A cat-and-mouse game: how to frontrun a transaction in the future
summary
Claims that front-run bots repeatedly rescued funds in 2023 (Curve, BlockSec, KyberSwap returned about $5.7M) and that such rescues decline in 2024 as attackers adopt two-phase deploy+trigger patterns. Shows concrete tools and results: trigger functions with no parameters are trivial to exploit, simple bytecode flips bypass naive auth checks, and fuzzing—via the open source EthiPhuzz—finds profitable inputs within the 12s block window. Proposes augmenting fuzzing with taint analysis and concolic execution to reach harder paths.
AI-written summary · about
chapters (12)
- 0:00MEV and front-running
- 1:05Front-running exploits in Ethereum
- 3:32Gas auction wars impact
- 4:36Private mempools limits
- 5:41Two-phase MEV attacks
- 7:02Smart contract auth bypass
- 8:28Exploitable function triggers
- 9:31Fuzzing smart contracts
- 12:22Why fuzzing outperforms
- 13:49Fuzzing MEV limitations
- 14:31Future: taint and concolic
- 15:27Q&A: Assertions and bytecode
related talks
21mSurviving in Dark Forest: Towards Evading the Attacks from Front-Running Bots
53mProtecting Crypto Exchanges From A New Wave Of MitB Attacks
43mOutsmarting Smart Contracts
22mA Multi-Layer Dynamic Security Framework for DeFi Smart Contracts
01h 33mWhite Hat Panel: DeFi Exploits
43mCybersecurity and Global Collaboration for Securing the Web 3.0 Ecosystem
51mA Deal with the Devil: Breaking Smart Contracts
10mHow to Understand a Smart Contract Hack