Future-block MEV in Proof of Stake / Torgin MacKinga

Transcript

foreign [Music] I'm happy to be here uh yeah so today I'm going to be talking to you guys about something that I call Future block Mev uh in proof of stake which is kind of a made-up name but I hope that by the end of this presentation you'll uh know what it means is this the right Clicker I don't think so oh maybe not okay uh

yeah so I'm from chain security we do smart contract audits we work with a lot of uh companies that you might have heard of um in my normal day job my specialty is uh working with the smart contracts directly but today I'm also going to be talking more uh about like the consensus engine of uh ethereum and uh so to understand what future block Mev is supposed to be uh first we have to talk about block production and block production is something that has changed a lot in ethereum over the last year uh so before the big merge uh we had proof of work right and in proof of work it was kind of a chaos so in

proof of work every single Miner was always trying to mine every single block and what that meant was you could never know who was going to be producing the next book now in proof of stake uh it's a little bit more structured so in proof of stake we're actually determining whose turn it is going to be to produce a block ahead of time and in ethereum specifically you can actually know up to two epochs ahead of time which is about 12 minutes who is going to be producing the next blocks and in particular that means that if you are one of the validators in ethereum you'll know 12 minutes ahead of time when your validator is going to be producing a block and this is different

than in proof of stake you could never know before and now you can right so this is what I mean when I talk about future block Mev so what are some things that we can do with that knowledge so one thing is that you could use it for Oracle manipulation so an Oracle in defy usually we use price oracles which tell you what the price of something is right like the price of ethereum today is different than it was yesterday and there's a lot of D5 protocols that need to know the prices of their assets for example if you had a lending protocol where you can put in some collateral and then you can borrow a different currency it's important to know what the exchange

rate between those currencies are and so one of the approaches to oracles are so-called on-chain oracles where you use an on-chain market for example uniswap and that's super convenient because that data is already on chain and your contract can just go read the other contract and see what the price is at the moment now if you just do that in a naive way and you just read the price at the current moment that's probably not a great idea because someone can just come and push the price up and then you read it and then they push it down again and you're reading a totally wrong price um so the kind of mitigation that people usually use is that they use a Time

weighted average price uh of some time frame so for example you say you use the average over the last 30 minutes of prices um and specifically in uniswap the way it works is it always records the last price in a block so it doesn't matter what the prices are in the middle of a block it only matters uh at the end of the block and the reason why this is supposed to be good is that it means that if you want to manipulate the price you have to bring it to let's say some very high level and then you have to wait for the block to end and when the block ends uh that means that everyone else sees that this price is wrong right so

there's going to be someone who's doing Arbitrage he's seeing Oh the price on uniswab is super high and maybe on coinbase uh it's lower right so they can just buy coins in one place and then sell them in the other and they'll make a huge profit and if you're the attacker that manipulated the price that's going to be a loss for you so now if we take into consideration this idea of future block Mev where we know that in the future we're going to be proposing a block we can do this exact same attack right but we're going to do it such that we manipulate the price in the block where the next one is going to be our own block right so the block n plus one here in the graphic is going to

be the one that we know we're going to be proposing and that means we're going to be able to order the transactions in that block in any way we want so we'll buy a bunch of the token in Block n and then the price is going to get recorded and then in Block n plus one we just make sure that our own transaction is going to be the very first transaction and we can just decide that like nobody else uh has any chance against us because we literally have the ordering rights and so in that way we can make sure that we are the ones that are taking the Arbitrage and we're pushing the price back down to where it's supposed to be and so what that means is that instead of the entire amount of money that we used for the manipulation being a cost

we're only going to be paying the unit swap trading fees of about 0.3 percent uh when we're trading up and down but aside from that we we have no costs and so basically what this means is we are hiding Mev from other people right so I guess an important thing to note is I'm assuming that we can use a dark pool such as the flashbot Smith boost uh to put our transaction into block n right um currently about like two-thirds of all ethereum block producers are using Mev boost and if you use map boost what they give you is transaction privacy so that means before the transaction gets into a block nobody is supposed to see

it this works in most cases we've also seen some cases where it doesn't but assuming that we have that then in Block n we're not going to use the mempool so no one can see our transaction then our transaction happens everyone can see that the block was produced but then it's too late because the next block is going to be our block we can take the Arbitrage down and then the other cool thing about this is that if let's say there was a lending Market that was using this uh Oracle then maybe because of our manipulation some positions would be in the zone where they can be liquidated now right let's say that we push the price of an

asset down um and then because that block is ours we can also just use the rest of that block space for ourselves right so first we take the Arbitrage and then we do a bunch of liquidations that are based on the new Oracle price and this is something that also nobody else can compete with us on because we'll just won't let them into the block and we'll just take the first slots for ourselves and so this means we can trigger a liquidation with no competition and the reason we can even do those liquidations is because of an oracle manipulation that we caused and had very low cost for and uh so this is basically the reason why nobody uses the

these on-chain oracles uh today so you can actually do this on track in practice just because nobody is using the twap oracles um and unfortunately there's also not really a lot of better ways to do it with on-chain oracles so a lot of people use chain link instead or similar Services where you know you don't have this specific problem but you have a bunch of other problems especially in terms of centralization um yeah now another fun thing that you can do if you know that you're going to have a future block is if you have a block you get all the Mev payments right if someone really wants to get into that Block they'll pay you a lot of money for

it so as an example of that we have here the other side nft sale this was the board ape Yacht Club land uh this is the biggest nft sale that ever happened and here you can see the gas costs uh at the beginning they were very low and then at one o'clock the nft sale started right and you can see that the gasp that was paid per block immediately jumped up to 200 eth per block which is about half a million dollars at the time so every single validator that got one of those blocks got paid half a million dollars um but there's a a caveat to it which is we

have the two colors right we have the black and the red so in the red we have the base fee from the eip1559 and in the black is the validator tip so the validators at the beginning they all got paid half a million dollars right but then because of the way that the ethereum fieldwork Market Works uh when there's a lot of demand the base fee spikes up as well so after about 15 minutes or so actually all of the if that was being paid was being burned in the base fee and the validators that got all of the rest of the super high fees actually got nothing right they only get the black part so that shows you that it's super important uh to be in that very beginning phase of a gas Spike

right so let's say that we are maybe some big entity that controls quite a lot of validators and we can go check always right if in the next 12 minutes we're going to have a bunch of blocks and if we do have let's say an over proportional number of blocks then it would be worth it for us to maybe uh make some Mev happen right and so one way you could do that is you just launch an nft mint at that point where you're going to be collecting the med right so you could maybe work together with an NFC project and you tell them like hey you probably don't care exactly when your mint starts right so you just pay them some money

and you tell them like okay you can start your mint within this 30 minute window and will tell you exactly when right and then you make it so that it starts when all of your validators are going to be collecting the the Mev fees and so this is kind of cool because it's like the validators should actually pay someone who is launching a project uh to do it at the time where it benefits the most and um it's kind of like reverse Med right the validators are paying the project and then the users of the projects are paying back the validators and of course it's very bad for like the average validators that aren't playing this game because they're probably gonna

get less lucky on average um another thing that's interesting uh which was actually brought brought to my attention by uh to my attention by a guy called iridian Alpha is that because of the way eip1559 works um it might actually be profitable to censor some blocks and combined with the way that meth boost works as well uh so as we saw before the the total fees paid on ethereum can be very high but it's possible that only a small amount of that goes to validators right so we have one example block here where uh the proposer was paid about 20

times less than uh what the total transaction fees paid were so that means that block space if you want to make a transaction is expensive because you have to pay the base fee and the tip but the blocks themselves are actually very cheap you only have to pay the tip right and so that means that if for example you wanted to just create a block that's empty you can forget about the base fee and you just pay the validator the tip right and the the way that it works in the Mev Booth system which most validators are using is they just get a block and they don't know what the transactions are inside they only get

the block header and they also get um how much the fees that or the the tip that's going to be paid to them is going to be right so if you're a builder in the flashbot system which is totally permissionless anyone can be a builder you can just start handing out empty blocks to validators and you tell them I'll pay them I'll pay you a slightly more than all the other blocks right and they'll just take it and blindly pick the one that gives them the most money um now the question is why would you do this right and the reason is uh or the reason that I can think of is that you might want to censor the block before

yours right so again we know when our block is going to be we know which one is going to be ahead of us so we might want to just make that block be empty right we pay a small amount um like in that example it was maybe like 40 bucks uh to the validator ahead of us and then all of those transactions are instead going to come into our block um and also the block before was empty so nothing happened on the blockchain right and this is super important for Arbitrage once again so one example is what is called stat ARB so for example the binance markets they trade all the time right all the tokens

are always trading but on uniswap the tokens only trade once every 12 seconds because there's only an ethereum block every 12 seconds so there's actually always Arbitrage opportunities between uh binance and uniswap just because one market lags it right and uh now you can imagine if there's one block being skipped on ethereum now all of a sudden uniswap lags behind by 24 seconds right and so the Arbitrage opportunities are going to be bigger because the market is going to move more uh on average and it actually turns out that uh if you do this if you stat up every two blocks um that will end up being about 35

percent more profitable which is an analysis done by this guy on Twitter I also recommend you check him out um because you can end up first of all with fewer transaction fees um but then also just because the market has more time to move the Arbitrage is generally going to be bigger and it actually turns out it'll be more than uh more than the combined amount of just the two single arbitrages and also even if you're just doing Atomic Arbitrage so like one very popular Med strategy is sandwiching where you see a big trade happening and then you buy that same

token before and then the trade happens and afterwards you sell it again so you're basically uh making sure that that trade gets the maximum amount of slippage uh that they've set and you take that slippage for yourself as profit um and now if you can censor let's say the block before then there's a good chance that there's going to be more sandwich transactions that you can all sandwich at once right like if it was two different trades and two blocks you would have to sandwich twice you would have to pay the gas fees twice um but if you just move them both into one block you can do it both at once also

if you want to do the Arbitrage yourself again you're the block producer so nobody can compete with you or you can just have other people do it for you and pay you the the fees um and then it'll actually be more efficient to sandwich multiple people at once there would be if you did it one by one and I think here there's actually also an effect where if you have more sandwiches they move the price more and it actually makes it more profitable uh to sandwich them as well um yeah so that already brings me to the takeaways for today so I think my main thing is that blocks Block proposers in proof of stake are known in advance and

this is very different than how it was before and proof of stake and you can take advantage of it in many different ways right this information can be very valuable if you want it to be I've showed you a couple different ways to do that uh I'm stumbling upon new ways all the time I'm sure you can also think of some uh that I haven't shown here and yeah I think it'll be very interesting I think it's an underexplored area so far and we'll see uh how big of a pain this is going to become in the future you know I could imagine maybe there's some problems that will show up uh as a cause of this we haven't seen too much of it

yet um we've seen the the meth boost system not quite work the way it's supposed to uh just two weeks ago where a validator actually uh basically proposed two blocks two two different ones so they got the one from Mev boost um where they don't see the transactions and then they signed that block and then the transactions are released and then they just created a new block as well with those same transactions uh but they weren't respecting the med boost rules so they were just reordering them however they wanted to

um and in that way they could actually take transactions that were supposed to all happen at once and they took them apart and they were able to steal 20 million dollars from the map at the Mev Bots that were creating those transaction bundles and uh in that specific case there was actually also a small bug in in math boost but in general you can actually just do this in every single map boost block if you're a proposer you might have to kind of race and make sure that your block is distributed through the network more but it's definitely possible and you will get slashed probably for one eth but if you can steal 20 million dollars maybe one eighth is fine to get slashed by so yeah I I think it's uh very interesting and

still evolving topic um yeah if you're interested in the Oracle manipulation part that I talked about I actually have a whole blog post about that and uh also this future block Mev multi-block Mev stuff that I've been talking about uh I also wrote a paper about the Oracle manipulation about two years ago back when it was in proof of work um it's actually you could kind of do the same stuff in proof of work as well in case you're interested the the paper is also linked in there um yeah so thank you very much for your attention uh if you want follow me on Twitter read the blog post thank you very much [Applause]

[Music] so we got a lot of time anyway um hang around for some questions sure all right everybody so we've actually got a fair amount of time left before the next speaker any questions out there any block producers looking for some tips hey I'm over here on your right um hi can you maybe just refresh us uh the the premise that you know the block producers are known ahead of time can you maybe just like give us a refresher on exactly how that works with ethereum like how the block browser is chosen and how far ahead of time yeah um so uh basically in ethereum the two inputs to the random function that decides who the

block producers are going to be is first of all the randow value um from the beacon chain and then also the current ethereum validator set and the Randall value you can always know it to uh epochs ahead of time that's just how it how it's determined um and then the ethereum validator Set uh it can at most change every epoch but if nobody get gets removed from the validator set it actually also won't change within two to epochs um yeah and and that just the input to the random function that generates the proposers um so if nobody gets removed from the validator set you'll know it uh up to

two epochs ahead of time right so if you're at the very beginning of one Epoch you'll know the entire next 32 blocks of this Epoch and then the 32 blocks after that as well now if you're at the very end of the epoch you'll just know like the next block right the end of the epoch and then the next Epoch as well um but in case someone gets slashed and gets removed from the validator set then this that second input changes the validator set and then it gets reshuffled so if you get unlucky then the next Epoch is going to change so the current Epoch that you're in right now you can know for sure that it won't change and the next one is like pretty unlikely to change I would say anybody else

yeah so so I wanted to ask it seems like the flashbots vev problem is persistence in the sense that you know if MVR I can get front run by the validator at just the cost of one eth essentially so what does this mean does it mean like I mean viewers can't have more than one if vulnerable at any point in time because then they can just get front run like this happened or what does that mean so it's a kind of yes the the valid error can just propose a second block there are some parts that make it a little bit harder um

which is they're gonna sign their block and give it to the med boost relay and that's going to send it to the network and then they actually two weeks ago when this happened they added a delay of one second uh of the relay sending the transactions back to the validator so you probably won't get it quick enough there so what you need to do is you have to have a bunch of ethereum nodes uh they can just be normal full nodes they don't have to be staking nodes and you have to basically build up a good peer-to-peer Connection in the ethereum network so that you have a high chance of being a peer of that node that the relay owns right and then you'll get

the transactions from there uh hopefully with less than one second delay right and then you need to do all your computations for your new block of how you want to reorder it um and then you need to spread that block uh in the network quicker than the other block which was earlier right so again here it's going to help you if you have a bunch of different nodes and you have good connectivity and you send it out from all of those nodes to their peers um because basically the other validators they're just going to sign whatever they see first right and so you need your block to have more signatures than the other one so that yours becomes the canonical one right so it's not super simple it's always going to be a

race um but you know it's pretty easy to just spin up a thousand ethereum validators right there's not really a cost to it um so yeah it's not super simple uh the other thing is one eth is going to be your slashing amount if uh if nobody else gets slashed in the same period if other people are also doing weird stuff or if you do this every block uh the slashing amounts are going to go up but even if you get slashed for 32 East and you can still 20 million it doesn't matter right so I do think it's a real problem um the the real world case where we saw this happening two weeks ago there there was actually the bug in the Mev boost relay where

it didn't validate that the block header was correct that was signed um so there there was actually no race because the relay got an invalid block and it didn't release it to the network and then the the validator just sent their block and it was the only block right so they didn't have to race so now that they fixed that they will have to do this race but I think it's something that's feasible to do super short follow-up question is this actually like bad for the network because I mean like I think the only ones at the disadvantage here are me viewers essentially like if there's this threat from if years to not do a movie like it's good for networking in in a sense because then

I mean I I think it's not as simple as saying like all Mev is bad or all people that use them nav relay are bad right like for example if I wanted to just do a big trade on uniswap I would also send my transaction through the Mev relay because of the Privacy that it gives me right because I don't want to be front run um even if I'm not creating a bundle right but then if this happened where the validator did this attack then they could front run me even though I think that I'm using this private mempool which protects me from Med got it all right we still have some time anybody else maybe uh yeah over here in the middle

then I think we have one more over here afterwards hi hi so imagine at some point um it's possible to hide completely who's uh proposing the next block or the future blocks is there may be like a threshold or some models on the percentage of stake that one validator might have to assume like it's so high that you can optimistically assume that you will have two blocks in a row and create attacks that are you know profitable anyway even if you don't know because you know that you have some likelihood of having two or even three blocks in a row is there yeah so does it make sense if you can't

see the future validators anymore so what was your beginning of the question yeah imagine that we find a way that uh there is no future Mev in the sense that you don't you cannot know yeah like there is anything such that validators will not know in advance but still the there is take maybe 30 percent is so high that it will still work is there some possible model like that so I don't think so I I think if you didn't know you know there would always be some percentage that you don't have blocks in a row and it's probably not worth it uh but but I think the ethereum upgrade you're talking about is the secret shared validators um

idea and as far as I understand they're the ideas that other people won't know when you're going to be proposing a Blog but you yourself are still going to know ahead of time uh so if that's if I've understood understood that correctly then it's actually not a solution to this problem so I'm not aware of any solutions right now uh being proposed thanks I think over here he had to he had his hand up which one of you is front running uh I had a question um

on account abstraction so things like uh so one of the things you can do with the account abstraction is going to be to schedule transactions and I think so I'm not an expert but I would imagine that if you're using something like bichonomy for instance in the case of the other side mint you could basically say okay we're gonna you pre-commit and you schedule transactions to happen over a certain amount of time to avoid having a gas roll right does that mean that then the operator is totally in control of because you can obviously you know how much you have to print and you know what the market is right so you could basically ARB this as freely as you want does that mean that it becomes quite mercenary

um so I'm not super familiar with how the scheduling works like if you I mean either yeah okay um I mean at the end of the day the proposers will always decide which transactions go in the block right no matter what you do um and there always has to be someone initiating the transaction like transactions never happen by themselves even with account abstraction um yeah so you'll still have the same problem if you're trying to get into a specific block maybe if there's some mechanism where you can just like sign up for a mint ahead of time and they give you some different time windows or something like that then yes uh but I think that would just be like a design decision on how you create uh the

the mint and do you think that um if like as things grow in the transactional layer becomes um basically happening on Roll-Ups and not really on mainnet anymore yeah you think that the fact that most protocols will you'll be using zero knowledge proofs most of the time right do you think that this kind of arbs away the use the the use cases of of Mev um so I don't think so I think all of those execution layers are going to have their own Mev problems you know you have usually some sequencer that just decides the ordering and then that sequencer is basically in control of the Mev uh and then the zero knowledge proof stuff

happens afterwards usually when the ordering on the rollup has already been decided um so yeah it's just a question of how you design the the rights to order transactions um and I think you will definitely want to have some kind of bidding Market where people can pay more to have their transactions included quicker okay I think we're gonna have to uh have to stop there thanks a lot man thank you very much [Applause] [Music]