1. Introduction

2. What oddities in the process of quickly analysing wallets and transactions caught the eye for a more in-depth look

3. Analyse transactions and movements of funds with the same patterns

4. Intermediate output and comparison of CEX withdrawals to a token price chart

5. Conclusion

1) Introduction

Note: This material is the personal subjective opinion of the author and does not represent the position of any company of this matter. USD equivalent figures are very approximate and are based on approximate data about the token price in certain time periods, so this information cannot be considered accurate. There may also be some discrepancies in the transaction overview despite multiple verification, due to which the value of funds in USD equivalent may fluctuate in some range. The purpose of this research is not to establish absolute figures, but to understand the situation and build a general picture.

In the transactions involving the Lybra Finance token, LBR, some peculiarities have been observed. Numerous empty wallets have been mining LBR tokens and promptly transferring them to MEXC, Poloniex, and Kucoin. Interestingly, these wallets share a common trait - they were all funded ETH for transaction fees via the ChangeNOW exchange. However, is the situation as clear-cut as it appears? It's worth noting that deposits to exchanges did not consistently result in a decrease in the exchange rate, as can be seen in the graph at the end of this research. This may be a way of providing liquidity for marketmaking on exchanges. Let's consider when these transactions were made and what were the price movements during these movements of funds - it is possible that the project does not have its own MM and market-making is done manually.

A user on Lybra’s Discord asked a similar question to the team:

Response from team member, 0xMarketing: Spoke to team! The vesting schedules (for the allocations) are only set up on the v1 version of the contracts, so the team simply claim the correct and available amount of tokens from the ecosystem incentives and treasury, migrate them, and then move to another wallet for an added layer of security, of which some have been set aside on the exchanges you mentioned to account for some upcoming operation expenses, mostly with respect to v2, such as audits, hires, liquidity provisioning and other associated costs 🙂 hope that helps! TL;DR - the team were so focused on making sure everything worked appropriately for users, they forgot to pay themselves for the operational expenses!

Why this version is questioned: every few days, amounts of 10k to 50k tokens or more are withdrawn to exchanges, which depending on the exchange rate can range from $6k to $100+k or more, and that seems like a lot of money to "cover operating expenses".

2) What oddities in the process of quickly analysing wallets and transactions caught the eye for a more in-depth research:

Let's try to untangle this tangle. First of all, let's look at the first suspicious wallet 0x4045ee04f0609804f93906fB7aAb83f672F3A903: this wallet received 0.019 ETH from ChangeNOW, and then LBR tokens from Null address, which were then sent to Kucoin and MEXC, time - 25 July 2023, 12:50:

Another interesting address that started funds with ChangeNOW, branded LBR and immediately, within minutes, transferred tokens to an address called Token Unlocking - 0x7fdc573Bf4b28F689b25a4A77604019585836F3f:

Let's check the addresses to which LBR tokens are sent from the Token Unlocking address (to be fair - it should be noted that some addresses have a real history of use and there are no ETH inputs from ChangeNOW and the accrued LBR settles on the wallets:

Among these addresses, one of the interesting ones is 0x5B9B9A8bB4481e6A70A4230612db9bB88D2694bC - this wallet does not hold LBR, since receiving $200k $LBR via Gnosis Safe Proxy this wallet gets rid of Lybra tokens, including sending them to other addresses. But for example, one of the addresses, 0x6A50B55551203863a3649652eBE9AAC653C844db81, loads the received LBR tokens into liquidity on Uniswap.Another, 0x5B9B9B9A8bB4481e6A70A4230612db9bB88D2694bC - also receives LBRs from the Token Unlocking wallet but it sends them further into liquidity on Uniswap v3.Another strange wallet that only LBR received in large amounts is 0xE388FE4074Bf9d317cE40387D1D87C622d7C9537:

Let's take a closer look at this address. In the picture below we can see that the wallet does not store LBR, but transfers tokens either to Token Unlocking wallet or to another address, and after transferring all LBR to other wallets returned ETH to ChangeNOW:

Also we see on this wallet an incoming transaction of 0.2 ETH from wallet 0xae2517..., and if we go to this wallet - bingo! Again, the ETH is brought in from the ChangeNOW (the incoming ETH transaction is highlighted in green, and the outgoing transaction to wallet 0xE388F..., which we looked at above, is highlighted in red):

Further, from wallet 0xE388F... there is an outgoing transaction for 17,834k LBR to 0xfccf5..., which after receiving LBR also received ETH from ChangeNOW and sent all LBR to Poloniex, and returned the unspent ETH to ChangeNOW as well:

Another interesting transaction from wallet 0xE388FE... - 75.76k LBR to wallet 0x29773a... which received ETH from wallet 0x5Ec01... and then sent 75.5k LBR to wallet 0x96B64..., which also received ETH from address 0x5Ec01.... and then the last wallet sent LBR in smaller transactions to other wallets:

Next, wallet 0x96B64 ... sent LBR in instalments to several different wallets:

Wallet 0x325A9b... received 9.82k LBR that were sent to Poloniex, as well as 0.98 ETH from ChangeNOW that were distributed to other wallets to which LBR from wallet 0x96B64... was distributed (these addresses are marked in yellow... (these addresses are marked in yellow), and the rest of the ETH was sent out in small transactions to ChangeNOW most likely to confuse the trail and deposits to other wallets:

From all these wallets, which have no activity other than LBR deposits and withdrawals, LBR tokens were sent to Poloniex between 1 June and 2 June. And just on the 2nd of June the value of LBR token started to fall:

But on the other hand, for example, we see a transaction on Poloniex from a wallet that mined 70k LBR, received a deposit of ETH from ChangeNOW in advance and sent them to Poloniex on 15 June at 8:17 UTC, after which the token price started to grow:

3) Analyse transactions and movements of funds with the same patterns:

Let's consider a few more wallets that mined large LBR transactions (this is only a part of them, as there are a lot of transactions). Some transactions have minimal data as they were added later, and the patterns and patterns are similar to other transactions - empty wallet, receipt of minimum amount of ETH for payment from ChangeNOW, mined LBR and sent to Kucoin, Poloniex, Mexc or just sold on Uniswap before listing on CEX:

• 19 May - $16k$ + 17k$

• 20 May - 23k$ Uniswap

• 0xf339FfA947Feb8cA18D2eA7Bd08326b94b0705dD - received ETH through a sequence of wallets, of which wallet 0x2C8b25... ETH was deposited via ChangeNOW. The 21.5k LBR tokens that came in - were sold on Uniswap between the 20th and 21st of May.

  • Summary: 27k$

• 0x2b087d61b28c83D269dB9dEf4183313ac9EE184a - as with the 20 May transactions, received ETH through a sequence of wallets, of which wallet 0x2C8b25... ETH deposit was made via ChangeNOW. 21.9k LBR was received, which was sold on Uniswap for $33.19k at an exchange rate on 21 May from 05:30 to 06:48 UTC

• 21 May - 29k$ Uniswap

• 21-22 May - $32k Uniswap

• 22 May - $34k Uniswap

• 0x57B22C8d566aD1BBAB5379d4bB1225121A85EEC8 - as with the 20 May transactions, received ETH through a sequence of wallets, of which wallet 0x2C8b25... ETH was deposited via ChangeNOW. 20,193k LBR was received, which was sold between 22 May and 23 May.

  • Summary: 34k$

• 23-24 May - $35k$ Uniswap

• 24-25 May - $31k Uniswap

• 0x6Af85de8E8aEf04188BF5c3673034B2045109FB6 - ETH entry from ChangeNOW, mint 50k LBR that were sent to Poloniex in one tranche of 50k LBR on 7 June 03:05 UTC.

  • Summary: 358k$

• 0x0a9252f4B75822353be72a7187afBafDf44b817a - ETH input from ChangeNOW, mint 50k LBR, which were sent to Poloniex in one tranche of 50k on 17 June 10:45 UTC, and the remaining ETH were sent back to CahngeNOW.

  • Summary: 43k$

• 0x61ED207d71D70AB1a26b38Ca04B43355d5045A7E - ETH entry from ChangeNOW, mint 56,515k LBR that was sent to Poloniex in multiple tranches:

  • 30k LBR - 19 June 11:00 UTC

  • 26,151k LBR - 19 June 11:02 UTC

  • Summary: 73k$

• 22 June 13:12 UTC - 45k$

• 23 June 06:23 UTC - 31k$

• 0xb13364cE9af53898494911F111147f4148B46d24e5B7 - ETH entry from ChangeNOW, mint 25k LBR, which was sent to Poloniex in one tranche:

  • 25 June 08:15 UTC

  • Summary: 33k$

• 27 June 12:04 UTC - 30k$

• 0xC4397a0558E5EdAE89A6193395cDcC8ad9fd9e9c - Repeated entry of ETH from ChangeNOW, mint 20k, 40k 15.75k LBR that were sent to Poloniex in multiple tranches: 28 June 03:15 UTC to 03:16 UTC 29 June 08:48 UTC.

  • Summary: 50k$

• 0xd4c4706B0281fE62841Cb52aA7c11203b73fDeCD - ETH entry with ChangeNOW, mint $50k LBR that was sent to Poloniex in multiple tranches:

  • 25k LBR - 30 June 4:10 UTC

  • 25k LBR - 30 June 04:12 UTC

  • Summary: 83k$

• 0x686f6C0009f031A4d35a05D7b8E9C9661db9802d - ETH input from ChangeNOW, mint 50k LBR that were sent to Poloniex in multiple tranches:

  • 20k LBR - 1 July 3:39 UTC

  • 10k LBR - 1 July 3:40 UTC

  • 20k LBR - 1 July 3:42 UTC Summary: 96k$

• 0x9AA004F6D766175971BcCc09A4F5ad68CF3768E4 - ETH entry from ChangeNOW, mint 45k LBR that was sent to Poloniex in multiple tranches:

  • 20k LBR - 1 July 17:46 UTC

  • 10k LBR - 1 July 17:48 UTC

  • 15k LBR - 1 July 17:49 UTC

  • Summary: 95k$

• 0x0c5026a508646aC7fCb04a6455dC9918DE1FFFC5 - ETH entry from ChangeNOW, mint 50k LBR that was sent to Poloniex in multiple tranches:

  • 25k LBR - 2 July 14:00 UTC

  • 10k LBR 2 - July 14:01 UTC

  • 15k LBR 2 - July 14:02 UTC

  • Summary: 93k$

• 0x00D684B2A20f98f99Ace6E1d66b32f2DFF8c68F5 - ETH entry from ChangeNOW, mint 49.95k LBR that was sent to Poloniex in multiple tranches:

  • 21k LBR - 3 July 10:30 UTC

  • 22k LBR - 3 July 10:31 UTC

  • 5k LBR - 3 July 10:34 UTC

  • 1.95k LBR - 3 July 10:37 UTC

  • Summary: 100k$

• 3 July 03:26 UTC - 54k$

• 0x4e75C454f5b74924e896Dade6862c64DE3651fcB - ETH entry from ChangeNOW, mint 25.05k LBR that was sent to Poloniex in multiple tranches:

  • 20k LBR - 4 July 14:30 UTC

  • 4.95k LBR - 4 July 14:37 UTC

  • Summary: 59k$

• 0x2F0Ce0311F28D020074FF20E1F3E4044C2926143 - ETH entry from ChangeNOW, mint 10k LBR that was sent to Kucoin in one tranche:

  • 5 July 15:44 UTC, 23,9k$

• 6 July 06:04 UTC - 24.4k$ Kucoin

• 6 July 06:13 UTC - $27.4k$ Kucoin

• 6 July 09:25 UTC - $26.4k$ Kucoin

• 6 July 17:03 UTC - 44.2k$ Kucoin

• 7 July 06:28 UTC - 57k$ Kucoin

• 7 July 14:18 UTC - 33k$ Kucoin

• 8 July - 22k$ Kucoin

• 0x1B4cabb230efC4aB8161cad54d327819f0D96559 - ETH entry from ChangeNOW, mint 20k, 17.5k and 12.45k LBR which were sent to Kucoin in multiple tranches:

  • 10,371k LBR - 11 July 04:48 UTC $23.23K

  • 9,355k LBR - 11 July 04:50 UTC $20.86K

  • 15.5k LBR - 11 July 04:53 UTC $34.57K

  • 10k LBR - 11 July 04:55 UTC $22.30K

• 11 July 01:48 UTC - $43.2k

• 11 July 01:56 UTC - 216k$

• 4,724k LBR - 12 July 08:00 UTC $9.83K

• 0x6AAA6D7023dFdE28f8C299186d0a119F54329A7F - ETH entry from ChangeNOW, mint 23.55k LBR which was sent to Kucoin in 3 tranches:

  • 16 July 10:46 UTC

  • 16 July 13:39 UTC

  • 17 July 08:13 UTC

  • Summary: 50k$

• 18 July 07:55 UTC - 37k$ MEXC

• 0x1d8cF32a5017C9B704fd3d268a1fD511001c90CD - ETH entry from ChangeNOW, mint 20k LBR that was sent to Poloniex in multiple tranches:

  • 10.31k LBR - 19 July 04:51 UTC

  • 9.69k LBR - 19 July 16:07 UTC

  • Summary: 36k$

• 0x05017464d60c8Fa309Ad167f7Ca75B8d91859c04 - ETH entry from ChangeNOW, mint $20.37k LBR that was sent to Kucoin in multiple tranches:

  • 9,935k LBR - 20 July 10:17 UTC

  • 10,435k LBR - 20 July 10:18 UTC

  • Summary: 37k$

• 0xA6393893A0e2C9D8C0A9CA9bA4D33cCd4CC5B629 - ETH input from ChangeNOW, mint 11.8k and 43k LBR that was sent to Kucoin in multiple tranches:

  • 11.8k LBR - 21 July 08:08 UTC

  • 23k LBR - 21 July 20:48 UTC

  • 20k LBR - 21 July 20:51 UTC

  • Summary: 90k$

• 22 July - 32k$ 23k$ Kucoin, MEXC

• 24 July 08:18 UTC 25k$ MEXC

• 25 July 09:39 UTC 22k$ Kucoin

• 0x7fdc573Bf4b28F689b25a4A7760401958585836F3f - ETH entry from ChangeNOW, mint 30k, 20k and 100k LBR which were immediately sent to TokenUnlock wallet. Also interesting is the fact that some of the wallets that received tokens from the TokenUnlock address sold them on Cowswap

4) Intermediate output and comparison of CEX withdrawals to a token price chart:

Only 200-250 first transactions were analysed here, which were ranked by the number of LBR tokens in the transactions. Based on this data, we can assume that:

• LBR tokens are mined and withdrawn to Kucoin, MEXC and Poloniex exchange wallets almost every day from wallets that are funded with ETH from addresses linked to ChangeNOW to make LBR withdrawals from the wallets.

• The above pattern is repeated with a large number of wallets, sometimes through intermediate transit addresses, some of which are linked by ETH transactions and almost all of these wallets are empty, with no other activity on them, which also suggests that actions with these wallets were done according to the same scheme and this suggests a common pattern of behaviour.

• The team in Discord claims that this is how the funds were transferred to finance the development of the project, but the problem is that the total amount of $2.5m, which is quite a significant amount, is obtained even only for selected transactions (and there are many more such transactions). And the team answers questions about these transactions directly that it is to cover operating expenses, and there is no talk about farmers. And even if the team claims that they are farmers - the same pattern of behaviour of a huge number of different wallets would not be in favour of this version. And most likely, the real amount of funds withdrawn in this way is closer to $5m, if we consider that we have considered only 40 days, and transactions go every day from may.

• Even if we assume that there are 6-10 people in the team, who get $10k per month, the sum of $60-100k per month will be obtained. And even if we assume that the project has been in development since December 2022, the maximum amount of operating expenses is $800-900k, but in reality the real figure for operating expenses is probably somewhere between $300-600k plus a maximum of $300k for audits. Considering that the project has still raised $480k on IDO - the team is clearly lying when claiming that these funds are needed to cover operating expenses.

• There is a possibility that the team may be using these funds for MM and liquidity maintenance, but then it looks strange to use a scheme with different empty wallets and sending ETH only for transactions with confusing traces.

Finally, we can compare the price chart and the outputs to the exchanges to try to trace the correlation between the minting large amounts of tokens and pressure on the token price. But it is also worth considering that it seems that the bulk of tokens in the circulate may be concentrated in the hands of the team or those close to the team (judging by the fact that the team does not deny transactions using ETH with ChangeNOW and the similarity of wallet patterns), and the concentration of tokens in the same hands allows drawing any chart due to direct liquidity management:

For comparison, below are charts that show the Mcap and Circulation Supply dynamics of the Lybra token:

5) Conclusion:

On the example of comparing the price chart and LBR transaction movement, we see that there is no obvious correlation between the price drop and token minutiae to disposable wallets with subsequent withdrawal to CEX. Moreover, in some cases, even on the contrary, the dynamics of the token price turned out to be positive. Therefore, we cannot confidently assert that there are any negative processes, especially considering that Lybra occupies almost 50% of TVL in LSDfi and is actively preparing for the launch of V2.

But nevertheless, it is also worth considering that the team's words that these transactions are needed to fund the development do not agree with the amounts of funds that were withdrawn to CEX through one-time wallets with the same patterns, as well as the fact that some transactions have clear signs of trail confusion. And it looks really strange considering that the project team is anonymised. Perhaps the Lybra Finance team can provide more detailed and detailed information about these funds and the use of this money realisation.