What's Going On With Gnosis?

    Question:

    There’s been some unusual activity with Gnosis as pointed out by our community. Time to figure out exactly what’s going on.

    Take a deep dive into recent activity on Gnosis, especially recent rapid rises in the number of active users, transactions, and more. Make any hypothesis you can about what is driving this activity. Is there a new dapp that launched? Is there some incentive program going on? Or is the spike in users/txns due to some sybil attack?

    What is Gnosis?

    Gnosis ==is a protocol based on the Ethereum network that provides developers with a variety of infrastructure to launch Prediction Market applications.== Prediction markets are platforms that allow users to bet on future events. Prediction market platforms are not unlike exchanges. With the difference that users trade the probability of events instead of trading assets. The crypto community believes that cryptocurrencies can decentralize the operation of prediction markets so that global users can access these platforms. The idea behind the Nosys platform to provide market forecasting infrastructure can be explained as follows; Blockchain enables users to trade cryptocurrencies that represent the outcomes of events on the open market. Gnosis aims to provide an infrastructure for decentralized applications that can act as a prediction tool, information source and standard for predictive assets. Gnosis developers aim to create various market prediction platforms that earn their income from commissions or sales of their data.

    Version 2 of the Gnosis protocol is a completely decentralized protocol that decentralized applications and decentralized exchanges that want to provide users with features such as better price and platform protection against the phenomenon of "miner extractable value" can use version 2 of this protocol in their user interface. to use

    How Gnosis works?

    Gnosis consists of 3 main layers, and decentralized products and protocols are developed on the basis of these layers. In the following, we will tell you what the Gnosis protocol layers are and what capabilities each one has.

    Main layer:

    The core layer is the center and basis of the protocol and is where the smart contracts that enable events, conditional tokens, transaction execution and market mechanisms are located. This layer is available to users for free and open-source.

    Service layer:

    Above the main layer, the service layer is located and it is the place where services such as stable coins, chat bots and market mechanisms are built on its platform. Users of platforms usually come into contact with this layer. The development team can add the features they need to the service layer.

    Application layer:

    The application layer or program (Applications Layer) includes decentralized market forecasting programs that are built on the Gnosis platform. Some of these Prediction Market applications are developed by Gnosis itself. But a large number of these programs are launched by other developers and get their money from users.

    The Roadmap of this analysis:

    The road map of this investigation contains the following steps:

    1. First, I look at the daily count of active wallets and transactions
    2. I saw some unusual activity and spike on some dates
    3. Determine the newcomers on Gnosis network to find out the age of these wallets
    4. To make sure, investigate on success rate these high count of transactions
    5. Decide to investigate on Bot activity
      • Define bots by wallets with more than 20 transactions per minute
    6. After that dive deeper and investigate on contracts that users interacted more on the spikes of transactions.
    7. Also, find the destination address that users interacted more specially on the spiked date.
    8. Use XDAI transfer table to find out the interaction with these addresses in more detail.

    The Flipside date has been utilized to execute this analysis. The Gnosis tables specially Fact_transactions has been used to handle this analysis.

    Findings:

    By investigating on active wallets on the daily basis it can be seen that the unnormal count of wallets like 57.391 unique wallets made transactions on October 5, 2022.

    In the next step, analyze the count of transactions around October 5, 2022 and as we expected, the count of transactions jumped high too.

    But, the total and average transaction fee around October 5 had normal values.

    Also, I investigate on daily newcomers to network to find out the age of wallets and woow its the deal. A huge group of newcomers about 54.715k unique wallets joined on October 5, 2022.

    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...
    Loading...

    Findings:

    So dive into the next level of analysis:

    • After determining the huge group of newcomers on October 5, I decided to investigate the status of their transactions.
    • By analyzing the status of transactions it shown that on October 5 to 8 lots of transactions have been failed and compare to the other days its unusual.
    • Think about bots and yes exactly their are bots!
    • Find out that the activity of bots enhanced dramatically from October 5 to 8.
    • Lets go next step to identify the goal of this bots.

    Findings:

    Various methods have been adopted to find out the common features of these BOTS:

    • First of all I investigate on the contracts interacted more with these unusual activities and find out that the most used contact on these special date is 0xc38d4991c951fe8bce1a12beef2046ef36b0fa4a after searching it on Gnosis scanner find that this contract belong to AMB Rinkeby Bridge.
    • Go further and find out the destination addresses that received most of the transaction on these dates
      • 0x37efe9b31830653039edc3b212a6e1b882cd46b4: This address received about 54.136k transactions on October 5.
      • The historical record of incoming transactions for this address is here.
    • Now investigate on the type of transactions that received by this address with transfer table.
    • Find out that a very small amount of XDAI have been transferred to this address on October 5. The average amount of transferring XDAI to this address is 0.009968 XDAI.
    • Who is responsible for this activity? The  0x562a9171c251777766285e877c80e7f4cc02d165 address sent XDAI to these new wallets and they sent it to 0x37efe9b31830653039edc3b212a6e1b882cd46b4 address.
    • Final conclusion that I draw:
      • Someone wants to pump Gnosis network and make noise
      • The mentioned address wants to be pumped up
      • Maybe its just bot activity but we know that bots attack on something to made profit.
      • Future events will probably determine the cause of this incident on Gnosis more precisely.

    Useful links:

    Author:

    Credited by MZG

    Discord handle: m.zamani#0361

    Twitter handle: @GargariZamani