Paper: ZAPs: A Reward Attribution Framework for DeFi Ecosystems with Adversarial-Robust Scoring via Parallel Anomaly Ensemble Detection
Authors: Girish G N, Ashutosh Sahoo, Ajay Bhat, Akshay SP, Gurukiran S, Parag Paul, Dhanashekar Kandaswamy
Date: 2026-07-30
Estimated Reading Time: 15-20 minutes
Points programs and retroactive airdrops distribute token value against observed on-chain activity, and the paper's starting position is that almost all of them attribute rewards through heuristics, being raw volume, transaction count and wallet count, that farming operations manufacture at scale. ZAPs is presented by its authors as an attribution framework, built at Zeru Finance, that addresses the structural and behavioural halves of that failure together. The structural half normalises a wallet's volume against a high percentile of each protocol's own population, then weights the result by a nested share, being the protocol's share of its sector multiplied by the sector's share of the ecosystem, a product that telescopes to the protocol's global volume share. The behavioural half is a four-layer stack of transaction-level gates, a two-detector anomaly ensemble, post-distribution memory of liquidation behaviour, and clustering over funding provenance, all feeding graduated rather than binary penalties. Evaluation draws on a labelled corpus of 1,073 malicious wallets spanning 124,638 transactions, of which 322 are held out and scored against 383 benign wallets, plus eight constructed scenarios and self-reported live campaigns. The authors state that the individual components are established techniques and that the contribution is their composition into an attribution mechanism.
Core insights
- Local dominance cannot exceed a global share Attribution is computed per wallet and protocol pair rather than per wallet, and each pair's score is multiplied by weight = protocol_volume / sector_volume * sector_volume / ecosystem_volume, which reduces to protocol_volume / ecosystem_volume. Proposition 1 uses that reduction to bound the reward any single wallet can obtain at a protocol by the protocol's global volume share, independently of how much of the protocol it captures or how cheaply. The numbers make the bound concrete: a protocol holding 19.4% of the DEX sector, which carries 85.7% of volume, weights 0.166, while one holding 71.3% of staking weights 0.0034, so roughly three times the local dominance receives about one fiftieth of the weight.
- The second detector inverts if it is fitted on the wrong population The anomaly ensemble pairs a reconstruction model trained only on malicious wallets, where low reconstruction error indicates malicious membership, with an isolation forest. Fitted on the pooled population the forest scores 0.250 ROC-AUC, below chance, because the malicious wallets both outnumber the benign ones in the pooled corpus and are individually sparser, at a median of 21 transactions against 499, so they define the dense region while heavy-activity benign wallets are isolated as outliers. Fitted on the benign population alone it reaches 0.638 with correct polarity and lifts the ensemble to 0.923 from the reconstruction model's 0.891, at a fusion weight of 0.90.
- The unpenalised tier holds most of the value Penalties activate only when several strong signals fire together, so the Suspicious tier is flagged and left at full attribution while holding 13,547 of 16,080 distributed reward units, or 84% of the total. The stated reason is that power users, market makers and institutional accounts exhibit the operational regularity that partial bot signals detect. Under binary exclusion at the adjacent tier, a legitimate wallet misclassified by one tier would lose everything rather than the tier increment, and the population most exposed to that error is the one holding the majority of legitimate rewards.
- Capture falls asymmetrically across attack types Activating the defence stack reduced modelled reward capture by 90% for the spam bot, 89% for the diversity farmer, 43% for the flash-loan exploiter and 30% for the sybil operator, while the four legitimate controls moved between plus 1% and minus 8%. The gradient follows the detection surface: single-wallet automation with sustained signatures is caught by the ensemble, while the sybil operator's individual wallets each resemble a modest participant and are reachable only by the clustering layer. Live campaigns are reported as 56% less sybil allocation, 49% more quality-wallet participation and 50% less post-distribution sell pressure.
- The evidence is proxy, constructed or self-reported throughout The labelled corpus is drawn from public exploit and phishing attributions rather than farming, which the authors identify as a transfer to a related but distinct behavioural class. The eight scenarios are constructed rather than observed, and the production figures are measured against baselines the paper does not define. Table 1 also reports aggregate volume of USD 300 billion while the five sectors of Table 3 sum to approximately USD 41.2 billion, and reports 320 million wallets scored against the 31,717 classified across the four tiers, while the contributions list and the conclusion both call the held-out evaluation 1,073 malicious wallets where Table 4 reports 322 held out after training, none of which the text reconciles.
The mechanism's economic content sits in the weighting rather than in the detection. A points programme that pays on volume creates an arbitrage: an attacker locates the venue where a unit of manufactured volume buys the largest share of the local reference, and captures rewards priced by that share. Weighting by global volume share removes the arbitrage by construction, because capturing all of a venue that carries 0.47% of ecosystem volume caps the payout at that fraction regardless of what capture cost. The paper's own deployment observation is the cleanest demonstration: the protocol with more than half of all scored wallets received 1.3% of rewards, because its volume share within its sector was 0.6%. Head count is the cheapest metric to manufacture, and the weighting prices it accordingly.
Saturation in the volume term does the complementary work on the demand side. Because a wallet's volume score is clipped once it reaches the protocol's high percentile, additional capital past that point earns no additional credit, which caps what a whale extracts and keeps the median reward non-trivial. The reported distribution is consistent with that intent, with the ten largest recipients holding 0.4% of rewards and a ratio of 36.6 times between the 99th percentile and the median. The design question this raises for an issuer is where the cap should sit, since a percentile low enough to bind on ordinary participants collapses differentiation while one high enough to bind on nobody restores the uncapped case, and the paper does not give the value it uses.
The withheld parameters are the practical limit on adopting this work. The mixing coefficients of the composite score, the fusion weight and the penalty breakpoints are described as calibrated and withheld, and the percentile anchor is never given a value at all, so the framework cannot be reproduced as specified and has to be recalibrated against a new population. That is defensible for a deployed commercial system (and it is also why a paper this specific reads as thin in places), and it changes what the paper is: a description of a mechanism with a proof about its weighting, rather than a recipe. Which of these parameters would a team have to rediscover before the reported asymmetry between attacker loss and legitimate-user loss reappeared on their own data?
The polarity finding travels further than the rest of the paper and is worth separating from it. Isolation forests are typically fitted on whatever unlabelled data is available, and a team assembling that pool from production traffic includes the attackers in it without meaning to. Where attackers are numerous and individually sparse relative to genuine users, they populate the dense region and the detector learns to score genuine heavy users as anomalies, which is a failure that reports as a working model rather than as an error. The magnitude here rests on a benign sample of 383 wallets that the authors acknowledge over-represents high-activity participants. I would take the direction as the finding and the size of the inversion as unestablished.
For a token issuer the transferable structure is the separation of a reward score from an eligibility penalty, with the second applied multiplicatively and graduated rather than binary. Reward equals the penalty multiplier times the sum over active protocols of the score times the weight, which keeps the fairness arithmetic and the adversarial judgement in separate terms that can be audited and tuned independently. The unresolved part is the third layer, post-distribution memory, which is specified qualitatively with no threshold, no observation window and no ablation isolating its contribution, yet it carries the claim about sell pressure that would matter most to a launch. If a programme wants to reduce post-distribution selling, is the effect coming from the memory layer, from paying fewer sybils in the first place, or from a campaign population that differed in ways the comparison does not control?
