A hunt in the dark forest of Ethereum: the arbitrage robot was arbitraged 130 ETH

Editor's Note: This article comes fromBabbitt Information (ID: bitcoin8btc)Editor's Note: This article comes from

Babbitt Information (ID: bitcoin8btc)sandwich tradingBabbitt Information (ID: bitcoin8btc)

, Author: CodeForcer, published with permission.

Note: For the recent frequent occurrence of Ethereum sandwich arbitrage transactions (

), developer CodeForcer created an ERC20 decoy token called "Salmonella" (Salmonella), in this way, it achieved a profit of 130 ETH in 24 hours, and this also tells us about the darkness of the Ethereum network Mempool The confrontation of the forest.

Those of you who track the Ethereum mempool action have noticed the sudden rise of sandwich trading, and for readers who don't understand the concept, sandwich trading is a very interesting strategy in which transactions are made before and after the victim's transaction, and Arbitrage is achieved through the resulting slippage.

However, withFlashBotsFor example, when someone conducts an asset transaction, the arbitrageur buys the same asset before him (artificially raising the currency price), and then waits until the other party successfully buys it, and then sells it to make a profit.

This strategy has been very risky in the past because there is no guarantee that the transaction will be successful on Ethereum. The mempool is a very interesting place, but it is not a safe place.

However, with

Wait for the rise of MEV (miner-extractable value) services, which allow traders to create "sandwich bundles" (sandwich bundles), where all 3 transactions are executed or none are executed. At the same time, there has been an increase in the activity of miner transaction teams that incorporate “sandwich bags” directly into their mined blocks.SalmonellaThe combination of these two innovations allowed sandwich traders to engage in some "risk-free" arbitrage activities, which got many people into a mood of excitement.

But in reality, "risk-free" isn't really risk-free.

To illustrate the risks of playing games in a mempool, I demonstrate a new species called "Salmonella" (

), which involves utilizing common front-running setups. While the purpose of sandwich trading is to profit from the slippage caused by other people's trades, the purpose of this strategy is to punish the exploiter.

A quick analysis of the blockchain revealed that a group called "Ethermine" currently executes most of the sandwich transactions on the market, and after identifying the initial target, I started analyzing their setup.

At the time of writing, Ethermine's setup is quite basic, relying on Uniswap router to execute transactions, and the transaction history shows that most of Ethermine's transactions are revert transactions, and its smart contract itself also holds tokens of various failed transactions, With this in mind, I set out to create my Salmonella contract.

The premise of the Salmonella contract is very simple, it is a regular ERC20 token that behaves exactly like any other ERC20 token in normal use cases. However, it has some special logic to detect when someone other than the specified owner is making a transaction, and in those cases it returns only 10% of the specified amount.

The following is the "poisonous" transfer function:

I deployed the Salmonella contract, then set up a simple Uniswap pool containing Salmonella and Ethereum. I then replicated the detection math of sandwich trading using binary search, creating a series of decoy trades that Ethermine and other sandwich traders would consider an interesting opportunity.

In the end, I wrote an execution architecture that allowed me to quickly cancel transactions, change gas prices, and reset the state of trapping Uniswap pools.

After a couple of espressos, I get to work, sending out a series of decoy transactions, carefully setting the price slightly below the market gas to keep the transaction in the mempool, but canceling if the price starts to drop drop the deal.

Within a few hours, I met the first target and looted 68 ETH from their bot, and a few more hours later, I took another 35 ETH from their contract.

After one night, I browsed my Salmonella contract and found that my experiment emptied another 17 sandwich trading contracts, of course, the amount of funds was much smaller than that of Ethermine.