Imagine making 800 ETH in a single arb
... and an hour later then losing 1100 ETH to a hacker
Here is the story of 0xbaDc0dE, an MEV bot who gained and lost it all in a few hours tonight
... and an hour later then losing 1100 ETH to a hacker
Here is the story of 0xbaDc0dE, an MEV bot who gained and lost it all in a few hours tonight
0xbaDc0dE is the prefix of the contract for a mempool bot that's been pretty active on ETH in the last few months.
In that time they sent ~220k transactions to Ethereum, I believe all arbs or trying to cancel arbs.
Address: 0xbadc0defafcf6d4239bdf0b66da4d7bd36fcf05a
In that time they sent ~220k transactions to Ethereum, I believe all arbs or trying to cancel arbs.
Address: 0xbadc0defafcf6d4239bdf0b66da4d7bd36fcf05a
Earlier today some poor soul tried to sell $1.8m in cUSDC on Uniswap v2 (!). They got ~$500 out in return. Yikes.
Meanwhile, this generated a massive arb opportunity.
tx: 0x96a129768ec66fd7d65114bf182f4e173bf0b73a44219adaf71f01381a3d0143
Meanwhile, this generated a massive arb opportunity.
tx: 0x96a129768ec66fd7d65114bf182f4e173bf0b73a44219adaf71f01381a3d0143
0xbaDc0dE dutifully backran the arb in the mempool (!) in a looong arb touching many protocols.
The profit from this was ~800 ETH!
tx: 0x2a615005a63785284f11a4c5cb803d1935d34e358c10a3b4d76398d2e7bb2f9d
The profit from this was ~800 ETH!
tx: 0x2a615005a63785284f11a4c5cb803d1935d34e358c10a3b4d76398d2e7bb2f9d
... But just an hour later all of 0xbaDc0dE's ETH was stolen
I'll let the reader make the joke about the code themselves
I'll let the reader make the joke about the code themselves
Digging in, it seems that the 0xbaDc0dE did not properly protect the function that they used to execute dYdX flashloans.
Note "callFunction," which is the function called by the dYdX router as a part of flashloan execution
Note "callFunction," which is the function called by the dYdX router as a part of flashloan execution
When you get a flashloan the protocol you're borrowing from will call a standardized function on your contract.
In this case dYdX called "callFunction" on 0xbaDc0dE.
0xbaDc0dE's code unfortunately allowed for arbitrary execution.
In this case dYdX called "callFunction" on 0xbaDc0dE.
0xbaDc0dE's code unfortunately allowed for arbitrary execution.
The attacker used this to get 0xbaDc0dE to approve all of their WETH for spender on their contract.
tx: 0x59ddcf5ee5c687af2cbf291c3ac63bf28316a8ecbb621d9f62d07fa8a5b8ef4e
tx: 0x59ddcf5ee5c687af2cbf291c3ac63bf28316a8ecbb621d9f62d07fa8a5b8ef4e
The attacker then simply transferred the weth out to their address.
tx: 0x631d206d49b930029197e5e57bbbb9a4da2eb00993560c77104cd9f4ae2d1a98
tx: 0x631d206d49b930029197e5e57bbbb9a4da2eb00993560c77104cd9f4ae2d1a98
Stay safe and protect your execution functions searchers!
Bad code, great content
Surprised that at this point this stuff happens on-chain and there's not a thread about it 4 hours later.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
