3 ms·

Attacking Ethereum and Stealing $25M

26 points by noch 2y ago

scrlk 2y ago
MEV bots sandwich attacking traders = okay MEV bots sandwich attacking other MEV bots = fraud This doesn't sit right with me.
- deleted 2y ago
  [deleted]
- noch 2y ago
  > This doesn't sit right with me. Agreed. They likely stepped on the wrong person's toes because this kind of stuff is the bread and butter of on-chain hedge funds.
- miohtama 2y ago
  MEV boost protocol was protected by $2000 economic security (1 ETH). Attackers had their 1 ETH slashed as the violation of the protocol. Flashbots, a US prop trader with $100M funding and $1B valuation then does $25M trades and then goes to the US court to complain that their own protocol was hacked, when it worked as intended. Pitiful. More here: https://twitter.com/Mudit__Gupta/status/1642848745460051969 https://twitter.com/Mudit__Gupta/status/1642848745460051969
clpm4j 2y ago
The standout bit to me is that they officially refer to the Ethereum blockchain as a "financial system", and clearly one that the US government is defending to some degree. Aside from that, I'm kind of impressed with these two brothers and a little disappointed that they got caught.
noch 2y ago
Post-mortem on the attack: https://collective.flashbots.net/t/post-mortem-april-3rd-2023-mev-boost-relay-incident-and-related-timing-issue/1540 https://collective.flashbots.net/t/post-mortem-april-3rd-202...
- chatmasta 2y ago
  I’ve just skimmed the post, but it seems like this attack takes advantage of validators operating in “untrusted” mode, i.e. outside the protection of the blockchain. They want to have their cake and eat it too. They want the security of the blockchain without the time spent to validate it. And then when someone takes advantage of this, they run to the police? This feels like selective prosecution of people who exploited the people who were already exploiting the system. Why should the court intervene and cut short this game of tit for tat? And why doesn’t it intervene in the same shenanigans that happen every day in HFT markets? I need to keep reading the technical write up, but it sounds a lot like an idea I had a few years ago. It seemed obvious to me. You have all these bots trying to frontrun the chain, and getting away with not trusting each other. Why not trick them and punish them for their exploits? You can scrape the DHT and impersonate arbitrary communications without the hassle of worrying about integrity and validation. For me, this was never more than an idle curiosity and area of research, but I certainly never thought it was morally or legally wrong. MEV bots are taking risk to exploit a system. Why would it be wrong to force them to realize that risk? Otherwise the MEV bots aren’t actually taking any risk and are simply exploiting their privileged position atop a moral hazard.

26 points by noch 2y ago

MEV bots sandwich attacking traders = okay MEV bots sandwich attacking other MEV bots = fraud This doesn't sit right with me.

deleted 2y ago
[deleted]
noch 2y ago
> This doesn't sit right with me. Agreed. They likely stepped on the wrong person's toes because this kind of stuff is the bread and butter of on-chain hedge funds.
miohtama 2y ago
MEV boost protocol was protected by $2000 economic security (1 ETH). Attackers had their 1 ETH slashed as the violation of the protocol. Flashbots, a US prop trader with $100M funding and $1B valuation then does $25M trades and then goes to the US court to complain that their own protocol was hacked, when it worked as intended. Pitiful. More here: https://twitter.com/Mudit__Gupta/status/1642848745460051969 https://twitter.com/Mudit__Gupta/status/1642848745460051969

clpm4j 2y ago

The standout bit to me is that they officially refer to the Ethereum blockchain as a "financial system", and clearly one that the US government is defending to some degree. Aside from that, I'm kind of impressed with these two brothers and a little disappointed that they got caught.

noch 2y ago

Post-mortem on the attack: https://collective.flashbots.net/t/post-mortem-april-3rd-2023-mev-boost-relay-incident-and-related-timing-issue/1540 https://collective.flashbots.net/t/post-mortem-april-3rd-202...

chatmasta 2y ago
I’ve just skimmed the post, but it seems like this attack takes advantage of validators operating in “untrusted” mode, i.e. outside the protection of the blockchain. They want to have their cake and eat it too. They want the security of the blockchain without the time spent to validate it. And then when someone takes advantage of this, they run to the police? This feels like selective prosecution of people who exploited the people who were already exploiting the system. Why should the court intervene and cut short this game of tit for tat? And why doesn’t it intervene in the same shenanigans that happen every day in HFT markets? I need to keep reading the technical write up, but it sounds a lot like an idea I had a few years ago. It seemed obvious to me. You have all these bots trying to frontrun the chain, and getting away with not trusting each other. Why not trick them and punish them for their exploits? You can scrape the DHT and impersonate arbitrary communications without the hassle of worrying about integrity and validation. For me, this was never more than an idle curiosity and area of research, but I certainly never thought it was morally or legally wrong. MEV bots are taking risk to exploit a system. Why would it be wrong to force them to realize that risk? Otherwise the MEV bots aren’t actually taking any risk and are simply exploiting their privileged position atop a moral hazard.