of tokenless protocols right after the launch.

Also Read: zkSync Price Drops Following Binance Listing Amid

Fortunately for Eigenlayer, there is no set deadline for the start of trading for EIGEN.

The token will hypothetically be used in a new prediction market, as a tool for consensus. Until then, Eigenlayer will still use staked or re-staked ETH as the basis for voting and consensus. The exact allocation of EIGEN tokens is also uncertain, but the expectation is that regular users will probably not receive a significant allocation. This further opens the opportunity for Sybils wallets to use bots, which try to resemble organic user behavior.

Eigenlayer loses 25% of value locked

Peak valuation has already passed for Eigenlayer. The protocol peaked at around $20B in value locked. In the past few weeks, the market correction caused that value to slide to $15B, mostly due to the lower price of ETH.

Currently, Eigenlayer counts only a few hundred daily active users. Two user spikes in May and June coincide with the most active airdrop dates. The presence of concentrated activity in the span of a few days also suggests Sybil activity. The Swell operator also shows similar activity spikes in May.

The Eigenlayer ecosystem of tokens, however, is still performing well. The tokens related to Eigenlayer are valuated at a total of more than $58B in market capitalization. That valuation may be fluctuating, and depends on a handful of top protocols, including Pendle and Ethena.

Also Read: EigenLayer on the Edge of Potential Yield Crisis

But the biggest source of value for Eigenlayer is ETH itself. The protocol still holds more than 72% of its value in direct ETH tokens, while aggregating various types of staked ETH from simpler staking protocols.

Initially, Eigenlayer carried most of its assets in stETH from LidoDAO. Since January, the share of ETH has increased continuously, potentially making the underlying protocol more secure. In the past few weeks, there is also increased stETh activity, which is much more volatile. Since June, stETH has been deposited and withdrawn with increasing frequency. That activity can also be counted toward potential airdrops.

Cryptopolitan reporting by Hristina Vasileva

Source