Frontrunning Hacks: Bound to Become Irrelevant | Odysseas Lamtzidis - Phylax

uh so without any further Ado let's get started now it's working cool thank you so much for this um yeah so originally the talk was about front running hugs but I figured to speak more broadly um about hug prevention and what I think that everybody seems to Miss Missing um yeah so I'm founder of PHX it's a new project in the area of hug prevention um and a technical adviser in uh in a fund and my my villain uh villain origin story is from Nomad where I was a protocol engineer and I went through the Haw and you know being in the war room talking with affected users afterwards strategizing with the team was something very impactful uh it was a formative experience and it really made me understand that we have an issue in crypto with hacks um M billions of dollars yearly are lost and I think we need to create better Solutions and although it's good that we're talking about hug prevention I feel that we are we are not uh viewing the problem from the right of lens so in this talk I want to First Define what's H prevention and then talk about the major design schools uh in hug prevention which is front Runing hacks or the what I call n block response and why I think both of these Solutions are not great so let's take a very uh classic definition of of incident response um we start with the surfacing of the issue the hiker send the Mal transaction the meol that should trigger some alert so now we know uh the hike is going on when we have detected it and finally we want to mitigate right we want to do something about it and mitigation means return to normaly in uh in web 2 it develops that we Define as mitigation the return to normaly we want to restore the issue before the user uh see that is happening and in blockchains in order to return to normaly we have to not allow it to happen in the first place because in blockchains as we know once something happens it it's immutable so to be more specific ad du should needs to be paused before the haug takes place we need to prevent the haug from happening in the first place the first large design school about H prevention is front running hugs and it started in a very interesting way um as you may know there's a lot of me searcher that uh create these generalizable Bots that detect M opportunities and try to capture them so a few years back when a har would send a malish transaction to the mempool this generalized boat would detect the MV opportunity and then copy it and essentially uh replace uh who will get the money from the haug with its own address and then it would send this new transaction with higher gas it would uh the proposer would from the men poool it I would emit a block and the result would be that uh instead of the hacker getting the funds the hands would be captured by these me Bots and we have seen that that in the wild we have seen MV Searchers capturing uh hacks by mistake and then going through a process to return them to the DBS so a few people figured out that since this is happening by accident we should probably productized right so this you know this the hiker will send a malish transaction the mempool and then you have some software where it monitors the meno it would detect the malish transaction and in and then send a medicative transaction so instead of sending front running the hack with another hack it will front run the hack with a transaction that will pause the me the the DB so when the proposer reach the menol and executes the transactions in the same block the Hacker's transaction will be after the medicative transaction which means that the hack is resolved the hack is doesn't take place in the first place and this is a quite good solution right well what if the hiker has access to a private menol what if the hiker sends the malous transaction to this private mol and then the private mol emits a block with a hug inside at that point there is no way for the front runner to actually uh see the transaction and front run it uh this very simple solution actually makes all front running Services useless and I believe that in the future as these front running Services become more and more apparent the more and more DBS use them we will see the creation of what I call the dark mols where the is a group of mols private and public that you know collaborate with the services they uh they allow the services to observe their mols but there will be always a private meol with proposers somewhere in some jurisdiction that doesn't Co cooperate that will include your transaction no questions asked so at some point a Mal transaction will be included in the block so here for example we see that we have this Cooperative the good uh me pools they they produce the the good blogs and at some point a proposal from the dark mle will be elected as the next proposer and will emit a block with a hack so maybe the hacker will need to wait more more time to get their transaction included but it will be included at some point so front running hacks depends on the hiker using uh uh not using private mols in other words it depends on the hardare being incompetent in a world where front running Services become prevalent hikers would just use private mols and immediately all these services will become quite useless and an interesting thing we have to remember is that dark mols are protocal compliant they don't do anything illegal they don't do anything wrong or more like they do something illegal but not from a protal perspective from a protocol perspective they include valid transactions in valid blocks so there is nothing really we can do at a protocal level and based on the definition we gave for mitigation front running the hacks is mitigation right we stop the haug from taking place we pause the DB before uh the trans the the malish transaction tries to do something about it the next big Design Group uh design school for hug prevention is what I call next block response it's very simple really first the hiker will send their transaction it will be included in a malici in in a block uh then the software will detect it and will send the med mitigative transaction in the next block right super simple much simpler than the front running of HS we described and this is useful for multiblock hacks where for some reason the hiker needs to you know sense transaction in multiple blocks so the idea is that some part of the haug happens you post the dab and then the user the hicker can do anything more about it uh for example with Oiler the draining uh the hiker drain the pools one after the other in multiple blocks but the problem is that there is no reason for the hiker to do so the only reason that the hiker will not actually drain all the oiler pools in a single transaction in a single block is because they are incompetent again it assumes that the hiker is not sophisticated because a sophisticated Harker will be able to properly simulate the attack and execute it in a single block so again in a world where next block response becomes prevalent is it will become irrelevant because the hacker will just perform more sophisticated hacks in a single block and based on the definition we gave next block response is not mitigation it's damage control right even if the hiker does the hiken in multiple blocks some part of the block will go through uh we just hope that the hiker will not drain the whole pool in a single block but will drain half of it so what to do um it's a cut and mouse unfortunately uh both Solutions work uh but they have a Time Horizon right there is a a near future where both of the solutions are no longer working because they force the hikers to become more sophisticated I think we should build tools with the end in mind which means that we should build tools uh assuming that the Hiers are competent that they are sophisticated and then try to think what we can do in that a end State and I think the best design school is a new one where we don't allow the transactions and Mal transactions to land in the first place um and this is what we are exploring with PHX where essentially maybe the correct way to prevent hugs is to censor hugs but we'll talk about that in another time thank you so much