The little-known wealth code: how powerful is the stealing robot? ｜Baked star selection
The Ethereum Dark Forest is a wild beast, and it's definitely not scary. These preemptive robots can analyze the calls of the contract to find potential opportunities to make money.
Most people may not have heard of front-running machines, so let’s first briefly introduce the concept and analyze their behavior, and we also studied their efficiency, the probability of successful front-running transactions, and tried to resist them in many ways.
What is a frontrunner?
First, let’s introduce the concept. Generally, a front-running transaction refers to inserting another transaction into the first position of the execution queue before a known future transaction occurs.
For example 🌰, the trading process of the exchange. For example, if someone is going to buy a large amount of ETH (the kind that is enough to pull the market) on Uniswap, one way to make a profit is to buy it quickly before the price rises, and sell it after the price is pulled.
Preemption is not limited to the method mentioned above, there are many others, such as liquidation, buying rare NFTs, or making some user errors. Here I want to introduce a concept to everyone: MEV, miners can extract value - the extractable value of a transaction or a group of transactions.
To preempt transactions on the ETH chain, you can provide an increase in the transfer fee, which is slightly higher than the target transaction, and encourage miners to rank their own transactions at the front when packaging. Because transactions with high gas prices will be executed first, so if two transactions want to profit from the same contract call, and the two transactions are packaged into the same block, it must depend on who pays the gas fee. The higher the score, the one who can rank in the front can successfully take the lead in arbitrage.
So having said that, front-running transactions can also be regarded as arbitrage to some extent.
Animal Ethology
In the article "Ethereum is a Dark Forest" co-authored by Dan Robinson and Georgios Konstantopoulos, a concept is mentioned: value extraction. The story tells the story of being intercepted by an arbitrage robot ("Predator") during the process of saving tokens worth 12,000 US dollars. These arbitrage robots are very advanced and powerful. They can track the arbitrage transactions in the Ethereum trading pool, and gain benefits by running ahead, which is what we mentioned above.
The article Dark Forest is very interesting, I suggest you read it when you have time. Readers who have read it may think that the article is too unimaginable, and they can’t believe it: a platform like Uniswap that is monitored by a large number of robots, there are still "super predator robots" that can snatch food from the hands of many arbitrageurs. steal money? Are these so-called robots also a group of ordinary arbitrageurs?
However, just because you don't know doesn't mean you don't. They are not ordinary bots, they can call smart contract functions that have never been called before to grab money, and still have the original transaction obfuscated by the proxy smart contract.
Being able to do this should at least arouse everyone's vigilance. Because being able to monitor the transactions in the transaction pool is equivalent to having a big weapon. But what is more worrying is that some service providers have begun to publicly provide the "dark pool" transaction layer.
The so-called "dark pool" transaction layer does not need to use services such as Infura, or even build a private node. It will directly send the transaction to the miners and promise not to broadcast the transaction to other nodes in the network. In this way, the transaction There will be no discovery by arbitrage bots, and trades can be protected from predators.
There is a well-known white hat named samczun. He and many of his friends also adopted the same method and successfully saved 9.6 million US dollars from a loopholed contract. So it is not difficult to imagine that miners will also start running front-running trading bots, while only providing safe channels for traders who pay extra fees.
These bots only run on the Ethereum mainnet, unlike other parts of Ethereum, for example, some smart contracts can be tested in the development environment or testnet. Except for some preliminary experiments, there is no need to let the front-running robot go to the front-running testnet transaction, and it will not make money. Also, they don't need to follow the rules like everyone else because their logic is hidden.
We still don't know under what circumstances the preemptive robot will make a move, and under what circumstances it will stop. So, tracking these robots now is a bit like hunting for rare wild animals. It is very difficult and challenging. And we can't find all types of robots, only for specific, generalized robots.
To achieve the goal of "finding specific, generalized bots" mentioned above, we need to set up a special trap - a new smart contract, created from the SHA256 hash of a secret string, and in the contract Put some funds, only the person who provides the secret string can withdraw the funds in the contract, and then once someone sends a withdrawal transaction, the funds will be sent directly to the sender of the transaction.
The original idea of setting up this trap is to initiate a "bait" transaction that provides the correct secret string, see if anyone will copy this string, and send a transaction that contains this string to withdraw funds. If someone can take it before the "bait" transaction, it means that someone can analyze the transaction, copy the relevant content, and give the content in the secret contract himself.
The experimental results are very interesting. The robot can provide a secret string that has never been seen before to a contract that has never been seen before, and then the funds are stolen. This is the real generalized and specific front-running robot!
How does the rush bot work?
Let's take a look at the working mechanism of the rush robot. But we can only reversely deduce it through their behavior, because everyone thinks, if you made a money-making machine, would you possibly share it on Github? Of course not!
First you need two components:
1. Ethereum account, with or without a smart wallet agent
2. The "backend", the brains of the entire operation, usually happens off-chain
The operator of the machine can check each transaction in the transaction pool through some technology, and analyze, replace the parameters (such as replacing the transaction caller), and draw a conclusion (whether the transaction is profitable, this single value is not worth Do).
The picture above shows the workflow of the rush trading robot
A rational robot model will not preempt a transaction where the transaction fee exceeds the potential profit, and the transaction fee may be high, especially if the gas fee is high. So in order to lure the robot to take the bait, we need to set at least a certain profit.
In addition, there are many transactions in the transaction pool, and the robot needs to analyze each transaction, and the time is tight. An Ethereum block is produced in an average of about 12 seconds, so if the transaction fee is high enough, the preemptive robot must quickly analyze it before the next block is dug out, and then quickly replace the original transaction.
This process also has a certain probability. For example, after a transaction is broadcast, the block is dug up immediately, and the robot has no time to analyze it, so there is no chance.
Considering the above factors, we made the following set of methods to attract the rushing robot to take the bait. Here comes the point! 👇
set a trap
The initial balance we set in the contract is 0.035 ETH, which is worth about $20 at the current price. Anyone who can provide the correct preimage of the hash value stored in the contract, which is also said to be a secret contract, can take the money. Then, the transaction that takes the funds will trigger a front-running bot action, and another account taker will try to withdraw the money by providing the correct secret contract.
The first round failed: call the contract directly
To make sure our trap works, we first use the taker account to call the smart contract. At that time, the gas fee was relatively high, and we successfully retrieved the funds in the contract without attracting rush-running robots.
Reflecting on the reason, it may be because the profit is too low, which is not attractive to the front-runner robot; it may also be because the block containing the transaction is dug out soon, and the front-runner robot has no time to respond.
We adjusted and got ready for the next round.
Round 2 success: Give extra time to the rushing bot
This time, we increased the potential benefits, and the funds in the contract increased to 0.04 ETH; and reduced the transaction fee, so the block containing the transaction was not dug out quickly, giving the robot more time to capture it.
This time, we succeeded!
After waiting for about three minutes, the transaction has not been dug out, and the funds in the contract have not been obtained. Then we took a serious look at all the internal transactions in the contract and found that the funds had been withdrawn by others.
The transaction initiated by our taker account used 25 Gwei, and the front-running robot used 25.000001111 Gwei, which is only 0.000001111 Gwei more than us, and the two transactions were packaged into the same block.
The second round of review: looking for clues to the robot
Alright, now that we got it for 0.04 ETH and some fees, we can analyze it.
First of all, the preemptive robot does not directly call the contract. Instead of copying the taker's transaction and sending it through its own account, it sends the transaction to the proxy smart contract, which acts as a smart wallet to execute the transaction.
Next, we can track the address of this robot, see how many transactions it has successfully robbed, and study its operating principle.
The picture above shows the proxy contract of the rushing robot itself. We decompiled the proxy contract and found that there are two main functions:
Withdraw: Send all funds in the contract to this operator. Another function is responsible for receiving parameters: the contract to call, the list of parameters, and the parameter to pass the value.
With the withdrawal function, the proxy contract can become the smart wallet of the operator. In addition to being able to perform the function of calling external functions, it can also ensure that the balance at the beginning of the transaction is not lower than that at the end, otherwise the transaction can be restored, thus avoiding potential losses caused by calling unknown contracts. Of course, the loss here is not Including gas fee.
We also monitored the bot's performance since it started running in May 2018.
Assuming it always uses the same proxy contract and address to frontrun, it can be calculated thatEarned a total of around 17 ETH so far。
The above picture shows the income of the robot we monitored, and the unit is ETH
The third round of exploration: how powerful is the front-running trading robot?
Now that we have found the robot and proved to everyone that the previous assumption is true, let's test whether we can use the second contract to confuse the call and get back the funds in the bait contract.
The second contract is a proxy contract, which will take away the funds stored in the decoy contract by calling a function. Additionally, the second contract also has a "retrieve" function that allows us to retrieve funds.
We deploy a ProxyTaker contract and then call the function to try and get our funds back. Since the cost of using the proxy contract to withdraw funds is relatively high, we increased the funds in the "bait" contract to 0.055 ETH. Sure enough, the deal was snatched away by another robot immediately.
This robot is a bit awesome, not only can it detect our withdrawal transactions, it actually! It can also be identified that this transaction is an internal call from a completely different contract! Moreover, it can complete this set of processes in a very short time, which is really incredible. Because our transaction was successfully mined in just a few seconds, and so was the bot's, which is shocking.
And the identity of this robot is also very interesting. Its contract is controlled by an account named arden43y. The act of withdrawing user funds in the Bancor smart contract.
The picture above shows the comment left by the robot operator account in the Ethereum browser: If you think I stole your money and can prove that it was a mistake, I will return the money to you.
The behavior of the second robot is the same as that of the first one, by calling the proxy contract of the account, and then sending the funds to another account, so we suspect that this robot is a robbery against the white hat in the rescue activity. run.
But the second bot is much more complex than the first one, the first one is only focused on the Ethereum chain, and the second one also executes many other arbitrage transactions.
And the balance of the second robot account is about 300 ETH, it earns more. And, with all the funds flowing into and out of the proxy contract address, it can be estimated that the second robot totals about 900 ETH.
Final round: This time, successfully fend off the robot
This time, we used a new proxy contract OwnedTaker, which only we can use to confuse calls. We put another 0.05 ETH into the "bait" contract. The funds are also returned to us through the transaction instead of staying in the contract.
In the first attempt, the transaction sent to the OwnedTaker contract was mined after about 1 minute, and we managed to get the funds back in the "decoy" contract.
The experiment was repeated one more time. This time, we re-deposited 0.06 ETH into the "bait" contract, which is the largest "bait" we have put so far, so we can rule out the possibility that the preemptive robot will not take the bait.
In addition, we also deliberately set the transaction fee to a relatively low value. The transaction waited for about 7 minutes, but the funds were successfully retrieved.
So the conclusion is: using an Owned proxy contract that can only be used by the owner to forward transactions can effectively prevent robots from parsing data and rushing transactions.
The picture above shows the process of successfully withdrawing funds
Perhaps because only the contract owner can execute the call, or the funds are sent to a different address than the calling contract, we managed to evade front-running trading bots.
These robots are likely programmed to prioritize self-preservation. After all, when they call an unknown contract, that contract has the potential to execute arbitrary code. Therefore, we can reasonably assume that they will choose to avoid unnecessary risk or transaction fee losses when profits cannot be guaranteed.
Have we really succeeded in fending off the bots?
Have we really won? It depends on how you look at it. We use a new contract, and only we know the secret string. Apparently, the two front-running bots we captured detect all trades in the trade pool. Judging by the profits they make, this is indeed their forte.
Why were we able to successfully resist the attack of the jump-starting robot in the last experiment?
in conclusion
in conclusion
Through this small experiment, we proved that the rush robot not only exists, but also is very intelligent.
Of course, we know that this experiment is incomplete and cannot draw authoritative conclusions. There are many other types of bots that have different trigger mechanisms and how they operate, and factors such as potential profit, communication patterns, and minimum complexity, such as gas fee caps, can also affect how they operate.
However, we believe that our experiments provide a proof of concept and shed further light on the modus operandi of these preemptive bots.
Shockingly, if someone calls a yield-generating contract that anyone can call, even if it's very obscure, there's a good chance that they'll be scooped up by a front-running bot.
Author: Alex Manuskin
References in this article:
Original link:https://zengo.com/ethology-a-safari-tour-in-ethereums-dark-forest/
Author: Alex Manuskin
