Identify Potential Cartel Relay Network in Cosmos GOS3

tl;dr: Identified 71 monikers (+2 false positives) that overlap with Certus One’s list of potential cartel members based on independent analysis.

Context:

While investigating nodes with similar voting power to `loco.block3.community`, I noticed a pattern of withdrawal and delegation.
Taking `randomness` as an example:

• When `randomness` was the proposer, there is a single transaction containing a large withdrawal and delegation, followed a few blocks later by another single transaction from `randomness` containing a withdrawal and smaller delegation — approximately 15% of the size of the first. The cycle then repeats the next time ‘randomness’ was a proposer.

When I dug into the block containing the second delegation (proposed by `Hydra-Validator`), I found the same pattern repeated, and further digging I saw the pattern repeat again and again.

RAW Footage screencast of initial walk through — over LTE network… sorry (best viewed full screen)

Hypothesis:

There are validators who:

1. Propose blocks containing TX for withdraw_validator_rewards_all and delegate with zero fees
2. A small number of blocks later contains a TX for withdraw_validator_rewards_all and delegate with 10k photinos fees
3. The validators operating in this way are ‘chained’ together (likely as a result of using some form of relay network)

Method:

1. Load ~2k blocks into a graph database — focusing on the PROPOSAL and TXs containing withdraw_validator_rewards_all and delegate.
2. Query to discover how many validators operate in this way, who they are, and are they chained together.

Source Code

Source code

Graph Query

// Neo4J CYPHER query
MATCH (n1:Validator)-[r:TX]->(n2:Block)
MATCH (n1:Validator)-[r3:PROPOSAL]->(n3:Block)
MATCH (n1:Validator)-[r2:TX]->(n3:Block)
WHERE r.tx_type IN [‘delegate’, ‘withdraw_validator_rewards_all’] AND r.fee_amount = 10000 AND r.fee_denom = “photinos” AND r2.fee_amount = 0 AND r2.tx_type IN [‘delegate’, ‘withdraw_validator_rewards_all’]
RETURN DISTINCT n1.moniker AS ValidatorMoniker

Result:

Chain of interconnected PROPOSAL and TX with fees @ 10k photinos

List of monikers

List of potential cartel members using the same methodology & relay network

False positives:

`Nodebreaker` and `PlumbTurst`. Ruled out as their delegation pattern didn’t match the large delegation, followed by a small delegation model. Additionally, they didn’t connect into the long chains.