Novel on-chain oracle manipulations: Proposer bribing and L2 sequencer timing - Pietro Carta

Transcript

[Music] Hello everybody. So I'm Petro. I'm a security engineer at chain security. I'm going to talk about novel onchain oracle manipulations. Specifically proposer bribing and L2 sequencer timing. uh these are two novel onchain oracle manipulation techniques we found conducting while conducting audits. So uh chain security is a researchbased security firm founded in 2017 as a spin-off of ETH Zurich the leading technical university in Switzerland. Uh we've

conducted hundreds of audits on big protocols and we specialize on complex D5 projects. What are onchain oracles to start with? So my my formula is not showing. Well, now it is. I think you will enjoy the browser. So onchain oracles are price sources that derive their value from uh an onchain market which can be for example

a a unis swap pool or a curve pool and um the new price after a trade is recorded at the end of a block and the price oracle value is computed with the last block of the last value. So the the value before uh the last trade. Uh so we have s of t which is the the price oracle value at time t and it's computed as a function f. We don't know which one of the previous price oracle the time since the last update delta t and the la the last price. The new price at the end

of the block is recorded to be used in the next Oracle update. So this can be used in uh LTV calculations or uh for lending protocols for example um or margin checks for leverage protocols uh and essentially better Essentially uh it's used to uh know when to trigger liquidations to enforce solveny of protocols. Um this can be done of course like with chain

link oracles which are off-chain oracles. This is onchain oracles with onchain sources. So the assumption that's done is that it's expensive to manipulate the price at the end of a block. Uh why? because manipulating the price of a pool of a of an AMM means you're trading up to very unfavorable prices. Um, and you are paying the leapage basically huge amount of slippage to bring the price to something very high or very low. uh and uh this opens a big arbitrage opportunity and uh in the during the next block anybody can

come and trade the other way and capture the the arbitrage you created and maybe for for pools with high liquidity might be like millions of dollars of value to manipulate the price and so you're paying millions of dollar to manipulate the price of the oracle just for one block which is expensive Uh but so this is one assumptions but there are ways to um uh break this assumption. Uh one way which is which is known for a long time is this multiblock me way. Um it's it's called like this and it consists

basically in being the proposer of the next block. So if you have a proposer of the next block, you can create a transaction that trades all the way to very bad prices uh in block n minus one. And um you you make the transaction so big that no other transaction can fit in the block for example. So you know you're not going to be arbitrage in that block and then uh you have your own block which you propose yourself in block n and you close the arbitrage yourself. So you recover the cost, you recover this $1 million spent on sleepage. Um so this is known and protocols uh assume that this is

possible. So when you're using an onchain oracle, you you always take this in consideration. Basically um so what formulas are used for onchain oracles depends. Unis swap v2 does an arithmetic average. Um, unis swap v3 does a geometric average or an arithmetic average of a ticks. Uh, cure curve does a an exponential moving average. Um, which used a capped version of the price. So this pn minus one the last price is actually uh limited in its uh in its change. Uh so unis swap v2 is known to

be completely vulnerable. You shouldn't really use it. It's completely vulnerable to multi-block MAV unisop V3 less so but still because of um uh because of the geometric average is better than the arithmetic but still uh curve is a bit safer still. So how can we increase this manipulation beyond a single block? The thing is okay if we hold the price over one block transition we are in in this formulas these delta t's is going to be 12 seconds on ethereum mainet or 2 seconds on optimism whatever um so one one way to make the manipulation uh

bigger is to hold the price uh change for longer so um and protocols in general assume Assume that this is hard. Why? Uh you can try to be the proposer of instead of a single block multiple consecutive blocks. But this has a very high capital requirement. For example, uh being the proposer of so if you have a single validator, you're going to propose on average three blocks per year with 32 E of capital. uh but it's very very unlikely that you will propose two blocks consecutively any time in during the year. So you need a lot of of

capital. Of course there are some actors that can do that. I don't know liido can probably propose but they're kind of trusted. Um, so can you uh buy the block space with proposer build separator? Uh, for example, pay to be the builder so that nobody can arbitrage you back. Well, not really because you're going to be competing with other builders who are going to pay as much as they can to profit from your arbitrage. So, basically, it's going to be an auction that gets to the arbitrage value. If it's $1 million, they're going to pay 999K and they're going to profit $1,000. Uh so that doesn't

work. So first uh novel Oracle manipulation mechanism is to bribe proposers to self slash. So you buy slashing proofs. Uh how does it work? Proposer of future blocks up to 32 blocks in advance are known in proof ofstake Ethereum and um they can self slash before the time of their slots came comes uh in exchange for some compensation for the slashing. Um the manipulator needs to

control one block proposal. So in the next 32, you know in advance when you're going to propose. Um but you can pay for the block proposers coming before you to self slash and uh this will give you a guarantee that no block will be proposed at that time. In detail how does it work? So uh a slashing proof it consists of different sign blocks headers for the same slot by validators. It can be generated at any time doesn't have to be generated for a block for a slot you actually need to propose to. So it can be generated in

advance. The slashing penalty is one if plus a variable part which can be assumed to be quite small actually. Uh so it's one if and um yeah the the proposer that gets lashed from the moment the slashing proof appears on the network cannot propose anymore. So this is a bit small. I make it a bit bigger. No. So um we are the attacker and we know we

will propose block 16 in the future. Now could be time one for example. Uh we try to buy as lashing proof for block number 15. Uh the lashing proof is submitted at block time 8. At block time 8 we are sure that block 15 will not be proposed. So this means uh we paid one one one if plus a premium uh we got block 15 out and we can create the arbitrage opportunity at block 14 which will be get we will get resolved at block 16. So

we we hold the arbitrage for two block transitions instead of one. So uh the cost for the attacker is uh you have to be a staker. So you you have to have lock some capital for a while because you still need to propose one block but it's fairly easy. It happens three times per year just randomly with 32 if um the cost of buying the slashing proof for as many blocks as you want. Here there's one but it could be could try four or five. I mean of course everybody has to agree but as we will see they have they're compensated for that. So uh there's no they get slashed but you

compensated compensate them more than the slashing and they profit. Um then there's the cost of placing the initial transaction reliably at block 14. But this is fairly simple. And then there's the trading fee for the pool to create the arbitrage. But you're recovering the arbitrage. You're just paying the trading fee to go all the way one one side and back. So, uh, especially the slashing proof that you're going to pay. What's interesting and particular about this is that at time eight when you propose when you when you buy the slashing proof uh the

seller has no knowledge of the arbitrage opportunity they're going to create you're going to create. So they don't know that uh that they could keep their block and uh and extract your arbitrage. Of course, if they don't if they don't sell you the slashing proof, you're not going to create the arbitrage. So they don't earn anything. Uh this means uh the cost to buy the slashing proof does not depend on the size of the arbitrage created. You just need to just need to pay the the slashing penalty plus a premium to makes this to make this interesting. And there's no trust

required between the manipulator and the bribe proposer. Uh you can make a a smart contract that's that does this and it's enforced by the consensus that uh at block 15 nothing will be proposed. So there's no way for the the the bribed validator to change their mind. basically um yeah this is kind of hard to pull off I mean it needs coordination between parties it needs a marketplace so doesn't happen in reality but it's a it's a concrete uh possibility in at the protocol level manipulation mechanism that we're

going to talk about is multiblock MV through FIFO L2 tools. So, uh how does block production work? In proof of work, everybody mines every block and tries to propose proof of stake. The block producer are chosen in advance depending on their stake. Uh on rollups, usually there's a centralized sequencer that produces every block. Uh so the sequencer chooses the ordering policy of the transactions.

Um and uh some sequencers operate in a FIFO ordering which means first in first out the first transaction that's received is processed. So uh what does this mean? Uh there's in general no public me and transactions are included on the blockchain in the order they're received and uh they're revealed when the block is published. This means you can send two transactions back to back. transaction one and transaction two and uh transaction one and at some point so they might be

included backtoback in the same block or they might be included back to back in different blocks and if they're in different blocks you it means you can manipulate the oracle but you have no risk of get someone getting in in between because you pushed them to the sequencer at the same time. Um so yeah uh at the end of lock n we reveal that the transaction the first transaction has been uh included. There's a very big arbitrage opportunity but we already sent the next transaction so nobody can get there before us and we can take back the arbitrage we created.

Um so on Ethereum multiblock MEV can only be done by proposers uh who stake uh a considerable amount of of of money on on first in first out L2s. Anybody can do this. There are some limitation is speculative backgrounding. So I said you send two transactions back to back and they get included uh one after the other. This is probabilistic actually and it happens that one transaction might get very in between and I think there's numbers that show that it's unlikely but not so unlikely.

So if this starts being exploited people will try to get there uh in to get in between just randomly. So they will spam transactions that just check if an opport arbitrage opportunity is present and if it is they will capture it and so uh so and this is a very big uh like risk for an attacker. Uh otherwise the sequencer at some point could choose to close the arbitrage opportunities themselves. So extract the me. Yeah. So conclusions two novel mechanism to achieve me multiblock me uh bribe proposers to set slash and time consecutive transa

transaction so they span different blocks on fifl2s and so be careful when using oracles that rely on 542 markets as primary sources. Thank you. [Applause] Yeah. Pier Bueno brothers. Yeah.

Yeah. So I I was asking about how this resembles the pair piano brothers. So for those who don't know they were they had a mechanism where they took control of a block then they triggered the MEV and they made was in 30 seconds several billion dollars and I think like two weeks ago they were sent to like 10 years in prison or something like that. So um beyond the incentives here, I mean don't you think any of these uh um these mechanisms you proposed could be considered fraud and uh I I think they would be considered market manipulation. Yes. So they're definitely illegal but they can be done anonymously

so hackers might not care. Okay. But yeah, I remember uh this attack which but that was uh that exploited a flow in flashbots I think and they they managed to unbundle transactions that were sent uh to flashbots bundled so they could extract all the mems themselves especially attacking me bots. Yeah. But basically they took control of a block and they rearrange it. And what you're proposing is let's have an idea of uh taking control of a block and doing something else, right? But yeah, but the mere idea, I mean maybe it's a mere creating a strategy that would give you

control of a block, wouldn't that already be considered some sort of fraud? Oh, no. This is this is completely accepted and um I think it's most blocks in Ethereum are built by builders who rearrange the transactions in a way to profit from it. So yeah, I don't think this is a problem in that sense. So the problem would be in the way that he rearrange block himself. Yeah. Okay. Thanks a lot everybody. See you again soon.

[Music]