Table of Contents
In smart contract land, it is well known that if there's a vulnerability in the code, it is a feature and not a bug. One sophisticated exploiter albeit with malicious intent had successfully deployed an exploit using an Ethereum validator and a Flashbots MEV-relay to drain a group of MEV bots for a total of $25 million at time of writing.
The exploiter planned the reverse-sandwich attack by essentially honey potting a group of top performing Maximal Extractable Value (MEV) bots after verifying that these bots used his validator on low-liquidity pools throughout an 18-day operation.
What are MEV bots?
MEV bots use complex algorithms to identify and exploit profitable opportunities in DeFi ecosystems. MEV bots extract profits by through arbitrage opportunities, liquidation events, and other market inefficiencies.
MEV bots leverage the transparency and programmability of blockchain networks to monitor the transaction pool and identify opportunities to extract value. These bots can detect when there are discrepancies in prices or liquidity across different platforms and execute trades to capture the profits.
What happened this time?
An Ethereum validator identified as Sandwich the Ripper prepared assets across multiple tokens and baited the targeted group of MEV bots to try to front run his transaction on low liquidity V2 Uniswap pools.
Typically, a sandwich attack happens when an MEV bot reads an incoming transaction, and front runs the order, pushing up the price of the asset for the original buyer.
The buyer pushes the price up even further through buying the same assets as originally intended. The MEV bot then sells the asset immediately after the original buyer's transaction goes through, making arbitrage profit off the buyer.
In this case, the exploiter baited the MEV bots with an exploited transaction forcing the bots to spend its WETH to arbitrage the baited assets inside a low liquidity pool while the exploiter needed not make an actual purchase transaction.
Read more: "AI Can't Live Inside a Blockchain": Fantom's Andre Cronje
The exploiter then modified the transaction order within the same block and sold all of its tokens (that it had prepared before the attack) immediately after the MEV bot had bought the baited assets. The exploiter then sold his tokens at a higher price to drain all of the WETH from the low liquidity pool, leaving the MEV bot behind with worthless tokens that it had acquired in the process.
Unfortunately, if the signed block was invalid, then it would never be accepted by the network, so there would be no race at all. By setting both the parent root and the state root to zero, that's exactly what the malicious validator did. pic.twitter.com/2eDLPaTgQN
— samczsun (@samczsun) April 3, 2023
While the exploit was simple to execute, this typically cannot happen as there are multiple safeguards in the design of the swaps. However as the exploiter was running his own validator, he had permissions to modify the parameters of the MEV-relay hosted on Flashbot.
The exploiter managed to successfully drain five MEV bots using the same strategy over 24 transactions. The exploiter has since distributed the stolen tokens into three separate wallets, with at time of writing, each respectively holding $20 mn, $2.3mn & $2.9mn.
🚨🚨🚨 #MEV The interesting bundles from sandwich-focused MEV bots on https://t.co/4AYDU3xkN3 seems broken. The backrun txs, which are supposed to do the reverse swap and take profits, were reverted!
— PeckShield Inc. (@peckshield) April 3, 2023
Our analysis shows that the victim txs were replaced by the bot-exploiting… https://t.co/pMOkKpVM8v
Stolen funds are held at
— Beosin Alert (@BeosinAlert) April 3, 2023
0x3c98d617db017f51c6a73a13e80e1fe14cd1d8eb ($19,923,735.49)
0x5B04db6Dd290F680Ae15D1107FCC06A4763905b6 ($2,334,519.51)
0x27bf8f099Ad1eBb2307DF1A7973026565f9C8f69 ($2,971,393.59) https://t.co/TCuAWKZCL0
What's happened since?
The Flashbot community has since rolled out a patch to all relays to prevent future attacks like these from happening again. While formal channels have reported the attack as 'malicious', some crypto twitter users were found on the other side of the fence, reasoning that the attack on the MEV bot was instead part of the game and that no foul play was made.
Justice for this based user they did nothing wrong.
— ZachXBT (@zachxbt) April 3, 2023
So if MEV bots are taking funds by front running users and a validator just gamed the bots by literally front running them.
— Insomniac (@insomniac_ac) April 3, 2023
Wouldn't it be considered fair game?
The world of Web3 can be quite a whirlwind. Whether it’s crypto news in Singapore, South East Asia or even across the globe, we understand how busy the industry is keeping you, so we kindly send out three newsletters each week:
- BlockBeat for a wrap-up of the week’s digital assets news
- Blockhead Brief for weekend happenings as well as what to look forward to in the week ahead
- Business Bulletin for macroeconomic updates and industry developments.
To avoid FOMO and access member-only features, click here to subscribe for FREE.
