Virtualchain uses Bitcoin miners to process the transactions, so Sybil attacks are handled by Bitcoin’s PoW. Virtualchain is no longer used in Stack 2.0 and Sybil attacks are handled by the new PoX mining in Stacks 2.0.
Looks like you figured everything out! @clayop just curious is this research for university purposes or are you writing some blogs about the recent proposal?