You stop farmers by making each fake wallet cost more than the allocation it can win, using several independent filters rather than one detection pass. A sybil attack is one operator posing as many users to collect more than one share. Farms run thousands of wallets, and they follow your published rules exactly.
The best public benchmark is Linea. Nansen reviewed 1,297,203 addresses and flagged 516,960 of them, 39.85 percent, as sybils, leaving 780,243 eligible. Its first pass flagged 50.45 percent before thresholds were relaxed to avoid hitting legitimate users with several wallets. Detection is a threshold decision, not a truth. Whoever runs it is choosing how many real users to sacrifice, and you should be in that conversation.
Layer four kinds of filter:
- Wallet clustering. Group wallets funded from the same source, moving in lockstep or repeating identical small transactions. Nansen’s Linea work targeted clusters of roughly 20 connected wallets. Skip it and one operator walks off with a share meant for hundreds of users.
- Time and thresholds. Require activity spread across weeks, plus minimum scores that are easy for a real user and expensive to repeat across many wallets. A wallet that has to look human for 60 days costs far more than one that has to look human for an afternoon.
- Proof of personhood. Ask for credentials that are cheap for one person and expensive for a farm. Gitcoin Passport now runs as Human Passport after Holonym acquired it, with more than 2 million users reported. Expect a share of real users to drop out at this step, and size the reward to justify it.
- Self-report and appeals. Give farmers a way out and real users a way back. In May 2024, LayerZero offered sybils 15 percent of their intended allocation if they self-reported within 14 days, and paid bounty hunters 10 percent of any sybil allocation they exposed.
Scoring design is a filter too. On Incentiv’s testnet, Surgence built an XP system that grew logarithmically, so the hundredth repetitive action earned far less than the first. Bots lost their edge without a single wallet being banned. The Incentiv case study covers the badge, streak and referral-tier mechanics around it.
Filters protect the budget. They do not create retention. The wallets that survive still qualified by doing whatever you counted, so count behaviour you want after launch.
Planning a points season or airdrop and not sure your eligibility rules will hold up? Book an intro call with Surgence Labs and we will review the rules before you publish them.