Welcome to the first weekend issue of the Dropshot! As always, thank you for subscribing and reading. If you’re a first-time reader and unfamiliar with NBA Topshot, please see this primer I wrote for the basics.
In today’s issue, we’re going to do an overview of the frustrating second half of this past week on Topshot, and talk about the major cause of the issues: bots!
But first…
Update about newsletter frequency
Because of the platform instability, some days pass without major incident or updates. Instead of cluttering your inboxes for the sake of having a “daily” newsletter, I’m going to start experimenting with sending out less-frequent but deeper / longer content, starting today. A lot of Internet content, from video to audio to text, is moving to shorter and shorter snippers of information designed to be consumed bit by bit — Topshot itself is a manifestation of that! You’re consuming “moments” of basketball rather than an entire quarter or game. Yet I personally do feel a need for a balance of depth and long-form content.
My personal goal is to send anywhere from three to five high-quality newsletters every week, depending on if there are enough topics to talk about, my work/job commitments, and external life factors. I’ll be working to refine how I measure if a newsletter is good quality or not, and I will share that here when the time is right.
The one thing I need from you (my valued readers!) is to comment on posts or email me directly with topics or ideas (in the Topshot or NFT space) that you want me to explore. Reader feedback will help me steer this newsletter into something that’s informative for all different profiles in my audience — for the near future, I’m going to be focused on the NBA Topshot niche, but I could easily imagine a future where this newsletter expands into discussing NFTs more generally, possible extensions of Topshot that I’d like to see implemented, etc.
That’s enough about me and this newsletter! Without further ado, let’s get to it.
Daily Review
If you built a word cloud of all the chatter on Topshot late in the week, the largest word would be “maintenance”. The team over at Dapper Labs is (understandably) getting crushed by the digital stampede to obtain moments. You can see the dip in sales volume during the week:
While the marketplace itself for reselling moments has been unstable, the main issue with the platform this week has been around the new packs being released. Interestingly, Dapper Labs has seemingly forged ahead and having increasingly more ambitious pack drops over the past couple of days, even in the face of issues with each pack drop. In the last week, Dapper has:
dropped a “Stress Test” Of 5,000 base packs (link)
announced a ~10K drop of “Premium packs” at $99 each (link)
pushed back the “Premium pack” drop by 24 hours (link)
performed the “Premium pack” drop over the course of 4 hours with ~200K users in line (link)
announced late on (Friday night) that they would be doing a surprise 600K Series 2 base pack drop at 10 AM PST on Saturday that is still ongoing as I write this post (on 2 PM PST Saturday).
I admire their persistence, and aggressively launching/selling packs and holding consumer attention within the digital zeitgeist are all extremely valuable feats. The Dapper team should be very proud about all the work they’ve done. With that said, I do wonder how much the continued push will damage consumer faith in the platform in the short term. Assuming they can eventually solve these problems in the long-term, incurring short-term credibility damage may result in them having to re-acquire the same users that have churned from their platform due to past site reliability issues.
Their CEO has even publicly commented about the pack drop issues on Twitter:
What does Roham mean when he says “bot“?
No, not R2D2, Star Wars, or really anything sci-fi related. He’s talking about something that’s already been happening for years in the world of physical goods, and that represents something existentially problematic for the world of digital goods and NFTs.
Bots Gonna Bot
For anyone reading this who is familiar with other collectible markets (mainly sneakers), bots are not a novel term. I’m going to summarize bots at a high level, discuss some common terminology, and discuss what bots mean in the context of NBA Topshot. If you’re interested in learning more about the mechanics of botting, I will attach a few links at the end of this section that go into the details.
What Is A Bot?
To put it very simply, a bot is a computer program or software script that a real person owns or rents from someone else. While bots are of varying complexities and types, the simplest use case for a bot is when interacting with a webpage like this:
Let’s say that this webpage for this shoe becomes available at precisely 10 AM on a Saturday morning. A regular human user would need to:
1) Click on their correct shoe size
2) Verify their bank account information
3) Authenticate
before they are formally entered into a queue to buy this shoe. Meanwhile, another real, but far less scrupulous person has used a bot to run a software program that has executed all three steps in a fraction of the time it takes a normal person not using software to execute just step 1.
The person who used the bot is generally speaking able to obtain the shoe before the person who didn’t use the bot, because they jumped the queue before them. It’s a hard concept to grasp — normally, if you want to get something valuable, you can sometimes wait in line for the store open or even camp out overnight (e.g. Black Friday). On a good sold digitally, though, bots are essentially the equivalent of buying the fast pass to the roller coaster at an amusement park, except you can do it over and over again for every ride without any limit.
Wow, that’s so messed up. What are companies doing to combat this?
The truth is, for a long time they didn’t do anything. When a company charges $100 for a shoe, they don’t necessarily care who buys it, as long as they get their $100. There was definitely a weird interim period, probably peaking in late 2018, where large companies selling high-demand goods just didn’t bother doing anything visible about bots and bot protection. This led to a surge in consumer fatigue and loss of trust in the product — unfortunately, a lot of the companies selling these goods do not have core competencies in technology, and rightfully just want to focus on making their goods and selling them to “authentic” customers who they know will purchase from them in the future.
The main counter-action to bots has been to institute raffles or randomized queues instead of a first-come-first-serve model. This certainly lowers the odds for any one particular bot entry to “win”the good, but savvy bot managers have responded by building bots that essentially flood the raffle with tens of thousands of requests.
Here’s a toy example: Let’s say a shoe company is selling a shoe through a raffle for $200 a shoe, and is only giving out 10,000 pairs of the shoes in the raffle. A user (let’s call him “Botty Bert”) can register 10,000 phony accounts on the shoe company’s website with the same address using a bot. When the raffle opens, Botty then runs yet another bot that essentially enters each of his 10,000 accounts in the raffle. Now surely at this point you’re asking: wait, what happens if all his raffle entries are chosen? Surely Botty can’t afford to store 10,000 shoes at his house?
Aha! Good catch. Yet Botty is smart - because he’s trusting in two things: the law of large numbers and the free market. Botty knows that if it truly is a high-demand good, the number of raffle entries will probably be in the hundreds of thousands (let’s say 500,000). So with registering “only” 10,000 accounts, Bert is essentially just betting that he has a 1/50 chance of winning the raffle, and he can obviously tune the number of accounts he registers for the raffle based on external signal he is getting about consumer demand for the product. 1/50 may not sound like a lot, but that’s 2%, while the chance of a person who entered one entry in the raffle is 1/500,000, or 0.0002%. And even in the rare event that Bert wins three or four of the raffle entries, he knows that the demand for this product will ensure that he can generate a profit by reselling it on the open market. Assuming the cost of the bots themselves are low, what Bert did is economically rational. Adam Smith would be proud!
This example is obviously rife with red flags that a company could use to ban botters from their platforms. There are numerous startups in this space that are essentially trying to brand themselves as the simple security layer that can be overlaid on a consumer good to prevent botting. Yet where there is economic incentive for it, botters and sellers will always be in a “cat and mouse” game to outflank each other.
So what are botters in the context of NBA Topshot?
Up to this point, it’s not very clear. Dapper has been playing their findings about bots on the site close to the vest, which is understandable — the best way for bots to work around a service is for that service to publicize how they are flagging them. About a month ago is the first time that Topshot saw major botting activity, according to Roham (CEO of Dapper):
Based on what they’ve said publicly and slight product adjustments they’ve made along the way, I would guess that the main places bots are being used on the website are for attempting to auto-purchase certain moments once they hit a certain lowest price, and infiltrating the queue during pack drops. I’ll focus on the latter, as this use case was the most chaotic this week for Topshot.
Every time Topshot drops happen, the marketplace is essentially locked down and deactivated. This is probably because Topshot doesn’t want users to be able to gain moments and immediately list them for sale while a pack drop is ongoing, potentially undercutting and removing the incentive to be in a queue for the drop in the first place. Furthermore, they’ve been rate-limiting when users can or cannot sign up in the hours leading up to major drops, which is probably to prevent malicious actors from being able to mass-register accounts in advance of the pack drops. Finally, they’re probably going to start enforcing ID verification before being able to withdraw money from Dapper.
The bots themselves are following the toy example that I outlined above — a large number of bots sign up, and then try to mass join the queue for pack drops. Even if only one of the bots gets into the queue, it’s probably worth it for the person pulling the strings. Dapper is using CAPTCHAs and the rest of industry standard things to check for bots, but most bots are now enhanced enough to know how to navigate around CAPTCHAs. If I had to guess, Dapper is purposely letting the bots “feast” for right now, but silently tracing and tracking all their IP and account activity and building risk models on top of each user account that can be used to auto-ban and filter bot accounts in the future. At least, that’s what I hope :)
References (or if you want to learn more)
https://increditools.com/best-sneaker-bots/
https://www.perimeterx.com/resources/blog/2019/sneaker-bots-deep-dive/
https://www.imperva.com/blog/understanding-bots-and-your-business/
How Do We Obtain Digital Goods?
This is probably going to be a full-blown larger post later, but all the bot concerns in the context of Topshot has made me ruminate on the future of transacting goods online, as more and more of these goods won’t exist in the physical world anyway. For instance, even with the presence of bots, you can sometimes go to a Foot Locker and pick up a sneaker you want. You may have to wait in line, but there is an alternative to getting a shoe online.
But what about a Topshot moment?
This is the crux of the issue — the next generation of humans are increasingly comfortable doing all types of actions online — buying homes, selling sneakers, meeting their significant other. Yet up until now, most transactions result in a pivotal inflection point where the digital becomes the real. In the case of a Topshot moment, if a bot prevents you from getting a moment you really covet, there is really no alternative (other than to pay whoever swiped the moment from you a market premium on resale).
KYC and other protocols are certainly being enforced selectively for the realllllyy really high value goods. I wonder if this is something that could be shepherded into a liquid marketplace to build trust. In theory, blockchain transactions should also make it easy to flag which accounts or users are using bots the most, but a lot of the bot structures and pathways to link their bank accounts of one user would make former Enron executives blush. Often, it’s not even one person pulling the strings — it’s popular for a group of people, known as a “cook group”, to invest in a bot together and use it on a rotating basis to attract less attention from a watchdog.
In the end, like a lot of other hard problems, I do wonder if it will boil doing to a fin-tech problem. Even if you’re running and wrapping a transaction through a hundred different protocols, you will eventually have to hit an endpoint that communicates with your bank / bitcoin wallet / other financial service. If an incentive was provided to them, banks could start more restrictively validating that any transaction happening from their side, or the API services that integrate with banks could start requiring ID verification on the spot. They’re certainly not incentivized to do that now, but could we get there one day?
The core problem boils down not only to the core definition of identity, but also the ethical lines. Is it unethical to ask your girlfriend / boyfriend to also enter a Topshot pack drop for you, even if they don’t care about Topshot? Probably not. Is it unethical to ask ten of your friends to do it? Maybe. Is it unethical to send a message to a large group of people in a third-world country and pay them $2 to enter a raffle for you, knowing that they will pass any identity validation protocol, but make them sign a contract with you that you will own their winnings if they win a raffle or a pack drop? Probably. But how do you flag / ban that? That’s where it becomes more ambiguous.
At the end of the day, time is a person’s most valuable asset. And if they’re willing to sell that time to someone else for that other person to achieve something — whether it’s building a business, setting up that other person’s furniture, or building a bot to obtain an NBA Topshot pack — that’s a hard peer-to-peer transaction to regulate.
Hope you enjoyed this first long read! Happy Saturday! Comments and feedback welcome, as always.
ARG