Beosin: A brief analysis of the $25 million attack on MEV robots

According to Beosin-Eagle Eye situational awareness platform news, the MEV robot suffered a malicious sandwich attack, and the loss amount was about 25 million US dollars. The Beosin security team conducted a brief analysis of the incident for the first time. Start by targeting illiquid pools and see if MEV bots are frontrunning trades. For example, in the figure below, we can see that the attacker used 0.04 WETH to test the MEV robot, and seduce the MEV robot for arbitrage. It was found that the pool is indeed monitored by the MEV robot, and the MEV robot will use all its funds for arbitrage. On the other hand, the MEV robot uses the attacker node to generate blocks. The attacker has been trying whether MEV uses his verification to generate blocks, so it is also verified in advance whether the MEV robot will execute, and as a verifier, you can view the bundle. 2. After the attacker succeeds in the test, he uses a large number of tokens exchanged in Uniswap V3 in advance to perform exchange operations in the low-liquidity V2 pool, and seduces MEV to use all WETH to rush to buy worthless tokens. However, the transaction that was preempted was actually an attack transaction targeting MEV, using a large amount of tokens to exchange out all the WETH that MEV had just preempted. 3. At this time, because the WETH that MEV preempted has been exchanged by the attack transaction, the operation that the MEV robot wants to exchange back to WETH will fail. 4. The main conditions for the success of the attack may be firstly because MEV still uses all its own funds every time it arbitrages in the low liquidity pool, and secondly because the same token can be obtained with a small amount of funds in uniswap V3, and its value The imbalance has been manipulated in the V2 pool. The third is because the attacker may have validator permissions and can modify the bundle.此前消息，Beosin KYT 反洗钱分析平台发现目前资金位于地址：0x3c98d617db017f51c6a73a13e80e1fe14cd1d8eb（19,923,735.49 美元）,0x5B04db6Dd290F680Ae15D1107FCC06A4763905b6（2,334,519.51 美元），0x27bf8f099Ad1eBb2307DF1A7973026565f9C8f69（2,971,393.59 美元）。