{"license":"CC-BY-4.0","licenseUrl":"https://creativecommons.org/licenses/by/4.0/","attribution":"ChainChoice (https://chainchoice.io)","category":"incentive_distribution","evidenceReadAt":"2026-11-10","generatedAt":"2026-11-12","criteria":[{"id":"recomputable_allocation","label":"If someone disputes their number, can anyone outside the vendor recompute it?","weight":30},{"id":"budget_control_after_publication","label":"Who is holding my budget, who can still change the list, and what comes back to me?","weight":28},{"id":"incident_and_operator_record","label":"What has already gone wrong on this machinery, and who is actually running it today?","weight":22},{"id":"sybil_defence_in_writing","label":"What exactly stops a farm from eating this budget, and what happens when it flags the wrong person?","weight":20}],"providers":{"merkl":{"recomputable_allocation":{"s":9,"q":"so anyone can audit past distributions | is a security window of 1-2 hours following each reward update during which anyone can contest reward allocations made by the Merkl engine | raise a dispute by sending a `disputeToken` to the Merkl Distributor contract | The merkle root is revoked and the…","u":"https://docs.merkl.xyz/merkl-mechanisms/technical-overview.md","d":"2026-11-10"},"budget_control_after_publication":{"s":8,"q":"As a campaign manager, you can reallocate unclaimed rewards from any recipient address to another address at your discretion. | Currently, this window ranges from 1 day to 1 year post-campaign.","u":"https://docs.merkl.xyz/distribute-with-merkl/campaign-management.md","d":"2026-11-10"},"incident_and_operator_record":{"s":8,"q":"the dispute mechanism can revoke an incorrect merkle root before rewards become claimable, containing computation incidents before funds move. | the Bug Bounty Program rewards responsible disclosure, up to $100,000 for critical vulnerabilities. | Merkl is operated by Angle Labs, Inc.","u":"https://docs.merkl.xyz/security-practices","d":"2026-11-10"},"sybil_defence_in_writing":{"s":8,"q":"Exclude specific addresses from rewards: exploiters, sanctioned wallets, team addresses, or contracts you do not want to incentivize. | As soon as a whitelist exists, every address not on it is excluded. | hold a minimum amount of a token at a snapshot block.","u":"https://docs.merkl.xyz/merkl-mechanisms/customization-options.md","d":"2026-11-10"}},"sablier_airdrops":{"recomputable_allocation":{"s":6,"q":"The system stores only the tree's root hash in the deployed Airstream contract, while the complete tree and recipient list reside in IPFS. | We've built a Rust backend service that provides REST API access to Merkle tree functionality.","u":"https://docs.sablier.com/api/airdrops/merkle-api/overview","d":"2026-11-10"},"budget_control_after_publication":{"s":10,"q":"If a recipient doesn't claim their airdrop, it's not created, and you remain in full control over their allocation. | The grace period ends 7 days after the first claim is made. | Campaign admin can then clawback the forfeited tokens after the campaign expires.","u":"https://docs.sablier.com/concepts/airdrops","d":"2026-11-10"},"incident_and_operator_record":{"s":7,"q":"Sablier Labs has stopped active product development and entered maintenance mode. Existing users will continue to be served through June 2028.","u":"https://blog.sablier.com/sablier-labs-is-entering-maintenance-mode/","d":"2026-11-10"},"sybil_defence_in_writing":{"s":8,"q":"A CSV file containing [address, amount] pairs for every campaign recipient | Validates the CSV file and its contents | Builds the Merkle tree and generates a root hash","u":"https://docs.sablier.com/api/airdrops/merkle-api/functionality","d":"2026-11-10"}},"boost":{"recomputable_allocation":{"s":6,"q":"reward rate = total budget ÷ duration | your share = your eligible balance ÷ total eligible balance | earnings = drip × share × time held | Boost takes a reward snapshot on a regular cadence, publishes it on-chain, and from that point the user can claim what's accrued so far.","u":"https://docs.boost.xyz/tbi/core-concepts/reward-calculation.md","d":"2026-11-10"},"budget_control_after_publication":{"s":8,"q":"measured from finalization, but this is configurable per campaign. | Anything still unclaimed becomes recoverable by the creator through the same withdraw flow. | Creators (or the protocol admin in emergencies) can end a campaign before its scheduled `endTime`.","u":"https://docs.boost.xyz/tbi/core-concepts/campaign-lifecycle.md","d":"2026-11-10"},"incident_and_operator_record":{"s":5,"q":"Funds are held in audited smart contracts | Budget accounts use the `ManagedBudgetWithFeesV2` smart contract, which provides secure fund management and role-based access control.","u":"https://docs.boost.xyz/v2/documentation/getting-started/setting-up-accounts.md","d":"2026-11-10"},"sybil_defence_in_writing":{"s":8,"q":"support allowlists — restrict claims to a specific set of addresses (NFT holders, token holders, partner communities, etc.). | support eligibility filters like minimum balance, new capital only, and earning activation, which limits rewards to users who actually came through Boost.","u":"https://docs.boost.xyz/v2/documentation/support/faqs.md","d":"2026-11-10"}},"streamflow":{"recomputable_allocation":{"s":6,"q":"You can use our public API for generating a merkleTree or use your own implementation | root: merkleResponse.merkleRoot, | proof: claimantData.proof, // Merkle Proof used to verify claim | As all the data is stored on-chain you can also search Airdrops with `searchDistributors` method:","u":"https://raw.githubusercontent.com/streamflow-finance/js-sdk/master/packages/distributor/README.md","d":"2026-11-10"},"budget_control_after_publication":{"s":7,"q":"clawbackStartTs: now + 5, // Timestamp after which Airdrop can be clawed back to the Sender address | claimsClosableByAdmin: false, // Whether individual Claims can be closed by the Sender | Returns all funds to the original Sender.","u":"https://raw.githubusercontent.com/streamflow-finance/js-sdk/master/packages/distributor/README.md","d":"2026-11-10"},"incident_and_operator_record":{"s":6,"q":"Streamflow protocol has been thoroughly battle-tested for close to 3 years in production, without a single incident. | Security audits are regularly conducted and available here","u":"https://docs.streamflow.finance/en/articles/9869371-security","d":"2026-11-10"},"sybil_defence_in_writing":{"s":7,"q":"Threshold defines the maximum number of wallets that can be linked to a single entity before it’s flagged as suspicious. | Flagged wallets identified as potentially sybil. | If sybil wallets were detected, they will be clearly highlighted in the file.","u":"https://docs.streamflow.finance/en/articles/12239098-sybil-checker","d":"2026-11-10"}},"hedgey":{"recomputable_allocation":{"s":6,"q":"Upload a list of recipients via CSV file. Your CSV should contain 2 columns: address and amount | Independently verifying that the spreadsheet used to create your claim matches the transaction you are about to sign is an important step in creating new claims.","u":"https://hedgey.gitbook.io/hedgey-community-docs/hedgey/token-claims/getting-started/for-claims-issuers.md","d":"2026-11-10"},"budget_control_after_publication":{"s":8,"q":"this function allows the campaign manager to cancel an ongoing campaign at anytime. Cancelling a campaign will return any unclaimed tokens, and then prevent anyone from claiming additional tokens | require(campaign.manager == msg.sender, '!manager');","u":"https://raw.githubusercontent.com/hedgey-finance/DelegatedTokenClaims/master/contracts/DelegatedClaimCampaigns.sol","d":"2026-11-10"},"incident_and_operator_record":{"s":4,"q":"Hedgey is now a part of Anchorage Digital with the launch of HedgeyPro. | Are Hedgey contracts audited. | Yes. Our token vesting and lockup contracts are audited by Consensys Diligence. Hedgey has completed 5+ audits to date with leading auditing firms.","u":"https://hedgey.finance/","d":"2026-11-10"},"sybil_defence_in_writing":{"s":7,"q":"even add the ability to clawback unstreamed tokens claimed by bots and airdrop farmers discovered post-claim. | Upload a CSV file with your whitelisted recipient list and Hedgey generates a Merkle tree based claim capable of handling unlimited recipients.","u":"https://hedgey.gitbook.io/hedgey-community-docs/hedgey/token-claims.md","d":"2026-11-10"}},"layer3":{"recomputable_allocation":{"s":2,"q":"The minting process is initiated by a wallet with the _signer role_ creating an EIP-712 signature. | Default Admin: Full control over the contract and can handle the different roles.","u":"https://raw.githubusercontent.com/layer3xyz/cubes/main/README.md","d":"2026-11-10"},"budget_control_after_publication":{"s":5,"q":"/// @dev Withdrawal can only be initiated by the escrow admin or an account with the default admin role. | if (msg.sender != s_escrow_admin[questId] && !hasRole(DEFAULT_ADMIN_ROLE, msg.sender)) { | // only allow withdrawals if quest is inactive","u":"https://raw.githubusercontent.com/layer3xyz/cubes/main/src/escrow/Factory.sol","d":"2026-11-10"},"incident_and_operator_record":{"s":6,"q":"Layer3 protocols have been audited by two separate firms in phase 1 and 2. You may access the complete audit reports below. | Sherlock | ThreeSigma","u":"https://docs.layer3foundation.org/audits.md","d":"2026-11-10"},"sybil_defence_in_writing":{"s":6,"q":"Filtering for high-quality participants, preventing sybil. | Set score threshold based on your needs. Higher for exclusive drops, lower for broader participation.","u":"https://layer3xyz.gitbook.io/layer3-updated-docs/builder/guides/guides--action-types-reference.md","d":"2026-11-10"}},"galxe_quest":{"recomputable_allocation":{"s":2,"q":"// Galxe Signer | address public signer; | require(_expiredAt >= block.timestamp, \"Signature expired\"); | return ECDSA.recover(hash, signature) == signer;","u":"https://raw.githubusercontent.com/Galxe/galxe-contracts/main/contracts/TokenReward/TokenReward.sol","d":"2026-11-10"},"budget_control_after_publication":{"s":5,"q":"Deposit tokens with a total value of at least $10 to publish quests. | When the quest ends, for the raffle quest, the winner has 15 days to claim the rewards. If there are still tokens left after 15 days, you can initiate a refund. | You'll need to contact our Livechat in your Space dashboard.","u":"https://help.galxe.com/en/articles/9645630-create-quest-rewards","d":"2026-11-10"},"incident_and_operator_record":{"s":7,"q":"we estimated that around 1,120 users were affected and around $270,000 USD was stolen. | The hacker(s) modified the NS records of Galxe.com | The incident only affected our domain and front-end application. All Galxe smart contracts, as well as Galxe's technical systems, remain safe and protected.","u":"https://help.galxe.com/en/articles/8452958-october-6th-dns-security-incident-statement-guide","d":"2026-11-10"},"sybil_defence_in_writing":{"s":6,"q":"Behavioral Analysis: Our system monitors user activity to identify patterns that differ from typical human behavior. | On-Chain Analysis: We leverage on-chain data to identify suspicious wallet activities | Exclusion from Rewards: If an account is identified as a bot, it may be disqualified from…","u":"https://help.galxe.com/en/articles/11827806-galxe-bot-identification-system","d":"2026-11-10"}},"zealy":{"recomputable_allocation":{"s":1,"q":"The Raffle method randomly selects as many winners as you have configred from all users who completed the quest. | We automatically fetch the data from the Twitter API to determine the top performers.","u":"https://zealy.io/docs/quest-properties/reward-methods","d":"2026-11-10"},"budget_control_after_publication":{"s":4,"q":"The sum of your available and locked USDC. This represents your complete USDC holdings on Zealy. | The USDC is deducted from your available balance at quest creation and locked to guarantee distribution to users.","u":"https://zealy.io/docs/start-guide/billing-and-plans","d":"2026-11-10"},"incident_and_operator_record":{"s":5,"q":"Crew3 is now Zealy | All links will continue to work and redirect to the new landing page, until everyone has had a chance to update them.","u":"https://zealy.io/changelog/2023-04-06-zealy","d":"2026-11-10"},"sybil_defence_in_writing":{"s":5,"q":"It is a bot filter, not a sybil filter: it does not detect one person running several accounts | The account must be following at least 50 accounts | An AI model reviews the profile and the account's last 10 posts for obvious automation patterns | legitimate users can fail the task if their…","u":"https://zealy.io/docs/tasks/proof-of-humanity","d":"2026-11-10"}}}}