Every airdrop designer faces the same enemy: one person pretending to be thousands. Sybil attacks work because wallets are free — so any distribution keyed only to wallets gets farmed. Here's an honest tour of every defense in use today, what each actually stops, and what it costs you in friction.
1. Curated allowlists
The project hand-picks recipients: community roles, contributors, early users. Strong against random farmers, but it doesn't scale, it centralizes power in whoever curates, and determined farmers still grind Discord roles across many accounts. Best for small, high-trust distributions.
2. KYC
Identity checks genuinely enforce one-person-one-claim — and kill the permissionless nature of crypto in the process. Massive drop-off (most users won't upload a passport for a small reward), regulatory weight, and a honeypot of personal data. Rarely worth it for community distribution.
3. Proof-of-personhood
Systems like World ID or Gitcoin Passport attest a wallet belongs to a unique human without revealing who. The strongest cryptographic answer — but coverage is the bottleneck: only a fraction of your audience has enrolled, so requiring it shrinks your reach to the already-verified. Powerful as an optional gate for high-value drops.
4. Onchain heuristics
Wallet age, transaction history, gas spent, cluster analysis of funding patterns. Cheap and invisible to legit users — and a permanent cat-and-mouse game. Farms age their wallets and randomize funding paths; every public heuristic gets gamed within one cycle. Useful as a filter, never as the wall.
5. Location verification
Require the claimer's body, not just their wallet: be inside a geofence, enter a code displayed only at the venue. One farmer can spin up 10,000 wallets from a laptop, but they can't stand in 10,000 places — the attack stops scaling. The trade-off is deliberate: reach is limited to people who can actually show up, which is exactly the point when you want real community, but wrong for a global retroactive reward.
What DropHood layers together
- One claim per wallet, enforced by the smart contract itself.
- GPS verification against a salted location hash (exact coordinates never public, never on-chain).
- An on-site code that exists only in the physical world — GPS spoofing alone gets you nothing.
- Per-device and per-network claim caps, so cycling wallets at the venue is slow, capped and detectable.
- Honestly labeled: this is layered deterrence, not identity. Optional proof-of-personhood gates for high-value drops are on the roadmap.
The takeaway
There is no single sybil silver bullet — only layered costs. The question for your airdrop isn't 'is it unfarmable?' but 'does farming it cost more than the reward?' Location flips that equation harder than anything short of identity, while staying permissionless.