MEV: Navigating The Dark Forest_Omer Arie Goldberg

cool hey everybody good morning thank you for joining me on friday to talk about mev uh it's gonna be quick primer and we'll try to get through as much as we can i know it's lunch coming up so i'll be outside afterwards for q a um cool so i'm omer i'm the founder of chaos labs a bit about chaos before we jump into mev so chaos labs is a cloud platform what we do is agent and scenario based simulations for d5 protocols there are a couple of use cases for this the main one being testing the economic robustness of different protocols so we use agents which is basically the ability to spin up any type of user on that you could kind of run into on mainnet it could be malicious activity or just ways that you're expecting for users to interact with the protocol and then we also have scenarios scenarios are more like macro changes to the blockchain environment you can imagine things like latency on transactions gas prices if it's in the context of ethereum and recently just finished partnerships with chain link and uniswap where in the context of the simulation you have granular control over the return value of the price feeds this opens like a whole world of testing and simulations one example is the stuff that we're doing for maker and you want to be able to test that the liquidation and auction mechanisms are working properly so in the context of the simulation we can drop the prices of collateral assets and then see that keepers are working auctions are working and that everything is working as expected the last kind of use case for chaos labs is after you deploy your protocol when you're doing governance updates you're tweaking parameters you don't really have a good way to test it today so using our infrastructure you can select different parameters for your protocol run thousands of simulations over different probabilistic distributions and then get results that are statistically significant for the market conditions that we set now for the talk okay so what is mev uh initially in flash voice 2.0 mbv was called minor extractable value today it's more maximum extractable value because nowadays it's not only the miners who are benefiting from this so ultimately muv is really what value can be extracted from reordering the transactions on a given block this doesn't sound too interesting on the surface but it is actually very interesting because there's a lot of opportunity here so when you have control over the transactions in a given block there's actually a lot of financial upside here because you can start benefiting from arbitrausers liquidations in different types of way now mevs usually kind of when we hear about it in the news it's kind of like this dark thing that's terrible for d5 and maybe kind of threatening for the future of ethereum or other chains uh but there's actually good sides to it uh which is making markets more efficient closing arms across dexes and stuff like that so it's not all bad having said that there is a lot of damage that's done to the network itself and to the overall user experience so what kind of damage happens to the network essentially like an mev you can't really do it manually anymore it's mostly bots you have bots that are competing and bidding and trying to get kind of transactions in very specific orders to be able to financially benefit from this now when there are many bots working across the network this creates competition and kind of creates this false sense of block block room ultimately this can drive up gas prices and we saw it earlier this year or around 12 18 months ago when gas prices and ethereum started spiking extremely significantly the other thing is an end user so if you're coming to like a uni swap or any other protocol and trying to execute your trade you could get sniped by a bot you pay the gas for the transaction but it's no longer possible to execute the transaction and it gets reverted so as an end user you might have to try several transactions each one having their own gas fees associated it's not good ux so how big is this network congestion that we're talking about so this graphic is taken from the flashbots website where they keep track of ebv extraction over time and this is the first kind of graphic that you see at the top is gas prices attributed to actions which are mev so you see here massive spikes the massive spikes often times correlate with kind of high market volatility where there's a lot of opportunity and they can they really just make things more expensive for everybody beneath that there's some numbers about like basically quantifying the the price uh and funds lost to kind of gas prices as a result of mev action let's quantify it a bit further uh so the numbers here are are freaking massive and this is why we're here so just the mev started being tracked by flashbacks in january 1st 2020 so this is definitely an incomplete history of um of basically funds and kind of prices that have gone towards mev right now it's a bit over half of a trillion dollars and like you see like this is like the the graphic here is an aggregate function so it's always getting larger larger and larger now as big as this number seems it's actually the tip of the iceberg flashbots which is tracking this they're only tracking some of the larger protocols um so we have here like the aves the compounds the unit swaps of the world um and that's just like a little bit right so you can imagine that the real number is much much larger especially with the the current pace of innovation at d5 i don't know if we're at 2.0 or 3.0 or maybe after this weekend 4.0 but there are a lot of protocols that are are missing all right so we kind of like painted the picture why should we care about mev um which is cool now let's start to talk a little bit more technically about what mev actually is under the hood so you can imagine the following flow i'll come to the screen because the text is very small on this presenter view so a following flow would go like this a user signs a transaction and it's broadcasted to the to the network in the context of this conversation will focus on ethereum even though mbv exists on every single chain as soon as the user signs a transaction the transaction enters the mempool now miners are working to solve some type of puzzle assuming that we're still in proof of work and a certain miner has one so now he has the ability to take all the take transactions out of the mempool and order them in any way they see fit and this is the part that's really important for most people coming into the space i think the intuition is that the ordering would be by some type of time stamp maybe when they were submitted so it turns out that it's not and usually minors act as rational kind of agents or actors in these systems and they're going to order the transactions in the way that's going to benefit them the most so one naive like approach for this is just gas prices or tips right so they can just take whatever's going to pay them the most and be the highest economic incentives and work that way but things over the years have gotten a little bit more complex and a little bit more basically smarter now we see kind of uh bots or mev searchers collaborating with miners to order transactions in the same way and even splitting fees there's more on that on the end but um definitely there's a lot more to it than just kind of taking any arbitrary order of transactions and filling a block so what kind of mev types this is you know this is very general and definitely not exhaustive but there are three types that we want to look at today there's front running there's back running and there's a sandwich attack let's go into each one and discuss it more so front running is just simple you have these mev searchers usually bots that are looking at the midpool and they're constantly searching for opportunity where can they turn a profit they look at all the transactions there and when they find something they execute so let's just give like an example for a little bit of intuition say you're trading on some type of decks on ethereum and you place a transaction with some type of slippage fee for example that you you kind of predefine say that on this trade i'm willing to take a five percent slippage fee okay this is like a kind of example that does all of them because in the end there's a sandwich attack but the the attacker sees how much slippage you're willing to take and starts taking that into consideration knowing that he can come in before you kind of play with the liquidity in this pool and as long as the slippage stays under five percent overall you're still going to do it okay so let's think about that slippage for a second now let's talk about back running so back running is what it sounds like front is put my transaction in front of your transaction now i'm going to put my transaction in back of your transaction this one has kind of the ability to be good mostly when we're talking about the context of arbs right so when you're trading in an amm doesn't matter what function the amm is using but you make a trade you're moving the prices in the pool and you want the prices to be uniform across the market for it to be efficient so they see an arb opportunity and they'll take it here right after your trade look at how much you're moving the liquidity in the pool how prices are trading how prices are changing and use that as a way to kind of turn profit as well now we take both front running and back running and we get a sandwich attack which is the nicest because you get everything together in one transaction so let's go back to kind of the the naive example of executing a trade on a dex someone sees that you're willing to accept a certain amount of slippage on the trade that you're going to do let's say five percent so they'll go and they can place an order uh that moves that basically causes slippage of 4.

99 just do it before you and then sell it right back to you okay so you get here special love and for them it's it's basically a risk-free way of turning profit they already see your transaction in the mempool they know how much slippage you're willing to take and they just make sure that their transactions go before and after you so we already kind of spoke about the numbers and the scope of how big this is but now let's kind of take a look what the distribution is so where are uh mev attacks the most prevalent we've been speaking about trading indexes so it's no surprise that most of the mev type of attacks come in the form of dexes but they also come in the form of liquidations mostly on lending protocols again this graphic is not exhaustive because currently what's being tracked by flash bots is just really the top kind of blue chip d5 protocols but this is another graphic that illustrates a distribution of which kind of protocols are basically they're tracking the most type of of mev action now i think this is like for anyone here who's like new to mev and has kind of heard the term but not really sure what it means i really recommend reading dan robinson's post from paradigm ethereum is a dark forest it's first of all it's freaking interesting like it sounds like this guy should be like a like an action or thrilling like thrill writer and so it's written really well it's very engaging but it also gives you an example of some of the stuff that we're talking about so where does the term dark forest come from there's a book there's a sci-fi book with the same title and really the the term means in this book that you're in a highly adversarial environment where just being detected someone knowing that you're there is almost certain death so that's like a very kind of dark and kind of morbid analogy but that's what it feels like when you're trying to kind of execute transactions in an area that's high that has a lot of muv searchers all right so in this blog post dan talks about a specific case that they were faced with dan is a researcher at paradigm paradigm works uh closely with unit swap one evening he was just browsing the support channels on unit swap and then somebody came to him with a question he said hey by mistake i sent my uni lp tokens into the pair contract is there any way i can get them out he started thinking about it a little bit and said okay i think there's actually a way to get it out because of how univ2 is built without going too much into the internal implementation of univ2 there's a burn contract there's a burn function on the interface of every pair contract basically when you query the person who queries it can take and receive all of the lp tokens that seems simple in a naive world but we're in a world of mev so dan understands this he says okay like i theoretically burning calling that function should be enough but i know there are a bunch of people who are watching the mempool the second they see that i'm trying to do this i get front run so let's get a bit more creative all right so why not if we go a little bit like one layer beneath this why not call burn directly there are many reasons in this blog post he specifically cites something that's called generalized front runners so you can create kind of mev strategies that are very very specific that work through very very special heuristics another opportunity is sort of like a catch-all we'll create something that's generalized so imagine a framework where you're looking at every single transaction in the mempool and you're running sort of a simulation you want to see what is the end state of all the accounts involved and if there's profit to turn if there's profit to turn let me just submit my address i don't care what protocol it's doing i don't care what the trade is i see that i can turn profit here let's go that's what they're worried about in this case he's calling a burn function and maybe esoteric kind of pair contract he's not worried that somebody's looking at exactly that pool he's working that there's generalized bots that are trying to that are constantly scanning and searching for opportunities so what is kind of what is the solution to trying to trying to pull out these lp tokens so ultimately these mev bots it's just code right so if you try something naive like calling the burn function immediately maybe that's too naive another bot will see this so maybe we can obfuscate some of the actions can i try to confuse the bots like the strategies hopefully aren't the mev strategies aren't that advanced and with this obfuscation i'll be able to call the burn function before anybody front runs me and submits the transaction so now i'll come here so we can kind of like review the code very quickly again this this wasn't like the most complex setup also it might be one of the reasons why it didn't work for them even though we'll get into that later but they deployed two contracts right they deployed a simple getter contract getter and setter contract and the idea is that only the person who deployed the contract can make the calls if not they're going to be reverted and this is where the obfuscation comes in right so they first deploy a getter contract with the deployer's address is only one who's eligible to call the methods on that contract and then they deploy a setter contract okay now when the setter contract is called when the set method is called it ultimately activates the getter contract so this is this level of indirection that they're hoping is going to throw off the bots that are searching for opportunities in the tx pool lastly after the contracts are are deployed we will try to submit the set transaction and they get transaction in the same block so that was the idea it sounds kind of complicated unfortunately it didn't work for them okay why didn't it work for them they tried to submit the transactions through infera infer kind of looked at the tries has a bunch of heuristics we're trying to predict kind of the state of um of the chain i guess like after things were submitted saw that this wasn't going to work and the transaction wasn't going through they got a little bit nervous it was late at night they tried to submit the transactions manually before they could get the lp tokens this was sniped the opportunity was lost we'll go really fast on the last slide basically monsters are real you hear about the stuff all the time in the news it's something different when you come to it face to face there are a lot of bots you don't hear as much as you should about them but the strategies are real and they're getting more advanced on a daily basis a little bit insights if you're doing stuff that's super sensitive on chain maybe don't go through an alchemy or inferra you might want to have your own node or at least talk to somebody who has your own node to make sure your transactions don't get blocked and 30 seconds of shilling if security all that stuff is important to you if you're deploying mev strategies and looking for kind of an environment to test them and play with them talk to us at ks labs we offer these real world environments and cloud environment where you can fork every blockchain and you have a catalog of agents and scenarios and you can play with all these things before you try them on mainnet i'll be outside and i won't take away more time thank you