Ethereum’s zero-knowledge (ZK) layer-2 scaling solution, zkSync, has come under fire from industry experts for allegedly failing to implement effective anti-Sybil measures in its recent token airdrop. Critics claim that the distribution of zkSync’s self-titled token, ZK, has been marred by vulnerabilities that allow for extensive manipulation and farming by automated bots.

Mudit Gupta, the Chief Information Security Officer at Polygon, a competing layer-2 network, was particularly vocal about the issue. In a post on X (formerly Twitter) dated June 11, Gupta described the airdrop as potentially "the most farmed airdrop ever," emphasizing the apparent absence of robust anti-bot mechanisms. "Anyone who knew the criteria could’ve easily farmed the shit out of it," Gupta remarked, highlighting the ease with which malicious actors could exploit the system.

Earlier that same day, zkSync announced that 695,232 wallets were eligible to claim the ZK token airdrop. The announcement included a list of seven criteria purportedly designed to prevent Sybil attacks—where an individual or group uses multiple wallets to unfairly accumulate tokens. However, industry experts were quick to criticize the effectiveness of these measures.

Adam Cochran, a partner at Cinneamhain Ventures, echoed Gupta’s concerns. "That was not a well-planned airdrop from a Sybil perspective," Cochran stated. He argued that the criteria were so lenient that genuine users might inadvertently miss out, while opportunistic farmers could easily meet the requirements.

The criticism prompted a response from crypto analytics firm Nansen, which clarified that it had not conducted anti-Sybil checks or advised on token allocations for zkSync’s airdrop. Instead, Nansen explained that it had only provided data on specific wallet segments, including those belonging to "whales and known scammers."

Further complicating the situation, crypto researcher Ignas pointed out that zkSync had intentionally avoided stringent anti-Sybil measures. According to Ignas, zkSync’s press release indicated that rigorous Sybil detection could unfairly exclude legitimate users.

Adding to the controversy, the Sybil-tracking X account "Sybil Horror 6" shared preliminary data from LayerZero Labs, suggesting that approximately 135 million ZK tokens could end up in wallets identified as Sybil accounts. Based on the tokens' value on pre-market perpetual exchanges such as Aevo and PancakeSwap, this amount could be worth up to $52.3 million.

In the wake of these revelations, the ZK token’s price has plummeted by around 43% over the past 24 hours on both Aevo and PancakeSwap, with significant drops occurring after zkSync disclosed details of the airdrop.

Matter Labs, the development firm behind zkSync, has yet to respond to requests for comment on the matter. The ongoing debate raises critical questions about the effectiveness of current anti-Sybil measures in crypto airdrops and the need for more sophisticated solutions to ensure fair and equitable token distributions.