17 ms·

Wrecking sandwich traders for fun and profit

269 points by dmckinno 6y ago

verdverm 6y ago
> As trad(itional) finance morphs into chad finance, it's easy to get sucked up in the excitement. This made me laugh. Interesting overall, adding it (b/c of what was exploited, not the exploit, kudos to that) to my reason list to not build on the blockchain. Thanks for the share
- tzone 6y ago
  That makes absolutely no sense. HFT and overall arbitrage games in traditional markets are way more wild and complex than all this.
  - verdverm 6y ago
    What makes no sense? Also, the stock market is not trying inject itself into every digital process (or possibly digitized process).
ajb 6y ago
"... it has some special logic to detect when anyone other than the specified owner is transacting it, and in these situations it only returns 10% of the specified amount - despite emitting event logs which match a trade of the full amount" Wouldn't be surprised if this comes under the definition of fraud.
- impostervt 6y ago
  How can it be fraud, when you can read the contract? It's a clear if/then statement.
  - gegtik 6y ago
    this is what people unironically believe should replace our current legal system
    - parhamn 6y ago
      To be fair, 250k legal correction isn’t that high relative to fighting nuances in conditionals and terms for 5 years in a more human court.
      - SamBam 6y ago
        250k was one one programmer made in an experiment over a couple nights. The Ethereum world (and potentially other cryptos) seem awash with this kind of thing.
  - Cthulhu_ 6y ago
    Just because Facebook puts things in their T's & C's doesn't mean they get away with it. That said, crypto is intentionally the wild west, because the Big Banks are bad. Libertarian economics, no oversight, no fraud protection, but freedom. Whether you want that is another matter. Personally I think it's a really really bad idea, and billions of monies have been lost, generated, stolen, etc because of it.
  - dleslie 6y ago
    It's possible to commit fraud while being entirely open and forthright. The key is whether it can be argued that there was an intent to deceive, despite being forthright. A famous example would be the Toy Yoda/Toyota fraud: https://apnews.com/article/6f88d96871f3292f506e2679cf012597 https://apnews.com/article/6f88d96871f3292f506e2679cf012597
    - eigen 6y ago
      the case was settled. there was no verdict of fraud, just the allegation based on the suit filed. https://www.morelaw.com/verdicts/case.asp?s=FL&d=19243 https://www.morelaw.com/verdicts/case.asp?s=FL&d=19243
    - gowld 6y ago
      That's different. The manager made an ambiguous oral statement, and in contract law ambiguity is resolved in favor of the party with less power or who didn't make the ambiguous statement.
- tych0 6y ago
  Why? The contract is public, anyone trading this token can read it. This seems like "don't trade tokens you haven't audited".
  - stepanhruda 6y ago
    Just because something is publicly documented doesn't make it legal. I can't put "our price says $5 but actually we will charge you $5,000" into terms onto a website and expect to get away with it. The only difference is there is no actual enforceability of anything on the blockchain outside of smart contract code itself.
    - tych0 6y ago
      This guy put up a sign that says "If you give me $100 I'll give you $10 back with an extra 0 handwritten on the bill", and people gave him $100. Put another way: I can't claim fraud just because I didn't understand/read/validate the contract language.
      - PeterisP 6y ago
        "I can't claim fraud just because I didn't understand/read/validate the contract language." is absolutely not true. If you create a contract with intent to mislead people and having them sign it with the expectation that they won't understand/read/validate the contract language, then the other party definitely can claim fraud afterwards and (depending on the circumstances and evidence) may win such a claim. Contract law is about intent above all, the actual contract language clarifies and documents that intent, but in circumstances where the contract language and intent clearly diverge, any adjudication must and will take intent into account. To be specific, "intent to deceive" is a key part of the limitations in contract law in pretty much every jurisdiction. Fraudulent misrepresentation, which explicitly includes withholding information as well, can invalidate the whole contract if you (for example) tricked someone into signing it i.e. 'fraud in inducement' and in such cases the harmed party definitely can claim fraud even if the contract language explicitly said that they will lose their money, if the other party mislead them into thinking otherwise.
- blobster 6y ago
  Exactly. Wouldn't be surprised if this became a common type of scam on Uniswap.
silentsea90 6y ago
Can somebody please explain the Salmonella contract like I am a 5 year old?
- dmckinno 6y ago
  The author noticed that: 1/ Prices move after large trades are confirmed 2/ An variety of sandwich bots have sprung up to take advantage of this behavior by detecting the trade in the mempool (before confirmation), front running the trade with a buy order of their own, and posting a sell order for a profit after the large trade landed. To profit from this exploitive behavior, he created a token that would trick sandwich traders into thinking a large trade was coming, but would keep their money when they tried to exit their position after the front run.
  - spuz 6y ago
    On which exchange can you buy and sell these "Salmonella" tokens? Why would anyone pay real money for a token without knowing who the issuer is?
    - flixic 6y ago
      On DEXes, or Decentralized Exchanges, you can exchange any standard-compliant token with any other token. No "listings" needed. That's why DEXes warn users to make sure they are trading the real tokens, not their fake clones.
    - andypants 6y ago
      Normal users wouldn't be aware of this token. Sandwich bots monitor all pending transactions. The author sent transactions between his own accounts, and sandwich bots tried to take advantage.
  - silentsea90 6y ago
    Do traders buy arbitrary tokens? This is a custom token that op created, not the ETH token, correct? I suppose sandwich traders don't mind buying salmonella because there's another buyer at the other end. This is quite interesting. I need to read up more!
newswasboring 6y ago
This has a very early internet vibe. Like bash quotes or declaration of freedom of cyberspace (of course much less eloquent and elegant).
- arberx 6y ago
  For this reason only, it's extremely exciting. I know blockchains get a lot of hate, but the things you can do with smart contracts should excite any techy.
  - twox2 6y ago
    Agreed. It's the invigorating "wild west" vibe that I loved about the early internet.
    - newswasboring 6y ago
      If you want a similar vibe, another space is VR. I am part of that mass adoption wave from oculus 2 and before I got it I binge watched a lot of content about VR on youtube. The amount of excitement in those videos was amazing and infectious. With the quest 2 also doubling as a dev platform I think next few years in this space are going to be exciting. Edit: There are a few differences though, mainly a lot more female representation.
      - arberx 6y ago
        I agree, the oculus 2 made me super bullish on the space.
      - twox2 6y ago
        Yep, 100%. The thing that bugs me about Oculus is the facebook connection, and there isn't a viable alternative at a similar price point. Otherwise, spot on. There's also a dotted line between VR and AR which kind of makes it a combined discipline imo.
crescentfresh 6y ago
> In layman's terms, you see that someone will buy an asset, so you buy it first to artificially inflate the price, before selling afterwards at a profit. This sounds familiar. Isn't this a tactic used on the stock market as well? Something something microtransactions.
- raziel2701 6y ago
  I think they call it front running. It sounds similar to the stuff that high frequency traders can do and what market makers like citadel do when they buy the order flow from brokers.
  - gruez 6y ago
    Payment for order flow =/= front-running. https://www.bloomberg.com/opinion/articles/2021-02-05/robinhood-gamestop-saga-pressures-payment-for-order-flow https://www.bloomberg.com/opinion/articles/2021-02-05/robinh...
    - justjonathan 6y ago
      I used to think that too, but this excellent piece from Matt Levine explains why that is not really the case: https://www.bloomberg.com/opinion/articles/2021-02-05/robinhood-gamestop-saga-pressures-payment-for-order-flow https://www.bloomberg.com/opinion/articles/2021-02-05/robinh... Retail traders benefit from this, and on Schwab, for example, they show you the dollars of price improvement the got you.
- clipradiowallet 6y ago
  The terms "wash trading" and "order stacking" come to mind, even though it's not strictly either of those things. It's more a combination of them. order stacking == placing bids(or asks), lots of them, that I have no intention of letting them fill. The reason I would place them is to falsely give the impression to retail traders that there are tons of buyers just waiting to snap something up...if you don't buy it first. The moment you buy it, I cancel them, and re-create them as asks. This tanks the price on the contract you just bought. wash trading == lots of transactions with yourself(or your partners), to give the impression of high levels of activity. This can lure other traders to place a trade they wouldn't otherwise place. front running == illegal with futures, I don't know about stocks. But the idea is this... I [as a broker or market maker] receive your orders to buy. I buy for myself before I execute your orders - your buy orders increase the price, which is good for my own position I opened initially.
jboydyhacker 6y ago
The term for this is public markets is "front running".
- tzone 6y ago
  Sandwich attack is more than just "front running". It is both "front running" and "back running" combined.
  - happyconcepts 6y ago
    "Sandwich attack" is the attacker marketing to de-emphasize that they are frontrunning. Unless it applies to sandwiching within the same block.
    - andypants 6y ago
      > Unless it applies to sandwiching within the same block. Yes, that's what it means. TX 0: attacker TX 1: victim TX 2: attacker
waynesonfire 6y ago
One thing that makes cryptocurrency trading special is that you get access to L2 trading data, for free. At least that's how it was when I was playing with it, when gdax existed. I'm not in this industry but, I suspect this level of access has a financial barrier to entry on the stock exchanges.
- arberx 6y ago
  Which is a huge advantage imo. Democratizing information that at the moment, only a few big players know/can use to their advantage in the traditional market.
- jb1991 6y ago
  Are you referring to seeing the depth of market? That's been free for many years in many stock and futures trading platforms as well. How is it different in crypto?
  - RobRivera 6y ago
    real-time L2 feeds are not free for intraday trading. historical L2 data is free
    - jb1991 6y ago
      That hasn’t been through with my TD Ameritrade account for many years. I get level two depth on stock and futures for intraday trading, no additional fee.
      - waynesonfire 6y ago
        https://www.brokerage-review.com/expert/level2/td-ameritrade-level-2-quotes.aspx https://www.brokerage-review.com/expert/level2/td-ameritrade... > TD Ameritrade offers Level II quotes free of charge to both professional and non-professional traders. This is a very generous policy. Not all brokers offer Level II quotes at no cost. For example, TradeStation charges $10 per month for Level II quotes for non-professionals, while professional traders must pay a very steep $110 per month for the same data. Nice! competition is great.
EGreg 6y ago
And this is why you have to understand fundamentals. Flash LOANS in ONE transaction actually work because unsharded blockchains suck and do one transaction at a time. You can be sure nothing else is executing, so you can safely rollback if you don’t like the result. On the other hand, if your transaction completes and you try the same with multiple transactions, you don’t have any ACID guarantees.
jtchang 6y ago
This actually makes me like blockchain technologies more. Finance has always been a game. A game in which the price of entry can be prohibitively high to a lot of people. Blockchain really levels the playing field. People are free to play the game (and metagame) with virtually no cost of entry besides time. Granted this may change as the meta evolves. Bigger players with more resources may be able to find new "exploits". However the risk increases as well and there has never been this much financial leverage introduced as with blockchain.
- croes 6y ago
  ETH is a bad example. It had critical bugs and is more vulnerable to 51% attacks.
  - zionic 6y ago
    [citation needed] Perhaps you meant ETC?
    - twox2 6y ago
      I would also like to see this claim backed up or at least offered with more context.
      - croes 6y ago
        https://bravenewcoin.com/insights/bug-causes-chaos-on-the-ethereum-blockchain https://bravenewcoin.com/insights/bug-causes-chaos-on-the-et... https://our.status.im/vitalik-escalates-eth-2-0-merge-as-miners-plan-a-51-attack/ https://our.status.im/vitalik-escalates-eth-2-0-merge-as-min...
    - Scoundreller 6y ago
      Wasn’t present-day ETH a 51% attack against now-called Ethereum Classic (ETC) because they wanted to roll-back a transaction/vulnerability they didn’t like?
tyrust 6y ago
>The premise of the Salmonella contract is very simple. It’s a regular ERC20 token, which behaves exactly like any other ERC20 token in normal use-cases. However, it has some special logic to detect when anyone other than the specified owner is transacting it, and in these situations it only returns 10% of the specified amount - despite emitting event logs which match a trade of the full amount. Does the ERC20 spec allow such a transfer function to let token creators implement transfer fees? And I guess uniswap doesn't care (or maybe even know) how high these fees are?
- spuz 6y ago
  Good question. The ERC20 spec defines only what methods a contract should implement. It does not specify how those methods should be implemented. To have a transfer function that doesn't actually transfer any balance is perfectly valid (and as a user you should be sure that the contract you are calling actually does what you expect). The spec does require that a Transfer event is created however. https://eips.ethereum.org/EIPS/eip-20#methods https://eips.ethereum.org/EIPS/eip-20#methods
- deleted 6y ago
  [deleted]
- andypants 6y ago
  There are real tokens meant to be used by real people that have some kind of 'tax' per transfer which is implemented similarly. Uniswap doesn't care, it just needs to update its reserves before every swap.
jl2718 6y ago
This is a weakness in many AMM implementations. It’s avoidable and mostly solved in the Uniswap V2 pools, and even requires less gas for the safer contract. Side note: there is a huge problem with contract standards in Ethereum. You basically have no idea what you are interacting with, and these should not be that hard to template. EDIT ON RE-READ: I’m going to call foul on this guy. His token is designed to deceive and exploit anybody but himself. Not just sandwich traders. You buy 10, it gives you 1. This would be clearly criminal in the offline world. Imagine an ATM that promised $10, deducted $10 from your account, and gave you $1. In fact, it’s even worse than that. It divides by 10 every time you send it, but not him. I agree that ethermine is clearly and openly unethical. Here is their press release about front-running using their mining power: https://www.nasdaq.com/articles/ethermine-adds-front-running-software-to-help-miners-offset-eip-1559-revenue-losses-2021 https://www.nasdaq.com/articles/ethermine-adds-front-running... But this contract is worse. He actually has no idea whose eth he is stealing. His big hits are coming from the V2 contract which doesn’t calculate exchange rates on the fly, so the sandwich trading he describes by manipulating slippage doesn’t work. https://etherscan.io/token/0x610b8B78da143fC1E38b36C4EA0f68F86cc3b4f4 https://etherscan.io/token/0x610b8B78da143fC1E38b36C4EA0f68F... function _transfer(address sender, address recipient, uint256 amount) internal virtual { require(sender != address(0), "ERC20: transfer from the zero address"); require(recipient != address(0), "ERC20: transfer to the zero address"); uint256 senderBalance = _balances[sender]; require(senderBalance >= amount, "ERC20: transfer amount exceeds balance"); if (sender == ownerA || sender == ownerB) { _balances[sender] = senderBalance - amount; _balances[recipient] += amount; } else { _balances[sender] = senderBalance - amount; uint256 trapAmount = (amount \* 10) / 100; _balances[recipient] += trapAmount; } emit Transfer(sender, recipient, amount); }
- gruez 6y ago
  >This would be clearly criminal in the offline world. Imagine an ATM that promised $10, deducted $10 rom your account, and gave you $1. In fact, it’s even worse than that. It divides by 10 every time you send it, but not him. But the smart contract isn't promising anything. You can even inspect it to see how it works. What's happening is closer to an ATM that charges a $5 service fee if you're out of network, and makes that known to you when you're using it.
lifeisstillgood 6y ago
My poor understanding of Libertarian theory suggests that this is anarchy working well - there was someone doing dodgy front running and exploiting people, and someone has made that too expensive to continue. But I cannot get away from the feeling that I would prefer if there was a centralised gov that took the 250K as taxes, and still prevented the front running. Edit: I may have been wrong - it seems it did not prevent future front running, just meant the front runners had to adjust their approach. It does seem like "if you rob people in the street, be careful as someone might rob you afterwards" as opposed to "all robbery is prevented"
- CityOfThrowaway 6y ago
  This method is desirable in that it is a generalizable and automatic correction mechanism. There is no need for a group of people to come together and decide to prevent it, figure out how to prevent it, and then stand up the infrastructure for detection, intervention, and enforcement. All of those things are cost centers in a non-free market, and will be judged as such. In the free market, somebody will turn that cost center into a profit center and achieve the same end goal. Of course, it doesn’t work in all cases. There are types of attacks that can’t be inverted into a profitable counter attack. For those things, libertarianism may well fall short and a dogmatic ideal.
- southerntofu 6y ago
  > this is anarchy working well No, this is anomie (see Wikipedia). Anarchy is the absence of domination/authority, not lawlessness and rule of the strongest. Also, as an anarchist, it makes me laugh to read people claiming crypto-coins are supposedly anarchist. Who controls the code? Who controls the network? Power is not as distributed as it appears. Moreover, one could argue the entire concept of money is antithetic to anarchism.
  - igorkraw 6y ago
    While I agree on you that crypto isn't Anarchy, I feel that Proudhons labor vouchers aren't much different from money. Money is just tokens of debt, be it if gratitude or other, if a group uses them to keep track of that debt it's not inherently evil
callamdelaney 6y ago
It sounds like this only applies to decentralized exchanges, eg where exchanges exist on the blockchain and require smart contract execution for trades to take place - ergo this should quite obviously create the opportunity for these front runners to exist and make money. It's confusing because this isn't really specified - it's not possible to do this on Binance or other centralised exchanges as I understand.
quentinadam 6y ago
This is absolutely fantastic.
pjc50 6y ago
Distributed finance is one big distributed CTF game. You can exploit other people's software for real money, and you get to keep it because law enforcement doesn't understand any of this and the tokens are fairly pseudonymous. Of course, that makes it a very perilous place to build a business.
- jl2718 6y ago
  Yes, but, the blockchain is forever.
  - chias 6y ago
    Bold words to describe something that's 12 years old.
    - skybrian 6y ago
      I assume they mean that law enforcement will catch up eventually. Copies are widely distributed. That's how it works. Even if the whole thing blew up somehow, it would be very unlikely for every copy to be lost.
jackconsidine 6y ago
This reminds me of an old scam on Runescape, which was to have two users, one purporting to buy an item for a very high price, and one purporting to sell an item for a moderately high price. Wannabe entrepreneurs would see an arbitrage opportunity and bite the moderately high price expecting a profit. After that transaction the supposed buyer would no longer be interested.
- 600frogs 6y ago
  I wonder what the Ethereum equivalent of trimming armour is...
  - minitoar 6y ago
    Fake NFT sales
    - valiant55 6y ago
      So regular NFT sales?
  - imtringued 6y ago
    https://www.bbc.com/news/amp/technology-56402378 https://www.bbc.com/news/amp/technology-56402378
- pochamago 6y ago
  Conjobs are such a fun bit of artistry, it's a shame they cause so much harm. I appreciate that video games provide an arena that mostly reduces it.
  - ethbr0 6y ago
    As an EVE Online player for a while, absolutely agreed. But I'll admit there is a "fairness gauge" regarding feature support (relevant here as well). Code systems are non-comprehensive. They support only those functions / features they implement. Thereby opening the possibility of creating a system that makes confidence heists possible, but mitigations against them overly difficult / impossible.
the__alchemist 6y ago
After a skim of Etherium's website's collection of uses for Etherium and finding what looked like money laundering through artwork (then reading about NFTs), I figured from the title this was about speculative trading of sandwiches in cryptocurrency.
- tyingq 6y ago
  https://nftshowroom.com/gallery/solymi_experiments_sandwich https://nftshowroom.com/gallery/solymi_experiments_sandwich
dash2 6y ago
This is funny. What I'd love to see, and don't ever, is a real world use of Ethereum which isn't just about arbitraging meaningless tokens. I'm sure there are lots of theoretical ways smart contracts could change the world. Is there any way in which Ethereum, right now, is adding value to the real economy? I'm talking about being used in a real product to provide a good or service.
- alteriority 6y ago
  I think that's a legitimate stance, but one way to put a silver lining on this writhing cesspool of dog-eat-dog bot-fuckery is to think of it as early-access alpha testing; ironing out exploits in the wild west before it's stable enough for the not-as-extremely-online to run something useful on.
  - munificent 6y ago
    The financial system did that already, hundreds of years ago. And it turned out that the most efficient way to iron out these bugs was through trust and regulation. To an outsider, the entire crypocurrency world just looks like a giant exhorbitantly expensive not-invented-here syndrome recapitulating the entire early history of finance.
    - alteriority 6y ago
      Did they, though? If I were to describe the finance industry, "trustworthy" and "well-regulated" would probably not be the first words I'd reach for. (EDIT: To be fair, I'm a pretty typical layman, and I might just be throwing stones at a strawman. Maybe EVIL GREEDY BANKERS are a rarity in an otherwise idyllic system, but that's not what's in the zeitgeist) To be clear, I don't strictly disagree with your outsider interpretation, but...if it's recapitulating the history of finance at 100x speed, at a thousandth of the cost, with the end result of removing an aspect (centralization) that could plausibly considered an irreconcilable technical debt, then...I mean, I'm personally not in that world at all, but I think that smart contracts have a lot of potential, in the abstract, and I'm all for early adopters who aren't me volunteering as guinea pigs. I genuinely think there's something novel here; I just don't know what form it will take, or how many millions of dollars we'll burn on shitcoins finding it. Like the first internet bubble--we'll have to shovel through a lot of pets.coms to find our proverbial Amazons. [Tangentially, I'm reminded of something I read yesterday about the nonexistent technological breakthrough, Write-Only Memory: "write-only memory: A form of computer memory into which information can be stored but never, ever retrieved, developed under government contract in 1975 by Professor Homberg T. Farnsfarfle. Farnsfarfle's original prototype, approximately one inch on each side, has so far been used to store more than 100 trillion words of surplus federal information. Farnsfarfle's critics have denounced his project as a six-million-dollar boondoggle, but his defenders point out that this excess information would have cost more than 250 billion dollars to store in conventional media."]
cryptica 6y ago
It feels like throwing money down the virtual toilet has become a new international sport for rich people. Ethereum is like giant garbage can for throwing away money; it lets you waste it all on ridiculous DeFi fees or on some useless NFTs, or you can waste it on completely ridiculous trading schemes that are only possible because of major flaws in the design of the garbage can... Um, I mean Ethereum... Rich people these days don't seem to bat an eyelash when it comes to throwing away huge sums of money on some obvious scams but they will not risk to invest even small amounts in new promising projects. Is there some kind of secret club for all rich people where one of the rules is that you should only invest your money in scams? That's the most rational explanation I can come up with. I'm not surprised that so many people believe in conspiracy theories nowadays. It's really difficult to explain how else rich people can be so dumb... It's almost like the invisible hand of fortune is selecting them explicitly because of their stupidity.
- 7sidedmarble 6y ago
  >Is there some kind of secret club for all rich people where one of the rules is that you should only invest your money in scams? That's the most rational explanation I can come up with. It's because when you have an absurd amount of money, you can afford to speculate on every stupid idea imaginable on the slight chance of turning their (to them) small investment into ridiculous money. Why else is Tesla stock up 1400% in a year? It's rampant speculation. The stupidest outcome is probably the most likely outcome when it comes to finance.

269 points by dmckinno 6y ago

> As trad(itional) finance morphs into chad finance, it's easy to get sucked up in the excitement. This made me laugh. Interesting overall, adding it (b/c of what was exploited, not the exploit, kudos to that) to my reason list to not build on the blockchain. Thanks for the share

tzone 6y ago
That makes absolutely no sense. HFT and overall arbitrage games in traditional markets are way more wild and complex than all this.
- verdverm 6y ago
  What makes no sense? Also, the stock market is not trying inject itself into every digital process (or possibly digitized process).

ajb 6y ago

"... it has some special logic to detect when anyone other than the specified owner is transacting it, and in these situations it only returns 10% of the specified amount - despite emitting event logs which match a trade of the full amount" Wouldn't be surprised if this comes under the definition of fraud.

impostervt 6y ago
How can it be fraud, when you can read the contract? It's a clear if/then statement.
- gegtik 6y ago
  this is what people unironically believe should replace our current legal system
  - parhamn 6y ago
    To be fair, 250k legal correction isn’t that high relative to fighting nuances in conditionals and terms for 5 years in a more human court.
    - SamBam 6y ago
      250k was one one programmer made in an experiment over a couple nights. The Ethereum world (and potentially other cryptos) seem awash with this kind of thing.
- Cthulhu_ 6y ago
  Just because Facebook puts things in their T's & C's doesn't mean they get away with it. That said, crypto is intentionally the wild west, because the Big Banks are bad. Libertarian economics, no oversight, no fraud protection, but freedom. Whether you want that is another matter. Personally I think it's a really really bad idea, and billions of monies have been lost, generated, stolen, etc because of it.
- dleslie 6y ago
  It's possible to commit fraud while being entirely open and forthright. The key is whether it can be argued that there was an intent to deceive, despite being forthright. A famous example would be the Toy Yoda/Toyota fraud: https://apnews.com/article/6f88d96871f3292f506e2679cf012597 https://apnews.com/article/6f88d96871f3292f506e2679cf012597
  - eigen 6y ago
    the case was settled. there was no verdict of fraud, just the allegation based on the suit filed. https://www.morelaw.com/verdicts/case.asp?s=FL&d=19243 https://www.morelaw.com/verdicts/case.asp?s=FL&d=19243
  - gowld 6y ago
    That's different. The manager made an ambiguous oral statement, and in contract law ambiguity is resolved in favor of the party with less power or who didn't make the ambiguous statement.
tych0 6y ago
Why? The contract is public, anyone trading this token can read it. This seems like "don't trade tokens you haven't audited".
- stepanhruda 6y ago
  Just because something is publicly documented doesn't make it legal. I can't put "our price says $5 but actually we will charge you $5,000" into terms onto a website and expect to get away with it. The only difference is there is no actual enforceability of anything on the blockchain outside of smart contract code itself.
  - tych0 6y ago
    This guy put up a sign that says "If you give me $100 I'll give you $10 back with an extra 0 handwritten on the bill", and people gave him $100. Put another way: I can't claim fraud just because I didn't understand/read/validate the contract language.
    - PeterisP 6y ago
      "I can't claim fraud just because I didn't understand/read/validate the contract language." is absolutely not true. If you create a contract with intent to mislead people and having them sign it with the expectation that they won't understand/read/validate the contract language, then the other party definitely can claim fraud afterwards and (depending on the circumstances and evidence) may win such a claim. Contract law is about intent above all, the actual contract language clarifies and documents that intent, but in circumstances where the contract language and intent clearly diverge, any adjudication must and will take intent into account. To be specific, "intent to deceive" is a key part of the limitations in contract law in pretty much every jurisdiction. Fraudulent misrepresentation, which explicitly includes withholding information as well, can invalidate the whole contract if you (for example) tricked someone into signing it i.e. 'fraud in inducement' and in such cases the harmed party definitely can claim fraud even if the contract language explicitly said that they will lose their money, if the other party mislead them into thinking otherwise.
blobster 6y ago
Exactly. Wouldn't be surprised if this became a common type of scam on Uniswap.

silentsea90 6y ago

Can somebody please explain the Salmonella contract like I am a 5 year old?

dmckinno 6y ago
The author noticed that: 1/ Prices move after large trades are confirmed 2/ An variety of sandwich bots have sprung up to take advantage of this behavior by detecting the trade in the mempool (before confirmation), front running the trade with a buy order of their own, and posting a sell order for a profit after the large trade landed. To profit from this exploitive behavior, he created a token that would trick sandwich traders into thinking a large trade was coming, but would keep their money when they tried to exit their position after the front run.
- spuz 6y ago
  On which exchange can you buy and sell these "Salmonella" tokens? Why would anyone pay real money for a token without knowing who the issuer is?
  - flixic 6y ago
    On DEXes, or Decentralized Exchanges, you can exchange any standard-compliant token with any other token. No "listings" needed. That's why DEXes warn users to make sure they are trading the real tokens, not their fake clones.
  - andypants 6y ago
    Normal users wouldn't be aware of this token. Sandwich bots monitor all pending transactions. The author sent transactions between his own accounts, and sandwich bots tried to take advantage.
- silentsea90 6y ago
  Do traders buy arbitrary tokens? This is a custom token that op created, not the ETH token, correct? I suppose sandwich traders don't mind buying salmonella because there's another buyer at the other end. This is quite interesting. I need to read up more!

newswasboring 6y ago

This has a very early internet vibe. Like bash quotes or declaration of freedom of cyberspace (of course much less eloquent and elegant).

arberx 6y ago
For this reason only, it's extremely exciting. I know blockchains get a lot of hate, but the things you can do with smart contracts should excite any techy.
- twox2 6y ago
  Agreed. It's the invigorating "wild west" vibe that I loved about the early internet.
  - newswasboring 6y ago
    If you want a similar vibe, another space is VR. I am part of that mass adoption wave from oculus 2 and before I got it I binge watched a lot of content about VR on youtube. The amount of excitement in those videos was amazing and infectious. With the quest 2 also doubling as a dev platform I think next few years in this space are going to be exciting. Edit: There are a few differences though, mainly a lot more female representation.
    - arberx 6y ago
      I agree, the oculus 2 made me super bullish on the space.
    - twox2 6y ago
      Yep, 100%. The thing that bugs me about Oculus is the facebook connection, and there isn't a viable alternative at a similar price point. Otherwise, spot on. There's also a dotted line between VR and AR which kind of makes it a combined discipline imo.

crescentfresh 6y ago

> In layman's terms, you see that someone will buy an asset, so you buy it first to artificially inflate the price, before selling afterwards at a profit. This sounds familiar. Isn't this a tactic used on the stock market as well? Something something microtransactions.

raziel2701 6y ago
I think they call it front running. It sounds similar to the stuff that high frequency traders can do and what market makers like citadel do when they buy the order flow from brokers.
- gruez 6y ago
  Payment for order flow =/= front-running. https://www.bloomberg.com/opinion/articles/2021-02-05/robinhood-gamestop-saga-pressures-payment-for-order-flow https://www.bloomberg.com/opinion/articles/2021-02-05/robinh...
  - justjonathan 6y ago
    I used to think that too, but this excellent piece from Matt Levine explains why that is not really the case: https://www.bloomberg.com/opinion/articles/2021-02-05/robinhood-gamestop-saga-pressures-payment-for-order-flow https://www.bloomberg.com/opinion/articles/2021-02-05/robinh... Retail traders benefit from this, and on Schwab, for example, they show you the dollars of price improvement the got you.
clipradiowallet 6y ago
The terms "wash trading" and "order stacking" come to mind, even though it's not strictly either of those things. It's more a combination of them. order stacking == placing bids(or asks), lots of them, that I have no intention of letting them fill. The reason I would place them is to falsely give the impression to retail traders that there are tons of buyers just waiting to snap something up...if you don't buy it first. The moment you buy it, I cancel them, and re-create them as asks. This tanks the price on the contract you just bought. wash trading == lots of transactions with yourself(or your partners), to give the impression of high levels of activity. This can lure other traders to place a trade they wouldn't otherwise place. front running == illegal with futures, I don't know about stocks. But the idea is this... I [as a broker or market maker] receive your orders to buy. I buy for myself before I execute your orders - your buy orders increase the price, which is good for my own position I opened initially.

jboydyhacker 6y ago

The term for this is public markets is "front running".

tzone 6y ago
Sandwich attack is more than just "front running". It is both "front running" and "back running" combined.
- happyconcepts 6y ago
  "Sandwich attack" is the attacker marketing to de-emphasize that they are frontrunning. Unless it applies to sandwiching within the same block.
  - andypants 6y ago
    > Unless it applies to sandwiching within the same block. Yes, that's what it means. TX 0: attacker TX 1: victim TX 2: attacker

waynesonfire 6y ago

One thing that makes cryptocurrency trading special is that you get access to L2 trading data, for free. At least that's how it was when I was playing with it, when gdax existed. I'm not in this industry but, I suspect this level of access has a financial barrier to entry on the stock exchanges.

arberx 6y ago
Which is a huge advantage imo. Democratizing information that at the moment, only a few big players know/can use to their advantage in the traditional market.
jb1991 6y ago
Are you referring to seeing the depth of market? That's been free for many years in many stock and futures trading platforms as well. How is it different in crypto?
- RobRivera 6y ago
  real-time L2 feeds are not free for intraday trading. historical L2 data is free
  - jb1991 6y ago
    That hasn’t been through with my TD Ameritrade account for many years. I get level two depth on stock and futures for intraday trading, no additional fee.
    - waynesonfire 6y ago
      https://www.brokerage-review.com/expert/level2/td-ameritrade-level-2-quotes.aspx https://www.brokerage-review.com/expert/level2/td-ameritrade... > TD Ameritrade offers Level II quotes free of charge to both professional and non-professional traders. This is a very generous policy. Not all brokers offer Level II quotes at no cost. For example, TradeStation charges $10 per month for Level II quotes for non-professionals, while professional traders must pay a very steep $110 per month for the same data. Nice! competition is great.

EGreg 6y ago

And this is why you have to understand fundamentals. Flash LOANS in ONE transaction actually work because unsharded blockchains suck and do one transaction at a time. You can be sure nothing else is executing, so you can safely rollback if you don’t like the result. On the other hand, if your transaction completes and you try the same with multiple transactions, you don’t have any ACID guarantees.

jtchang 6y ago

This actually makes me like blockchain technologies more. Finance has always been a game. A game in which the price of entry can be prohibitively high to a lot of people. Blockchain really levels the playing field. People are free to play the game (and metagame) with virtually no cost of entry besides time. Granted this may change as the meta evolves. Bigger players with more resources may be able to find new "exploits". However the risk increases as well and there has never been this much financial leverage introduced as with blockchain.

croes 6y ago
ETH is a bad example. It had critical bugs and is more vulnerable to 51% attacks.
- zionic 6y ago
  [citation needed] Perhaps you meant ETC?
  - twox2 6y ago
    I would also like to see this claim backed up or at least offered with more context.
    - croes 6y ago
      https://bravenewcoin.com/insights/bug-causes-chaos-on-the-ethereum-blockchain https://bravenewcoin.com/insights/bug-causes-chaos-on-the-et... https://our.status.im/vitalik-escalates-eth-2-0-merge-as-miners-plan-a-51-attack/ https://our.status.im/vitalik-escalates-eth-2-0-merge-as-min...
  - Scoundreller 6y ago
    Wasn’t present-day ETH a 51% attack against now-called Ethereum Classic (ETC) because they wanted to roll-back a transaction/vulnerability they didn’t like?

tyrust 6y ago

>The premise of the Salmonella contract is very simple. It’s a regular ERC20 token, which behaves exactly like any other ERC20 token in normal use-cases. However, it has some special logic to detect when anyone other than the specified owner is transacting it, and in these situations it only returns 10% of the specified amount - despite emitting event logs which match a trade of the full amount. Does the ERC20 spec allow such a transfer function to let token creators implement transfer fees? And I guess uniswap doesn't care (or maybe even know) how high these fees are?

spuz 6y ago
Good question. The ERC20 spec defines only what methods a contract should implement. It does not specify how those methods should be implemented. To have a transfer function that doesn't actually transfer any balance is perfectly valid (and as a user you should be sure that the contract you are calling actually does what you expect). The spec does require that a Transfer event is created however. https://eips.ethereum.org/EIPS/eip-20#methods https://eips.ethereum.org/EIPS/eip-20#methods
deleted 6y ago
[deleted]
andypants 6y ago
There are real tokens meant to be used by real people that have some kind of 'tax' per transfer which is implemented similarly. Uniswap doesn't care, it just needs to update its reserves before every swap.

jl2718 6y ago

This is a weakness in many AMM implementations. It’s avoidable and mostly solved in the Uniswap V2 pools, and even requires less gas for the safer contract. Side note: there is a huge problem with contract standards in Ethereum. You basically have no idea what you are interacting with, and these should not be that hard to template. EDIT ON RE-READ: I’m going to call foul on this guy. His token is designed to deceive and exploit anybody but himself. Not just sandwich traders. You buy 10, it gives you 1. This would be clearly criminal in the offline world. Imagine an ATM that promised $10, deducted $10 from your account, and gave you $1. In fact, it’s even worse than that. It divides by 10 every time you send it, but not him. I agree that ethermine is clearly and openly unethical. Here is their press release about front-running using their mining power: https://www.nasdaq.com/articles/ethermine-adds-front-running-software-to-help-miners-offset-eip-1559-revenue-losses-2021 https://www.nasdaq.com/articles/ethermine-adds-front-running... But this contract is worse. He actually has no idea whose eth he is stealing. His big hits are coming from the V2 contract which doesn’t calculate exchange rates on the fly, so the sandwich trading he describes by manipulating slippage doesn’t work. https://etherscan.io/token/0x610b8B78da143fC1E38b36C4EA0f68F86cc3b4f4 https://etherscan.io/token/0x610b8B78da143fC1E38b36C4EA0f68F... function _transfer(address sender, address recipient, uint256 amount) internal virtual { require(sender != address(0), "ERC20: transfer from the zero address"); require(recipient != address(0), "ERC20: transfer to the zero address"); uint256 senderBalance = _balances[sender]; require(senderBalance >= amount, "ERC20: transfer amount exceeds balance"); if (sender == ownerA || sender == ownerB) { _balances[sender] = senderBalance - amount; _balances[recipient] += amount; } else { _balances[sender] = senderBalance - amount; uint256 trapAmount = (amount \* 10) / 100; _balances[recipient] += trapAmount; } emit Transfer(sender, recipient, amount); }

gruez 6y ago
>This would be clearly criminal in the offline world. Imagine an ATM that promised $10, deducted $10 rom your account, and gave you $1. In fact, it’s even worse than that. It divides by 10 every time you send it, but not him. But the smart contract isn't promising anything. You can even inspect it to see how it works. What's happening is closer to an ATM that charges a $5 service fee if you're out of network, and makes that known to you when you're using it.

lifeisstillgood 6y ago

My poor understanding of Libertarian theory suggests that this is anarchy working well - there was someone doing dodgy front running and exploiting people, and someone has made that too expensive to continue. But I cannot get away from the feeling that I would prefer if there was a centralised gov that took the 250K as taxes, and still prevented the front running. Edit: I may have been wrong - it seems it did not prevent future front running, just meant the front runners had to adjust their approach. It does seem like "if you rob people in the street, be careful as someone might rob you afterwards" as opposed to "all robbery is prevented"

CityOfThrowaway 6y ago
This method is desirable in that it is a generalizable and automatic correction mechanism. There is no need for a group of people to come together and decide to prevent it, figure out how to prevent it, and then stand up the infrastructure for detection, intervention, and enforcement. All of those things are cost centers in a non-free market, and will be judged as such. In the free market, somebody will turn that cost center into a profit center and achieve the same end goal. Of course, it doesn’t work in all cases. There are types of attacks that can’t be inverted into a profitable counter attack. For those things, libertarianism may well fall short and a dogmatic ideal.
southerntofu 6y ago
> this is anarchy working well No, this is anomie (see Wikipedia). Anarchy is the absence of domination/authority, not lawlessness and rule of the strongest. Also, as an anarchist, it makes me laugh to read people claiming crypto-coins are supposedly anarchist. Who controls the code? Who controls the network? Power is not as distributed as it appears. Moreover, one could argue the entire concept of money is antithetic to anarchism.
- igorkraw 6y ago
  While I agree on you that crypto isn't Anarchy, I feel that Proudhons labor vouchers aren't much different from money. Money is just tokens of debt, be it if gratitude or other, if a group uses them to keep track of that debt it's not inherently evil

callamdelaney 6y ago

It sounds like this only applies to decentralized exchanges, eg where exchanges exist on the blockchain and require smart contract execution for trades to take place - ergo this should quite obviously create the opportunity for these front runners to exist and make money. It's confusing because this isn't really specified - it's not possible to do this on Binance or other centralised exchanges as I understand.

quentinadam 6y ago

This is absolutely fantastic.

pjc50 6y ago

Distributed finance is one big distributed CTF game. You can exploit other people's software for real money, and you get to keep it because law enforcement doesn't understand any of this and the tokens are fairly pseudonymous. Of course, that makes it a very perilous place to build a business.

jl2718 6y ago
Yes, but, the blockchain is forever.
- chias 6y ago
  Bold words to describe something that's 12 years old.
  - skybrian 6y ago
    I assume they mean that law enforcement will catch up eventually. Copies are widely distributed. That's how it works. Even if the whole thing blew up somehow, it would be very unlikely for every copy to be lost.

jackconsidine 6y ago

This reminds me of an old scam on Runescape, which was to have two users, one purporting to buy an item for a very high price, and one purporting to sell an item for a moderately high price. Wannabe entrepreneurs would see an arbitrage opportunity and bite the moderately high price expecting a profit. After that transaction the supposed buyer would no longer be interested.

600frogs 6y ago
I wonder what the Ethereum equivalent of trimming armour is...
- minitoar 6y ago
  Fake NFT sales
  - valiant55 6y ago
    So regular NFT sales?
- imtringued 6y ago
  https://www.bbc.com/news/amp/technology-56402378 https://www.bbc.com/news/amp/technology-56402378
pochamago 6y ago
Conjobs are such a fun bit of artistry, it's a shame they cause so much harm. I appreciate that video games provide an arena that mostly reduces it.
- ethbr0 6y ago
  As an EVE Online player for a while, absolutely agreed. But I'll admit there is a "fairness gauge" regarding feature support (relevant here as well). Code systems are non-comprehensive. They support only those functions / features they implement. Thereby opening the possibility of creating a system that makes confidence heists possible, but mitigations against them overly difficult / impossible.

the__alchemist 6y ago

After a skim of Etherium's website's collection of uses for Etherium and finding what looked like money laundering through artwork (then reading about NFTs), I figured from the title this was about speculative trading of sandwiches in cryptocurrency.

tyingq 6y ago
https://nftshowroom.com/gallery/solymi_experiments_sandwich https://nftshowroom.com/gallery/solymi_experiments_sandwich

dash2 6y ago

This is funny. What I'd love to see, and don't ever, is a real world use of Ethereum which isn't just about arbitraging meaningless tokens. I'm sure there are lots of theoretical ways smart contracts could change the world. Is there any way in which Ethereum, right now, is adding value to the real economy? I'm talking about being used in a real product to provide a good or service.

alteriority 6y ago
I think that's a legitimate stance, but one way to put a silver lining on this writhing cesspool of dog-eat-dog bot-fuckery is to think of it as early-access alpha testing; ironing out exploits in the wild west before it's stable enough for the not-as-extremely-online to run something useful on.
- munificent 6y ago
  The financial system did that already, hundreds of years ago. And it turned out that the most efficient way to iron out these bugs was through trust and regulation. To an outsider, the entire crypocurrency world just looks like a giant exhorbitantly expensive not-invented-here syndrome recapitulating the entire early history of finance.
  - alteriority 6y ago
    Did they, though? If I were to describe the finance industry, "trustworthy" and "well-regulated" would probably not be the first words I'd reach for. (EDIT: To be fair, I'm a pretty typical layman, and I might just be throwing stones at a strawman. Maybe EVIL GREEDY BANKERS are a rarity in an otherwise idyllic system, but that's not what's in the zeitgeist) To be clear, I don't strictly disagree with your outsider interpretation, but...if it's recapitulating the history of finance at 100x speed, at a thousandth of the cost, with the end result of removing an aspect (centralization) that could plausibly considered an irreconcilable technical debt, then...I mean, I'm personally not in that world at all, but I think that smart contracts have a lot of potential, in the abstract, and I'm all for early adopters who aren't me volunteering as guinea pigs. I genuinely think there's something novel here; I just don't know what form it will take, or how many millions of dollars we'll burn on shitcoins finding it. Like the first internet bubble--we'll have to shovel through a lot of pets.coms to find our proverbial Amazons. [Tangentially, I'm reminded of something I read yesterday about the nonexistent technological breakthrough, Write-Only Memory: "write-only memory: A form of computer memory into which information can be stored but never, ever retrieved, developed under government contract in 1975 by Professor Homberg T. Farnsfarfle. Farnsfarfle's original prototype, approximately one inch on each side, has so far been used to store more than 100 trillion words of surplus federal information. Farnsfarfle's critics have denounced his project as a six-million-dollar boondoggle, but his defenders point out that this excess information would have cost more than 250 billion dollars to store in conventional media."]

cryptica 6y ago

It feels like throwing money down the virtual toilet has become a new international sport for rich people. Ethereum is like giant garbage can for throwing away money; it lets you waste it all on ridiculous DeFi fees or on some useless NFTs, or you can waste it on completely ridiculous trading schemes that are only possible because of major flaws in the design of the garbage can... Um, I mean Ethereum... Rich people these days don't seem to bat an eyelash when it comes to throwing away huge sums of money on some obvious scams but they will not risk to invest even small amounts in new promising projects. Is there some kind of secret club for all rich people where one of the rules is that you should only invest your money in scams? That's the most rational explanation I can come up with. I'm not surprised that so many people believe in conspiracy theories nowadays. It's really difficult to explain how else rich people can be so dumb... It's almost like the invisible hand of fortune is selecting them explicitly because of their stupidity.

7sidedmarble 6y ago
>Is there some kind of secret club for all rich people where one of the rules is that you should only invest your money in scams? That's the most rational explanation I can come up with. It's because when you have an absurd amount of money, you can afford to speculate on every stupid idea imaginable on the slight chance of turning their (to them) small investment into ridiculous money. Why else is Tesla stock up 1400% in a year? It's rampant speculation. The stupidest outcome is probably the most likely outcome when it comes to finance.