3 ms·
Sort of. If using Ethereum for example, you could run your own ETH node and frontrun any transactions trying to transfer ETH out of one of your wallets. The at
by pcthrowaway 5y ago
Sort of. If using Ethereum for example, you could run your own ETH node and frontrun any transactions trying to transfer ETH out of one of your wallets.
The attacker wouldn't lose money because they're using that wallet to pay the fees, so you'd be the only one paying the transaction fee. Also, if this became a standard, it's possible that attackers would find ways around it (it kind of becomes an arms race to see who can bribe miners the most).
If your wallet contains no ETH, but contains for example, USDC, then they have to transfer their own ETH in to make a transaction to extract the USDC. This would work in theory, but it's such a common way to scam/hack people already that most attackers would be able to sniff out the honeypot.
The typical scam is "leaking" the private key for a wallet that has, say, $30 of some valuable token in it (e.g. on reddit, discord, anywhere that less technical users congregate). When users import the key and realize they can transfer the token out, they only need to deposit some ETH to the wallet first to pay for gas fees. But when they do that, a script automatically sends the ETH somewhere else.
Personally I see this being a potentially valuable way to manage servers, and also pay a non-critical bug bounty to black-hats. Each server can have its own crypto wallet, and the amount you fund it with varies based on how critical it is. If a compromise of one system occurs, you know immediately where the compromise occurred based on the address.
The attacker gets a payday, and you get a lead on something you need to patch.
- FatalLogic 5y agoInteresting, thank you. And to avoid most risk, maybe the hackers could just mine the thieving transaction themselves? The hackers could operate a miner which privately adds that transaction every time it tries to solve a block, but broadcasts it only when they successfully got the block. It could be running for days before it succeeds, because there's probably no urgency. They can take all the fees, and it's difficult to frontrun because nobody knows the theft is happening until the block is already solved and it's almost too late.
- pcthrowaway 5y agoI mean it's not like they're risking a massive amount of ETH on the first try, but if they saw it get stolen the first time, sure, they might try sniping the token by running/bribing a miner if the payout was great enough (there are networks of miners that let you include transactions without getting front-run by paying them a fee)
- syzygyhack 5y agoYou are correct. Actually in practice it is far less complicated to achieve this, at least for Ethereum. You can simply use the Flashbots RPC to bundle your transaction and have it sent straight to a miner. No exposure to the public mempool = no frontrunning possible, and no need to run your own miner/validator.