The Return of Sandwiches: MEV and Sequencer Design on Layer-2s

Transcript

Hello everyone. My name is Chris Gogo. I'm a co-founder of a D5M and a researcher at University of Zurich. I work at the intersection of institutional D5, maybe and layer tools. And today I'm going to present you a study about sandwich attacks on layer two blockchains. It's a joint work together with Jan Golgner, Manvith and Professor Claudio Tessone. Before we go to L2s, I assume you might have heard about the sandwich attack that took place around I think two weeks ago when one of the

traders using other um mobile app was trying to swap uh 50 million worth uh USDT into other tokens and to his big surprise uh after signing that transaction, he received back only other tokens worth around 50,000. So simply he lost more than 49 49 millions. The transaction was executed successfully.

And the first actual warning that the user received was here about the extreme slippage because when you are trying to swap 50 millions stable coin into some token, I mean uh the slippage will be 90% but then still you would receive almost 5 million worth token but he received 50,000 because later he was also sandwiched. And the generally those solvers like a cow swap, they offer like a a timely execution splitting those trades into a smaller ones that you can uh slowly slowly execute. And that user that user having having done that.

So but what is the sandwich attack? A sandwich attack is actually when the um MEV searcher some bot that's running on the blockchain observe your upcoming transaction. For example, it see okay, you are you want to exchange 50 million USDT into other tokens and then this is your transaction is a target transaction target swap. And simply such attacker is trying to put inside the same block the front running transaction and back running transaction.

The front running transaction is buying those tokens just ahead of you increasing increasing the price at the exchange and later after your after after your transaction is actually selling those tokens. And because those transactions are happening just after and before your transaction is being called a sandwich. And they simply inflate the price or decrease the price if you are selling which is extremely unfavorable for you and for for your transaction.

However in order for that attack to happen a few things must take place. I mean first of all, attacker must be able to see your transaction that you are willing to yeah swap 50 millions into into other tokens. On most of the blockchains like Ethereum, the mempool which is like a data structure with the transactions waiting for execution is simply public meaning that anyone can observe those transactions. So the second thing that needs to happen as attacker once identify his target needs to make sure that one of his transaction will be executed before and one after that target transaction. So there needs to be

a way to influence the order of transactions in a block. On Ethereum it can be done by the builders that simply decide about order of transactions within within a block. And then the third thing is those transactions should be included inside the one block otherwise you have no guarantee that maybe other swaps or other attackers will place their transactions in between and then your attack will be unprofitable or partially successful or unsuccessful and you incur your some losses.

And this is the state on Ethereum. We can ask the question what's actually happening on L2s because L2s are structurally different than Ethereum. The first difference is that on most of the rollups, the mempool is actually private meaning that nobody except for the centralized sequencer cannot see cannot see the transactions waiting for execution. Also there is no [clears throat] builder market, there is no MEV boost but um but all of the participants they simply need to compete with each other about inclusion and they need to they need to compete

about the the latency and also the height of the height of the block. That's not I mean doing anything actually on the rollups is probabilistic. We don't get any guarantees that we know that they exist on Ethereum. And then there are some analytics. This is example a dashboard from flash bots which is showing that such sandwich attacks actually already happen on already happen on L2s. Because on L2s the mempool is private.

However, once the transactions executed it's becoming public to anyone and we can look at those transactions after execution and simply check if there are some sandwich patterns. If there are some swaps that are surrounded by buy and sell swaps coming from the same actor. And according to some yeah analytics, such patterns already exist on rollups. And simply what we did in our work we look in deeper into what's standing behind those patterns and we simply check who are those attackers, what is the profit and what strategies those attackers used in order to extract that volume.

Because on the L2 in order to ensure that your sandwich will be actually executed not to even mention a profitable, you need to ensure that a few things will happen. The first thing of course you need to make sure that the back running transaction will happen before the front running transaction and target transaction will happen will happen in the middle. Then you also need to make sure that that if you are paying the tip then simply you can try to influence the order by the priority fee. On some rollups they uh they accept priority fee and they order

the transactions based on the priority fee that you pay. And in such case the the priority fee of a front running transaction the first one should be the highest and the fee priority fee paid by the back running back running transaction the the lowest. And the last thing is that those transactions like a front running and back running they need to happen relatively close to the target transaction. It doesn't need to be the same block especially as on L2s blocks are produced every 200 milliseconds but they need to happen ideally in the same block or within a few blocks around.

And there are generally two strategies that the sandwich attackers on L2s can use. The first one is simply a delay strategy meaning they are first sending front running transaction, they wait a few milliseconds and then after that they send a back running transaction. And simply by doing that they assume that the front running transaction will be executed the first and the back running transaction will be executed later. The same thing can be achieved using some smart contracts.

For example, there can be some smart contract with which those front running and back running transactions are communicating and simply the back running transaction using that smart contract can check if the front running transaction was actually already executed. But this is how actually you can or attacker can influence order of the front and back running transaction. Attacker still doesn't know whether the whether whether will be victim transaction or if there be any victim transaction.

And this is actually where the things start to become interesting. Because whereas on Ethereum, yeah attacker can observe the mempool and knows there is a target, here on the L2s because mempool is private, attacker must guess how many how many targets will be in the will be in the mempool and how many target transactions he can potentially attack. And by observing some patterns for example, USDC if it's a very liquid cryptocurrency pair and there are in every block even on the rollups, there are plenty of swaps that are exchanging USDC into ETH and back.

And then simply by observing what is the pattern and how many of such swaps are happening in every block, sandwich attacker can predict what should be the size of the front running and the back running transaction and how often they should be executed. However, when we look at the all factors around L2s like the time of the block and the probability of coinclusion, then actually probability that the attack will be successful is relatively very slow because it's between 5 and only between 5 and 20% meaning that uh to generate some significant profits

on average in every block on L2, there should be a swap of at least 4,000 4,000 dollars. We found that a simply that that probabilistic strategy will be not profitable and the attacker will incur incur more losses. And we simply go deeper and we check what is the profit from the attackers today on the rollups. So we look at the major rollups like Arbitrum, Base, zkSync, UniChain and we simply look at all of the sandwich patterns that are out there happening. Yeah, we uh

I mean to identify all the patterns that are out there, we simply look at the different DEXes. We actually grouped the front-running and back-running transactions to make sure they are coming from the same actor, the same smart contract or the same bot if they are ordered in the same way and if the back-running and the front-running transactions are actually opposite to each other. And actually here you can see the here you can see the results of our analyses.

And you can see that actually >> [clears throat] >> in most cases, there is a very big difference in sizes between the front-running and back-running transactions. This is what we call the strong signature. It simply means that only around 5-7 on Arbitrum at 20% of those of those sandwich patterns they meet the criteria that the front and back-running transaction, they actually have a similar size or they differ in size but no no more than 10 no more than a 10%.

You we also compared we also calculate actually a coefficient correlation between the victim transaction, the front and back-running and generally they are very slow. Even I mean the highest correlation exists on Arbitrum. Although it's still relatively low, it's below 0.5. And this simply show that attackers I mean if there will be like a real sandwich attacks, it's showing that attackers are not behaving in the optimal way.

I mean you can look for the paper that is behind that research and in that paper we actually calculated what would be the optimal size of a front-running transaction on Uniswap V2 and on Uniswap on Uniswap V3. Because when a sandwich attacker can actually observe the coming transaction and he knows its size, he knows what's the size of the liquidity pool or what's the distribution of the liquidity in Uniswap V3 then the attacker can actually calculate what should be the size of the front-running transaction in order to maximize his profits.

And this is clearly not happening currently on rollups. This is becoming even more visible when you look at the profits, potential profits from those sandwich patterns. Because uh this is very funny but if those sandwich patterns, they would be really attacks then they would lead to a negative profit. What we saw in the research is that typically the front-running transactions are around maybe 500 500 dollars whereas the target swap is maybe around 100-200 dollars and simply uh

the the profit from that attack is even not enough to cover the losses from the slippage that the attacker is incurring. And in almost all of the cases on all of the L2s, simply sandwich patterns that exist today, they leading to the negative negative return. And this is simply showing that what we see there and those transactions that yeah, everybody is suspecting to be front-running they must be doing something else. And here we also look at who is issuing or initializing those transactions.

And actually it turned out there are some bots that actually dominate them the market and most of those front-running transactions, they are coming from the the same the same bots. However, however those sandwich patterns, they are extremely small portion of what those bots are doing. And when we go deeper and deeper, we simply observe that those bots are typically trading USDC against ETH and our our suspicion is that they are simply doing arbitrage. They are doing arbitrage between the Uniswap and Binance. They are executing plenty of swap transactions in every block on L2 in order to equal the price

with Binance. And simply some sandwich patterns or potential sandwich attacks that we see on L2s, they are more a byproduct of that arbitrage strategies run by those run by those bots. So the major takeaways from our study is that generally it's possible to execute a sandwich attacks on L2s. However, this is a probabilistic probabilistic execution meaning that you can guess, you can assume and in some situation such attacks might become profitable.

However today those sandwich attacks are not profitable. However, the reason why they are not profitable is not because they are not possible to be executed but they are unprofitable because the swaps are too small on L2s. Like on Ethereum, typical size of a swap is around 1,000 US dollar on whereas on L2s, it's much smaller. It's between 1 and 2, maybe up to 400. However, when the when we see more more user attraction coming to L2s and those swaps becoming larger in volume, then such attacks, sandwich attacks based on the probability, they become feasible.

And simply the conclusion is that the private mempool and hiding the pending transaction is actually not eliminating the it's not eliminating the math. It's simply creating a new way of math that a stochastic or statistical math where you are guessing or predicting what's going to be in the next block and based on that you include your transaction. This is also by the way leading to a lot of reverted transaction because when the bot is only guessing, then that transaction if it's not successful, it's being reverted.

However, gas fees on L2s are so low that the those MEV bots, they can afford for that, they can afford to pay those fees for the reverted transactions. However, there is a lot of work on the rollups. For example, there is a lot of work about auctioning the block space in the rollups. There's also work about based based rollups and pre-confirmations. And simply in one of those uh decisions or design choices will be that we have a public a mempool again on rollups or when we have some auction mechanism that is simply allowing to

deterministically assure that my front-running transactions are in the same block or within the same range then simply we will see acceleration of the sandwich attacks on L2s. Mhm. Okay and thank you for your attention. >> [applause] >> Yes, if you have any questions, feel free to ask. There. Yeah. Hey Chris, great talk. Thanks so much.

I have just hypothetically speaking, let's say um let's say some arbitrageur is basically checking for some off chain signals, let's say the market condition. Let's say the crypto is going to crash or it's going to go up, you know. And then something we we should expect something happening on chain. And some products at some rollups, they also allow you to prioritize some transactions. And then leveraging this information of some off chain signals do you think that it could somehow be profitable for these arbitrageurs conducting some MEVs?

And have you observed some correlation when let's say some time period where you have best MEVs, let's say arbitrage property whether this is correlated with some off chain signal, let's say market condition or something like that. Yes, I think you got a very good question. So uh what I see so far is that the block there is a value in a block. Our block block is having the value meaning the order of a transaction is having the increased value and there is more and more attempts to to extract to extract it. And what actually some of the attackers are trying to do because mempool is private on L2s,

they are simply trying to see the transactions that maybe will be coming from MetaMask or they will be coming from another providers, another wallets where you can see the mempool or the pending transaction before it comes to the private before it comes to the private mempool of L2. So there are there is a value in in it and people are trying to trying to extract it. Okay, maybe here. I think. Okay. Thanks for the talk. Just a quick question on the efficiency of mechanisms like time boost. It's a question I've never figured out. Like in the end would a first come first serve plus time boost be better than priority fees on L2s or

do you think that it's still to be decided? Mhm. Mhm. Yes, that's that's actually an excellent question and the short answer is yes. I mean generally the priority fee auction doesn't work on L2s. So generally also make sure that before you pay priority fee, make sure that actually it really influence the order of transactions because a lot of bots, a lot of users paid whereas the rollups are first come first serve. And also when with the introduction of the flash blocks and making um blocks much faster like going to 200 milliseconds or even less, then the impact of the priority fee is becoming less and less important

and also that impact uh it's going to be not executable. Meaning there is a need for the proper proper auctions like a time booster for example. Okay. And thank you. >> [applause]