flashfish

⚡️🐠

[Sen Yang @syang2ng]

Many sophisticated MEV bot contracts use control flow obfuscation techniques to protect their logic. However, this also causes existing tools to struggle with analyzing obfuscated smart contracts, leaving critical vulnerabilities hidden.
Excited to share our solution: SKANF (1/n)

[flashfish @flashfish0x]

Interesting challenge. Even if you’re not looking for a job it’s useful for anyone wanting to improve their improve their on chain skills.

[Igor Igamberdiev @FrankResearcher]

1/6

Today, we’re launching The Alpha Challenge, a two-week experiment for the crypto community to test their on-chain analysis skills and for Wintermute to hire top talent

We've also collaborated with six companies to provide exciting awards for those who will not be hired👇

[flashfish @flashfish0x]

To expand. Medium liquidity on the curve pool is a feature not a flaw. It is easier to maintain peg (cheap to incentivise, smaller swaps to repair) and stops large single swap dumps (due to exponential price curve). While allowing reasonable trades to happen with no price impact

[flashfish @flashfish0x]

Worth saying that historically cvxCRV has had a worse peg than ycrv. Yes ycrv has less liquidity, but in reality a dca exit strategy of 3m exiting ycrv would probably net a better result that cvxCRV. I liked the rest of your thread though

[wishful_cynic @EvgenyGaevoy]

2.5 a really obvious one is convex (and we going to deploy at least half of our CRV there today actually). It’s good yield, battle tested and, very importantly - you can exit from cvxCRV with relatively low slippage fairly quickly - 1% slippage on 3 mil if you are desperate

[flashfish @flashfish0x]

@LefterisJP The relay is a trusted intermediary. The relay ‘should’ give you the best block proposed by all builders. And even more importantly ‘should’ be checking the builder is behaving, because if they make you sign an invalid block you’ll be slashed. So yeh, lots of trust in the relay

[flashfish @flashfish0x]

@LefterisJP Remember the proposer doesn’t see the contents of the block the builder proposes. They only get it once they’ve signed the header.

As a side note it can sometimes be a worse deal for the proposer than building themselves because of the burnt gas costs of the mev payment tx

[flashfish @flashfish0x]

@LefterisJP That’s one way builders make money. Provide a superior block where they keep part of the fees and still provide more to the proposer than they would get otherwise. Easiest example of how is private transactions. The proposer wouldn’t see those txs if they built themselves

[flashfish @flashfish0x]

@pashov @iearnfinance Deployment is a really dangerous step. So easy to make a mistake and the dance you have to play to get things verified on etherscan makes it really easy to mess up. Also easy to hide something malicious in the constructor.

[flashfish @flashfish0x]

Looks like it was possible because of a bug with mevboost relay. It didn’t verify the validator signed the head correctly before revealing the internal block. So no double signing slashing and no risk of reorg

[samczsun @samczsun]

Block 16964664: A user managed to drain five MEV bots by exploiting a bug in mev-boost-relay.

Here's the block: https://t.co/ruSz8YzAJR
Here's the user: https://t.co/VY4gpmX0L8
Here's the patch: https://t.co/TPO80i3dz5
Here's the longer explanation:

[flashfish @flashfish0x]

My guess at how this was done.

Sandwichers submit their bundle to flashbots (or another builder) who build it into a block and send that block to a trusted relay.

The relay sends the block head to the validator for signing. Only after signing does the validator see inside

[punk3155 @punk3155]

Dusk for sandwich bots? A few top mev bots were targetted in block
https://t.co/tnlx5tAX1G
@peckshield @BlockSecTeam @bertcmiller @samczsun @bbbb

[flashfish @flashfish0x]

This is normally safe as there are slashing penalties if the validator validates a block with a different head. Due to having now signed two heads.

But what happens if it is worth paying the slashing cost for the opportunity to exploit the block? Maybe that’s what happened here

[samczsun @samczsun]

Block 16964664: A user managed to drain five MEV bots by exploiting a bug in mev-boost-relay.

Here's the block: https://t.co/ruSz8YzAJR
Here's the user: https://t.co/VY4gpmX0L8
Here's the patch: https://t.co/TPO80i3dz5
Here's the longer explanation:

[flashfish @flashfish0x]

@junorouse @punk3155 @peckshield @BlockSecTeam @bertcmiller @samczsun @bbbb maybe because that transaction includes has a very high priority fee so some extra free money for attacker

[flashfish @flashfish0x]

@punk3155 @peckshield @BlockSecTeam @bertcmiller @samczsun @bbbb So validator can sign the head of the flashbots bundle to see it’s internals. If potential profit > slashing penalty then 💵. Any risk of being reorged if you do this?

[flashfish @flashfish0x]

@punk3155 @peckshield @BlockSecTeam @bertcmiller @samczsun @bbbb How do you think it was done?
Know when your validator is going to be chosen. Do an easily sandwichable trade and wait for flashbots builder blocks to roll in. But then what? Sign it and then validate a different block and take the slashing?

[flashfish @flashfish0x]

@ObadiaAlex Pretty sure we have. There have been some very strange sized blocks and it’s definitely worth it if you have a bunch of high gas usage transactions you want to get done

[flashfish @flashfish0x]

Really feeling for Euler and the team at the moment. A project doing some real innovation. Sometimes I hate this space.

[flashfish @flashfish0x]

@zachxbt Sending love. You've been a huge positive force we all owe you a lot. Look after yourself

[flashfish @flashfish0x]

@storming0x Thanks for the shoutout, but big props to @murderteeth who’s been the main contributor working on it recently

[Daniel Von Fange @danielvf]

In a dazzling reverse hack, a substantial chunk of the Playtpus hack stolen funds have been recovered.

Here's how it worked: (1/4)