Thread by @hackenclub

🚨 A Validator Attack on MEV Bots caused $25.2M loss for MEV bots

Thread below with comprehensive explanation ⬇️

🧵...

💸 MEV bots lost $25.2M today due to a planned validator action

The validator was previously funded through the anonymous #Aztec protocol, suggesting that the theft from MEV bots was premeditated

The validator's confidential top-up occurred 18 days ago

⚙️ In simple terms, the attacker takes advantage of being a validator and having control over the order of transactions in a block

The attacker strategically places their transactions around the MEV bot's transaction to manipulate the outcome

⚙️ The #MEV bot is then left with worthless tokens as the attacker prevents the final transaction from being executed in the same block, which would have allowed the MEV bot to swap back to the original tokens

📃 Example of such a transaction: In this case, the MEV ripper exchanged 223 $BIT tokens worth around $100 for 2,239 $ETH worth around $4 million

Transaction link:

etherscan.io/tx/0x2bb955b94…

💰 As a result of series of transactions, #MEV Ripper or the "validator-hacker" managed to steal from the unlucky MEV bots:

7,461 $WETH ($13.4M)
5.3M $USDC
3M $USDT
65 $WBTC ($1.8M)
1.7M $DAI

🗃️ Stolen funds are held at these addresses

0x3c98d617db017f51c6a73a13e80e1fe14cd1d8eb
($19.9M)

0x5B04db6Dd290F680Ae15D1107FCC06A4763905b6
($2,3M)

0x27bf8f099Ad1eBb2307DF1A7973026565f9C8f69
($2,9M)

📑How did Validator made #MEV bots to act on particular pools:

⬇️⬇️⬇️

1⃣ The hacker first targets a pool with low liquidity to see if the #MEV bot will front-run the tx

For example, the hacker tempts the bot with 0.04 $WETH

If the pool is indeed monitored by the #MEV bot, the bot will use all of its funds for arbitrage

2⃣ Since the MEV bot uses the attacker's validator to produce the block, and the attacker has been testing if MEV uses their validator, the #MEV bot is verified in advance to see if it will perform and can view the bundle as a validator

3⃣ The attacker then uses a large amount of tokens exchanged in Uniswap V3 to swap in the low liquidity V2 pool to seduce #MEV to use all the $WETH to front-run and buy the worthless tokens

A large amount of tokens are used to swap for all the $WETH that #MEV had just front-run

📑 In conclusion, the #MEV bot was left with worthless tokens due to the validator attack

#MEV attempts to swap these tokens back for $ETH at a highly inflated exchange rate were reverted, leaving the MEV bot at a significant loss.