Numbers Don't Lie: 10 MEV Tales That Shaped Ethereum's Landscape in 2024

Transcript

[Music] Hello. Hello. All right. Uh, thank you guys for being here. Uh, my name is Brian. Uh, I work for IGNFI. So, I'm going Today I'm going to talk about like 10 uh myths that most people don't know about ME. Uh, M also is known about the most intense PVP game in the world. Um, okay. We're going to cover cases including like the most profitable arbitrage, the best MV bot, also limiting order arbitrage, jar 2.0, and also going to uh use a case to oppose Alio's uh idea that flashb is still sorry, flash loan is still good.

Actually uh I can assure you that flash lo is still pretty bad. Okay. Uh the first case is that uh most people think that unfail limit orders actually are immune to me. It just simply can represent a future intention. Actually that's not true. Um so a user set two limit orders on the two legs for the same token pair Mang and WTH. So both orders were in the same liquidity pool is which is the user's EOA and due to the price different difference this actually create arbitrage opportunities for searchers.

Okay. Uh here's how the B do the B essentially the bot walk away with 0.1362s. So first it borrow 17 million muden from user to sell order. The next uh it borrow like 0.56 WTH from the buy order. So the third step is repay the muden into the buy order and fill part of the with a higher price and then he repay only like 0.43 WTH to the sale order essentially leave 0.13 west supplies. So basically your own limit orders actually found the attack.

Uh the same bot actually repeat this kind of play in the same block is 30 times. Uh so which tells us that a stay order could be formed until you cancel it. And also case like this has been happen a lot in 2024. We observe several bots doing the same kind of stuff like doing this kind of limited arbitrage on several limit orders. So the takeaway is that don't let your stale limit or those linger in public view because boss always like monitor mistakes 24/7. So your passive trades aren't as passive as you think it is.

Okay. So next case is about like people might think that only active trades get sandwiched actually um that is not the case and you will see that an RP lose all their WBTC in one three-step stack. So this whale actually tried to add about like 10 WPDC that equals to uh 851K to a unis swap v2 pool and they weren't trading they were just adding liquidities right uh eventually under v2 you must set a uh parameter called among amin which is a minimum tokens you will accept. So in this case a whale left it at zero. That blank check actually let any bar can distort the prize right before the deposit.

So step one the bot front run and he swaps a huge amount of uh just before the arrow piece transaction and make WT WBTC looks pretty cheap. This distort the uh the price. So in the next step the RP adding liquidity transaction X landed with the price is still distorted. So because only a bit of WA BTC is accepted the whale effect uh effectively like gives uh 10 WBTC to the pool at a very bad rate. So in the back run the B do the reverse trade and essentially get all the WPTC from the victim just added to the pool and lock the spread. So all the profit to the bot is like okay so this is the uh uh actually the

full token flow chart state transaction list together. Uh so this wasn't a bad wasn't a bug it was like a fully compliant unchained logic. So modern sandwich bots they can hurt anybody with any unprotected value value moves. So three takeaways is always said among a min and use private RPC and always treat RP like like a swap with slip page. So don't skip protection. Okay. Okay, our next case like uh so some people might think that like uh we have this private man pools and all those kind of stuff might help people and how people like uh being protected by sage actions that's not the case either uh because like on March 12th so we have this dashboard actually we find

something very unusual so six out of the top 10 transactions actually uh done by the same bot using same uh method attacking on the same token pair so causing the total loss of uh 714K. So the vict slip page as zero on six USDC to USDC swaps UST swaps. The searcher uh 6B for zero flash borrowed from AR and front run to to the pool and let the zero slipage swaps execute at very absurd rates and then back run to restore price. So in one transaction the trader sent uh 220k USDC and only received about 5k US back.

So all the 67 actually mined by the same builder Bob the builder. So each block held like fewer than 30 transactions that was like u uh usually one block contains more than 150 transactions. So like regular users basically kind of like physically pushed out so the bot could run its own playbook. So you always need to set a right slip page and you say trust the private relay and the bigger thing is like search build integration hasn't kill sandwiches it's actually industrialize them so with one bad settings you'll be formed like block by block okay the first case is that some people might think that small trades won't get

damaged uh they might think that some only attack big trades but that's not the case as well uh because in this case like uh this is actually done by the Jerry 2.0. So, how many of you have heard of Jerry 2.0? Jerry from Subway. Okay. Yeah, a few. All right. Uh look at this like this is a split from R Sage. So, there are two victims. Uh first one swap like 0.1 is a second one actually 0.08 is so they all being prayed by Jerry 2.0.

So, here how it happens. So the step one Jerry like pushed the WTH and ID price up with a tiny front run and step two he reuse tech text run as the front run for a second sandwich uh saving saving gases also uh there's a second like micro front run which uh the transaction for is as uh the front run of the second sandwich the lift price again setting up a victim number two. So the effects is that it reduce gas overhead and capital lockup and he can take max value out of the s victims.

Okay, from the position one to position six of this block. So Jared used three transactions to form three sandwiches of two types. So we just talk about the split front one uh which can be counted as two sandwiches. Now the other type is a swap plus git sandwich instead of like normal front run swap Jerry drops in just time liquidity in the trans in transaction one and he add this uh ETH grow uh liquidity and let victim swap against it then pull liquidity out so there's no swap fees minimal slipage and suddenly even every tiny trade can be turned profitable so during the peak time Jerry 2.0 actually execute like 87% of all

sandwiches on Ethereum. So it's not like every trade is very huge because like the medium profit is like about 20 cents but adding so much so many sage together you get a lot of money. So now the key takeaway is that at this moment Sage is not about like um it's about like low margin high frequency and hyper optimized execution. Oh, case number five. Um, so people might think that is a scan tell the whole story about transactions cost, but that's not the case as well. Uh, in this liquidation, it looks like this liquidation only cost like 0.37 E. In reality, the searcher actually

paid the builder 358.7 E. That's over 800K USD. And none of it appear as cost on his scan. So you can scroll down to the internal transfers. There's a side payment of u 358.7 east straight to the builder address. So that is a real inclusion fee as a tip was given uh during the liquidation and the liquidator and the builder are integrated. Okay. So I won't go into the detail of how the liquidation actually got done. I'll just uh go through. Uh anyway, uh this V tape is the largest direct builder payment of 2024. Um also you can see that over 95% of the searchers rewards builder

rewards. That's like more than 5,000 is actually routed to his own builder. So this dashboard is actually built by us. You can search it like uh builder performance on on doing. Yeah. Okay. So if you really want to understand I mean with economics you need a better tool with a a more advanced more specialized dashboards to help you understand to surface a builder tips to bundle provenence all those kind of stuff and also with such a builder integration is kind of getting more and more serious. So transparent tool is really essential.

Okay, the number six like uh so like any other historical like risk events like the 1.5 billion bybit hack actually generated many me opportunities. So this charts actually shows that the arbitrage profit from uh 14 to 16 UTC. So 14 uh 1413 is the when the hacker actually exploited uh by bit. So in that two hours the profit of arbitrage actually reached like u 510,000. So significantly higher than the hours preceding the hack. So in the hour after the hack, how many pools would be affected by the by be hack? What guys do you think like any number?

Okay, I'll show you the uh the chart. So this table is actually uh the hacker swaps like uh 15k stth for ease wire dudu. So that single trace actually distort price in curve balancer unis swap even pancake swap. So uh 11 arbitrageers actually touched 22 pools in the same block. Uh each color cell here is a different bot actually doing uh capitalizing on the ripple of the the swap. So let focusing on the build uh searcher 9D6B. So it flash along uh 6334 uh reverse swap in the same cur pool and then in balancer. So the net result is

like 1.4 four east profit after the uh 0.04 east tip. So just one of eight back runs it fired in that hour. Okay. So uh about 4 C99 and one two E3 actually pick up the level ending about $79 uh use a switch arbitraries. So this is actually a perfect illusion of uh illustration of the MEV repo effect to understand the uh composibility. It's like create this like kind of like network wide repos. So it's kind of like hard to understand for someone that a hacking one project can walk prices in dozens of pools instantly.

Okay. Uh case number seven. So how much will be the profit of the biggest arbiter of 2024? Anybody want to give a number? Oh, okay. Um, so yeah, people might picture uh lucky strike on one wild mispriced pool, but in this one is the north case. Um, on April 13, so is got this like a 15% crash. A set of liquidations the price of a curve pool.

So the uh price difference will leverage by this arbitrage. Uh first bought I borrowed 216 west uh through RS flash loan. So next I swap v curve and balancer and got 329 west back. And uh after returning the loan and tipping the block builder like 22.6 is the bot um walked away with 90.5. That's like u 271k profit. That's like not two million. Okay. Um so this is like a very strategic uh sequencing. Uh the searcher carefully optimize the order of execution to maximize profits across both arbitraries. So I said both

arbitrage because uh this act this transaction actually the second arbitrage. So the B's first arbitrage is on position 2011. So create a price distortion that made this one possible. So if the bot had high random in reverse order the first arbitrage will be failed completely. So in this case a sequencing is like more important than speed. So in crypto like when trader disaster become not go. So liquidation lead to all kinds of arbitrage. Okay. Uh case number eight. Uh people might think that me and scams are separate risks. One is technical the other one is social. So um actually in this one this block contain a triple

evil sandwich. Um this one actually has 94 layers with 74 victims. So one actor actually control the token control the pool and also control the bot. So savage is the first evil. Uh the second evil is the taxing. So the attacker actually deploys the uh yellow token a yield stone token with a 35% transfer tax as shown in the chart. Um now the third evil is the rockpool. So it has a hidden enable trading switch to start the rockpool. So transaction zero actually uh flip the switch.

Now at position five the malicious actor actually use a back run to rockpool. So usually like uh 19 back runs which is 19 rag pool and uh totally is like 95 transactions and u take a 2.9 is profit. So now in this case the the attacker actually controls the code the pool and the bot. Okay. Uh case number nine. Um yeah so we finally got to flash lo.

Okay. So people might think that lending protocols a bigger risk is that borrowers cannot repay their debt. Actually that's not the case as well. So this attack shows the opposite. A borrower repaid instantly yet still stole 19.3 million. So that's powered by a 10 billion. 10 billion. Okay remember the number 10 billion flash loan bundle. It actually uh consisted of three transactions. So this is I'm only going to show one here. So to b flash borrow from balancer, unis swap, morpho, uh spark, rway, even maker. So totally that's 3.49 billion and slams curves USD pool and spoofing the UW lend protocols

or for SUSD and eventually cost the UW lending protocol loss like 19.3 million. And also our flash loan module shows that almost all the flash loans actually used the four mess. So flash loan count here is like uh yeah you can see the number that's also the other thing is like uh last year flash loans actually powered like 357 million loss across 115 incidents. So five out of the top 10 D5 attack vectors actually connected with flash loan. So I don't think flash loan at this moment can be count as good. People still need mer to prevent this kind of a attack.

Yeah, the old model assumed that attackers had to build up capital or collateral but flash loan kind of broke that. So they allow anyone with a smart contract to simulate to fun to execute an attack without position exposure. Okay, finally our last last one. So people might think that MV bot actually specializ in one strategy only for example this bot only do arbitrage or only liquidation. Um so I think everybody still remember the black Monday. Right. April the 5th, right? It's crash. So they search uh 0 E49. He fires a single bundle with five arbitraries and eight liquidations in 126 internal steps. So one bot every strategy.

So here I simplify the uh uh the steps into this chart. Basically it's like uh the bot first trigger the liquidation then use the uh price difference uh crossed by the liquidations to do its own arbitrage. And this is a uh case that combine the liquidation and the arbitrage together. So this type of uh uh strategy training actually offers multiple competitive advantages. First is gas efficiency because they share all call data. They can optimize bundling and this kind of stuff. And next is higher profit density per block. Next is like they can reduce like replication

because strategy like this is really hard to do and also it's like stronger bribery competitives in builder auctions also in last 30 days uh this bot actually done uh 10% of all me activities of uh ethereum one so you can see it you can do arbitrage signaturation everything so uh elite me boss they no longer specialize they combine liquidations arbitrage and sage and and also sequencing into a single atomic bundles. Okay, I categorize the 10Ks into these three categories. Uh so don't think you are safe, don't think you are facing all the same risk and don't think you can

really understand how both works and uh okay for the uh uh micro impact. So these are the five forces shape Ethereum in 2024. So first one is a hidden uh vertical integration builder and searcher integrated issuer and attacker integrated. Okay. The second one is instant leverage uh our every legacy risk model. Uh third one is composibility multiplies uh extern externalities are good and bad. Third one is block space become an optimization puzzle not a marketplace. Last one is limit orders turning into predictable me beacons.

Okay. uh about us we are the de facto standard me onchain data provider we want to provide structure contest and continuity to achieve credibility and coherence while cutting cost so for the tune case if you guys want to read more about it because I cannot get into too much detail you can just go to the bry I'm buster you can download the free ebook to understand all of them okay thank you thank you we have time for one good question if there is You spoke about a number of types of ME including front running, sandwich attacks, arbitrage. Are some uh rightfully classified as malicious ME

and others as benign ME? Yeah. Yeah, for sure. I I think I we always think that back arbitrage is always a good MEV because they are good for the uh price discovery is good for the marketing efficiency. These are definitely the good ones. But for the bad ones like sandwich and front running, those are pretty pretty bad ones because they kind of like distort the users intentions, right? They put their orders uh present transactions before users transaction kind of like the tread fight HFT. So which should be regulated, I think. But at the moment still there's no not some very clear cases that has been reviewed.

So yeah, I guess uh stay tuned. Thank you for the question. Thank you for the answer. Take it. Thank you. [Music]