"Miner Extractable Value with Phil & Georgios" - Georgios Konstantopoulos & Phil Daian

Hello everyone. My name is Georgios. I work with Paradigm and I'm here to talk with Phil Diane who will introduce himself really shortly about minor extractable value. A topic which I believe we will hear more and more about in Ethereum. So Phil, would you want to introduce yourself yourself and we can get into it?

Yeah, I'm Phil. I'm a PhD student at Cornell University. I work on smart contract security and distributed systems security in general. Particularly I'm interested in systems currently that have sort of economic forms of security as well as traditional sort of computational based notions of security or even that blend the two. And part of this interest has been in the past in Ethereum and in DEXes on Ethereum and many many other projects on Ethereum that I've you know studied or helped with in various capacities and I guess today we're talking about MEV which uh I first encountered in my work on DEXes in um you know 2017 kind of time period and kind of coined the term as a way to describe this implicit fee that we saw as potentially changing the game theoretic kind of consensus economic game between miners on Ethereum.

So yeah, that's my backstory in a nutshell I guess. Nice yeah and somebody that uh learns reads about the Flash Boys 2.0 paper might say that you and your co-authors on that paper are kind of like the fathers of MEV. So it's very exciting. So would you be able to give us a succinct definition of MEV and give us some intuition on why it can be dangerous for Ethereum or destabilizing to some extent?

Yeah, absolutely. So in a nutshell MEV is basically the profit or the value. It stands for minor extractable value. So it's the value that a miner is able the able is very important. It doesn't matter whether it actually happens or not to extract from the Ethereum network when they create a block.

So MEV kind of as a whole comes from several different places in the in the loosest form. One of them is the block reward and the other one is transaction fees. Those are both kind of extensively studied in the past as sources of fees for cryptocurrency. But there's two other sources that I think are very interesting and that apply specifically to smart contract platforms like Ethereum. One of them is transaction reordering so changing the order in which things happen on the network either to prefer kind of certain users transactions over others or assign certain profits to certain trading bots over others or whatever the case might be.

Or even for miners to insert their own transactions that actively interfere with or take advantage of or use depending on what the nature of the transactions is these systems. So it's kind of looks at the value with all the degrees of freedom a miner has in the protocol that a miner can use to increase their ETH balance in in one Ethereum block or across a range of Ethereum blocks. Why is this destabilizing? Well, the simplest intuition is imagine if there's almost no MEV from reordering in the system and then one block comes along where suddenly it's really profitable to control the order of that block. Let's say Ampleforth has just rebased and created a massive arbitrage opportunity on decentralized exchanges or something like that.

So in this one block it may be hundreds or thousands of times more valuable in terms of MEV than the block that came before it. So now the next miner that comes along has a choice of which block to mine on. Do they kind of ignore this block that just extracted all this MEV and try to take that MEV for themselves? Or do they extend it like they're supposed to in the honest blockchain protocol and just kind of go for fees and block reward? So And typically you call this time bandit attack in your papers if I'm not mistaken.

Yes. So time bandit attacks specifically are also you can do this over multiple blocks. So you can do an even longer 51% attack. And so so yeah, that's a great point. I will I will tie that in.

But yeah, basically this this makes consensus extremely Can you still hear me? Uh sorry. Yeah, yeah. Yeah, it makes consensus potentially unstable. One important thing to note about time bandit attacks is because it's hard to figure out the MEV in a block you know, it becomes more profitable the more transactions you have access to the more reorderings you can do.

And so it's actually like super linear in time basically the number of profits you can make from a time bandit attack which I think is a is a super interesting point. So a time bandit attack can happen only in a chain that has reorganizations kind of in a Nakamoto like consensus where you can choose to build on the latest block or you can start a new fork from the past. So is it the case that MEV is less of an issue in a chain such as something that's built on Cosmos or Tendermint where they use a Byzantine fault tolerant consensus with no forking? Yeah, I think this is an interesting conversation especially with you Georgios and I'd love to hear your thoughts here because you're a POS and a L2 kind of guy. Yeah, so So in some ways Yeah, let me let me let me let me challenge you a little bit and then I'll I'll throw it to you.

So yeah, I I would say that the the the high level answer and the one that's in the Flash Boys paper if you read like the last last section is that maybe long-term reorgs are going to be harder so you won't see huge like 51% style attacks because of finality because it's kind of hard to reorg past this finality checkpoint. And the real fundamental reason for that is just almost a social contract of the community. Like if you reorg past finality the community won't consider that valid even if the software says it's valid I think people will reject that and there's other incentives to sort of prevent that from happening. On the other hand I think those incentives also kind of are subtly there in proof of work chains too. Like if someone came along with a 100 block time bandit attack on Bitcoin it's not clear whether people would accept what the client says and say yes, this is the most proof of work or will they say like no, obviously this was mined retroactively and it's a malicious thing.

So I think a big part of it is the social contract of the community. Like POS kind of formalizes that a little bit more and maybe gives you this distinct boundary past which time bandit attacks are hard. I still think they're an issue for like kind of the interim process of how you actually decide on that finalized checkpoint and that order. There's all sorts of issues there that can be discussed but yeah, my I would posit to you and I'd love to hear your take on this that really they're kind of equivalent in that in both you could possibly have this long-term economic incentive but in both proof of work and proof of stake there's like some reorg point past which the community will just be like no and in proof of stake it's a little bit more explicit because there's this like finality discrete notion. Right, so I think I can push back on this.

So firstly I think that we have have a disconnect in the sense that there's the BFT proof of stake flavor which is what Tendermint does and there's the whatever we call it proof of stake that Ethereum does. So the Ethereum 2 will do. So the proof of stake that Ethereum will do it will it takes about 12 to 18 minutes to reach finality for a transaction and that's because you need to get three blocks to finalize to justify. Which means that in that period indeed you can have some short reorgs and indeed the time bandit attack can still happen. But in Tendermint once a block has been signed on by all the validators it's no longer possible to create a valid block in the past.

It will get rejected by the by the clients that are that are sent to the chain. So I think that you do not have time bandit attacks in Tendermint flavored versions. However, there still can be MEV until you reach consensus on the next block. So for example, while we're still gossiping our precommits and our commits for the next BFT round maybe a miner say a validator comes in and says exclude this transaction because it it will give you more like because I will bribe you for whatever amount and then it allows you to to destabilize that. So potentially what I think that it could cause is that instead of reaching consensus you know in 5 seconds maybe it takes you eight or nine seconds to to do that.

So it's more like a performance deterioration rather than an actual destabilizer to the extent that it changes the security. So moving forward from this like how big do you think that the MEV market is? How much MEV exists? And is it bigger than the transaction fee market? Will it be?

Yeah, so you know, I wish I had a better answer to that question. I mean we lower bounded it in Flash Boys 2.0 but that was a very conservative lower bound where we only looked at one type of transaction on one type of DEX. There's a few different ways to answer this question. You know, you can go for just looking at what people are extracting.

And I think a decent proxy for that is the transaction fee market. Like I think the MEV market is you know, somewhat linearly correlated to the transaction fee market maybe a little bit more than the transaction fee market in terms of what bots are actually exploiting. But the actual MEV that's available to be exploited by bots is much harder to study because you have to basically ask yourself like what is the optimal order of transactions a miner can do in this next block to profit. And that's a really hard computer science problem pretty much intractable. So like it would include all hacks and like all arbs and things like that.

So you know, I would expect the MEV market in reality like the real deal if you measured it that way what you would see is like approximately the size of the DeFi security market which is probably like one order of magnitude and this is just me BSing in my intuition here kind of smaller than the DeFi market. love your intuition Phil. We If we hear your intuition, that's great. So do you think that there would be formal methods, for example, to find all the available MEV inside a block or even kind of calculate the optimal permutation of transactions uh so that we can pull um from the mempool to maximize the MEV? Uh 100% I do and I would say stay tuned on that front.

I'm definitely planning on polishing some work in related to this uh and I'm sure I'm not the only person in computer science who's going to do that. So, uh yeah, I think we'll definitely see some all sorts of formal techniques. I hope there'll be uh nice space of competition here. Um, I think formal verification historically has been very murky. Uh the incentives to actually do it because it's expensive and hard and the value is not immediately visible up front a lot of the times.

Uh so, I hope this will actually be like a nice playground for those techniques to become profitable and maybe even be able to fund their own development eventually. Fantastic. So, we will all be looking forward to that. So, I mean, so far, how does the MEV market, in your opinion, differ in Ethereum rather than in Bitcoin? Um, is it that due to the composability available in Ethereum that it it's MEV market will always be larger than Bitcoin?

Yeah, um it's hard to know. I mean, Bitcoin has some forms of MEV um because the market is larger. Like, it's obviously profitable if you're a let's say a large market maker on Coinbase and you know the addresses of your competition and you can bribe miners say to even like delay them by like a block with like some probability. Uh that might be a worthwhile thing for you to do because in terms of market shocks and market events, you know, you might be able to move a little bit faster and have longer-term like a more profitable equilibrium than they do. Uh so, I think it exists in Bitcoin.

It's much more second order and therefore harder to quantify. Uh and it depends on like the real economics of Bitcoin in a way that like I think by design we'll never be able to know or measure um unless maybe we see some attacks come out down the line. Um, so yeah. Does layer two increase MEV? For example, Lightning creates a lot more opportunities to censor a transaction or reorder a transaction That's a great point, yeah.

Yeah, I think layer two hugely increases MEV and I think that's one of the things the Lightning skeptics early on in Bitcoin pointed out that like look, you're moving all your security to another layer, but the miners' incentives kind of change when you do that. Um, and I think that was a poorly articulated case back then. But yeah, I think we can probably formally calculate like, you know, how much and uh my guess is if if if Lightning is the scaling future of Bitcoin, that will probably be substantial. So, that is a great point, yeah. How does smart contract composability relate to MEV?

And I imagine that a lot of our a lot of our audience will be protocol or smart contract developers. So, how would you recommend to them um to design their software to minimize MEV? What are some best practices? Yeah, that's a great uh those are both great questions. Um, so I'll take the best practices one first because I think it's a little bit easier and more poorly defined.

Um, so I think the best practices for MEV right now is just to like write an economic spec of what you're building and kind of try to reason through the MEV and put it out there with your protocol like in those early stages of having the white paper. Um, make it part of the design and part of the awareness of this whole process um so that you are thinking about it and that you're showing people that you're thinking about it and that you get feedback from people when there are MEV vectors that maybe you haven't thought of. Uh I think soon we're going to see some more formal toolkits that will help people and like I hope things will become easier. Um, but I think that's one really good way in the future. Uh the other question is how MEV relates to security and composability.

Uh I think they're all kind of the same thing. So, like in some ways the miner is the most powerful permissionless uh enemy of your protocol if you're designing a protocol. They can simulate any other cartel, any other set of people on the network. Um, they can reorder transactions, they can censor, they can insert. So, they're like strictly more powerful than anyone else on the network uh with your protocol.

Um, so the MEV to me is kind of like a lower bound for your security um and kind of speaks to in which sets and which cases miners kind of can or can't extract value uh from strategies in your protocol. So, I think while you're doing your security analysis, MEV will naturally kind of fall out. Um, and the last thing, composability. So, uh I I'm I'm hoping that uh we're going to release a paper on this soon out of Cornell. Um, but to give you a sneak peek um and you can probably look at my Twitter for some other sneak peeks.

Um, I think composability is also in some ways a function of MEV. So, composability is in some ways saying uh when I deploy my contract, the MEV of the world is not going to increase. That's basically saying that your contract will compose with everything that's out there uh because it won't substantially increase the degrees of freedom in either attacking other protocols or in taking money out of your protocol. Um, so I think that's one way to reason about security and I hope that we have a lot more information on that uh soon and a lot more kind of formal modeling. I know we will have a lot more of that soon.

Um, so yeah, really looking forward to that. You you have us all really excited about this. So, while we call it MEV, um it is actually not being used as MEV so far. It has been more like front runner extractable value um because all the liquidator bots are just bidding up and doing all these priority gas auctions uh in the time scale of one block. So, are there have there been any real examples of miners reordering transactions to pocket MEV or inserting their transactions at the very top of the mempool of the transa- of the block or has it just been or are miners still not uh awake to this?

Yeah, so you know, I I've been talking to a lot of uh pools and reading about a lot of pools recently. So, I've got my pools a little bit jumbled. I forgot if it was F2Pool or SparkPool and I don't want to say the wrong guys. I think it was F2Pool, but I just want to make make sure that I'm not saying the wrong thing. But uh I think they were the earliest instance of when when I saw this uh a while back.

There's a FC paper on this uh about uh it's a it's a front running SOK. So, if you Google like front running space SOK space FC, you'll find this paper. Uh I think it's by uh Jeremy Clark is on there along with a few other people. And they talk about how F2Pool basically front ran an ICO. Uh and in some ways that was one of the early forms of MEV in 2017 was like, if I can get into this ICO pump and then dump it on the people a little bit later in the pump, you know, that's a form of MEV in some way.

Uh and they did do that. I think more recently people have been DMing me a bunch of examples of uh pools that are doing uh arbitrage transactions that aren't ordered by gas and that are causing that are let's say preferring certain bots um and doing things like that. So, I think those trust-based networks are are currently being built and I think we're going to see more and more of that. Uh and and on chain if you if you want to if anyone cares to see it. And shout out so on what you said last week uh an anonymous Twitter account uh called Frank researcher who always puts out amazing uh research out of nowhere on Twitter uh put out actually a case study of this where he found out he or she found out um that actually some miners were inserting low gas transactions on top of the block.

And uh it was interesting because it is kind of like you can tell that there's something fishy happening here. Um, Phil, what is the difference between front running and back running and uh I think most of our audience possibly knows what front running is, but it would be helpful to get a full definition of both, what are their differences and uh what are how are they impacting things in different way? Yeah, um so that's that's a good question. Um, front running classically is a really old term. It deals with when people were trading on paper and people would kind of write orders and walk them across the room and like when you saw your competition kind of the fat guy was walking an order pad like at 2 mph, you could go run in front of him and like you knew this guy was probably buying based on the news you just saw.

So, you just like basically sandwich someone and you like take the best orders in the order book before they can uh or execute the best trade before they can. Then they come in after you kind of get whatever uh is left in the market. And then you go and sell back at like now the higher rate of like the market conditions they've created by buying. Uh so, you basically make a guaranteed profit almost guaranteed by like wrapping this person's order. Um, in Ethereum, this profit kind of is guaranteed because you can do these atomic smart contract transactions where you do the sandwiching and you kind of just throw the whole transaction.

So, uh in some ways it's a little bit easier to analyze than even traditional front running. Phil, and when you say sandwiching, you mean you insert a transaction before somebody does something, what they do happens, and then you do another transaction? Typically, that's what front running would look like uh and sandwich. Sandwiching is the particular term. Front running just refers to wanting to be there uh before them.

Sandwiching is kind of a case of that where immediately after you also kind of uh liquidate your position or you get out, you know, yeah, exactly. You're trying to piggyback on them or whatever you're trying to do. Uh it's also very common in high-frequency trading like uh when people place large orders on Robinhood or something, they're routed through companies that have more direct lines to the exchange. So, they kind of like triangulate you out and like place a little order right before yours because they know your order is going to come in now and they know they can sell to you, basically. Um so, yeah, this is classically it could either refer to being in front or very often to sandwiching.

Uh backrunning is kind of a crypto more crypto specific phenomenon, although I would argue it's also kind of a subset of this same kind of behavior. Um and it refers to kind of getting in right after someone. So, let's say after an Oracle update. How do you do that? Uh usually by spamming at a slightly lower gas price than they would put.

So, if they're going to do 25, you try to spam a lot of like 25 minus one gray transactions and if miners sort by gas price, you hope that And and and what is the effect of these actions? So, these are kind of actions that do not have a net benefit to the Ethereum ecosystem, yet they have some kind of effect on gas prices. So, could you expand on that? Yeah, so it's hard to measure their effect. I mean, for sure they're paying a lot of gas and for sure they're putting a lot of transactions in that are raising the gas price and leading to this congestion.

Uh we've also seen bots like that engage in bidding wars when there's just not enough throughput on the whole chain to handle everyone's uh kind of events that need to happen. Uh so, in general they definitely drive these spikes that we've seen. Um they also cause a lot of like negative externalities on the P2P network. So, like if you're just running a full node you many of these PGA transactions that we talk about in Flashbots and even some of these backrunnings and other kinds of spams, the frontrunning that we see, uh a lot of this stuff never even makes it to the blockchain. So, like you have nodes that process maybe 100 or 200 transactions for the one transaction that ends up getting mined.

Uh and miners don't care about that cuz they get the revenue and they kind of pay the cost once. But, if you're just running a node, you're not making that revenue. You're doing this out of your pocket for whatever business reason you have. Uh and in some ways this is a tragedy of the commons that's like these people's bandwidth are what's being used to to play these games on the network right now. Right, so Phil, um currently it is still how how do you think that the liquidator software or the keeper software operators will evolve over time?

Will it be like how how mining got commoditized and it's now only big players in the game or will so will there only be big player liquidators or will there be some more um um like an HFT kind of situation or will there be more hobbyists around in the future? Yeah, I think that's a great question. Um So, yeah, I I I I don't know. I think either future is in the cone of possibilities right now. Um I think I mean, I would hope that it's not a few big players, but I think the economics are set up to promote that in the same way that a lot of market economics promote a lot of big players uh just because expertise will kind of naturally concentrate in a few places and this is going to be a very kind of tight margin um very competitive kind of ecosystem.

So, I think, you know, there is definitely a realm of possibility here that you get a few actors who gain outsized influence on Ethereum through this. Um and I think as a community, uh you know, how to prevent this is like a conversation that we need to have moving forward on the social side of the ecosystem and uh also the R&D side. Um so, I don't know, you know, I hope it'll be a lot of small players, but I think the economics are set up in the other direction, I personally think. What kinds of MEV exist? Is there benign MEV?

Is there good MEV or is there only bad MEV or both or neutral? Can you give us some flavors? Yeah, I mean, I would imagine there's good MEV. Um you know, for example, this is the same question I think about general trading activity on Wall Street and in general there's a lot of parallels here. Uh you know, a lot of lessons to be learned.

Uh like when is HFT and are these things uh parasitic and rent-seeking versus when are they beneficial? Uh it's a very hot debate. Uh some people would say they're always beneficial because in some ways they are part of the security model of the network and they should just be maximally exploited. Um and you know, users want to do this, so we should enable this uh in as little uh damaging way as possible, but still like it is what it is. Um other people would say there's some MEV that's more obviously benign like, for example, providing uh liquidity providers the ability to respond to news and like move their tokens around inside Uniswap contracts could be one example of this.

Um or um another example could be, you know, matching orders on EtherDelta, uh making that market more efficient and uh arbing some centralized exchange, bringing that liquidity into the blockchain. That could be fine, you know, if the if the if it's done at a reasonable liquidity provider premium that the user is aware of and okay with, no problem. Uh you could on the other end have like these hacks like the BZX attack or something like that where like a bunch of people just lose their shirts and uh you know, that's also MEV. So, and everything in between I think also exists. How do you feel about unified approaches towards MEV extraction such as the one taken by KeeperDAO?

I just using saying that if you try to outbid me, I will bid as high as possible so that it's not profitable for anyone. So, this creates a kind of a new equilibrium where everybody where maybe it's better for everybody to collaborate instead of collude. Do you think that uh that approach has a future? Yeah, I mean, I think approaches like that are kind of going to have to. Um I think it's interesting.

Uh that kind of equilibrium is one we talked about a lot in Flashbots and I think it originally developed out of an interest of these trading bots that are exploiting the MEV to basically cheat miners uh and keep prices as low as possible amongst themselves. Um and then they were enforcing that cooperation and if you break that, then they kind of make it unprofitable and that could be a way to like kind of socialize profits a little bit more efficiently and keep them off of the miners' table. Um I think we're going to see that mechanism in a lot of different places or something like it. Uh it's kind of a natural thing to evolve. Maybe one place could be in preventing time bandit attacks.

So, like intentionally leaving money on the table for other miners or having some sort of, you know, intentional uh transparent cartel that's like a good cartel. I don't know if that such a thing exists. Got it. Yeah. A counterintuitive question as we're slowly running on time is is it possible for MEV can be good for chain security and this is more like a thought experiment.

So, let me lay it out. So, in the absence of the block reward, you are relying only on transaction fees to align minor incentives. But, what MEV is is more revenue going to miners from non-block reward sources. Um is it possible that you could fund miners with MEV to have a chain without you Sean's work? Yeah, I think that's an interesting open question.

When I originally talked to Vitalik about MEV was when the original infamous Uniswap x times y equals k post went on EthResearch and like I emailed a bunch of people and I was like horrified. I was like, what is this? Um you know, this is terrible for users because all these arbs exist and the system's not very efficient, so they're going to get arbed. It should not be a bug. Yeah, exactly.

And the response I got from at the time at least was, you know, like maybe this will be the future block subsidy instead of transaction rewards when we dedicate a zero, you know, And like yes, that is an argument. I think there is some possibility that we will see that equilibrium. I think it depends on what the MEV actually looks like. So, if you have this like very burst-like MEV, I think it's much more unlikely because like systems in general don't like shocks. They don't like these crazy things that like break the norm and suddenly change all the incentives.

Um so, you know, my worry is that MEV looks more like that. On the other hand, if MEV kind of becomes this predictable thing we know how to deal with, maybe we can reach that kind of a So, I think the jury's still out. say the power of chaos. Exactly. Yeah.

Fantastic. So, I have a final question for you, Phil, and this comes from our audience. Um do you think that MEV and the EIP-1559, an upcoming proposal for changing the block the block space market for Ethereum, um have any relationship? So, I think we both kind of agree here that they don't have a direct relationship at all. Um like the EIP-1559 still allows you to give a tip, aka a bribe, aka extra gas that still lets you do that.

Which depends on transaction ordering, exactly. Yes, exactly. And so, it lets you From the first principles approach, MEV comes from transaction ordering. The EIP does not affect transaction ordering, so they should be unrelated. Yes, I agree.

There might be some edge case interactions like the fact that spam now has to burn more gas because of the way it's charged with the minimum or like weird things like that like at the edges, but in the core I don't really see a fundamental difference. Fantastic. Phil, I think we are at time. Uh can somebody confirm that we are at time? I think so, too.

Yes. at time, indeed. Um but thank you so much, you so much. Hold on. Hold on because I am going to bring Kartik up because there are a couple of extra questions from the audience.

You guys have just it's been um firing with all of the questions. So, hang tight. I'm going to say goodbye. Kartik, step in and I'll see you all soon, hopefully. Thank you so much, Simona, and Charges and Phil, thanks so much for uh for a great talk.

Um I do have a good camera set up for for this event, so thanks for uh Thanks for noticing. Um so we have a lot of questions coming from the chat and and for for those of you who are joining us now, you can just go to live.ethonline.org and just see all the questions there from the audience on the chat. And what I'll do is I'll ask a couple of questions uh now to uh to you both, and if you have time, Georges and Phil, um you can just go to live.

ethonline and just kind of answer the the questions directly in chat for any follow-ups. Um a lot of them are kind of small clarifications, so I'll just kind of ask a small one, which is um in one of your comments, Georges, you said something in uh one of uh our attendees would like a clarification, and that is can you clarify the difference between Eth2 finality and BFT finality, and kind of how do you differentiate the two? Yeah, so typically Tendermint-like systems, they require so, you know, let's say that you have 10 validators, uh they require that or let's say that you have 100, um you require that in order to produce the next block, 67 of the validators, they must sign on the um on the block's hash, let's say. And once they've done that, um you can move on to the next block, and the previous block is considered final, the one that they just signed on. While in Ethereum 2, um finality only comes after, you know, so Ethereum 2 has one block per 6 seconds and one epoch per 12 per 6 minutes, and it only finalizes a block, due to how the fork choice rule works, after two epochs.

So, there's a fundamental difference basically that in the Eth2 kind of model, it takes you two epochs for your block to be for the block to be finalized, um while but it has a a kind of looser uh liveness requirement compared to the kind of quote-unquote permissioned or tighter liveness requirements on BFT. So, it's a um how do I say? There's a trade-off between having a tighter consensus algorithm which gives you the the the finality versus having something that's more loose while having while not being able to have the finality. So, it's a it's a bit hard to explain this like more in detail um in this time span. But I can I can expand this line if you want to email me, please do.

Yeah, I think it'll be if you're able to kind of comment on more on the chat, that'll be awesome. And then uh one final question for Phil, which is uh do you proof-of-stake systems solve MEV in any way, and uh the question also says, "My impression is that the system in which someone gets to be has not