Sybil Attack

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // Pass a hash of the connected wallet address, never the raw address.
  // The callback hands you the requestID to correlate with the score.
  mod.forceCheckAuthenticatedUser(hashWallet(walletAddress), (ip, requestID) => {
    document.getElementById('shield-request-id').value = requestID;
  });
</script>

<form method="POST" action="/api/claim">
  <input type="hidden" id="shield-request-id" name="shieldRequestId" />
  <button type="submit">Claim</button>
</form>

curl "https://account.shieldlabs.ai/api/v1/history/device_id/5eb7fd5c-2a1b-4c3d-9e8f-7a6b5c4d3e2f?limit=100" \
  -H "Authorization: Bearer sec_your_private_api_key"

app.post('/api/claim', async (req, res) => {
  const { walletAddress, shieldRequestId } = req.body;

  // 1. Your normal eligibility checks first (wallet eligible, not already
  //    paid, within the claim window).
  if (!(await walletIsEligible(walletAddress))) {
    return res.status(409).json({ error: 'wallet_not_eligible' });
  }

  // 2. Read the scored result for this session (snake_case fields).
  const shield   = await waitForScore(shieldRequestId, 2000);
  const score    = shield?.score ?? 0;        // 0-100, default to 0 if not yet in
  const deviceId = shield?.device_id;
  const flags    = shield?.detection_flags ?? {};

  // 3. Count distinct wallets behind this device. The all-zero DeviceID is
  //    "no device", not a real one — skip the count and decide on the score.
  const NIL = '00000000-0000-0000-0000-000000000000';
  const usableDevice = deviceId && deviceId !== NIL;
  const walletsOnDevice = usableDevice ? await walletsBehindDevice(deviceId) : 0;

  // 4. YOUR code owns the verdict. Branch on the band and the count, never
  //    on a signal label string. ip_mismatch is a masked-claim tell.
  if (walletsOnDevice >= YOUR_DEVICE_WALLET_LIMIT) {
    return res.json({ status: 'review', reason: 'many_wallets_one_device' });
  }
  if (score >= 60 || flags.ip_mismatch) {
    return res.json({ status: 'verify', reason: 'anonymity' });
  }

  // Clean session, no wallet cluster: pay out.
  return grantAirdrop(walletAddress, res);
});

// Distinct hashed wallets seen on one machine, from a device_id history read.
async function walletsBehindDevice(deviceId) {
  const rows = await shieldHistory('device_id', deviceId, 100);
  return new Set(rows.map((r) => r.user_hid).filter(Boolean)).size;
}