Invite Rewards Anomaly Investigation

[thalescb]

Context

Investigating anomaly in new claimer and invitee metrics on XDC and Celo flagged in weekly KPI review (2026-07-21). Confirmed bot farm activity -- coordinated account creation via XDC invite channel, with on-chain links to known extraction network.

Investigation Scope (agreed with Hadar, Aug 4 2026)

Focus: identify signals that confirm farming from a single source AND can enable blocking.

Phase 1: Device and IP Clustering (Amplitude)

Objective: Determine if suspicious accounts share devices or IP addresses, indicating a single-source farm.

• Query Amplitude for device_id clustering across flagged accounts (top 50 claimers from existing cohort qwjbdmif)
• Check if multiple accounts register/claim from the same device_id
• Query IP address distribution (if available via Amplitude user properties)
• Check for IP range clustering (same /24 or /16 subnet)
• Quantify: how many accounts share a device? How many share an IP range?
• Document signals that could be used for automated blocking (device_id threshold, IP rate limiting)

Phase 2: Deliver Results and Propose Next Steps

• Present Phase 1 findings to Hadar with clear summary
• If additional investigation angles identified, propose with estimated effort and expected impact
• Get agreement before proceeding to any expanded scope

What Is NOT In Scope (until agreed)

• Broad network structure mapping
• On-chain extraction chain analysis (already completed in prior sessions -- see work-log Jul 16-17)
• Reserve impact quantification (already completed)

Prior Work (reference only, not re-doing)

• 81% of UBI claims from suspected bot accounts (1.64M vs 378K legitimate)
• Full on-chain chain: claimers -> relay wallets -> aggregator 0x991f -> sell bot 0x12bc -> Gate.io
• ~.8K extracted from Celo reserve, ~/day ongoing
• 9 Dune queries, Amplitude notebook (y1dpgmnl), cohort (qwjbdmif), investigation dashboard
• Jul 15 spike: 639 new Celo claimers (4.9x baseline), 530 XDC invites (15x baseline)
• Sell bot uses multi-hop DEX: GD -> Mento -> Uniswap -> USDT -> Gate.io

[thalescb]

Thread 1 (device/IP clustering from Amplitude) is complete. Findings documented. Thread 2 (expanded onchain analysis across all Celo liquidity pools) is in progress. Report being prepared.

[thalescb]

Thread 1 findings presented to Hadar in impromptu session (Aug 12). Key evidence reviewed live: VPN subnet clustering (45.8.25.x), ipinfo/abuseIPDB cross-checks, device ID saturation (41 FV successes from a single device across 40+ wallets in 7 days). Hadar confirmed he has enough information from Thread 1. Next step is on his side: determine blocking approach. Pausing investigation pending his decision on countermeasures.