Comprehensive Security for NFT Launches
A standard Discord whitelist bot accepts any wallet, while Sybil attacks drain up to 30% of slots, destroying the ecosystem. On one project, we faced a situation: within an hour after registration opened, the bot received over 5,000 applications, 80% of which came from suspicious accounts — no history, zero balance. This cost the project tens of thousands of dollars in missed mints. We designed a system that combines deduplication, on-chain verification, and Merkle Tree generation, reducing WL preparation from a week to 3 days. Results: 99% of fake accounts are filtered out, real holders get priority. Our Discord whitelist bot with Sybil protection and Merkle tree generation ensures secure NFT launches. Contact us to discuss your project.
How to Protect a Whitelist from Sybil Attacks?
The Sybil Problem and Its Solutions — Discord Bot Development
A basic bot simply records a wallet address — no protection against multiple accounts from one person. Large collections attract hundreds of bot accounts with purchased Discord history.
- One wallet per Discord account — minimal level: if a wallet is already registered under another Discord ID, reject it. Does not protect a user with multiple Discord accounts.
- Guild membership requirements — registration requires being in the server for N days, having X messages, or having a specific role. This raises the attack cost: buying an aged Discord account is more expensive than creating a new one. For example, requirements "account older than 7 days and 50 messages" filter out up to 60% of bots.
- On-chain activity check — the most reliable filter. The bot checks via Alchemy/Etherscan API: whether the wallet has a transaction history, NFTs from specific collections (OG holder), POAPs, or a minimum balance. Such verification is 3 times more effective than basic deduplication — it not only counters Sybil but also serves as target marketing: WL for real collectors, not flippers.
Based on our experience, on-chain verification reduces fake registrations by 99%.
Ethereum Address Validation
A common mistake: the bot accepts any string that looks like an address without a checksum check. A user enters a lowercase address — that is a valid Ethereum address. However, when generating a Merkle Tree for the contract, normalization is required: all addresses via ethers.utils.getAddress() or viem.getAddress() for EIP-55 checksum. A mismatch in case in the Merkle Tree will prevent the user from minting even with the correct address.
Check: ethers.isAddress(input) before writing + normalization via ethers.getAddress(input).
Comparison of Protection Methods
| Protection Level | Implementation Complexity | Effectiveness Against Sybil | Setup Time |
|---|---|---|---|
| Only discord_id | Low | Low (1 account = 1 slot) | 1 hour |
| + Account Requirements | Medium | Medium | 2-3 hours |
| + On-chain Check | High | High (up to 99% fakes) | 4-6 hours |
How to Set Up Multi-Layer Protection: Step-by-Step Guide
-
Deduplication by dual binding — the database stores pairs
discord_id ↔ wallet, excluding duplicate registrations. Setup takes 30 minutes. - Filtering by guild requirements — set account age (>7 days), minimum number of messages (50+), or role. Increases attack cost by 5x.
- On-chain verification — via Alchemy, check balance (>0.01 ETH), history (>10 tx), or NFT ownership from a whitelist. Detects up to 99% of bots.
- Merkle Tree generation — after registration closes, the bot collects all valid addresses, normalizes them (EIP-55), and builds the tree. The root is sent to the contract, proof to users.
More about Alchemy Setup
For on-chain checks, we use webhook requests to the Alchemy API. Configure a Node.js module with axios and ethers.js — the bot handles up to 100 requests per minute without delays.Bot Functionality
Wallet Registration. /wallet 0x... — the user enters an address. The bot validates, checks duplicates (both directions: Discord ID → wallet and wallet → Discord ID), and saves to the database.
Roles and Privileges. Separate roles for different WL categories: OG (priority mint, more slots), WL (standard), Public. The bot automatically assigns a role after on-chain criteria verification.
List Management. Admin commands: /wl-export — CSV export, /wl-stats — count by category, /wl-remove @user — remove from list, /wl-check 0x... — check address.
Merkle Tree Generation. On request or automatically before deployment — the bot generates a Merkle Tree from accumulated addresses and outputs the root for the contract. Proof for each address via API or direct message.
Why Trust Development to Professionals?
Our experience in blockchain tools exceeds 5 years. We have delivered over 30 projects for NFT collections and DeFi protocols. This is not our first work — we know typical mistakes (missing checksum normalization, data leaks through logs, incorrect gas calculation) and guarantee their absence. On-chain verification reduces moderation costs by up to 70% — Manual whitelist management costs $1,000 per month; our bot reduces that to $300, saving $700 monthly. Order development for your project. Get a consultation on setting up a bot for your collection.
Tech Stack
discord.js v14 — main library. Slash commands instead of prefix commands (modern Discord standard). Interaction handling with ephemeral responses for commands with personal data.
Database — PostgreSQL (for production) or SQLite (for small collections). Storage: discord_id, wallet_address, registered_at, wl_tier, on_chain_checks_passed.
ethers.js v6 — address validation, Merkle Tree generation via merkletreejs + keccak256.
Deployment — Railway or VPS with PM2. For reliability — webhook-based deployment instead of long-polling.
Comparison of Development Stages
| Stage | Time | Cost |
|---|---|---|
| Basic bot (registration, deduplication, admin commands, export, Merkle) | 3-4 days | $2,500 - $5,000 |
| + On-chain activity checks and multi-level WL roles | 5-7 days | $5,000 - $10,000 |
| + Custom mechanics (gamification, quests) | additional | negotiable |
Cost is calculated individually after requirements analysis — get a consultation on setup.
What's Included
- Full bot code with open documentation
- Deployment on hosting (Railway / VPS)
- Configuration of on-chain checks via Alchemy / Tenderly
- Merkle Tree generation and integration with smart contract
- Admin training (up to 2 hours)
- 30 days of support after delivery