I first wrote about the problem of bots front-running transactions a year and a half ago in The Order Flow, citing Dan Robinson and Georgios Konstantopoulos’
Ethereum is a Dark Forest from August 2020 and samczsun’s Escaping the Dark Forest. But I should have paid more attention. It turns out that front-running is the tip of an iceberg of fundamental problems that Ethereum and similar systems suffer. In replicating the functions of Wall Street they have replicated, and in some ways enhanced, its pathologies, Below the fold I survey these and related issues.

Daian et al

The reason I should have paid more attention was that I failed to follow Dan Robinson and Georgios Konstantopoulos’ link to Philip Daian et al‘s Flash Boys 2.0: Frontrunning in Decentralized Exchanges, Miner Extractable Value, and Consensus Instability (also here) from 3 months earlier. This seminal paper introduced the concept of Miner Extractable Value (MEV) and the various ways it could be extracted. Their abstract reads:

Blockchains, and specifically smart contracts, have promised to create fair and transparent trading ecosystems.

Unfortunately, we show that this promise has not been met. We document and quantify the widespread and rising deployment of arbitrage bots in blockchain systems, specifically in decentralized exchanges (or “DEXes”). Like high-frequency traders on Wall Street, these bots exploit inefficiencies in DEXes, paying high transaction fees and optimizing network latency to frontrun, i.e., anticipate and exploit, ordinary users’ DEX trades.

We study the breadth of DEX arbitrage bots in a subset of transactions that yield quantifiable revenue to these bots. We also study bots’ profit-making strategies, with a focus on blockchain specific elements. We observe bots engage in what we call priority gas auctions (PGAs), competitively bidding up transaction fees in order to obtain priority ordering, i.e., early block position and execution, for their transactions. PGAs present an interesting and complex new continuous-time, partial-information, gametheoretic model that we formalize and study. We release an interactive web portal, frontrun.me, to provide the community with real-time data on PGAs.

We additionally show that high fees paid for priority transaction ordering poses a systemic risk to consensus-layer security. We explain that such fees are just one form of a general phenomenon in DEXes and beyond—what we call miner extractable value (MEV)—that poses concrete, measurable, consensus-layer security risks. We show empirically that MEV poses a realistic threat to Ethereum today.

Our work highlights the large, complex risks created by transaction-ordering dependencies in smart contracts and the ways in which traditional forms of financial-market exploitation are adapting to and penetrating blockchain economies

Their starting point was the observation that Ethereum “smart contract” execution is order-dependent within a block, unlike transaction execution in Bitcoin and similar systems:

First, they identify a concrete difference between the consensus-layer security model required for blockchain protocols securing simple payments and those securing smart contracts. In a payment system such as Bitcoin, all independent transactions in a block can be seen as executing atomically, making ordering generally unprofitable to manipulate. Our work shows that analyses of Bitcoin miner economics fail to extend to smart contract systems like Ethereum, and may even require modification once second-layer smart contract systems that depend on Bitcoin miners go live [23].

The reason that bots engage in PGAs is that they can extract value despite paying for “Order Optimization” (OO) by front-running other transactions in the block:

Second, our analysis of PGA games underscores that protocol details (such as miner selection criteria, P2P network composition, and more) can directly impact application-layer security and the fairness properties that smart contracts offer users. Smart contract security is often studied purely at the application layer, abstracting away low-level details like miner selection and P2P relayers’ behavior in order to make analysis tractable …. Our work shows that serious blind spots result. Low-level protocol behaviors pose fundamental challenges to developing robust smart contracts that protect users against exploitation by profit-maximizing miners and P2P relayers that may game contracts to subsidize attacks.

Thie led to the discovery that:

OO fees represent one case of a more general quantifiable value we call miner-extractable value (MEV). MEV refers to the total amount of Ether miners can extract from manipulation of transactions within a given timeframe, which may include multiple blocks’ worth of transactions. In systems with high MEV, the profit available from optimizing for MEV extraction can subsidize forking attacks of two different forms. The first is a previously shown undercutting attack [11] that forks a block with significant MEV. The second is a novel attack, called a time-bandit attack, that forks the blockchain retroactively based on past MEV.

Their discovery was important, first because:

Undercutting attacks were previously considered a risk primarily in the distant future, when block rewards in Bitcoin are expected diminish below transaction fees. By measuring the significance and magnitude of OO fees, our work shows that undercutting attacks are a present threat.
…
Our study shows that OO fees are a form of value that sometimes dominates explicit transaction fees today. The tail of our OO fee distribution, including all of the example blocks in Figure 11 represent such opportunities. In other words, undercutting attacks represent a present threat in Ethereum, and one that will grow with the success of smart contracts that attract OO fees.

And second because:

Time-bandit attacks are also a present and even larger threat. They can leverage not just OO fees, but any forms of miner-extractable value obtained by rewinding a blockchain. Time-bandit attacks’ existence implies that DEXes and many other contracts are inherent threats to the stability of PoW blockchains, and the larger they grow, the bigger the threat.
…
Of course, a time-bandit attack relies on real-time access to massive mining resources. As noted in [5], however, “rental attacks” are feasible using cloud resources, particularly for systems such as Ethereum that rely heavily on GPUs, which are standard cloud commodities. Sites such as http://crypto51.app/ estimate the costs.
…
We posit that the OO fees alone that we have described threaten the security of today’s Ethereum network. As Figure 11 shows, blocks with high OO fees and/or arbitrage opportunities can already enable such attacks.

More generally and alarmingly, time-bandit attacks can be subsidized by a malicious miner’s ability to rewrite profitable trades retroactively, stealing profits from arbitrageurs and users while still claiming gas fees on failed transactions that attempt execution. The resulting MEV is potentially massive, suggesting a possibly serious threat in Ethereum today.

T