On Friday afternoon, decentralized finance (DeFi) users discovered that a researcher for Divergence Ventures, a crypto venture firm, was receiving
On Friday afternoon, decentralized finance (DeFi) users discovered that a researcher for Divergence Ventures, a crypto venture firm, was receiving hundreds of ETH from wallets selling recently-airdropped RBN tokens – a sign of an airdrop exploit that Divergence later admitted to.
The episode presents the largely unregulated, permissionless DeFi community with yet another chance to debate the nature of fair play in an increasingly powerful, $200 billion-dollar ecosystem where the only governance is on-chain rules and some modicum of common sense.
“Airdrops” are a token distribution method that allows users to claim tokens if they’ve completed certain actions or fulfill other parameters, such as having deposited into a vault or participated in a project’s governance.
In Friday’s exploit, the Divergence researcher allegedly used dozens of wallets to fulfill bare-minimum parameters to claim $2.5 million in RBN tokens – an exploit that some have labeled a sybil attack on the distribution.
this @divdotvc analyst @_bridgeharris has made 652 $ETH and counting from @ribbonfinance airdrops, quite impressive. finding wallets like their's and copytrading them is probably the best way to make it tbhhttps://t.co/vqC1LjyfT3
— Gabagool.Ξth 🥀 (@gabagooldoteth) October 8, 2021
The crypto community responded with ire, noting that Divergence is an investor in Ribbon and speculating that the researcher may have successfully gamed the distribution using insider information. A Ribbon community manager denied these allegations.
Divergence has since published a tweet thread acknowledging the sybil attack in which they said they “crossed a line” and said they would be “better contributors to the community going forward.”
They’ve also sent the ETH back to the project’s treasury, and the Ribbon community is now debating what to do with the funds.
1/6@_bridgeharris is a brilliant young woman new to crypto and still in college. Don't drag her, drag us (@glambeth94 @cjliu49) we run Divergence, and we've been in the space for many years.
We realized that in sybil-ing the $RBN airdrop, we crossed a line. A few notes:
— Divergence Ventures (@divdotvc) October 8, 2021
A Ribbon Finance representative declined to comment. Divergence Ventures did not respond to a request for comment by press time.
The airdrop exploit was first flagged by pseudonymous self-described “ex-academic” Gabagool.eth. In an interview with CoinDesk, he said that the episode is a prime example of a nascent ecosystem still trying to determine the rules of the jungle.
“There are rules we enforce socially, and this is an important example of that playing out,” Gabagool said. “Divergence responded in a few hours and returned 705 ETH because an anon with a Sopranos joke as a name tweeted an analysis? That is the opposite of ‘code is law.’ That’s community law, and I don’t think that’s a bad thing – we’re making up the rules as we go along.”
Due diligence
Gabagool told CoinDesk that he spotted the exploit as a result of his day-to-day research. He’d bought Ribbon tokens pre-launch from a friend and was doing due diligence after adding to his position on Friday.
“Today I bought Ribbon in size, so I was looking at the Uniswap v3 pool, checking out some of the wallets buying and selling Ribbon,” he told CoinDesk. “I was curious, primarily to find out what people were doing with their airdrops.”
He said that he noticed a 17 ETH sale by “happenstance,” a sale whose proceeds were subsequently sent to another wallet. The new wallet, he noted, was funded with ETH that “all came from wallets that had received a Ribbon airdrop and sold a Ribbon airdrop.”
The parent wallet also linked to a wallet containing bridget.eth – an Ethereum name service domain that identified the owner as a Divergence Ventures researcher.
“Crypto people are very good at opsec, but ENS is a weak point,” he cautioned.
Initially Gabagool reached out to Divergence Ventures’ Calvin Liu to compliment his firm on the windfall, but another friend tipped him off that Divergence was actually an investor in Ribbon – a sign that they may have been acting on insider information.
“That’s when I sent my tweet, because I said, ‘That’s interesting, a fund that’s invested in this protocol has a rogue analyst or is doing something people won’t like,’ based off what I know about crypto.’”
Worse than it looks
Gabagool told CoinDesk that, despite appearances, he leans towards believing that there was no insider information at play.
“I tend to land on the side of trusting [Ribbon Finance community manager] Julian Koh, but that’s purely my gut. The way Julian responded to this seems pretty above the board,” he said.
There was a lot of speculation of insider information between team and investors, but I'd like to clarify what we did and did not disclosehttps://t.co/4KbEdo331l
— Julian 🤹 (@juliankoh) October 8, 2021
Gabagool also noted that the farming…
www.coindesk.com