EIDOS Airdrop Farming Attack

Summary

EIDOS was a token launched on the EOS mainnet on November 1, 2019 by the pseudonymous creator of an earlier EOS token called ENU. The mechanic was almost insultingly simple: send any amount of EOS (as little as 0.0001 EOS) to the account eidosonecoin, and the contract instantly returned the exact EOS plus a proportional share of freshly minted EIDOS — roughly 20 EIDOS emitted per second, split among senders in that window. Because the EOS blockchain does not charge per-transaction gas fees in the Ethereum sense (instead requiring staked CPU/NET/RAM bandwidth), the "cost" of farming EIDOS was not cash but network resources. Anyone who had staked, rented, or otherwise controlled EOS CPU bandwidth could spam round-trip transfers to the faucet essentially for free, harvesting EIDOS with every loop. The result was a de facto stress test — and takeover — of the entire EOS network: within days, over 95% of all transfer actions on EOS were EIDOS round-trips, and the chain's finite CPU capacity was monopolized by farmers rather than the dApps and users it was built to serve.

Design (Mechanism)

The airdrop had no cap on participation and no cooldown: any account could fire transfers to eidosonecoin in a tight loop, limited only by how much CPU/NET bandwidth it had staked or rented via EOS's Resource Exchange (REX). Each round trip returned the sender's EOS untouched (so there was no capital cost beyond opportunity cost and resource rental) plus a pro-rata slice of that block's/second's EIDOS emission. Because rewards were split among all senders in a given interval, farming became a bandwidth-maximization arms race: the more CPU a farmer controlled, the more loops they could execute per second and the larger their share of each emission tranche. Sophisticated actors pre-positioned by renting large blocks of CPU through REX at low pre-airdrop prices, then used bots to hammer the faucet continuously — some reportedly securing the equivalent of ~3,000 EOS worth of CPU-time per staked EOS over a 30-day rental. The airdrop's supply design allocated 800 million of 1 billion EIDOS to this free faucet, disbursed on a schedule designed to run for roughly 15 months, guaranteeing sustained incentive to farm rather than a one-off grab.

Outcome

The mechanism worked exactly as an incentive scheme, and that was the problem: it out-competed every other use of the EOS chain for scarce CPU. Within 24 hours, EOS's daily active accounts fell from roughly 80,000–133,000 to under 20,000–30,000, even as raw transaction throughput spiked to record highs, because normal users and dApps (gambling platforms, exchanges, wallets) could no longer get transactions processed at reasonable cost. CPU rental prices on REX spiked over 10,000%–100,000% within hours of launch, and by November 4 the REX rental pool was roughly 83% drained. The EOS mainnet was widely described as being in "congestion mode" for about a week (November 1–8, 2019), with Coinbase and other exchanges publicly warning users of delayed transactions and temporarily increasing their own staked CPU to compensate. EIDOS's own market price slid quickly after launch (roughly $0.056 to $0.029 within the first week) as farmed supply was dumped, and secondary exploits emerged where attackers hijacked EIDOS transfer-notification hooks to siphon CPU from dApps like EOSBet that subsidized resources for their users.

Why it worked

EIDOS exploited a structural mismatch in EOS's resource model: bandwidth (CPU/NET/RAM) is a shared, finite, non-fee-metered pool, so any activity that is profitable per unit of bandwidth will crowd out activity that is merely useful per unit of bandwidth. Because the "cost" of participating was resource opportunity cost rather than an explicit fee, farming had no natural price ceiling the way gas-metered chains do — the more competitors piled in, the more resources got bid away from everything else, and there was no mechanism forcing the airdrop to internalize the externality it created for the rest of the network.

Why it failed or underperformed

As a token, EIDOS collapsed quickly in price once farmers began dumping supply, and per-participant rewards diminished sharply as more bots joined, giving it the reward dynamics of a saturating farming pool rather than a durable asset. As a network event, it was widely condemned as effectively a denial-of-service attack on EOS, publicized as protest/commentary on EOS block-producer governance and resource allocation rather than a sustainable product; it damaged EOS's reputation for usability at a moment when the chain was competing for developer mindshare against Ethereum.

Lessons

• Resource-metering models without a hard price cap on congestion (unlike fee-market gas auctions) are vulnerable to any incentive that rewards raw transaction volume — "free" bandwidth becomes a commons that gets strip-mined.
• Perpetual, uncapped, pro-rata airdrops create farming arms races where the dominant strategy is to acquire as much of the scarce input (here, CPU bandwidth) as possible, which concentrates rewards among well-capitalized actors rather than distributing tokens broadly.
• Protocol-level congestion caused by one popular application can degrade service for the entire chain when resources are shared and unpriced at the margin, making airdrop and incentive design a systemic-risk question, not just a token-economics question.
• Announcing an activity-farming airdrop with no throttle effectively invites bot competition; any design intending broad, fair distribution needs sybil resistance or diminishing per-account returns, not just a per-second reward pool.

Redesign (EDITORIAL)

EDITORIAL — hypothesis, not fact: A less network-damaging version of EIDOS could have capped the number of round-trips counted per account per epoch (e.g., diminishing marginal EIDOS reward past a small number of interactions per account per day), which would preserve the "airdrop for using the chain" idea while removing the incentive to spam. Pairing the faucet with a resource-usage fee paid in EIDOS itself (rather than free-riding on staked EOS bandwidth) could have made congestion self-limiting, since farmers would need to burn part of their reward to keep farming. Finally, distributing rewards via a lottery or Merkle-proof snapshot of genuine, rate-limited chain activity — rather than real-time pro-rata emission tied directly to transaction count — would have decoupled "get the airdrop" from "spam the chain as fast as possible."