Basics of MEV in WEB3 security
Hello,
It’s been a bit moth than a month I’ve not written any articles about blockchain and security. Don’t worry, I work on a new crypto project, so I lack the time to write articles.
In this article, we will skim through the MEV on the blockchain.
Why I’m talking about MEV here? Because it’s strongly related to blockchain security.
In fact, they are like “mini-hacks” but without emptying the Ether (or token) of a contract.
1. What does truly means “MEV” ?
MEV = Miner Extractable Value. (Or Maximal Extractable Value)
MEV is the set of strategies employed on the blockchain by inserting, reordering and censoring transactions in a way that benefit the attacker.
Usually, this is led by very skilled actors with a very high understanding of how the blockchain works.
They deploy bots with a predefined “strategy” and monitor each transactions of the blockchain in order to see when the “strategy” can apply. (this is called an “opportunity”)
2. Different Strategies
2.1 Arbitrage
The most known strategy is to exploit the differences of prices of an asset between the exchanges.
Step 1 : Exchange Uniswap list WBTC at 16000
Step 2 : Exchange Sushiswap list WBTC at 17000
Step 3 : Buy WBTC at Uniswap (for 16k) and sell WBTC at Sushiswap (17k) and take 1k of profit.
Depending of the amount bought, profits will be of 1000USD per WBTC bought. (minus the slippage, and minus the DEX fees)
But in real life, the prices between exchanges of such an asset don’t vary at this extent, a difference of prices of 0.5% is already quite rare.
This is the simplest strategy, but the most competitive and thus profits are very limited…
2.2. Sandwich bots
Let’s say a victim buy 100 SHIBA for 1 ETH,
- The sandwich bot see your transaction on the mempool. (the transactions submitted but not written on the blockchain)
- The bot buy SHIBA too (but order shiba at higher gas price, therefore the transaction is placed before the victim), thus the price of SHIBA increase and the victim buy the token a higher price than advertised.
- The bot sells SHIBA after the victim bought SHIBA at a slightly higher price.
- Bot take profits.
- The Victim got wrecked because he’s got SHIBA at a slightly higher price…
This is called sandwich bot because the bot created 2 transaction (buy and sell) before and after the victim bought.
2.3 Front running
Let’s say a victim “hack” a smart contract and withdraw 1000 ETH from it
- You (the attacker), monitor the blockchain and see the victim transaction on the mempool.
- You submit the same transaction than the victim BUT with a higher gas price, so your transaction is included first in mempool BEFORE the “victim.” (like in the sandwich attack)
- You take the profit INSTEAD of the victim.
This can apply also to NFT by buying them before others and selling them at the floor price.
2.4 Sniping
Sniping bots were very widely used in the “shitcoin” season 1 year a go.
Step 1 : Monitor the blockchain for a shitcoin launch. (More precisely for adding liquidity.)
Step 2 : When liquidity is added, instantly buy the shitcoin before others with your bot at a good price.
Step 3 : Wait for others to buy the shitcoin AFTER you, so the price will increase.
Step 4 : Once the price attained a good level (like x2, x5, x10 or even more) sell all the shitcoins you bought at the beginning and take the profit.
3. How to prevent MEV ?
There are some possible mitigations in order to reduce the amount lost :
- Encrypt part of transactions on the mempool.
- Keep a decentralized blacklist of known blots.
- Reorder transaction by date/time using proxy contract.
- Verify if a user sent 2 transactions (or more) in a too small time frame.(like the same block)
But some of the MEV strategies may do more good than harm like arbitragers because they assure the stability of prices.
4. Conclusion
I hope this article was a good introduction to the MEV on the blockchain :)
Despite some “effective” means to prevent MEV on smart contract, the amount lost by users due to MEV is still very high. (about 1 Billon dollar in total since 2020)
Merry Christmas and happy new year !
5. More resources
Here are some resources if you want to dive deeper:
