Over $25 million stolen, MEV robot vulnerability event analysis
On April 3, Beijing time, the MEV robot was exploited by hackers in block 16964664 of Ethereum. A malicious validator replaced several MEV transactions, resulting in a loss of approximately $25.38 million.
secondary title
attack steps
① Many MEV robots are doing sandwich transactions at block 16964664. In Ethereum block 16964664, 8 MEV transactions were exploited by malicious validators.
② This vulnerability is mainly due to the excessive concentration of verifier power. MEV performed a sandwich attack where they front-run and back-run a trade for a profit. Malicious validators front-run MEV trailing transactions.
③ Let's take STG-WETH pair https://etherscan.io/address/0x 410 fb 10 ba 8 af 78 a 1 e 191 fe 3067208 d 321 2d ed 961... as an example: contract 0x e 73 F 15 wants to increase The STG price in the trading pair. MEV bots will front-run and back-run for WETH profits every time they try to pump the price up.
④In a MEV sandwich attack, after MEV called the swap function in exchange for STG, the malicious verifier replaced the trailing transaction (back-run) first. As a result, 2,454 WETH were transferred to https://etherscan.io/address/0x 84 cb 986 d 0427 e 48 a 2 a 7 2be 89 d 78 f 438 b 3 a 3 c 58 via the 0x e 73 F 15 contract d 1 .
secondary title
write at the end
Attacker address:
https://etherscan.io/address/0x27bf8f……f1a7973026565f9c8f69
https://etherscan.io/address/0x5b04……d1107fcc06a4763905b6
https://etherscan.io/address/0x3c98……4cD1D8Eb
write at the end
The core reason for this MEV attack is that the attacker obtained the original information of the bundle and replaced the transaction. Although the code of the MEV robot is not open source, validators generally need to access certain information to mine transactions, and malicious validators can actually obtain bundle information from such as the public memory pool (mempool).
Flashbot verifiers are usually more reliable, because they have to pass the KYC verification of MevHUB to ensure that the data source is safe and credible. In this case, because the verifier has the information, it can initiate a front-running transaction before the MEV Searcher or MEV Bot.
It should be noted that this case is limited to non-atomical attacks or strategies (such as sandwich attacks), because malicious validators cannot arbitrage from the sender, but only profit from strategies (such as liquidation). Ultimately, the original information was leaked.
After this incident, MEV searchers (Searchers) may be more vigilant about non-atomical tactics (such as sandwich attacks) in the future. The Flashbot team may be more likely to prefer to use some "reliable" verifiers with a verification history.
