For those who are trying to take advantage of airdrops, there are two most important things. The first is which project to choose, and the second is how to avoid being screened by witches. The former prevents a lot of meaningless work and provides a chance to get higher returns, while the latter avoids the risk of returning empty-handed.

Judging from the current airdrop market, most people choose projects based on high financing amounts. As long as it is a high-financing project, they will keep an eye on it and jump in as soon as there is a slight opportunity. Therefore, the difficulty of selecting projects is becoming smaller and smaller, and more emphasis is placed on witch screening.

In short, a witch attack is a method of attacking using a group of fake accounts. In airdrops, it means that one person uses multiple accounts to interact to complete tasks and finally gets a huge airdrop. Early airdrop project parties basically did not pay attention to witches. For example, uniswap, as long as all users on the chain interact, there will be UNI token airdrops. Later, 1inch did not add witch detection, but since 2021, many projects have begun to use KYC and other methods to set thresholds in order to prevent users from having multiple accounts. KYC was still very useful in the early stage, but then the KYC merchants in the market were flooded. Some people used Southeast Asian KYC identities to do real-name authentication, thereby providing services to some users with multiple accounts, making KYC something that can be done as long as money is spent.

The emergence of KYC is on the one hand to prevent one person from having multiple accounts, and on the other hand there are also concerns about project compliance. However, from the current point of view, some large projects such as UNI, DyDx, ENS and OP do not have KYC, but witch detection has become popular.

How to detect witches

There are many ways to detect witches, and different projects have different rules. But in general, witch detection can indeed screen out some large numbers of wool parties, but it cannot be completely eliminated because it is a process of mutual confrontation. Both the tester and the tested are constantly upgrading their methods, which makes the threshold for witch detection higher and higher. Ultimately, only a few people can persevere, and most people may be eliminated in the future.

Generally, witch detection is mainly divided into web page detection and on-chain behavior detection. For example, the project party collects information on the web page or downloads identification information files to the user's machine, or directly collects the user's IP address. Of course, these can be cracked, such as users installing virtual machines locally, or using fingerprint browsers, using residential IP proxies to circumvent this part of the detection, making themselves more like an ordinary real user.

On-chain behavior detection is mainly based on the interaction characteristics of wallets. For example, if the project team finds that a batch of wallets are interacting at a certain time, they will analyze these wallets separately to find their patterns and connections. After final confirmation, these wallets will be directly banned to avoid the situation where one person has multiple accounts. In addition, they can check the fund transfer process between similar related wallets for query. In addition, some can even distinguish between script interaction and manual interaction.

On-chain behavior detection is a relatively advanced detection method. Generally, freeloaders use scripts/group control/API to improve the efficiency of interaction. After all, hundreds or thousands of accounts can complete the operation tasks within a few minutes with just a click of the mouse, without having to deal with each wallet one by one. This also saves a lot of time and energy, but it will also leave a lot of loopholes on the chain, which will be banned by the project party.

Therefore, some freeloaders may upgrade their accounts manually to interact with each other. Of course, this method does increase the difficulty of detecting witches, but it also increases the cost of freeloaders (including time and labor costs). Therefore, they are likely to be reversed and suffer losses. In addition, hiring people also introduces external risks, which increases the probability of private keys being stolen.

How to do it

Although anti-witch is theoretically feasible now, it is also disadvantageous to the project, because the more interactions on the chain, the better the data that the project party can show to investors, and their project valuation will naturally increase, thus having the opportunity to raise more money. Although the wool party exists, it also has a positive role in promoting the project, which is also a tacit secret of everyone. Therefore, it is not good to kill the wool party, but it may produce disadvantages, such as some negative impressions (it is easy for people to think that the project party has no vision, etc.).

In other words, most of the wool-gathering parties that have been banned at present either have poor skills and are easily exposed, or they have a large amount of money. The project party is unlikely to ban ordinary people who have two or three accounts. For example, the author has 6 accounts that received airdrops in this arbitrum, and these accounts were operated on the same computer, without using fingerprint browsers, group control, etc., and scripts. The IP address is also the same, and the account is normal in the end. This also shows from the side that the official will not strictly ban ordinary users with a small number of accounts.

At the same time, this also shows that the quantitative change of wool pulling has begun to change to qualitative change. The previous extensive method is no longer feasible. Specializing in two or three accounts may become a normal situation. Although there will be no sudden wealth, there is also a chance to get a considerable income. At the same time, wool pulling also needs to bear the corresponding risk of being reversed. Some small-scale project parties may even give people an illusion, so that wool parties pay a lot of expenses for this. After these factors are added together, the entire market will gradually get rid of the myth of "low risk and high return", and eventually gradually return to normal. The threshold of wool pulling itself is relatively low. If wool pulling is regarded as a long-term full-time job, it may not be a good strategy for some time in the future. However, in the short term, the airdrop market still has certain opportunities and prospects.