Source-linked AI summary
Frontrunner Jones and the Raiders of the Dark Forest: An Empirical Study of Frontrunning on the Ethereum Blockchain
Christof Ferreira Torres, Ramiro Camino, Radu State
TL;DR
Public transaction visibility and miners’ ability to reorder transactions make Ethereum’s pending pool vulnerable to displacement, insertion, and suppression frontrunning. The paper develops a conservative measurement methodology and applies it at scale, identifying 199,725 attacks with over 18.41M USD in accumulated attacker profit.
Problem
Public blockchains expose pending transactions and allow miners to reorder or censor them, creating conditions for frontrunning in Ethereum’s adversarial transaction pool.
Method
The paper introduces an efficient methodology using historical blockchain data and conservative heuristics to measure displacement, insertion, and suppression attacks.
Results
199,725 attacks generated over 18.41M USD in accumulated attacker profit, with suppression attacks generally more costly and profitable than the other attack types.
Takeaways & Limitations
The findings provide evidence that frontrunning is prevalent and lucrative on Ethereum, while miners also earned more than 300K USD in transaction fees from frontrunners.
Takeaways & Limitations
The study lacks ground truth and uses conservative heuristics that may produce false negatives, while causal explanations for temporal activity patterns remain unresolved.
Abstract
from arXiv · showhide
Ethereum prospered the inception of a plethora of smart contract applications, ranging from gambling games to decentralized finance. However, Ethereum is also considered a highly adversarial environment, where vulnerable smart contracts will eventually be exploited. Recently, Ethereum's pool of pending transaction has become a far more aggressive environment. In the hope of making some profit, attackers continuously monitor the transaction pool and try to frontrun their victims' transactions by either displacing or suppressing them, or strategically inserting their transactions. This paper aims to shed some light into what is known as a dark forest and uncover these predators' actions. We present a methodology to efficiently measure the three types of frontrunning: displacement, insertion, and suppression. We perform a large-scale analysis on more than 11M blocks and identify almost 200K attacks with an accumulated profit of 18.41M USD for the attackers, providing evidence that frontrunning is both, lucrative and a prevalent issue.
1 Introduction
The paper examines frontrunning as an emerging Ethereum threat and develops a large-scale methodology to measure displacement, insertion, and suppression attacks. Its analysis identifies nearly 200,000 attacks, substantial attacker profits, organized attacker clusters, and miner revenue from these practices.
- Ethereum’s transparent pending transactions and miners’ ability to prioritize transactions create opportunities for frontrunning.
- The authors propose an efficient methodology to detect displacement, insertion, and suppression attacks in Ethereum’s historical transaction data.
- The study analyzes Ethereum frontrunning over the past five years through an extensive measurement study.
- 199,725 attacks, 1,580 attacker accounts, and 526 bots were identified, generating over 18.41M USD in profit.
- 137 unique attacker clusters were formed from the identified attacker accounts and bots.
- 300K USD in profit accrued to miners through fees paid by frontrunners.
2 Background
This section introduces Ethereum’s smart contracts, transactions, gas economics, and blockchain structure as the setting for analyzing transaction ordering and frontrunning. Gas prices influence transaction fees and priority, while miners select and order transactions within blocks.
- Ethereum’s work setting includes smart contracts, transactions, gas economics, and transaction ordering.
- Ethereum contains externally owned accounts controlled by private keys and contract accounts that execute stored programs across the blockchain.
- Transactions carry ether, sender, receiver, input data, gas limit, and gas price, and invoke smart-contract functions through encoded data.
- Figure 1 illustrates the three frontrunning attack types introduced in the paper.
- Gas Economics: The final transaction fee equals gas used × gas price, while the sender must cover gas limit × gas price.
- Miners maintain the append-only blockchain, compete to create blocks, and receive block rewards plus execution fees from included transactions.
3 Frontrunning Attacks
The paper models financially rational non-miner attackers that monitor pending transactions and use automated bots, accounts, and sometimes smart contracts. It distinguishes displacement, insertion, and suppression by how attacker transactions are ordered around or instead of a victim transaction.
- Attacker Model: The attacker model assumes a financially rational non-miner that monitors the transaction pool and prepares attack transactions before a victim transaction is mined.
- Attacker Model: Attackers use off-chain bots to process pending transactions, identify victims, and automatically create attack transactions.
- Attacker Model: Miners can manipulate transaction order directly, whereas non-miners generally need higher gas prices to move their transactions ahead of others.
- Displacement: Displacement places one higher-gas-price attacker transaction before a victim transaction, without requiring the victim transaction to execute successfully.
- Insertion: Insertion places attacker transactions before and after a victim transaction, requiring the victim transaction to execute successfully; this is also called a sandwich attack.
- Suppression: Suppression fills a block with higher-gas-price attacker transactions so the victim cannot enter the next block, an attack also called block stuffing.
4 Measuring Frontrunning Attacks
The study detects displacement, insertion, and suppression attacks using transaction-level heuristics, Bloom filters, runtime validation, and transfer-event analysis. It clusters attacker accounts and bot contracts while acknowledging efficiency-driven scope limits.
- Identifying Attackers: Attacker clusters connect accounts and bot contracts that share attack transactions or identical bytecode, with connected components interpreted as single attackers.The clustering relies on assumptions that attackers use their own bot contracts and that identical bot bytecode indicates common ownership.
- Detecting Displacement: Displacement detection scans overlapping 100-block windows and matches 4-byte transaction-input n-grams against previously observed n-grams using Bloom filters.The method accepts at least 95% n-gram matching because copied victim input may be embedded with command-and-control data.
- Detecting Displacement: Runtime validation compares transaction execution orders and reports displacement when the two orders produce different numbers of executed EVM instructions.Heuristics reduce the computational burden but may retain benign cases that require validation.
- Limitations: The displacement analysis can miss attacks separated by more than 100 blocks or performed directly without bot contracts, so its results are a lower bound.These efficiency and identification choices prioritize soundness over completeness and may produce false negatives.
- Detecting Insertion: Insertion detection uses token Transfer events and transaction metadata to identify an attacker buying before a victim and selling afterward on AMM-based DEXes.The heuristics check transfer relationships, approximately matching bought and sold amounts within 1%, transaction ordering, and gas-price ordering.
5 Analyzing Frontrunning Attacks
The study applies conservative heuristics to measure displacement, insertion, and suppression attacks, finding that insertion dominates the observed attacks and that all three forms involve organized, sometimes highly profitable activity.
- Displacement attacks: 2,983 displacement attacks came from 49 attacker accounts and 25 bot contracts, forming 17 attacker clusters.Most displacement attacks used small gas-price differences and occurred within the same block, although the maximum block distance was 19 blocks.
- Insertion attacks: 196,691 insertion attacks came from 1,504 attacker accounts and 471 bot contracts, forming 98 attacker clusters.Attackers accumulated over 13.9M USD, with an average profit of 78.72 USD per attack and a maximum single-attack profit of 20,084.01 USD.
- Insertion attacks: Insertion activity spanned 3,200 tokens and four exchanges, peaked at 2,749 daily attacks on October 5, 2020, and concentrated on Uniswap V2.The study counted 180,185 attacks on Uniswap V2, compared with 3,004 on Bancor, 13,051 on Uniswap V1, and 451 on SushiSwap.
- Insertion attacks: 19,828 insertion attacks, or 10.08%, lost roughly 1.1M USD, but insertion remained profitable because average losses were below average profits.The average loss was 56.93 USD per attack, compared with an average profit of 78.72 USD.
- Suppression attacks: 50 suppression attacks were identified, and the controlled gas loop strategy was the most successful strategy by number of attacks.Table 7 distinguishes successful and failed attacks, while the identified attacks were associated with 98 accounts, 30 bot contracts, and five clusters.
6 Discussion
The discussion examines frontrunning’s implications and why existing mitigations are insufficient. It highlights incentives for miners and the need for solutions addressing transaction visibility and ordering while remaining practical and broadly adoptable.
- Implications of Frontrunning: Miners earned more than 300K USD from transaction fees paid by attackers performing insertion frontrunning attacks.Transaction fees rose from 9% of monthly miner revenue in January 2018 to nearly 40% in January 2021.
- Implications of Frontrunning: Uniswap liquidity providers profit from every trade performed by frontrunners through the exchange’s 0.3% transaction fee.Fees are divided among liquidity providers proportionally to their share of the liquidity.
- Limitations of Existing Mitigations: Public-blockchain frontrunning arises from transparent pending transactions and miners’ ability to reorder or censor transactions.Gas-price ordering introduces determinism that outsiders can manipulate.
- Limitations of Existing Mitigations: Mitigations must address transaction confidentiality and ordering while controlling user costs, preserving miner incentives, and remaining broadly adoptable.The paper contrasts these requirements with proposals involving trusted hardware or centralized designs.
- Limitations of Existing Mitigations: TESSERACT resists frontrunning through a trusted execution environment but uses a centralized approach and requires hardware support.The passage presents this as a limitation of the proposed design.
7 Related Work
Related work studies frontrunning through economic models and detection methodologies, while identifying flash loans as an open direction for future research.
- Frontrunning Models: Prior work models frontrunning as gas-price auctions and game-theoretic competition between bots.It identifies transaction-validation latency and miner-driven transaction prioritization as factors affecting decentralized exchanges.
- Open Directions: Flash loans are another decentralized-finance phenomenon whose implications for frontrunning remain future work.Existing work detects flash loans using specific patterns and heuristics.
8 Conclusion
The paper measures displacement, insertion, and suppression frontrunning across Ethereum’s historical blockchain data. It identifies 199,725 attacks and over 18.41M USD in attacker profit, while also finding that miners profit from these practices.
- Conclusion: 199,725 attacks generated over 18.41M USD in accumulated profit for attackers.The study presents these findings as evidence that frontrunning is lucrative and prevalent.
- Conclusion: The methodology efficiently measures displacement, insertion, and suppression frontrunning attacks.The paper describes this as the first systematic large-scale study of all three types.
- Conclusion: Miners earned more than 300K USD from transaction fees paid by frontrunners.The conclusion identifies miners as another entity profiting from frontrunning practices.