Executive Summary
JIL Sovereign's sybil cluster detection system identifies wallets controlled by the same entity using a union-find data structure with four independent correlation signals. When wallets are merged into a cluster, they are treated as a single trading entity for toxicity scoring and enforcement purposes.
Four Correlation Signals
| Signal | Detection Method | Weight |
|---|---|---|
| Temporal Correlation | Synchronized submission patterns within a configurable time window | High |
| Directional Correlation | Consistent same-direction trading across wallets | Medium |
| Funding Chain | Common funding source analysis (on-chain tracing) | High |
| Behavioral Fingerprint | Order size patterns, timing preferences, asset selection | Medium |
A minimum of 2 of 4 correlation signals must be present to merge wallets into a cluster entity. This prevents false positives from any single coincidental correlation.
Union-Find Data Structure
The union-find (disjoint set) data structure efficiently tracks wallet-to-entity mappings with path compression and union by rank for near-constant-time operations.
class SybilClusterDetector {
parent: Map<WalletId, WalletId>
rank: Map<WalletId, number>
find(wallet): EntityId {
// Path compression
if (parent[wallet] !== wallet)
parent[wallet] = find(parent[wallet])
return parent[wallet]
}
merge(wallet_a, wallet_b): void {
// Union by rank
root_a = find(wallet_a)
root_b = find(wallet_b)
if (rank[root_a] > rank[root_b])
parent[root_b] = root_a
else
parent[root_a] = root_b
}
}Retroactive Attribution
The retroactive cluster attribution mechanism is the key defense against "clean wallet" evasion. When a new wallet is linked to an existing cluster:
- All historical trades of the new wallet are reassigned to the cluster entity
- The composite toxicity score is recalculated with the merged trade history
- Any enforcement actions (spread widening, position limits) are immediately applied
- The historical score contribution is backdated, preventing score reset via new wallets