PaperlayerView exact revision on arXiv

Source-linked AI summary

Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges

Philip Daian, Steven Goldfeder, Tyler Kell, Yunqi Li, Xueyuan Zhao, Iddo Bentov, Lorenz Breidenbach, Ari Juels

arXiv:1904.05234v1cs.CRcs.GT

TL;DR

DEX trades are slow and vulnerable to adversarial frontrunning, challenging blockchain promises of fair and transparent trading. The paper examines transaction-ordering opportunities, bot auctions, and their security implications, finding realistic Ethereum threats from fee-based and time-bandit attacks.

  • Problem

    On-chain, smart-contract-mediated DEX trades are slow, allowing adversaries to observe orders and frontrun them with higher fees.

  • Method

    The paper quantifies pure-revenue arbitrage opportunities, studies priority gas auctions and bidding strategies, and models miners’ transaction-selection behavior.

  • Results

    Fee-based forking and time-bandit attacks are empirically demonstrated as realistic threats to Ethereum, with MEV and PGA fees sufficient to enable time-bandit attacks.

  • Takeaways & Limitations

    Transaction-ordering opportunities create measurable consensus-layer risks and expose limits in the transparency afforded to blockchain users.

  • Takeaways & Limitations

    PGA identification may combine unrelated bot activity, excludes bots with fewer than four observed bids, and may miss bots whose addresses are not observed.

Abstract

from arXiv · show

Blockchains, and specifically smart contracts, have promised to create fair and transparent trading ecosystems. Unfortunately, we show that this promise has not been met. We document and quantify the widespread and rising deployment of arbitrage bots in blockchain systems, specifically in decentralized exchanges (or "DEXes"). Like high-frequency traders on Wall Street, these bots exploit inefficiencies in DEXes, paying high transaction fees and optimizing network latency to frontrun, i.e., anticipate and exploit, ordinary users' DEX trades. We study the breadth of DEX arbitrage bots in a subset of transactions that yield quantifiable revenue to these bots. We also study bots' profit-making strategies, with a focus on blockchain-specific elements. We observe bots engage in what we call priority gas auctions (PGAs), competitively bidding up transaction fees in order to obtain priority ordering, i.e., early block position and execution, for their transactions. PGAs present an interesting and complex new continuous-time, partial-information, game-theoretic model that we formalize and study. We release an interactive web portal, http://frontrun.me/, to provide the community with real-time data on PGAs. We additionally show that high fees paid for priority transaction ordering poses a systemic risk to consensus-layer security. We explain that such fees are just one form of a general phenomenon in DEXes and beyond---what we call miner extractable value (MEV)---that poses concrete, measurable, consensus-layer security risks. We show empirically that MEV poses a realistic threat to Ethereum today. Our work highlights the large, complex risks created by transaction-ordering dependencies in smart contracts and the ways in which traditional forms of financial-market exploitation are adapting to and penetrating blockchain economies.

I. INTRODUCTION

DEXes offer non-custodial, transparent trading, but slow on-chain execution enables frontrunning and exposes ordering-dependent smart-contract risks. The paper measures pure-revenue arbitrage, models priority gas auctions, introduces MEV, and shows associated consensus-layer vulnerabilities.

  • DEX trades are visible and atomically executed, but their slowness lets adversaries observe orders and pay higher fees to be mined first.
  • Pure revenue opportunities are atomic multi-trade transactions that profit in every traded asset; the measured economy has a lower bound exceeding USD 6M.
  • Arbitrage bots compete in priority gas auctions by bidding up transaction fees, and empirical strategy measurements validate key features of the formal model.
  • Miner-extractable value is cryptocurrency profit extractable directly from smart contracts, including ordering-optimization fees created by PGAs and pure revenue opportunities.
  • The paper shows that ordering fees can incentivize fee-based forking attacks and that pure-revenue profits and PGA fees suffice to enable time-bandit attacks on today’s Ethereum.
  • The findings distinguish consensus security for smart-contract systems from payment systems and show that low-level protocol behavior affects application-layer security and fairness.

B. Gas and Fees in Ethereum

Ethereum’s gas, nonce, and transaction-replacement mechanisms determine transaction fees and ordering, while DEX architectures and public information flows create opportunities for frontrunning and automated rent extraction.

  • Gas and transaction replacement: Ethereum gas measures computational work, and a transaction’s gas price multiplied by consumed gas determines the ETH fee paid to its miner.
  • Gas and transaction replacement: Gas limits cap attempted execution and ensure senders can immediately demonstrate funds sufficient to pay up to gasPrice · gasLimit ETH.
  • Gas and transaction replacement: Nonce-based replacement lets users resubmit an unconfirmed transaction with a higher fee, while canonical chains include at most one transaction per account–nonce pair.
  • DEX architectures: DEXes implement order books or automated market makers through smart contracts, with users retaining assets on chain and contracts performing exchange functions.
  • Frontrunning and arbitrage: Because transaction information propagates through a peer-to-peer network and execution is serial and state-dependent, actors with infrastructure advantages can exploit ordering and timing.
  • Frontrunning and arbitrage: Bots adapt high-frequency-trading behaviors to blockchain markets, competing to exploit price discrepancies and other information asymmetries.

A. Smart-Contract-Enabled Trade Atomicity

Smart contracts let arbitrageurs bundle cross-exchange trades atomically, turning certain DEX price discrepancies into unconditional revenue opportunities. These opportunities generate competitive bidding for transaction priority.

  • Smart-contract-enabled trade atomicity: Proxy contracts can execute multiple exchange trades sequentially within one transaction with an all-or-nothing failure model.
  • Pure revenue opportunities: Pure revenue opportunities execute multiple trades and generate revenue for the trader in every traded asset, making them especially suitable for measurement.
  • Pure revenue by example: A TokenStore orderbook cross created approximately 0.79 ETH in revenue and approximately 496,000 residual FREE for the arbitrageur.
  • Pure revenue by example: After gas costs, the example transaction produced approximately 0.77 ETH, or 267 USD, in profit.
  • Priority gas auctions: Arbitrageurs compete for each publicly broadcast opportunity because only the first successful atomic transaction executes while later attempts fail.
  • Priority gas auctions: A priority gas auction consists of repeated same-account, same-nonce bids with increasing gas prices competing for miner priority.
  • Priority gas auctions: In one observed auction, two bots issued 42 and 43 transactions over 13.4 and 12.1 seconds, respectively.

A. Experimental Setup

The study combines mempool instrumentation with on-chain data to measure decentralized-exchange arbitrage, priority gas auctions, and their associated profits and market dynamics. The resulting measurements reveal a substantial but conservatively estimated market, concentrated among exchanges and bots, with bots optimizing gas and retaining much of the opportunity revenue.

  • Measurement infrastructure: The measurement harness recorded unconfirmed transactions because on-chain data discards losing PGA bids and nodes often fail to propagate replaced transactions.The authors used a forked Go-Ethereum client and six geodistributed nodes with nanosecond-synchronized timestamps, collecting over 300 gigabytes across nine months.
  • Measurement infrastructure: The study dynamically tracked suspected arbitrage accounts, combining mempool observations with Ethereum on-chain data and daily price data to determine transaction profits.The suspected-bot list was seeded from pure-revenue transactions and updated when high-value gas replacements appeared.
  • Market observations: Etherdelta generated most observed pure revenue, while the exchange market remained oligopolistic and the total was conservative because unsupported exchanges were omitted.The supported set covered only a limited subset of popular DEXes, including the top five by sustained volume at infrastructure-development time.
  • Bot strategies: Bots optimized gas costs over time, while more sophisticated exchanges produced more complex trades requiring more gas per trade.GasToken enabled bots to bank gas below market rates and deploy it during PGAs, allowing higher gas-price bids at the same cost.

C. User Comments

The paper describes Ethereum’s continuous-time, imperfect-information PGA setting, where latency, bid costs, stochastic block timing, and network constraints shape bot competition.

  • Model properties: Ethereum PGAs model asynchronous bidding with delayed observation, so lower latency can provide a competitive advantage.Players observe others’ bids after latency Δ_i, measured relative to miners’ latency.
  • Model properties: Losing players pay gas costs on failed transactions, making PGAs partial all-pay auctions.The modeled loss is ℓ($b_last), typically smaller than the final bid.
  • Model properties: The auction ends when the next block is mined, with proof-of-work block duration modeled as an exponentially distributed random variable.This makes auction duration probabilistic rather than fixed.
  • Model properties: Players cannot continuously rebid: network throttling imposes a waiting interval, and bids can only increase.Ethereum participants may raise bids but cannot lower them once submitted.
  • Model properties: Ethereum PGAs impose practical starting and self-replacement constraints, including a minimum starting bid and a 12.5% default minimum increment in Parity.Competing players may outbid one another by arbitrarily small amounts while still increasing their own previous bids sufficiently.

B. Formal PGA model

The formal model represents a two-player PGA as strategy execution under latency and random duration, producing financial payoffs from bidding outcomes.

  • Game definition: The model focuses on two players because empirical observations show that most PGAs involve a pair, while the formalism generalizes to n players.Players are denoted P0 and P1 in the restricted analysis.
  • Game definition: A bid records its placement time, price, and bidder identity, while bid sequences capture all network-published bids through auction termination.The notation distinguishes current-time bids from the full history.
  • Strategies: A strategy maps current time and local state to a bid or no-bid action, an internal state update, and a future wake time.Wake times allow immediate publication when a strategy emits a bid.
  • Execution and payoffs: Game execution accounts for players’ imperfect information caused by latency and outputs each bot’s profit or loss as its payoff.The execution procedure combines both strategies with block-duration and loss-function parameters.
  • Execution and payoffs: The paper defines null-profitable strategies as those yielding positive expected payoff against a player that never bids.The null strategy has no bidding activity and therefore no relevant latency.

C. Why repeated bidding?

Repeated bidding arises from stochastic block timing and delayed information: bots trade off rapid action, adaptive response, and accumulated bidding costs.

  • Why repeated bidding?: In a sealed-bid auction, equilibrium players bid once near the full payoff, leaving only ε/2 expected payoff under discrete ticks.The symmetric deterministic equilibrium is bidding 1 − ε.
  • Why repeated bidding?: With fixed block duration, repeated bids provide little strategic value because players can submit equivalent sealed bids near the block’s end.The remaining repeated activity mainly signals intent on-chain and costs more than out-of-band communication.
  • Observed strategies: The model studies prevalent blind-raising, counterbidding, and cooperative strategies, while predicting lower-latency players gain an advantage.Observed bots consistently reduce latency over time.
  • Blind raising: Blind raising follows a predetermined schedule independent of the opponent’s bid history, commonly using repeated fractional increases.A basic strategy raises from b0 by factors of (1 + f)^k at intervals δ.
  • Blind raising: Network latency can make blind raising advantageous because non-adaptive bots publish faster than bots waiting to observe and react.This mechanism explains how blind raising can outperform natural adaptive responses.
  • Empirical evolution: Figure 9 tracks mean bot latency over time, with colors indicating the number of raises per auction; later auctions show more raises and lower mean latency.Latencies outside 0–1 seconds are excluded because of monitoring limitations.

C. Counterbidding

Counterbidding can exploit low latency, while cooperative strategies can sustain profitable alternating bids under Ethereum-like parameters; observed behavior moves toward minimum raises without proving perfect cooperation.

  • Counterbidding: Reactive counterbidding responds to observed opponent bids by quickly placing the smallest permitted higher bid.It can outperform blind raising when the counterbidder’s latency is small relative to δ.
  • Counterbidding: When Δ1 exceeds δ, the model predicts a null-profitable blind-raising strategy can outperform any pure reactive counterbidding strategy.This is presented as latency amplification.
  • Cooperation: The cooperative strategy alternates minimum bid increases at agreed times and responds to deviations by eliminating auction profitability.The strategy is modeled as a grim trigger.
  • Interpretation: Latency remains central because deviations are eventually detected, yet delayed detection may leave time to profit from deviation.The knowledge gap therefore affects whether cooperation can be sustained.
  • Cooperation: The model’s optimal cooperative bids start at s and increase by the minimum increment ι, matching observed convergence to Parity’s 12.5% minimum raise.This behavior is consistent with convergence toward cooperative-equilibrium elements.
  • Interpretation: The authors do not claim perfect cooperation or exact equilibrium play, only convergence toward a more cooperative state approximated by the model.Players may allow opportunities for others to maximize expected profit over time.
  • Cooperation: For Ethereum-consistent parameters, a two-player grim-trigger cooperative Nash equilibrium exists.The theorem compares cooperative payoffs with deviation payoffs.

VII. MINER-EXTRACTABLE VALUE AND BLOCKCHAIN SECURITY

DEX transaction-ordering opportunities create miner-extractable value that can undermine blockchain consensus security. The paper argues that OO fees and broader MEV can make forking attacks economically viable.

  • OO fees can exceed block rewards, incentivizing miners to reorder transactions, insert their own transactions, and mount forking attacks.Miners can extract value by controlling transaction ordering within a consensus epoch.
  • MEV is the broader value miners can extract from transaction manipulation across one or more blocks.OO fees are one component of MEV, which also includes value obtained by rewinding past blocks.
  • Undercutting attacks are a present Ethereum threat because OO fees can sometimes dominate explicit transaction fees.The paper contrasts this with earlier analyses that expected fee-dominated instability much later.
  • Time-bandit attacks are a present and larger threat because miners can use MEV from past blocks to rewrite blockchain history.This attack can exploit value beyond newly generated OO fees.

A. OO fees: Measurement study

The measurement study finds pure-revenue arbitrage in a measurable subset of Ethereum blocks, with occasional OO fees large enough to challenge block-reward incentives. The estimates are conservative lower bounds, while time-bandit attacks can make broader MEV economically relevant.

  • OO fees: Measurement study: 3.6% of Ethereum blocks contained at least one pure-revenue arbitrage transaction, rising to 6.3% since block 7,000,000.The measurement covers blocks 3,875,490 to 7,408,826.
  • OO fees: Measurement study: 17,897 blocks had pure-revenue OO profits below 1% of total stealable fees, indicating that frequent opportunities were usually small.These opportunities correspond to small price differences during ordinary cross-exchange trading.
  • OO fees: Measurement study: 101.6 ETH of arbitrage revenue in block 7,029,147 dwarfed its 3 ETH block reward and 0.022 ETH explicit transaction fees.One transaction generated all the pure-revenue OO fees in that block.
  • Measurement limitations: The measurements underestimate arbitrage and MEV because pure-revenue opportunities cover only a subset of ordering fees and profit calculations omit some costs.The instrumentation and heuristics may miss behavior, server costs, failed opportunities, and other transaction costs.
  • OO fees: Measurement study: OO fees sometimes dominate explicit transaction fees, making undercutting attacks a present Ethereum threat.The paper identifies the high-fee tail and example blocks as evidence of this regime.
  • Time-bandit attacks: A 24-hour history rewrite could yield 2M USD gross MEV and approximately 220K USD net profit after a 1.78M USD Ethereum attack cost.The example assumes 1M USD of rewritable exchange volume and a 3 USD-to-1 USD price difference.

VIII. OPEN QUESTIONS AND FUTURE WORK

The paper closes by identifying unresolved questions about arbitrage, PGA incentives, centralized exchanges, and the broader scale of MEV. It nevertheless concludes that ordering manipulation already presents a consensus-stability concern.

  • Open questions: The authors identify unresolved questions about whether PGAs are positive- or negative-sum games and how their model should be enriched.
  • Centralized exchanges: Centralized exchanges remain an open measurement problem because their off-chain activity is private and difficult to assess without privileged access.The paper also asks how centralized-exchange incentives could affect DEXes and blockchain stability.
  • Open questions: Future work should quantify non-pure-revenue arbitrage and develop tighter bounds on Ethereum’s total MEV.The paper asks how much larger the full arbitrage economy is than the executed subset.
  • Contributions: The study quantifies pure-revenue arbitrage as a lower bound on ordering-manipulation profitability and models bots competing for transaction priority.Empirical results validate key predictions, including convergence toward minimal gas-price increases.
  • Conclusion: MEV, especially OO fees, can subsidize serious network attacks and constitutes an economic vulnerability for Ethereum.

APPENDIX A SMART-CONTRACT-ENABLED COMPLEX NONDETERMINISM

The appendix explains why smart-contract-enabled arbitrage is difficult to classify and measure: contracts can encode complex conditional strategies and interact with changing network state. It also describes how miners and bots optimize around transaction snapshots, latency, and uncertain auction outcomes.

  • Complex nondeterminism: Smart-contract wrappers can implement complex strategies beyond simple transaction batching because they are Turing-complete programs.
  • Complex nondeterminism: Conditional trades depend on automated-market-maker prices, Ethereum state, and whether other batches succeed, making outcomes difficult to know in advance.Batches can also revert based on these changing conditions.
  • Market measurement: The pure-revenue market appears relatively consistent in ETH but more correlated with ETH price when measured in USD.USD-denominated revenue decreases during price slumps.
  • Bot breakdown: The top 10 transaction senders capture a market shape similar to estimated profits, with a relatively constant offset.
  • Limitations: Profit heuristics omit server costs and may not identify other transaction costs or failed opportunities associated with bots.These measurement issues are left for future work.
  • The miner perspective: Miners snapshot observed transactions and include the highest n eligible bot transactions, ordering them by gas price.The highest-paying transaction is included first; n counts unique account-and-nonce pairs.
  • Partial information: Bots may continue bidding after the winning block template is formed because they cannot observe the miner’s private state in real time.They stop only after learning the outcome.
  • The bot perspective: Bots optimize latency to other bots and miners because faster information and later bids can improve priority in the miner’s template.The model identifies latency optimization as profitable in this market.

APPENDIX D ADDITIONAL PGA MODELING DETAILS

The appendix formalizes priority gas auctions as latency-sensitive, continuous-time games and derives conditions for bidding, cooperation, deviation, and equilibrium. It models auction termination probabilistically and identifies a finite point beyond which cooperative bidding is unprofitable.

  • Cooperative strategy: Observation 4 establishes a finite interval imax after which cooperative bidding is no longer profitable, even if the block remains unmined.The corresponding latest auction end time is defined as tend = V[imax].
  • Game execution: PGA execution accounts for scheduled bids, player-specific latency, wake times, bid validity rules, and tie-breaking procedures.Pending bids enter the current bid list at scheduled times, while opponents observe them only after latency Δ_i.
  • Auction termination: For proof-of-work blockchains, the probability that a PGA has ended by time t is ptime(t) = 1 −e−λt.The model uses the exponential block-interval distribution with rate parameter λ.
  • Cooperative strategy: A player’s probability of winning equals the probability that the auction terminates during an interval controlled by that player.This follows from miners continuously updating blocks with more profitable transactions, so the interval controller has the highest bid.
  • Deviation and equilibrium: If delay(Pb) < W[i + 1]−W[i] for every i, a deviating player can be detected and countered before the next cooperative bid interval.The counterbid raises the bid to 1 + c, making the PGA unprofitable for both players; the deviation payoff is then determined by the undetected period.
  • Deviation and equilibrium: The grim-trigger cooperative strategy yields a Nash equilibrium when cooperation is more profitable than deviation at every interval and for either player.Deviation is most profitable at the beginning of an interval and matters only when the deviator is the non-bidder.

APPENDIX E OO FEES AND OTHER SYSTEM DESIGNS

The paper considers how order-oblivious fees affect proof-of-stake, permissioned, sharded, and alternative exchange systems. It states that transaction-ordering incentives and history-rewriting possibilities extend beyond proof-of-work DEXes, while leaving complete enumeration of impacts to future work.

  • Cross-system consequences: The paper leaves complete enumeration of order-oblivious fee impacts across blockchain systems to future work.The discussion presents high-level consequences rather than a complete assessment.
  • Proof-of-stake systems: Proof-of-stake systems allowing forks can create incentives for miners to orphan or rewrite history when profitable order-oblivious fees exist.The next miner may overtake a previous block and replay its transactions in an optimized order.
  • Permissioned blockchain systems: Permissioned blockchains raise auditability questions because the real order in which a block producer received transactions cannot be objectively determined.The passage discusses this issue in the context of permissioned systems explored for exchange use cases.
  • Sharded blockchain systems: Sharding reduces each shard’s security relative to the whole system, affecting how transaction-ordering threats may be mitigated through validator sampling.The passage identifies reduced shard security as an important consequence of sharded designs.
  • Other exchange designs: Layer 2 exchange abstractions do not necessarily prevent ordering attacks because miners may manipulate prices or selectively publish profitable historical states.The paper gives channel-based networks with public watchtowers as an example of possible history-rewriting attacks.
Loading 1904.05234v1…