Mempool Wars & Drainers
I. INTRO
While lurking around the @BitcoinFrogs discord there was a distress call from @gamergamer123g:
"
[2:50 AM]i do not have the time to explain rn
[2:50 AM]I NEED HELP
[2:51 AM]PLEASEEEEEEE
[2:51 AM]HOW TO FRONTRUN
"
So we offered our assistance and see what can be salvaged.
II. GATHERING DATA
First we needed to determine the following:
- Drained wallet address / derivation / mnemonic
- Most important assets (and the current utxo location of them)
- UTXO to be used for fees
- Safe wallet address
Since this is very time-sensitive and the double spend transactions need to be written manually we only focused on the important (in no particular order):
- c1b4742c03ffa0aec4c423eae72f2d90e42df1361e3e714c613589471e735b6bi0 (Bitcoin Boos)
- 8c89917a80bb3fe9f77191373b643c8c9b761a1fb0b3f45de63ea9c2844a0f29i0 (Bitcoin Boos)
- 1e101bd2075e7bc62c81f27ea72ce94218c09488d20dc3424bbc257343fec0fdi0 (Bitcoin Frogs)
- 6c795a38551123b443fe1c0d7dc418b9eeef7ec72ce6cbb9caa9c7c1267b82aai0 (Bitmap Grail)
III. CONSTRUCTING THE DOUBLE SPEND
Using our custom script we added the required data:
- Mnemonic
- Inputs (utxo fee last)
- Outputs (making sure the padding is respected)
- Some other misc data
IV. MEMPOOL BATTLE
- First TX was broadcasted: https://t.co/Hn0Em1MQhx
After waiting for a couple of blocks this was pretty unlucky to get rejected from our experience. This is seen as a double spend because it's a RBF on a non-RBF transaction with a higher timestamp. Nodes that have the RBF flag enabled won't broadcast this further and the nodes in front of the miners that won the puzzle didn't get to see it. No important assets were lost here.
- Second TX was broadcasted: bf04dd87d90bf1d2415ac62b3eed4bbc15d379e3ca14a227cb7c52023b691f1f
This contained the same 4 assets and a spending utxo for the fees. After some waiting, the BITGRAIL asset was lost due to the same "issue".
- Third TX was broadcasted: https://t.co/uB9JalIXnt
Victory!!! The third TX went through and we recovered the 3 assets that were left.
V. DO MORE
We saw the drainer is listing everything at floor prices and he did not know the value of what he is selling.
Our bot wasn't ready as we were actively modifying some stuff on it, once he listed and a buyer was found we attempted to intercept/front-run the mempool transaction: https://t.co/wSpqh2yx2D
Unfortunately it didn't go through.
VI. SAFETY
The victim which was unexperienced was trying to separate some pipe assets from ordinal ones (or something similar) and he found a malicious software that does it requiring the keys. This is an attack vector and many more will follow as the space gets bigger and incentives are higher. Ordinals is a pretty though space for newcomers right now and stuff are different than on other chains, while this is exciting it is also dangerous and it is all our duty to educate each other.
P.S.: How awesome is this RBF history in the image?
If you ever need emergency help please tag @Aervue on our discord.
Special thanks to @gm7t2 & @const_quary who chimmed in and all the communities that hopped in immediately to provide assistance in any way they can.
TricksterEU Staking Pool is live with 0% fees.
You may delegate your ADA with us by going to the following link, pressing join on the right and picking the wallet of choice.
I wonder what prizes the new and top delegators will receive...
https://t.co/LY4TmRtNWj
#Cardano#ADA
TricksterLabs offers the following endpoints (Koios, Submit-API, Ogmios) for free, to be used by developers and users as they see fit. Fair usage terms apply. Links in the comments.
#Cardano#ADA#CNFT
After 15 months of work, we have arrived! We wish to assemble a group of extraordinary citizens to pursue the great things life has to offer. Will you join us?
10x StellarCrystals will be randomly distributed to those that like and retweet this to 3 friends.
#Cardano#NFT#ADA
Alpha version of our wallet has been released. TricksterLabs will be the entity in charge of software development while StellarFox will be in charge of the art and community. Future holders will have various benefits within the ecosystem.
https://t.co/BLv49SFrYS
#Cardano#ADA
The solution we will be using for our NFT generation was publicly released by TricksterLabs. Expect discord and support for our various tools very soon!
https://t.co/X3eyZMoug6
#Cardano#CNFT#NFT#ADA
Current features:
- Easily manage multiple wallets (with franken address support)
- Easily send multiple assets from multiple wallets at the same time
- Military grade security
- Data analytics per asset & policy id
Better design and new features soon!
#Cardano#CNFT#NFT#ADA
Announcing the release of the alpha version of TricksterWallet!
An all encompassing open-source Cardano wallet (light or full-node). We plan to support automation features, complex transactions, in-app marketplaces and dapps, community plugins.
#Cardano
https://t.co/MytN9Hipb2
Announcing the release of the alpha version of Trickster Image Generator!
A software utility to aid in pseudo-random image generation with the purpose of fine-tuning NFT collections. More features coming soon!
#Cardano#ADA#NFT#CardanoCommunity
https://t.co/60gSPjL3tS