MEV and oracle manipulation in PoS Ethereum by Torgin Mackinga (@MTorgin)

Transcript

oh there it is okay so yeah all right this one works I don't think we have any sort of local mics okay and then if you're ready I am all right all right welcome everyone to day two of the conference uh this is in track four and today uh join me in giving a warm welcome to our first Speaker torgen makana as he talks about future block Mev and proof of stake hey um yeah welcome everyone thank you very much for showing up so early in the

morning and uh yeah I'm going to be talking about future block mov and proof stake [Music] um so first of all kind of about me I come from a security background so I work at chain security um where I do smart contract audits we work together with most of the big D5 protocols um such as maker curve compound Ave um yeah and today I'm going to be talking not specifically about smart contract security but more about uh how ethereum Works in general and kind of what the implications are from that uh partially from from a security perspective um so what I'm going to be talking about

is future block Mev which is a word that I totally made up but I'm going to explain to you what I mean by that um so for that first we have to understand uh block production in ethereum so block production has changed quite a lot over the last couple months so ethereum used to run on proof of work right until the merge happened and in proof of work uh basically every Miner tried to mine every single block and then if you got lucky you were the miner that was producing the next block but it was totally random and you couldn't predict it and now in proof of stake everything is a lot more structured than it used to be and the block producers are actually

determined in advance um deterministically so uh the way it works in ethereum is that you take the current block producer set and the Randall value and based on that you know who the future block producers are going to be and the these values can only change at most once per Epoch but usually they actually don't change to epochs in advance and an Epoch in ethereum is six minutes so what that means is that if you are a block producer or someone you know is a block producer then you will know up to 12 minutes ahead of time when you will be

creating a block in ethereum and of course block production is very important and the reason for that is Mev right so Mev is basically the value that can be derived from ordering the transactions within a block which is what the block producer can do and then also from inclusion or exclusion of any transactions um and so one specific type of thing that you can do with this future block Mev is an oracle manipulation and usually in uh so and specifically the type of work or manipulation that I'm going to be talking about today is for the uniswap

Oracle and this is something that I've uh researched quite a lot initially in the proof of work setting and now in the proof of stake setting and basically in proof of work it was already kind of easy to manipulate if if you did some specific things but now in proof of stake it's going to be a lot easier so though the way that the so first of all a price Oracle uh the idea of a price Oracle is that it tells you what the price of an asset is so if you have some lending protocol like Ave let's say what that'll allow you to do is you can put in some asset let's say like if and then you can borrow a different asset

like usdc but for that the smart contract first needs to know how much an eth is worth right because if you put in one eighth and it's worth a thousand dollars then it might let you borrow like eight hundred dollars of usdc and then you'll have an over collateralized loan which means there's a little risk to the borrowers to the lenders from your borrow but if instead the contract thought that the eth is worth two thousand dollars then all of a sudden it'll let you borrow more against that collateral and you might actually be allowed to borrow more than what the collateral is worth and then at that point you can just never pay back your loan and uh you'll be stealing uh from The Lending protocol

and so there's basically two types of oracles one are the option oracles and the other are the on-chain oracles so the off-chain oracles are are things like chain link where you take the price from some price Source that's off chain and then you have some trusted party that posts that price on chain and then you just kind of believe it um right which is not great because we're trying to build kind of trustless systems here and if you at the core of your mechanism you have a trusted party uh that's not really what you want so the alternative to that are on-chain oracles and there what you try to do is you take data that's already on chain and then

you just work with that and so the most popular or at least it used to be popular uh it's not so much now because people know that it's manipulatable but the most popular one is the uniswap Oracle and so what that does is that it takes the price of a unit swap Market which is on chain of course and then you just take an average of that price over some time like let's say the 30 minutes uh last 30 minutes of uniswap prices and you take that as your price Oracle and the idea is that that Oracle should be pretty close to the overall market price because if the unit swap Market

had a different price than the off-chain markets or like any other markets then there would be an Arbitrage opportunity right if you can buy it for cheaper on uniswap and then sell it back on binance or something you can just make a risk-free profit by taking the side uh the the correct sides on on each market um and so the the first version of the uniswap Oracle uh it just took the current price at whatever moment you asked it um to give you the price and that's really bad because what you can do is you can take a flash loan and you just buy a bunch of the asset on uniswap and then you check the Oracle and it says oh

yeah it's super expensive and then you sell it back and you bring the price back to where it was and you have basically no cost and you can manipulate the oracle so what they changed in unusual B2 is that instead of giving you the price at any time they always record the price at the end of each block so that in between a block you it doesn't matter what what a what the price is only at the end and then that means that you can't use any flash loans to manipulate it um and then even better is of course if you don't just use the price at the end of one block but you take this average over like 30 blocks or something like that or 30 minutes worth of blocks

um and then what that gives you is that because you have to keep the price manipulated at the end of the block then there's going to be an Arbitrage opportunity at the beginning of the next block right because the unisaw price is going to be wrong and then whoever is the fastest can come and push that price down to where it's supposed to be and then they're going to make a big Arbitrage profit and if you're the attacker then that's a loss for you um and so that's the idea of why the unisop Oracle is supposed to be expensive to manipulate um but now we'll get back to the the future block Mev and how we can avoid this cost uh if we're an attacker so

what we're going to do is we're going to wait until we just randomly get a block that we're going to prop propose right so we're going to run some number of ethereum validators which you can do you know you need 32 East for each one but there's not really a cost to it aside from the the capital cost but uh you know there's people that do this just to stake um so it's it's not anything super crazy um so you just run a couple validators and then because of what I talked about before with how the block production works you will know exactly when you're going to be proposing a block right so you can know up to 12 minutes ahead of time oh okay I'm gonna be up now I can do some funky stuff right and so what

we're going to be doing is we wait until the block we're proposing is going to be the next block and then in the current block what we're going to do is we're going to do a unisob price manipulation right so um I have that here on on the chart uh we're in Block n right now and then we're going to push the unisop price up to you know some really high amount however much money we have to push up the price uh because we're basically going to be getting all this money back so we we push up the price and then at the end of the block the price is going to be recorded and then the next block is going to be our block right so we can decide the block ordering so we just put our self as the first transaction in the next block and

we make sure that we are the ones that can get the Arbitrage right and so then we can get to push the price Back Down On uniswap and nobody else has any chance of competing with us on that Arbitrage because we're going to be the ones that are ordering the blocks right now one important caveat is that uh what could have happened is that we get back run on our first transaction right like if we're not the last transaction in the block that might be a problem but there's an easy solution to that and it's called flashbots right if you submit a transaction through the flashbots RPC then they claim at least that your transaction won't be visible to anyone else right so as long as you

trust that flashbots doesn't leak your transaction then the first block you just submit it through flashbots nobody's going to see it in the mempool and the first time that people can see the Arbitrage opportunity is going to be when the block is already done and then the next block is going to be yours so they have no chance of competing um and so if you do this then you've created uh one outlier in the uh in the average that unit swap uses for for its Oracle and you've done this uh with the cost that is basically just whatever the unit swap transaction fees are right so you might pay like 0.3 percent on the way up and then 0.3 on the way down on however

big your manipulation is uh but that's it and usually if you weren't doing this then someone else would argue and you would lose you know a large percentage from that um so essentially what you're doing is you're hiding the Mev um from uh the other Searchers that are out there and if this is a unisaw V2 Oracle then this is kind of already enough so on the unisoft V2 Oracle the way that they do their average is just a normal arithmetic mean so you just sum up all the prices and then you divide by the number of blocks so if you just have one outlier that's really high then you know you've already uh like manipulated the

entire average like if it's uh an average over 150 blocks and here you just push up the price by 150 times then the entire average is still going to be two instead of one right and that's enough to to steal from a lending Market um now luckily kind of by chance in unisoft V3 they changed this and uh not for this reason like for other reasons but in unisa V3 they changed from an arithmetic mean to a geometric mean and so in a geometric mean what you do is you multiply all the values together and then afterwards you take a root where it's the nth root with however many blocks you have and so uh that might sound a bit fancy but

really what it means is that in this calculation if you have one large um one large amount in your calculation that's in the in the multiply because you take the root afterwards it doesn't have such a big impact so if you have single outliers in a geometric mean then that has a lot less of an effect than in the arithmetic mean so if you're attacking uniswap V3 you would have to repeat this attack multiple times within the two up window so that you can create multiple outliers and if you can do that then you can also manipulate it but that means that you need to have a lot more validators right like if for the unisa V2 case if you just need one block it's enough to have one validator and you'll

get a block like every one or two months but if you want to have like multiple blocks within one t-wop window which is like 30 minutes you need more right but if you have like a couple million dollars that you're willing to stake and then unstake the next day uh or whenever you you get through the queue uh you know it it's still fairly simple to do so if you can could potentially steal like many millions of dollars you know you might you might want to do that um and now so now we've we've manipulated our Oracle right and so either we manipulate the price up and then we can just steal from a landing protocol but if it's a V3 Oracle that's kind of hard to do

so what might be a lot easier is if we try to manipulate the price down right because if we manipulate up we need to change it by like 100 or so but if there are some positions on the lending protocol that are close to liquidation we might be able to just manipulate the price down a little bit and then we can go liquidate all those people right they might be away like like two percent away from Liquidation and then we just push the price down a little bit and then uh we can liquidate them and the the cool part about that is we can trigger that liquidation with no competition right because the the Block in which the updated price is going to

be there for the liquidations also happens to be the block that we control right so at first in the block we put our Arbitrage to get back all the money we spent on the manipulation and then afterwards we can trigger the Liquidation on that protocol and you know any other protocols that use this Oracle um and nobody else is going to be able to compete with us so we can liquidate it super uh like without having to pay a lot if that's how the liquidation engine works right it depends if the liquidations are over time then it doesn't work but if you can instantly liquidate an undercollateralized position then you can liquidate it without um any competition

and so this is basically the reason why nobody uses the unit swap Oracle anymore um Euler actually used to use unisol of the three oracles and they did a lot of research on why they think it's secure um but that was in proof of work right and then when the merge came close I talked to them about this kind of stuff and after that they weren't so happy about it anymore so they changed to chain link which unfortunately is kind of the best solution we have right now like it has a lot of centralization problems there's uh there's one four of nine multisig where chain link can just upgrade all of its contracts and rug all of D5 basically so probably not the best long-term solution but for the moment

it's the best thing we have um so yeah this was the the Oracle part but then our maybe there's other things that we can do as well right if we use this future block Mev with the knowledge of knowing when we're going to be proposing a Blog um and one fun thing that you can do is you just create your own NF uh your own Mev right so if you know that you're going to have a specific block or maybe you're a big Staker and you know that by chance you're gonna have like 10 blocks in a row or something like that um right you're just going to have more than your average number of blocks you can try to create a lot of Mev in those

blocks right so one thing you could imagine is that you could work together with an nft pro project and just have them launch their mint exactly in the blocks that you control and then you're going to get the uh the Mev that gets created there and you'll get paid for it right so as an example of that uh this right here is a chart of the gas prices during the other side nft sale which was the the board ape land sale this was the biggest nft sale that ever happened and you'll see on the chart at one o'clock that's when the sale started right and you see the gas price just spiking up immediately uh and the height of that is 200 eighth

per block right so every 12 seconds people were paying half a million dollars in gas to the validators that were proposing those blocks um and the very tricky part about this is uh since eip1559 we have the base fee and the tip right and the base fee is the eth that gets burned and then the tip goes to the validators so the tip here is in black and the base fee is in Red so you'll see that at the very beginning the tips were insanely huge right and the validators were getting all of that money but then just after like 10 minutes or so um the the tips were basically zero and it was all base fee because the base fee just shot up so quickly so it was super

important to be in those first couple minutes of validators because afterwards even if you proposed a block that had super high gas you weren't getting any of that right you were just uh you were just burning the gas so this shows like how important it is to be at exactly the right spot and if you are someone that has a lot of validators you know you could maybe try to influence when this nft project launches right they might not care so much if they launch a couple blocks earlier or later and then you could make a lot of profit you could pay the nft project for that right it's like kind of reverse Mev the validators pay you to to launch your project whenever they say um so yeah I think that's a really cool

application uh and then the other one which is a bit more concerning uh and this is something that I talked about uh with a guy named iridian actually lasts yeah last week at East Denver and I had never really thought about this uh in this way but it's that you might actually be able to uh do profitable censorship right so incentivized censorship and the reason for that is that in erp1559 as we talked about before the base fee might be super high but the tips that are being paid to the

validators might be low right so I have here an example of of a specific block right where the proposer got paid like thirty dollars worth of eth but the transaction fees that were in the block were like 800 right so it's about one thirtieth of the entire fees actually go to the validator and so what that means is that the block space is expensive but the blocks themselves are really cheap right so if you imagine that you're a builder in the math boost system that basically all the validators use these days what you can do is you could actually propose a block that's totally empty it doesn't have any transactions except you pay the

validator you know slightly more than all the other builders right like in this case if you had paid 35 dollars you could have gotten that block and put anything in it right and the Val the validator doesn't care how much gas the block uses right they only care about how much they're getting paid like in fact in Mev boost they don't even know what transactions are in the block or how much gas is used they only know how much you're willing to pay them for it um and so you could create like blocks that are empty or that sensor specific transactions uh that you want to delay by one block um for a really low price right on average maybe the gas would have spiked right and then you would just not do it

so if if it becomes too expensive you can just not do it and if it's cheap uh you do it and so Nick the question is why why would you do this right and so the the answer is you censor the block before yours right so you know which block you're going to be proposing and then whatever the block is before that you just try to censor it right um You you could try to censor all transactions or it'll actually be cheaper if you just uh censor specific transactions because then you don't have to pay the entire tip to to the validator um and so one reason why you would want to do this is maybe uh because of Arbitrage right so uh there's a lot of uh what what is called stat ARB between

centralized and decentralized exchanges um and the way that it usually works is that an on-chain exchange like uniswap lags behind off-chain exchanges like binance by 12 seconds right because ethereum produces a block every 12 seconds so the unisoft markets can't move more often than that and so binance has price Discovery all the time and if the binance price Moves In Those 12 seconds then there's always going to be an Arbitrage between binance and all all the on-chain markets um and so that's going to be some amount of Arbitrage but now the kind of fun thing is that if you just censor the block before yours and you remove let's say

all the unit swap transactions or even just all the units of transactions of like specific pools that'll be super cheap and it'll make it so that now unisop lags behind binance by 24 seconds right or you could even try to censor it for multiple blocks uh that's you know a bit harder in case you might not censor a later transaction um but still you'll be able to make it so that the difference between unisop and binance just grows more and more um because the unisoft markets are literally just Frozen in Time um and so what you can then do is either you Arbitrage yourself but you probably don't want to do that right like there's already people that do the stat ARB so

really what you do is you just wait until they pay you in your blog to do this Mev right um and there's a guy on Twitter uh I put his handle here he he did some theoretical calculations um that if you can lag the the price more compared to the centralized exchanges then if you do Stat or every two blocks instead of every one block that should be on average 35 percent more profitable um then uh if you yeah then if you did it every block and the thing is for you as a validator the the cost is going to be very low right so you're going to censor all the

transactions that are in uniswap in the block before but then in your block they're going to pay you that amount back right so you're only going to have to drop like whatever the bottom transactions uh in your block would have been uh and you'll be getting these high-paying transactions that you had to pay for before so you might not even be paying a hundred percent of the cost of the block before yours but then in your blog uh it'll probably be worth twice as much because you just have more orders but then also because the Arbitrage opportunities are bigger and there's probably going to be um multiple people that all want to take the same Arbitrage opportunity you'll probably end up making more than twice

as much um in in validator fees and tips by doing this uh censorship in this way um and the other thing is that even if you ignore the centralized exchange Arbitrage even if you're just doing Atomic on-chain Arbitrage you could still be making more money if you do this and the reason is that uh so one form of Mev are these sandwich trades right where you buy before someone else and then they buy and then you sell back to to the pool and this is profitable and now if in the blog before yours um there was no transactions there's

going to be twice as many transactions in in the current block right so there's a higher chance that there's going to be two transactions or more that are all trying to do the same trade and so then you can actually sandwich all of those trades at once and that'll be more profitable right because the price impact of those trades together is going to be higher and your gas cost is still going to be the same as if you were just sandwiching one trade um so this also makes Atomic ARP uh yeah more more profitable and uh yeah I think this is something that I hadn't thought about before last week so a big shout out to iridian who who talked to me about this and I found it super interesting um

and yeah we'll we'll see I as far as I know this isn't happening on chain right now but there's really no reason for it because all you need is like a single validator and then you need to be a builder in in the flashbots Mev boost system but that's permissionless so anyone could be doing this and there's even like open source uh versions of the flashbots Builder that you can just plug in and and it'll work and you'll make small uh adjustments to it um so I I think this is really interesting it might be happening and we don't know about it um I it also should be actually pretty easy to see if these theoretical results of it being profitable uh are true if

you just do an analysis of blocks that are just naturally skipped right every now and then a validator Skips a block and if you then check like how much the blocks after it are worth uh I haven't done this analysis yet but I think it would be super interesting uh to do and then you could see if this these theoretical results for why it should in theory be profitable actually hold up uh based on that data and then yeah I mean I wouldn't advocate for doing this live but you know it might be profitable and the the incentive is there so that's how these permissionless systems work um so yeah that brings me towards the end uh I think the big takeaways that I I wanted for today is just first of all

the Block proposers in POS are known in advance right this is very different than it used to be on proof of work so the merge kind of uh has an impact on the Block production and then that also has impact on the applications that are running that rely on that block production right uh such as Arbitrage assumptions and then the second thing is this information is valuable right so there's many ways that you can uh use it I'm learning about new ones all the time there's the the simple Oracle manipulation where you could try to steal some money or liquidate people um you could try to create Mev in your blocks you could try to censor the blocks before you and then get that Mev

for yourself you could also of course sell your blog ahead of time right this is the idea of a block space future where people could pay you for your block ahead of time and then you just guarantee them that they can have the first couple transactions in in your blog and they pay whatever they think is fair for that right so if such a block space Futures Market would exist then you could do all of these things without even needing to be a validator yourself right you need just need to have some validators that you trust that if you pay them for the future Block they'll actually uh give you that that block space um so yeah I also have a a blog post uh on chainsecurity.com about the Oracle

manipulation part and um you know how how the proof of stake block production Works uh if you want to read more you're happy you can read that this is actually based on an entire paper that I wrote about Oracle manipulation of the universe the paper is also linked in there if you go want to go really deep [Music] um and yeah thank you very much uh I've been to Oregon if you like you can follow me on Twitter I usually tweet about like security uh Mev that kind of stuff um and then also actually in case you're interested at chain security we're hiring a marketing and sales manager uh so if you're interested in the security space and then also maybe have like a

network in in the crypto space uh we would be happy to talk to you thank you very much