- Projects like Scroll are reporting massive spamming of their GitHub repos.
- GitHub repos of tokenless crypto projects have become the new target of airdrop farmers.
- Sybil farming like this won't be rewarded with any tokens, Scroll said.
Scroll’s blockchain developers have a major headache — airdrop hunters are spamming the project’s GitHub repository with low-quality contributions, causing the team to spend valuable time filtering out the spam.
One Scroll developer said the “core team is stretched thin” and the problem could “make their lives harder.”
While Scroll’s senior researcher Toghrul Maharramov says it’s not a big problem for now, the spammed submissions continue to increase — over 1,100 issues as of the time of reporting, an increase of 300 in the last 24 hours.
“It shows that even the most noble causes in crypto — rewarding open-source software contributors — can create perverse incentives that some may choose to exploit,” Maharramov said.
Despite the incessant spamming, Maharramov said the team is on top of the situation.
“It should take a couple of hours to filter out all the spam.”
Meanwhile, the effort being put into spamming Scroll’s GitHub might all be for nought.
“If you spam out GitHub repos with typo fixes, you’re only wasting yours and our time,” Maharramov posted on X, formerly Twitter.
Next level airdrop strategies
Airdrop hopefuls have recently turned to a new meta in search of free coin: GitHub contributions.
That’s because Celestia and Starknet, the most recent project to reward early participants with airdrops, also extended its recent provisions to developers and contributors.
Developer Tom Kysar was eligible under this category and earned 1,800 Starknet tokens for a single submission on the project’s GitHub — spellcheck for a single word in Starknet’s documentation. Starknet’s token isn’t trading yet, but its pre-launch trading price puts the value of Kysar’s airdrop at $3,200.
Kysar’s success has spawned several copycats who are piling on to the GitHub repositories of tokenless projects like Scroll, hoping to register activity they hope will earn free money in a future airdrop.
“It shows that even the most noble causes in crypto — rewarding open-source software contributors — can create perverse incentives that some may choose to exploit.”
— Toghrul Maharramov, Scroll senior researcher
The allure of crypto airdrops has only grown of late, especially when recipients land five-figure dollar jackpots. Crypto users who received airdrops from dYdX, Ethereum Name Service, and Arbitrum, for example, have earned massive windfalls.
The GitHub spamming problem is only the latest in the broader Sybil airdrop farming gambit, which is already a major problem for crypto projects. Sybil farmers create multiple wallets to increase their transaction footprint on tokenless blockchains in order to scale their potential airdrop rewards.
Sybil farmers like the pseudonymous CapitalGrug claim to have made $10 million through such practices. More recently, one teenager made over $1 million from the Jupiter airdrop after farming with 9,246 wallets.
These gains can come at the expense of legitimate users in more ways than one.
Airdrops are supposed to reward early users of DeFi protocols, turning the project’s first fans into the group that shepherds the project’s next steps. Usually, these tokens are used to make proposals for changes to a project, for example.
“The goal of the airdrop should be to distribute your tokens to as many users aligned with your project as possible,” Maharramov said.
Sybils can dilute the airdrop rewards of non-Sybil actors or normal users with organic activity. Since the former is all about volume, their gains will likely be significantly higher.
The menace of Sybils forces projects to create filtering methods that can sometimes catch non-Sybil actors in their dragnet.
Christopher Whinfrey, the co-founder of crypto bridge Hop Protocol, previously told DL News that airdrop framing and the defence mechanism against malicious Sybils is “an iterative game.”
“Every time an airdrop is ‘Sybilled’ or ‘Sybils’ are filtered out, it escalates,” Whinfrey said at the time.
As such, projects have to be aware of the latest trends.
“I suspected that one of our repositories will be raided at some point, I am surprised that it took so long to happen,” Maharramov said.
Liam Kelly is DL News’ Berlin correspondent. Osato Avan-Nomayo is our Nigeria-based DeFi correspondent. Contact them at liam@dlnews.com and osato@dlnews.com.
