GNOSIS: What’s going on?

Gnosis Chain is an EVM based Ethereum sidechain (L2 chain).

Gnosis Chain (known as xDAI) is a blockchain compatible with EVM (Ethereum) designed to enable faster and cheaper transactions, providing greater stability, scalability and availability to ‘Community Labs' iBS blockchain services platform

There’s been some unusual activity with Gnosis as pointed out by our community. Time to figure out exactly what’s going on.

Take a deep dive into recent activity on Gnosis, especially recent rapid rises in the number of active users, transactions, and more. Make any hypothesis you can about what is driving this activity. Is there a new dapp that launched? Is there some incentive program going on? Or is the spike in users/txns due to some sybil attack?

\n

Methodology

In this dashboard, we’re gonna dive in some metrics to find out what caused the recent spike on the Gnosis Chain.

The metrics are divided into three parts:

• Transactions: Daily Average TPM, Daily Success rate, Daily Average TPM vs Failed TPM, Total Number and Volume of Transactions

• Users: Daily total active and new users, active users categorized based on TXN

• Net Flow and GAS: XDAI Net Flow, Average, Cumulative Average and Total GAS used

• All data analysis is based on Flipside data.

• The date range is considered from 45 days before up until now (October 17th).

Transactions

Users

Observations:

We can see 2 big spikes on our date range, one on September 27th and 28th, and the bigger one which is what we’re analyzing, is on October 4th and 5th. So I narrowed down to see the which addresses were mostly the destinations.

Interestingly, on the the given days, most of the transactions were failed.

The address 0xc38D4991c951fE8BCE1a12bEef2046eF36b0FA4A which was the destination target of more than 540K transactions on the spike date, belongs to AMB Rinkeby Bridge. All of them failed and no volume of XDAI were bridged.

Net Flow, GAS

Observations:

• As we saw in the previous sections, most of the transactions failed and didn’t use any Gas, so it’s not a surprise to see that total Gas Used on the spike date were almost in a normal range.
• The Cumulative Average Gas as a better metric says differently, we can see the spike on October 4th and 5th.
• The Net flow is also another metric that we can see there is no big volume change happened on the given date.

Definitions

• TPM: Transactions Per Minute

• Success Rate: The percentage of successful transactions

• New User: We consider an address a new user if it has done its very first transaction within our given date range.

• Active User: Users who have done at least 1 transaction within the given date range

• XDAI Net Flow: The result of this (XDAI Volume bridged to Gnosis - XDAI Volume bridged from Gnosis)

• Sybil attack: A Sybil attack uses a single node to operate many active fake identities (or Sybil identities) simultaneously, within a peer-to-peer network. This type of attack aims to undermine the authority or power in a reputable system by gaining the majority of influence in the network.

  \

Observations:

• The big spike of the October, is on 4th and 5th mainly.
• Interestingly, the success rate from almost 90%, dropped under 30 percent and even 15% on the following days.
• But still, the number of successful transactions had a big spike, meaning that although a great deal of transactions failed, still a lot of them were successful, comparing to the previous and next days.
• Another interesting point is that, the volume of transactions were in a steady trend and didn’t change much, meaning that those excessive transactions probably had a very small amount.

Findings and Conclusion

• By going through the addresses that were mainly the target of most users on the spike date, considering the fact that majority of transactions failed and the succeeded ones didn’t add up that much to daily volume, we can say that this strange activity was a Sybil attack arranged by attackers or bots per say.
• The first wallet with more than 540K transactions, belongs to AMB Rinkeby Bridge. The next 2 wallets are not for any specific DApp or Protocol and the 4th one: 0x22C1f6050E56d2876009903609a2cC3fEf83B415 belongs to POAP, with about 11K transactions to mint a POAP token.
• So all and all, sounds like a Sybil attack trying to weaken the network and mostly the AMB Rinkeby Bridge.
• And as the last important note, we can see that the activity on Gnosis got back to normal on the following days.