L2DAO Investigation: Summary

To keep things neat I’ve moved my own research into its own thread. Details below:

I’ve identified what I think is the origin of the second transfer of 27,500 OP to a multisig governed by L2DAO’s principals, who then market dump that OP for USDC.

This snapshot completes strong onchain and firsthand evidence that:

  • NFTEarth and this second multisig, called LFGROW, share leadership teams with L2DAO and can be said to be indistinguishable from it as far as management is concerned
  • Layer2DAO principals govern the multisigs dumping OP for USDC and proceeding with other onchain activities apparently inconsistent with the grant’s intention and violating the no-sale rule (regardless of whether it was in force when this grant was made)

I am going to selectively quote the linked proposal authorizing this transfer here, emphases mine:

This is a proposal to the Layer2DAO community to create a new DAO focused exclusively on educational and tooling solutions for L2 NFT creators, artists and owners. In addition to education; the new DAO would have a clear focus on connecting the new knowledge gained by creators/artists/owners to easily accessible infrastructure leading to pragmatic results and the proliferation of NFT development on Layer2 Ethereum. This initiative is to revive and support active NFTs creation (and thus trading) on L2 chains, which have a lot of benefits “by design” vs. Mainnet. NFTEarth is focusing on trading, however, without active creators/projects, there will be no trading; 2. If you are not having huge funding (to be able to develop everything on your own), as a creator/project, you need to use certain tools to create and promote your collections. Unfortunately, most of the tools available in the market as well information are not “tailored” to L2 and are scattered around. Most needed tools are – NFT Generator, Allow/WL list/raffles tool, Launchpad and specific in this case: tool to migrate NFTs from L1 → L2.

So this is supposed to be a separate DAO that receives this grant. However, this purportedly separate DAO comprises the exact same signers as NFTEarth and, like NFTEarth, cannot be credibly determined to be an arm’s-length ecosystem project, as the multisig is controllable by Layer2DAO signers.

Train claims in his response the following:

Train’s claim downplaying their role is misleading and demonstrably untrue. The shapshot’s author, 0xadventurer (whose identity could be an alt of a known principal given the relative lack of historic activity in L2DAO), says so themselves:

funds will be sent to multi-sig controlled by current L2DAO leaders, for them to oversee fund distribution.

This proves by the author’s admission that NFTEarth, whose multisig is identical to the one described here, is in fact run by Layer2Dao’s principals. This is proof that the Layer2DAO team market sold granted OP on two separate occasions.

A follow-up post will describe in greater detail what this wallet has in fact been doing. Suffice it to say it calls into question the stated intentions of the grant.

As a reminder, Layer2DAO’s original proposal states:

Layer2DAO’s stated mission as a DAO is to expand the Ethereum L2 ecosystem and invest in L2 ecosystem projects. As such the DAO aims to use part of its Optimism Fund grant to incentivize high-impact Optimism protocols.

Layer2DAO is proposing to use 240,000 OP tokens to create the OPIncubator project that will incentivise projects that run on Optimism.

I think anyone would take this to suggest that this grant is intended to incentivize outside projects in the ecosystem. If L2DAO had spun up 6 entities with the same two principals and gave them OP to be market dumped, I think that would be correctly understood to be against the spirit of the application or the Grant program as a whole.

What we have here is just this, for at least 2 subgrants (research ongoing).

Finally, I’m not going to address Train’s claims about me, but I do want to make an illustrative point here. Train quotes me to claim that I am being inconsistent in my application of Grant guidelines:

This is a crucial point I want to make. Decentragora is a separate organization that, after interviewing its principals, I judged to be completely at arm’s length from L2DAO. They do not pose the same risk of self-dealing that I am observing in L2DAO’s self-granting two ecosystem grants, one for NFTEarth and one ostensibly for this other DAO described above. Surely anybody can tell the difference here.

But don’t worry, of course, the Layer 2 Dao team assures you that the funds are in good hands:

Moreover – here is my promise that I personally will not “take” any penny from this initial LTIP-7 funding. I’m not doing this for short term benefit, I’m doing this for L2 and way too bigger aims/goals! With this new initiative, we would like to support NFTEarth focus on the Layer2 NFTs market development as well as grow the L2 NFT ecosystem in general!

Future disclosure will discuss what in fact has occurred on these multisigs.


Original post

I can distill some of this info @Dicaso presents into what I think is the key fact here:

There are two multisigs controlled by L2DAO signers that receive and market dump OP. If you grant that one of these is ostensibly NFTEarth’s official multisig receiving an L2DAO grant, I can’t find public justification for the second.

Regardless of what these addresses then did (among other things, sell OP for USDC), the ownership of these multisigs is what to focus on.

Layer 2 Dao’s multisig is Safe – Settings – Setup – addresses are:
0xD131F1BcDd547e067Af447dD3C36C99d6be9FdEB - westonnelson.eth
0xE7a2d53dA40Ba37495d4Cf84811a59AAcE2f04A5 - wallet connected to exospherel2.eth
0x1CabC3e62e0527cBe09917F5Ca8e6D9999502d82
0x357990585a6BB953DCBA126de48585ed27E22319 - wallet connected to exospherel2.eth

The first multisig, 0x56d, which we’ll say is the main NFTEarth multisig, gets 27,500 OP from 0xaf5 on Jan 10. Its owners (2/5 structure) are:
0xD131F1BcDd547e067Af447dD3C36C99d6be9FdEB - westonnelson.eth
0x062a07cBf4848fdA67292A96a5E02C97E402233F - OP delegate address exospherel2.eth
0x1CabC3e62e0527cBe09917F5Ca8e6D9999502d82 - on L2DAO’s multisig
0x119a849400dd8b61c8AB8995cb37AF32dBBD2D8B
0xa2f0F2265DbB5636Ca2dE35a2E4A01b518d5c620

I’m not sure but can surmise that this is the transfer corresponding to L2DAO’s ‘official’ grant to NFTEarth. But because this is a 2/5 multisig, L2DAO principals can be said to control this wallet.

Interestingly, an owner is removed and replaced on Feb 3. The previous owning address had been 0xeafcb5b9f0be74296d89182c9915117e59882f2a and was evidently sunset on Optimism. It was replaced by 0x119a849400dd8b61c8ab8995cb37af32dbbd2d8b , an active L2DAO owner called 0xadventurer.eth.

This may be relevant because the previous day, the 2/4 L2DAO multisig performs a second transfer of 27,500 OP to a different 2/5 multisig . The reasoning behind this transfer is unaccounted for and is suspicious because this multisig has the exact same signers as the first - i.e., it comprises Layer2DAO principals and is functionally controlled by L2DAO signers. This address also methodically dumps all of the sent OP.

So there are two multisigs controlled by L2DAO signers that receive and market dump OP, and one of these transfers I can’t find public justification for.

I think future research should uncover the actions and linkages involving these multisigs and their signers, and I call on @0xWeston or @Exosphere to explain why there are two identical multisigs, both with L2DAO signers, that receive and sell large amounts of OP.

This of course in addition to assembling further information on what ultimately gets done with the funds once they are swapped to USDC.

11 Likes

This is the second part of a series detailing the activities of Layer2DAO’s use of 300,000 in OP granted to them by Optimism Governance last year. These posts reveal a pattern of now three attempts by Layer2DAO to sell and move Optimism grant funds contrary to their stated intentions, Optimism Governance rules and norms, as well as their misuse after sale.

  • Timeline of original sale and bridging of Optimism grant funds here
  • Original post establishing L2DAO’s ownership of multisigs here

In part one, I detailed how L2DAO directed 55,000 $OP to two multisigs (ostensibly NFTEarth and LFGROW) under the pretext of ecosystem grants. Onchain evidence and the team’s own statements confirmed that these wallets were in fact actually controlled by the Layer2DAO. That is, the team granted itself the funds before dumping them to USDC and distributing to individual wallets, violating the no-sale policy.
image

This post will outline what happened to these funds post-sale and transfer. Research has uncovered a remarkably labyrinthine network of short-term wallets moving the proceeds from grant tokens among them. It’s going to take some time to uncover and catalogue all of this, as there is simply too much to distill in one post. I encourage others outside Optimism to take up this work. For now, I will focus on the transactions and flow of funds originating from the purported LFGROW multisig, which is identical in composition to the NFTEarth multisig which and is controlled by L2DAO principals.

Beyond the violation of the no-sale clause, on-chain findings suggest funds were not used in accordance with the stated purpose of the governance proposal behind this grant, which was to “create a new DAO focused exclusively on educational and tooling solutions for L2 NFT creators, artists and owners.” I can find no evidence of this DAO existing in any form.

Rather, after selling much of the OP for USDC, this multisig directly distributes the entirety of the grant’s value in several thousands of USDC and OP to 20 wallets, many of which are connected to other L2DAO/NFTEarth associated wallets and at least one of which belongs to a known NFTEarth team member, milkywave.

Wallets funded by this multisig engage in activities such as:

  • Depositing at least five figures of value directly into a Coinbase deposit wallet used by westonnelson.eth
  • Taking unusual action to obfuscate wallets, duplicating actions across several wallets and using contract integrations that make flow tracking more burdensome
  • Buying up large amounts of NFTE and then exiting these positions at a profit using Uniswap v3 LP positions in a low-liquidity pool
  • Engaging in activities such as pulling liquidity before buying up more NFTE and manipulating price upwards only to re-exit the positions later through liquidity pulling
  • Ultimately pull nearly all liquidity out of the token, sending it to close to zero, its current value, mostly after after public evidence of misuse was surfaced
  • Participating in the exchanging and wash trading of NFTs on NFTEarth between them, obscuring value exchange and juicing NFTEarth stats highlighted in public comms

Every single transaction on this multisig (and likely that of NFTEarth) is signed by the same two wallet addresses: westonnelson.eth and a second address that evidence suggests is likely also owned by westonnelson.eth.

In short, funds quickly leave the purported LFGROW multisig and are distributed to individual wallets with no observable value generated that aligns with the stated goals of LFGROW grant; rather, value is primarily extracted directly to a Coinbase account used by westonnelson.eth.

LFGROW Multisig: Major Findings

Overview: This multisig distributes funds to 20 different wallets, some apparently belonging to team members for personal use, contrary to the governance proposal’s claim.

Relevant Wallets:

L2DAO Multisig 1: 0xaf5a0068f5465260a1a88a6264d0dce4469609cf

  • Recipient of original OP Grant

L2DAO Multisig 2 - 0x79ff559431891cfa36fa1e7589c845f2b8831201

  • Owner of L2DAO Velodrome veNFT

LFGrow Multisig - 0x5a711a7aae4a270c05fb9d67544ddcd2694bdc2c

NFTEarth Multisig 1 - 0x56d02ede412b7a786e0662219676439757794fb4

NFTEarth Multisig 2 - 0x78ed254b9c140c1a2be10d2ad32c65b5f712f54b

  • Same signers as NFTEarth Multisig + LFGrow Multisig

General Observations

All transactions on NFTEarth and LFGGrow 2/5 multisigs are signed exclusively by two parties: westonnelson.eth and a second signer.

  • Weston Nelson: 0xD131F1BcDd547e067Af447dD3C36C99d6be9FdEB
  • Second Signer: 0xa2f0F2265DbB5636Ca2dE35a2E4A01b518d5c620

It seems highlighly likely the second signer is the same person as westonnelson.eth as his address was the first and most frequent sender of funds to the second wallet address, including initial gas deposits. 1 westonnelson.eth also transferred/sold several NFTs to the second signer’s wallet, which is a common practice in individuals seeking to book tax losses in a calendar year.

In short, not only did L2DAO control the two multisigs that they granted, but there is strong evidence to suggest Weston Nelson had total control over the grant funds contained within them. This also aligns with the evidence that a significant portion of the sold funds made their way back (via multiple wallets) to a Weston Nelson-used Coinbase address.

LFGROW Multisig

This is the multisig managing the second 27,500 OP distribution, ostensibly to a DAO created to focus “exclusively on educational and tooling solutions for L2 NFT creators, artists and owners NFTs on L2.” We now know that the multisig address is in fact controlled by Layer2Dao principals if not Weston Nelson himself. The NFTEarth team refuses to disclose who is on this multisig, claiming even the anonymous identities of second signer and non-Weston members are “private”.

It is worth noting that L2DAO community members publicly raised concerns about this grant prior to its vote:

Below is timeline of key events:

Feb 2

Feb 3

  • Swaps ~3k OP for ~10k USDC in two transactions 1, 2

Feb 14

Distribution to several fresh wallets. We’re going to have to describe each of them below.

Feb 15

Feb 16

Feb 22

Feb 25

Feb 26

Believed Team Wallets

Wallet A

0xd155f38a8e8de6ff51981ad1af3d524794544f1b

Mostly a relay wallet.

Receives two 250 USDC distributions from LFGROW multisig and one 100 OP distro from NFTEarth multisig

Gas funded by 0xa8fd40f305ae7802d07051da9ee3c2d947f3be9f

Receives 800 USDC from Alternate NFTEarth Multisig

2/24 Swaps 100 OP for USDC

Sends 1600 USDC back to 0xa8FD40f305AE7802D07051Da9eE3C2D947F3bE9f

Receives another 800 USDC 0x78ed254b9c140c1a2be10d2ad32c65b5f712f54b and immediately relays to Binance deposit address 0xc563939d59620f6ddc9e64f5a9f4bf94c3ce689a.

Wallet B

0x533efe4be8ac3db73ace6a9693e32d9eb9766ada

Gets gas from 0x7d3e5dd617eaf4a3d42ea550c41097086605c4af, ryuzaki01.eth

Likely dev payout, paid from both NFTEarth and LFGROW multisigs

Funds still there

Wallet C

0xe080cca10d375face1bdcc8529dbb58bfa90cfda

Funded by Binance wallet

Sends everything to what looks like cold wallet: https://debank.com/profile/0x68fb45903efe31c296a88ce2de5a26dc91aa5547/history

Also paid by alternate NFTEarth multisig https://debank.com/profile/0x78ed254b9c140c1a2be10d2ad32c65b5f712f54b

Wallet D

Apparent dev wallet; does not do anything with funds.

https://debank.com/profile/0xaf416b6310840e372da03994ea778a118b7b844f

Funding wallets:

0xe2665358fcd9ecd3f40fe4d1d87d473236180202

0x390e263d1734e3997dd5f61ace3ffffc66ab0b34

500 USDC from Multisig 2

100 OP from Multisig 1

Also receives 3700 USDC from Alternative NFTE multisig 1,2,3,4,5

Wallet E

0x8cb2c246264fe4106edea4b86120d9555caa5d31

Connected to a large network of wallets that all seem to do the same actions - enter the NFTE market through LP and swaps, and moving NFTs.

Connected wallets:

0xdf23b8510848b1fa707980136f7cb7864186004e

0xe5f6c1d3ab1c0d4fce14975717541f8f4fad2b26

0x79ff169de4b6e4259c03e7e2a12c4f1d814b35a5

Network of wallets that seem to do the same things, as though they sibyl activities

Wallet F

0x9581c5df8ea9a0aa84e52f40a378d7339bedccc3

5000 OP from LFG multisig

All swapped to USDC and ETH within hours 1, 2, 3, 4, 5

https://debank.com/profile/0x9581c5df8ea9a0aa84e52f40a378d7339bedccc3/history

2/17

EXAMPLE OF LAUNDERING OP THROUGH NFT SALES

Buys up chads and L2stateofmind NFTs from Wallet G 0x4e9df8fb6b266d7ca430fab6e8a2e8c8f0170595#tokentxns (funded by 0x81ad206d5438e6d0b368812d90ee5a00a18ac0da swaps all for NFTE and sends most received funds to Wallet L

The rest is sent to 0xd004bd8490b761202f3c0a139d446be7153e03c7

Bridges 2 eth to Arbitrum to wash trade NFTs 1,2 (smolbrain sold to 0x4e9df8fb6b266d7ca430fab6e8a2e8c8f0170595)

In general:
early buyer of

There are just too many instances to count but I’ll just tally up related wallets

0x7b91FA01Dc8Cb3bC55E1781163f5aEaed6747d10

  • westonnelson.eth connected wallet — has multiple transactions

There are simply too many transactions here to recount but in summary:

Too many tx’s to count so refer to https://debank.com/profile/0x9581c5df8ea9a0aa84e52f40a378d7339bedccc3

Wallet G

0x4e9df8fb6b266d7ca430fab6e8a2e8c8f0170595

Wallet H

0xFA6461Bb191D63854A995b9a20c9e751B426dAff

Basically the same as Wallets F and G, trade NFTs, swap for NFTE and send to Wallet L

Wallet F

0xcab9f6c96f7e404f5a6799b795feb10231c1c71b

750 USDC from Multisig 2

Mostly used for onchain speculation

Wallet G

0x903d7cca2c906992a3580a274431f1c8c718e987

Confirmed Milkywave’s wallet.

Jan 25 - Sent 250 OP from Multisig 1

Feb 3 - Sent 50 OP from Multisig 1

Feb 15 - Sent 1000 USDC from Multisig 2

Also receives Llamapay from Thales:

https://optimistic.etherscan.io/tx/0xab48c2532b951b15db742a40bfa082a61814696ef45616c8d38c1684e7472f27

And receives milkywave.lens

Wallet H

0x065625c463b857013da7f1a7267d56d317f7a8c2

Feb 22

Feb 25

Feb 27

  • Buys back NFTE

Mar 3

Mar 19

Wallet I

0x49a9561f5631db7a062b3048740939ed62391892

Feb 22

Feb 23

Feb 25

Wallet J

0x337c57c361e7eec6153524b615e2109a23752162

gas eth funded by Wallet I

Feb 22

Wallet K

0x8c7e0268dea8603b6e9a09b593d8e9056c371cda

3500 USDC funded by Multisig 2

USDT to ETH, Eth swaps to NFTE with some LPing and trading

Wallet L

0x8acd4ee46a97be6e483dcfcc99263915abde996a

aka, the base wallet of the sibyl network

There’s so much stuff happening on this wallet that it really needs its own post

Highlights:

Sends at the time 150k USDC worth of NFTE to four wallets

Sends to 0x73dbdd23279e92015d4fa983f9f05adea549855f

Following start of allegations, moves funds to new wallet 0x5422a41174b5bbc639f82352dc1ac33c6b256eab/history which has been taking ETH and buying up NFTE with hit.

Wallet M

0x54d65f117b5496ccdc155208048fc15334ae0dec

7000 USDC funded from LFGROW wallet

ETH from 0xf8d6ae551667887180ddbc4a5b8a652f11e8bc11, which itself is funded by Wallet L

CEX deposit addresses:

Coinbase deposit 0x106e04a17f7462967b7df788ea29018cdc59ca4b

14 Likes

Layer2DAO’s response to the accusations of grant misuse can be found here:

2 Likes

A move to freeze delegation for l2dao and to all its partner projects temporarily for further investigation and not add any more damages to this kind of activity. I move to vote !!!

3 Likes

We need a responsive & responsible mechanism for this kind of scenarios coz this is just one of the challenges we will be facing as a growing ecosystem and would require certain rules of conduct and also we would like to know if Optimism Foundation has an Optimism Audit Team or Program for this instance. This would be for transparency and clarity for any issue brought here not only for L2DAO alone but for the benefit as a whole. Let’s go Optimism.

4 Likes

Hopefully :pray: there are better ways to prevent this type of event from happening. The grants council that is in charge of reviewing grants is extremely overwhelmed with work every season. There is no doubt that some bad actors will continue to slip through the cracks.

It has been left up to fellow community members of the token house to report this project in other L2 ecosystems which is seemingly the best solution for now. Until there is any enforcement from the actual Optimism governance for large amounts of funds like this 300,000 OP tokens.

I am sure that isn’t a relatively small amount of funds that are being written off as a loss. The team has completely disappeared from participation in the governance forum of the Optimism ecosystem. It’s really sad for other builders who are struggling to build their product when they see this happened.

It does appear that karma is becoming a big lesson as delegates on the governance of Arbitrum have voted :ballot_box: against the proposal that was recently submitted.

3 Likes

This is the wrong conclusion to make. This grant came during a different period (not under the grant council) – and it was in fact a grant council member who exposed much of this in his spare time.

The current structure of grants and governance has much more capability to enforce, with the introduction of milestones, the ability to claw back funds, and different patterns of OP distribution. Moreover, I think the Grant Council has done a fantastic job in choosing where to place bets.

I’m not really sure what tack you’re taking by resurfacing an old thread, but I’d encourage you not just to look forward but to look around you and observe how far we’ve already come.

4 Likes

You were not in the governance forums of Arbitrum exposing this were you ?

Please let me know if I am wrong.

Hopefully :pray: there are better ways to prevent this type of event from happening. The grants council that is in charge of reviewing grants is extremely overwhelmed with work every season.

I’m saying that yes, there are now better ways to prevent this type of event from happening – and to enforce rules if it does happen.

1 Like

He’s saying that this report here was made by a council member. And that the grant approved was not part of the grants council process.

2 Likes

Okay cool. :sunglasses: Maybe there is some confusion here. I am referring to the STIP grant that is approaching the final moments of a vote :ballot_box: currently within the Arbitrum ecosystem.
A community member who was banned from the OP governance forums who is also a grant recipient here on Optimism and RPGF round #2 recipient spearheaded the discussion on the Arbitrum gov forums which helped governance delegate members decide their final vote.

2 Likes