raster ▦

𝕔𝕣𝕪𝕡𝕥𝕠

[raster ▦ @raster_ct]

Don’t forget to mention the Curve stETH pool being on vyper 0.2.8 in your gratitude journal, anon.

[raster ▦ @raster_ct]

@SCBuergel @Rabby_io I made a git patch back in the day to remove Rabby trackers. It's probably outdated by now, but a good starting point for a clean fork
https://t.co/pI4eO0DREO

[raster ▦ @raster_ct]

Rabby has a nice UX but terrible privacy.

There's a ton of telemetry that you can't turn off. They use at least 4 different services to track you.

I made a git patch to remove most of the tracking code: https://t.co/SWaJYj9UBn

Note: you're still relying on their backend API.

[raster ▦ @raster_ct]

The attacker is bridging out his GNO via Relay at a 20% discount. Solvers eating well today.

[koeppelmann @koeppelmann]

Unfortunately, there is a hack related to @gnosispay and the "delay module".
Please be patient while we try to contain the damage. Rest assured, Gnosis will cover all user losses.

[raster ▦ @raster_ct]

I may be wrong about exactly why the two values are out of sync, but the cause is definitely due to poor state management

[raster ▦ @raster_ct]

the sato hook is _not_ working as intended.

`totalMintedFair` and `ethCum` are out of sync due to `exp()` and `ln()` using polynomial approximations. Over time, this caused a ~22% slippage between buys and sells

dev should admit it and migrate or just add it to the lore

[clerdent @Clerdent]

the curve has fulfilled its initial purpose.

it bootstrapped supply by minting sato in exchange for eth at deterministic prices. that work is done. the hook stays online from here as minter + buyer of last resort.

[raster ▦ @raster_ct]

@calif_io @justdionysus You published this before utm has a chance to release a patched version without the vulnerable dep? am I understanding this correctly?

[raster ▦ @raster_ct]

@haikane wen multipool routing sir?

[raster ▦ @raster_ct]

Which aggregators are constantly underquoting? @robotevm has the answer. https://t.co/E5IpL8oAUv

[robot @robotevm]

4/
and it goes both ways.

some aggregators underquote you too. they show a worse price than what you actually get after execution.

that has its own issues…

[raster ▦ @raster_ct]

Dex aggregators who collect positive surplus are financially incentivized to underquote you and skim the difference when they overdeliver tokens.

That's the real issue here, not MEV. Unless you broadcast to the mempool like a caveman.

[phil-ociraptor @philipliao_]

When an aggregator underquotes, this might be worse!

On the surface, this doesn't sound bad. Underpromise and over-deliver right?

Well... not really.

On venues that don't simulate, these quotes didn't appear competitive so they were rarely chosen. But now that most meta aggregators simulate, you will often see an underquoted option at the top.

However! With naive simulation an aggregator that underquotes will actually magnify your slippage by the underquoted amount. You will be exposed to way more potential MEV than expected.

This can be really bad for your execution quality!

Imagine you set a 5bps slippage tolerance and the aggregator underquotes by 4bps. Your slippage tolerance is essentially now 9bps

[raster ▦ @raster_ct]

Which aggregators collects surplus? Almost all of them. Here's a good ref from the matcha meta docs

[raster ▦ @raster_ct]

@robotevm @matchametaxyz I miss the golden days of 0x v1. Fast quoting, great routing, no positive slippage.

[raster ▦ @raster_ct]

https://t.co/C75azy6Ce6

[CoW DAO @CoWSwap]

Users should revoke all approvals made on CoW Swap after 14:54 UTC today. Tools like https://t.co/CGNBLppgWS make this easy to do.

[raster ▦ @raster_ct]

CoW frontend potentially compromised. TLS cert reissued today. Careful interacting.

[raster ▦ @raster_ct]

@pcaversaccio curl -L https://t.co/gJenErKgMj | bash

*ducks*

[raster ▦ @raster_ct]

@SCBuergel @StaniKulechov The solver didn't get anything. The bot that backran the trade, the builder and the validator got most of it https://t.co/BA86UVTljb

[raster ▦ @raster_ct]

An MEV operator backran this trade to make a 4824 ETH profit after bribing Titan Builder with 13087 ETH. Think both entities are reasonable and would return a good chunk of it to the user. See: 0x45388b0f9ff46ffe98a3124c22ab1db2b1764ecb3b61234e29e5c9732b7fd4ab

[raster ▦ @raster_ct]

The plot thickens: the CoW solver that settled this tx usually sends their order flow to mev-blocker, but for some reason did not do it for this order, sending it straight to the mempool. Had they done it, they would have received a ~90% refund from the builder.

[raster ▦ @raster_ct]

An MEV operator backran this trade to make a 4824 ETH profit after bribing Titan Builder with 13087 ETH. Think both entities are reasonable and would return a good chunk of it to the user. See: 0x45388b0f9ff46ffe98a3124c22ab1db2b1764ecb3b61234e29e5c9732b7fd4ab

[Stani @StaniKulechov]

Earlier today, a user attempted to buy AAVE using $50M USDT through the Aave interface.

Given the unusually large size of the single order, the Aave interface, like most trading interfaces, warned the user about extraordinary slippage and required confirmation via a checkbox. The user confirmed the warning on their mobile device and proceeded with the swap, accepting the high slippage, which ultimately resulted in receiving only 324 AAVE in return.

The transaction could not be moved forward without the user explicitly accepting the risk through the confirmation checkbox.

The CoW Swap routers functioned as intended, and the integration followed standard industry practices. However, while the user was able to proceed with the swap, the final outcome was clearly far from optimal.

Events like this do occur in DeFi, but the scale of this transaction was significantly larger than what is typically seen in the space.

We sympathize with the user and will try to make a contact with the user and we will return $600K in fees collected from the transaction.

The key takeaway is that while DeFi should remain open and permissionless, allowing users to perform transactions freely, there are additional guardrails the industry can build to better protect users. Our team will be investigating ways to improve these safeguards going forward.

[raster ▦ @raster_ct]

@etheraael pain

[raster ▦ @raster_ct]

@L0laL33tz Small but important distinction: your citizenship does not matter in the CARF (and CRS) contexts. Only country of residence matters.

[raster ▦ @raster_ct]

@eyeonchains @Lomashuk He probably wants to pay back some Aave debt on 0x7c697d6CFF279F3F9c2401D0Ea2ac7e7eDe0E2c3

[raster ▦ @raster_ct]

@eyeonchains 0x36ed68c47a007b6d896515070375b3f5ac9bc889

the ETH he bought on Binance using the aave-borrowed USDT