Detecting DeFi Bot Activity: Separating MEV Scripts and Farmers From Real Users

Launch a DeFi protocol with an incentive program and the liquidity floods in, most of it from bots. When the emissions stop, the same liquidity vanishes overnight because it was never a user, just a script chasing yield.

Not every DeFi bot is a problem. Arbitrage and liquidation bots keep markets healthy. The bots that hurt you are the ones farming the points, airdrops, and reward programs you built to attract real people.

Why incentive design attracts bots

Liquidity mining and points programs pay for behavior, so they get exactly the behavior they pay for, whether or not a human is behind it. A farmer optimizes ruthlessly:

• Many wallets, one operator, to multiply per-wallet rewards.
• Minimal-risk positions engineered to farm points without real exposure.
• Instant exit the moment emissions drop below the farmer’s threshold.
• Cross-protocol reuse of the same infrastructure across every new launch.

The mercenary capital shows up as impressive TVL and vanishes as soon as the reward math turns, leaving a protocol that looks adopted but is not.

What on-chain data cannot tell you

On-chain, a farmer’s wallet and a genuine user’s wallet perform the same actions: deposit, stake, claim. The addresses are pseudonymous and the funding is laundered enough to break naive graph links. The distinction lives off-chain, in the environment driving the activity.

The off-chain signals that expose farming

When wallets interact through your protocol’s web interface, the sessions carry identity the farmer struggles to fake at scale:

• Stable visitorId linking the many wallets one operator rotates through.
• Automation detection for the headless browsers and frameworks scripting deposits and claims.
• Proxy and datacenter signals revealing that the “diverse” user base routes through shared infrastructure.
• Behavioral tempo that is machine-regular across a cluster instead of human-irregular.

Prynt returns these as server-side Smart Signals on each session, so your points engine can weight rewards by how human the activity looks, not just what the wallet did.

Weighting incentives by authenticity

You do not have to block bots outright; you can pay them less. A reward-weighting pipeline:

1. Attach session identity to every reward-eligible action via visitorId and Smart Signals.
2. Cluster wallets by device to find multi-wallet farmers hiding as many users.
3. Score each cluster on size, network reputation, and behavioral regularity.
4. Weight emissions by the score, paying full rewards to genuine users and reduced or zero rewards to high-confidence farms.

This aligns your incentive spend with the outcome you actually want, real adopters, and starves the mercenary capital that was only ever renting your emissions.

Where reputation raises the cost

DeFi farmers are the ultimate infrastructure reusers, hitting every new launch with the same wallet lists and proxy pools. A cross-site reputation layer means a device that farmed the last three protocols arrives in yours pre-flagged. The farmer’s fixed setup stops amortizing, and the marginal cost of faking a user finally climbs, which is the only durable defense against a purely economic attacker.

Calibration for a permissionless system

DeFi users value permissionless access, so heavy gating backfires. Keep the defense proportionate:

• Score, do not block, by default. Weight rewards rather than denying access to the protocol.
• Require corroboration before treating a cluster as a farm; a VPN alone is not fraud.
• Stay explainable. Reason codes let a wrongly down-weighted user understand and contest the decision.
• Rescore continuously, since farmers adapt and infrastructure reputation shifts.

The goal is an incentive program that pays for adoption instead of paying for scripts.

Measure your bot share

Instrument your protocol’s interface, capture session identity on reward actions, and cluster by device. The gap between your headline TVL and your genuine-user TVL becomes visible fast, and it is usually sobering.

The Prynt playground shows what a scripted DeFi session exposes, and the free tier is enough to instrument a launch and measure your farming share. As activity grows, the pricing scales with session volume rather than wallet count.