ZAPs: A Reward Attribution Framework for DeFi Ecosystems with Adversarial-Robust Scoring via Parallel Anomaly Ensemble Detection

Source: arXiv:2607.27859 · Published 2026-07-30 · By Girish G N, Ashutosh Sahoo, Ajay Bhat, Akshay SP, Gurukiran S, Parag Paul et al.

TL;DR

This paper presents ZAPs, a novel reward attribution framework designed specifically for decentralized finance (DeFi) ecosystems where incentive programs are commonly exploited by bots and sybil attacks. Conventional reward schemes simply count raw on-chain metrics such as transaction volume or wallet counts, which adversaries can easily manipulate to extract outsized rewards. ZAPs addresses this by combining a composite economic contribution score with a multi-layer adversarial defense stack, thereby bounding reward capture from fabricated activity and emphasizing genuine, economically meaningful participation. The framework ensures that no protocol or wallet can gain rewards disproportionate to its true share of ecosystem-wide volume, thereby disincentivizing farming niche protocols with small absolute volumes. Empirically, ZAPs achieves ROC-AUC of 0.923 in malicious wallet detection on a labeled corpus by using a parallel anomaly ensemble, outperforming individual detectors. Controlled experiments show 30-90% reduction in adversarial reward extraction at the cost of minimal impact on legitimate users. Live deployments confirm substantial real-world sybil and sell-pressure reductions alongside higher quality wallet participation.

Key findings

• Composite activity score uses protocol-specific percentile normalization with a high percentile anchor to limit whale dominance, preserving differentiation across users.
• Two-layer cross-domain weighting (protocol share within sector × sector share within ecosystem) bounds max wallet reward per protocol by the protocol’s global volume share, preventing cheap farming of niche protocols.
• Ensemble anomaly detection combining a one-class autoencoder trained on malicious wallets and an isolation forest trained on benign wallets yields ROC-AUC = 0.923 ± 0.013 versus 0.891 ± 0.016 for autoencoder alone on held-out malicious and benign data.
• Isolation forest trained on pooled malicious+benign wallets inversely predicts maliciousness (ROC-AUC 0.250), destroying ensemble gains.
• Graduated penalty multipliers applied across four adversarial detection layers reduce adversarial reward capture by 30-90% in simulations while legitimate users’ reward shift remains limited to 1-8%.
• Live campaigns deploying ZAPs showed 56% reduction in sybil allocations, 49% increase in quality-wallet participation, and 50% reduction in sell pressure.
• Top-10 wallet reward share constrained to 0.4% and top-100 to 2.8%, indicating capped concentration compared to uncapped volume attribution.
• Reward shares across five DeFi sectors closely track their respective volume shares, validating the weighting design.

Threat model

The adversary includes automated farming bots and sybil operators who can create many coordinated wallets and perform fabricated on-chain transactions (e.g., rapid round-trip trades, wash trading) to inflate metrics like volume, transaction count, and wallet participation. They seek to maximize reward extraction via cheap local dominance or distributed farming of niche protocols. The adversary cannot falsify global transaction provenance, or evade graph-based cross-wallet clustering and multi-dimensional anomaly detection operating over sophisticated behavioral signals.

Methodology — deep read

1. Threat Model & Assumptions: The adversary includes bots, sybil operators, and farming entities capable of fabricating high-volume, high-transaction on-chain activity, including splitting capital across multiple wallets or dominating low-volume niche protocols cheaply. The adversary cannot forge underlying transaction graph provenance or bypass multi-layer anomaly and sybil detection.

2. Data: The system ingests multi-chain transaction streams from 5 DeFi sectors (DEX swaps, lending, perpetual futures, NFT trading, staking). The labeled malicious wallet corpus comprises 1,073 wallets and 124,638 transactions derived from public exploit/phishing attributions; a benign comparison set includes 383 wallets with 326,943 transactions. Preprocessing includes discarding zero-value or approval/revocation transactions, filtering by volume ceilings, and per-(wallet, protocol) decomposition.

3. Architecture / Algorithm:

• Composite Reward Score: For each (wallet, protocol) pair, three dimensions are scored—volume normalized by a high fixed percentile of protocol participants’ volume distribution; engagement duration capped at a threshold; and a behavioral quality signal from a zScore reputation engine capturing consistency, diversity, and economic substance.
• Cross-domain weighting multiplies protocol’s volume share within sector by sector’s share in ecosystem, telescoping to global volume share, bounding maximum extractable reward.
• Four adversarial detection layers: (1) transaction-level binary gates censor economically meaningless transactions; (2) parallel anomaly ensemble combining a one-class reconstruction autoencoder trained solely on malicious wallets and an isolation forest trained solely on benign wallets, fused via calibrated convex combination; (3) post-distribution memory reduces future rewards for wallets exhibiting rapid liquidation of rewards; (4) graph-based sybil clustering uses funding provenance graphs and behavioral uniformity metrics across wallet families to detect coordinated multi-address farming.
• Penalties are graduated, not binary exclusions, applying proportional multipliers based on aggregate suspicion across layers.

4. Training Regime: The autoencoder uses 10-dimensional wallet-level behavioral features with a 16-dimensional latent space, trained via Adam optimizer with learning rate 0.001, batch size 128, for 50 epochs with early stopping on 15% held-out malicious validation split. Isolation forest parameters are standard; critical novelty is training exclusively on benign wallets to correctly capture normality.

5. Evaluation:

• ROC-AUC performance measured on held-out malicious and benign wallets.
• Controlled adversarial simulations model eight scenarios (four adversarial farming archetypes and four legitimate user profiles), measuring attribution with and without adversarial defenses.
• Real-world deployment metrics on production-scale data (>320M wallets, $300B volume, over 16K reward units).

6. Reproducibility: Code, numeric hyperparameters, and training weights withheld or calibrated internally; details sufficient for replication are provided. Dataset partially public (external exploit labels), full production dataset private.

Example walkthrough: A wallet w active on protocol p has its volume Vw,p relative normalized by the 95th percentile volume at p, engagement capped by a fixed time span threshold T*, and quality score from zScore. These three dimensions combine into sw,p. The global weight ωp is protocol volume share × sector volume share. The product sw,p · ωp is summed across all active protocols for w and multiplied by penalty µ(w) derived from adversarial detection layers, producing final reward Rw. Suspicious trade patterns or sybil clusters lower µ(w), penalizing adversary reward extraction while preserving legitimate user rewards.

Technical innovations

• Composite reward score normalizes user activity by high percentile volume per protocol to limit whale dominance while preserving differentiation.
• Two-layer multiplicative cross-domain weighting establishes bounds on maximum rewards per protocol equal to its global volume share, closing the common niche-protocol farming exploit.
• Parallel anomaly ensemble combines a one-class autoencoder trained on malicious wallets with an isolation forest trained on benign wallets, yielding higher ROC-AUC via complementary detection.
• Graduated, non-binary penalty multipliers integrate multiple adversarial signals to reduce false positives and proportionally penalize suspicious wallets rather than outright exclusion.
• Graph-based sybil clustering leverages funding provenance and behavioral uniformity within wallet families to detect coordinated sybil operations beyond per-wallet detection.

Datasets

• Malicious Wallet Corpus — 1,073 wallets, 124,638 transactions — Public exploit and phishing attributions
• Benign Wallet Corpus — 383 wallets, 326,943 transactions — Internal label set

Baselines vs proposed

• One-class reconstruction model alone: ROC-AUC = 0.891 ± 0.016
• Isolation forest (trained on benign wallets): ROC-AUC = 0.638
• Isolation forest (trained on pooled population): ROC-AUC = 0.250 (inverse polarity)
• Ensemble (one-class + isolation forest with benign training): ROC-AUC = 0.923 ± 0.013
• Adversarial simulation reward capture reduction: 30–90% vs no adversarial defense
• Legitimate user reward impact in simulation: changes limited to 1–8%
• Live campaign sybil reward allocation reduction: 56%
• Live campaign quality-wallet participation increase: 49%
• Live campaign sell pressure reduction: 50%

Limitations

• Public details of hyperparameter values, mixing coefficients (α, β, γ), and penalty breakpoints withheld, limiting exact replication.
• Ground truth malicious wallet corpus is relatively small and naturally incomplete; adversaries may adapt to evade detection.
• No explicit testing reported under substantial distributional shift or novel attack types beyond tested archetypes.
• Isolation forest’s reliance on correct benign-only training regime is brittle and may limit generalization if benign distribution evolves.
• Quality behavioral scoring component is fixed in current deployment, with potential unknown sensitivity to evolving attack vectors or economic conditions.
• Graduated penalty scheme’s balance between false positives and false negatives calibrated empirically; sensitive thresholds may impact operational robustness.

Open questions / follow-ons

• How does ZAPs perform against adaptive adversaries who modify behavioral patterns to evade anomaly detectors over time?
• Can the quality behavioral score component be dynamically adapted or learned end-to-end alongside adversarial detection to increase robustness?
• What are the tradeoffs in penalty calibration in diverse DeFi ecosystems with different protocol compositions and attacker incentives?
• Can the isolation forest and autoencoder be replaced or augmented with more expressive deep anomaly or graph neural models to improve detection coverage?

Why it matters for bot defense

The ZAPs framework directly addresses a critical problem in bot defense for financial incentives: differentiating genuine users from adversarially generated activity that seeks financial gain. Its integration of a robust composite scoring mechanism with layered anomaly detection and graph-based sybil clustering exemplifies a holistic approach to adversarial resilience. CAPTCHA practitioners can learn from ZAPs’ graduated penalty design, avoiding harsh binary exclusion that risks false positives. The paper’s emphasis on placing limits on structural exploits via formula-level constraints is a valuable lesson for crafting tamper-resistant scoring functions. Additionally, the demonstrated importance of training unsupervised detectors on clean benign populations versus pooled adversarial data has implications for anomaly detection design in bot defense.

Cite

@article{arxiv2607_27859,
  title={ ZAPs: A Reward Attribution Framework for DeFi Ecosystems with Adversarial-Robust Scoring via Parallel Anomaly Ensemble Detection },
  author={ Girish G N and Ashutosh Sahoo and Ajay Bhat and Akshay SP and Gurukiran S and Parag Paul and Dhanashekar Kandaswamy },
  journal={arXiv preprint arXiv:2607.27859},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.27859}
}

Read the full paper

• arXiv:2607.27859 (abstract)
• arXiv:2607.27859 (PDF)