Blog

Technical posts on detection methodology + public retros on completed airdrops.

Posts are scheduled to drop together with the first hosted public-good deployment. Drafts are in /content/blog in the repo.

• Why 30 seconds is the tell: detecting scripted wallets via inter-tx timing

  Coming soon

  Real users transact at irregular, human-paced intervals. Sybil farms running shell scripts produce inter-tx gaps with characteristically low variance and high lag-1 autocorrelation. Here's why.

• Replicating Linea's filter: 478K agreement, 45K candidates they missed

  Coming soon

  Public retro-analysis of the Linea airdrop filter results. Aggregate-only. We agree with Linea on 478K addresses, disagree on 39K, and identified 45K candidates their filter missed.

• Why training on Trusta's labels is a trap

  Coming soon

  Every public Sybil list is itself an output of a detector. If you train on those, you inherit their false positives. We use a tiered confidence system to avoid this.

• Designing the appeals protocol

  Coming soon

  After LayerZero published their Sybil list, thousands of users complained. We built the appeal flow into the product from day one — here's the spec.