Another unicorn of web3 has shown itself this morning. The Block reported that Flashbots seeks up to $50 million at a billion-dollar valuation. It is definitely well-deserved due to its contribution to Ethereum. The existence and popularity of Flashbots Auction bring fierce competition to Sandwich searchers, thus crushing the profit of Sandwich chefs for a long time. Our data shows that, in the past 30 days, 82.5K sandwich MEVs created $845.5K profit out of a cost of $4.7M. The overall ROI is 18.1%.

As the most notorious MEV, Sandwich has always been known for its shady approaches. Being one of the best MEV data platforms in the industry, EigenPhi has provided an exclusive Sandwich module for Ethereum. The module displays real-time Sandwich attacks, as well as summary data, happening on Ethereum.

Although Flashbots has lessened the awful effect of Sandwich MEVs, the caused spillover has extended to the BSC chain. More and more Sandwich searchers moved to other chains, BSC Chain especially, on which none like Flashbots exists. Yet how bad was the situation? Nobody knew.

“If you can’t measure it, you can’t manage it.” Peter Drucker once said.

Today, we announce the first BSC Sandwich module of DeFi.

Similar to the one under ETH, the newly released BSC sandwich module includes Overview, Top 10 Exploited Contracts, Profit Distribution, Latest Attack,** and transaction, attacker, and** **victim leaderboards **over specific time periods.

With these data, we can answer the question: how dire the circumstance is on BSC?

Here is the 30-day data:

• Sandwich Count: 29,055

• Total profit for Sandwich attackers: $319,011.58

• Total cost: $44,271.02

• Attackers: 423

• Victims: 18135

Although the overall profit on BSC is about 37.8% of Ethereum, the cost is 100 times smaller, making the overall ROI 725%. And the attacker count, 423, is 2.5 times the number on Ethereum.

Let’s go through the BSC Sandwich module and see what else we can find.

Top 10 Exploited Contracts comes after the Summary section.

The chart tells us that 91.6%, which is 25,168 sandwich MEVs, happened on PancakeSwap Router V2.

Then there is the Profit Distribution chart. The one below shows that, out of the 29,055 sandwiches, 14,466 have a profit between $1 to $10. The average is $3.5 in this range.

Next, you can check out the latest Sandwiches happening on BSC.

And you can check out the leaderboards about sandwiches, attackers, and victims. The first two are ranked by profit, while the last is picked based on their losses.

Wanna find out more details about one specific attacker or victim? You can click their addresses to view the data. Our user guide will guide you through the details of attackers and victims.

Of course, you can examine how a sandwich actually works by clicking the hash of it.

The detail page consists of mainly two parts: Summary and Token Flow Chart. The Summary section displays the profit, cost, and revenue of this sandwich. The Token Flow Chart section gives you detailed token flows happening in the format of a balance table. It reveals how tokens are traded among trading venues, i.e., liquidity pools, in three parts: FrontRun, Victim, and BackRun. Remember that sometimes you can many transactions fall victim to prey.

You can click the EigenTx button, marked below, to use the visualizer, which gives you a more intuitive graph about the process of the whole attack.

Here are the token flows of the previous sandwich.

That’s about it. DeFi’s first BSC Sandwich MEV module will show you many unexpected data that you would not be able to find anywhere else. Go check it out and tell us what you find!

Follow us via these to dig more hidden wisdom of DeFi:

• Youtube

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

Abstract

At block number 23545404 (Dec-02–2022 12:43:18 AM +UTC) on BSC, an attacker successfully packaged a transaction on-chain targeting the liquid staking protocol Ankr’s Deployer contract, in which the reward-bearing token aBNBc was suddenly minted at an amount of 10 trillion and transferred to the attacker’s address 0xf3a4.

In subsequent transactions, the attackers minted another 50 trillion aBNBc and exchanged only a tiny percent of these printed tokens into blue-chip ones worth $5.656 million via DEXes. Instead, the attacker transferred part of the proceeds to Ethereum via cross-chain bridges and mixed the remainder through Tornado Cash.

According to CZ, the theft of the private key of the Ankr Deployer contract may have caused the attack. Moreover, after the first attacker carried out the exploit, several other participants took the opportunity to profit from it. One of them took advantage of a defect in the Helio lending protocol’s evaluation of ankrBNB’s value and staked cheaply-purchased ankrBNB to the protocol. This staked ankrBNB allowed him to borrow excess HAY and exchange it for BNB and BUSD via DEXes, totaling $15.533 million (three times the attacker’s proceeds). Several DEXes were also affected by a cascading effect.

This article will show that the swift actions of the Helio arbitrageur and the followers demonstrate that searchers perform better than protocols in gathering information and detecting trading opportunities or risks. This event also sheds new light on liquidity. A significant increase in the issuance of a problem asset can be a precursor signal to the sale of the asset into the market and subsequent devaluation.

The arbitrageur was well prepared to take advantage of this delay. Conversely, the affected protocols were unaware of it. Helio’s failure to set up a separate oracle for aBNBc to track its market price indicates that the current DeFi protocol’s risk control system is careless and unresponsive. We hope to provide some insights to related parties by carefully reviewing the incident’s details.

Timeline

The Ankr attacker, as the originator of this incident, naturally deserves attention. On the other hand, various KOLs have also retweeted the story of the Helio arbitrageur, who made 15.5M BUSD with only 10 BNB. Both roles use two new addresses during the event, with historical transaction counts of 78 and 96, respectively. It’s interesting to compare them by merging the timeline of both roles’ actions. The following table summarizes the timeline of crucial transaction steps for these two addresses.

Ten minutes after the Helio arbitrageur completed the 6th round of arbitrage, implicated protocols, and third-party tools started tweeting security alerts one after another, for example:

• 2022/12/2 01:55, Wombat Exchange paused the aBNBc pool

• 2022/12/2 02:13, PeckShieldAlert tweeted the incident

• 2022/12/2 02:24, Ankr tweeted an announcement

Cashing out a tiny percentage of fake aBNBc

The table above shows that the Ankr attacker minted aBNBc in increments of 10 trillion every six times. However, he converted only 27,074 aBNBc into BNB and USDC, and the attacking address 0xf3a4 still holds over 60 tri llion aBNBc unused at the moment (with an amount of 7,777,777 incoming aBNBc from 0x0d86).

The attacker converted 27,074 aBNBc to 4,050,000 USDC and 5,500 BNB via PancakeSwap, then 4,500 BNB to 1,293,086.99 USDC. They transferred all the USDC to Ethereum via three cross-chain bridges: Celer Network, deBridge, and Multichain, and mixed 900 BNB left in 0xf3a4 via Tornado Cash. The Ankr attacker’s total gain was about $5.656 million, with 1 BNB worth $292 at the time.

Six rounds of arbitrage with high ROI

As you can also see from the table above, the Helio arbitrageur activated this new address the day before the Ankr attack and conducted several arbitrage activities between BUSD, MATIC, and WBNB at PancakeSwap. However, just 40 minutes after the Ankr attacker’s first mint operation, this arbitrageur quickly reacted and started his first round of testing on his strategy involving the Helio platform.

In the beginning, several of the arbitrageur’s transactions reverted due to problems setting the borrowing amount. They waited until they had successfully tested the strategy to gradually increase the principal amount from 1 BNB to 50 BNB and 100 BNB.

Before the 6th round of arbitrage, the price of aBNBc in the DEX market had not completely collapsed, and the swap ratio was above 0.41 BNB per aBNBc. Note that the Ankr attacker converted the last aBNBc into a blue chip token at 01:39:11, when the swap ratio was around $113 or 0.39 BNB per aBNBc

Just 2 minutes after the 5th round, the price of DEX plummeted to near zero. One reason is that many other participants followed the Ankr attacker’s action and cashed out more aBNBc.

While everyone else was putting aBNBc into the DEX’s liquidity pools to smash its price, the Helio arbitrageur took the opportunity to implement the 6th round of arbitrage. He obtained 183,884 aBNBc for only 10 BNB, at which point the exchange price dropped to 0.00005438 BNB per aBNBc, showing that the DEX’s liquidity pools had become severely imbalanced.

Helio’s valuation of aBNBc failed to keep up with the market. This price discrepancy allowed the arbitrageur to take advantage of the overvaluation of this collateral. They borrowed 16,444,740 HAY, which they swapped for about 15.5 million BUSD.

After six rounds of arbitrage, the arbitrageur invested a principal amount of 262 BNB and earned a net gain of 15,504,986 BUSD and **97.4438 BNB **(not considering the cost of gas fees), equivalent to $15,533,440. The ROI of the 6th round is about 530,800%.

Other interested parties

We also studied some other addresses involved in this incident, including implicated third-party protocols, follow-on attackers who mimicked the Ankr attacker’s minting behavior, and other addresses that profited considerably during this time.

Implicated third-parties

To identify the third-party protocols that also suffered losses in this event, we obtained all transactions that generated aBNBc-related transfer logs during the event, and further extracted all token transfer logs that occurred in these transactions.

In total, we obtained 345,199 token transfer logs. They contain 15,762 unique “from” addresses, 17,793 unique “to” addresses, and 601 unique tokens. We find the top 20 tokens with the highest frequency of interaction with the from address and to address to see which kinds of tokens are primarily involved in this event. aBNBc, BNB, USDT, BUSD, WBNB, USDC, and HAY are all included in the list.

We convert the BNB and WBNB held by the addresses into dollar value based on the price of $292, and calculate the net value change of each address by the net amount change of BNB, WBNB, USDT, USDC, and DAI and omit other tokens’ value. We found the following three DEX pools suffered predominantly.

The Helio arbitrageur’s HAY sell off affected the HAY related trading pools of PancakeSwap and Wombat. They swapped out most of the BUSD, causing the HAY price to deviate heavily from $1.

Follow-on attackers

The following table lists the addresses that are suspected to have followed the attackers in this incident and profited in the same way. Proceeds are estimated at a price of $292 per BNB/WBNB.

Other winners

In addition, we found several addresses with only net inflows across tokens and ranked high in the total net inflow. One should note that since some of the winners transferred their final proceeds elsewhere, this method will miss such addresses.

Insights

Security

The theft of Ankr Deployer’s Private Key caused a security incident. But the security and robustness of the DeFi system cannot be based on the assumption that no one involved in the system can make a mistake. People make mistakes, programs have bugs, and these are all inherent characteristics of the system.

Information monitoring bias

The swift actions of the Helio arbitrageur and other followers demonstrate that searchers perform better than protocols in gathering information and detecting trading opportunities or risks.

He acted quickly after the attacker’s first aBNBc minting transaction and before the aBNBc market had collapsed entirely, with ample time to conduct two small-scale tests. A reasonable guess is that his monitoring system observed an anomaly in aBNBc’s total circulating amount and succeeded in alerting him to it.

What makes him even better is that he figured out the arbitrage path to pledge aBNBc to Helio and borrow HAY before the market crashed. Then he quickly captured the huge valuation difference between the Helio protocol and other DEXes on the token in question at the moment of the crash. The whole process took him about 1 hour.

Oracle manipulation

For the Helio lending platform itself, it would be unwise to evaluate a reward-bearing token on top of some ideal assumptions (e.g., the probability of aBNBc deviating from BNB is small). Therefore, the relevant protocols should always be alert that there is no absolute anchoring relationship between the values of different tokens.

Protection against abnormal liquidity

Many protocols do not react promptly when extreme events occur in the market and DeFi system. This lack of response resulted in the drain of the Helio lending platform and some DEX pools suffering severe losses.

During the event, there was a delay of hundreds to thousands of blocks between the occurrence of the giant aBNBc mint and the subsequent actions. If this window of time is seized, the risk contagion can be stopped early by closing the market to the risky asset, preventing it from being used as collateral, or adjusting the parameters of how someone can borrow it. As a result, the impact of a security event may be avoided or mitigated.

The current DEX or Lending protocol uses quasi-static parameter settings and is slow to adjust in response. This is why we again emphasize the importance of establishing a dynamic risk control system for DeFi with a feedback loop based on the liquidity state of the market.

Follow us via these to dig more hidden wisdom of DeFi:

• Youtube

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

Curve is a DEX liquidity pool built on Ethereum and launched in 2020. It is also known for StableSwap, a feature dedicated to creating an ecosystem that allows users to exchange stablecoins with other DEX protocols with lower fees and slippage.

After about two years of development, Curve can currently support three categories of exchange:

• Stablecoins: Curve has more than 20 USD-pegged stable currency pools, such as 3pool, Lusd+3Crv, UST, etc.

• Stable pegged assets: For example, Curve supports ETH’s PoS and synthetic assets.

• Non-stable pegged assets: After Curve V2, users can exchange BTC, ETH, and USDC in the Curve Tricrypto Pool.

But what makes Curve stand out from other DEXs is its 3-token pool and unique price curve. Take Curve tri-pool as an example. It plays a significant role in reducing risk. Curve does not directly set up pools between premature or risk tokens and stablecoins. Instead, it relies on 3Crv as a medium token to isolate risks, bringing a strong risk buffer to stablecoins. Its unique price curve differs from the constant product formula curve, enabling its pools to suffer from less slippage in the stablecoin AMM markets.

When we talk about AMM markets, we inevitably talk about MEV activities. MEV (Maximal Extractable Value) has generated attractive wealth opportunities in the dark forest. The investigation into MEV bots is vital in improving the efficiency of price discovery in AMM markets. Curve has become an irreplaceable DeFi infrastructure, so we must explore the in-depth impact of MEV activities on Curve.

By providing the MEV impact overview on Curve, we hope this report could inspire stakeholders and researchers to shed light on these questions:

1. How far do MEV bots impact the Curve community and its users?

2. Who would be most likely to be involved in MEV activities?

3. How valuable could MEV data be to enhance the protocol design and impact trading decision-making?

This report will calibrate the MEV market and its impact by observing the extracted asset values. Unlike Uniswap V3 (referring to the research report we released earlier), the MEV type like JIT (just-in-time liquidation) hasn’t emerged in Curve. So we will focus on the two major types of MEV bot activity involving Curve liquidity pools:

• For arbitrage bots, we have filtered out all the transactions involving curve pools.

• For sandwich bots, we will target the transactions where victims get sandwiched in Curve liquidity pools.

The following analysis will start with abstract of key points we have discovered during the investigations of MEV behavior on Curve. Then present an overview of the MEV revenue, volume, frequency analysis, profit, etc. Finally we will dig deeper into each MEV type with some compelling and inspiring conclusions.

Thanks for reading Wisdom of DeFi by EigenPhi! Subscribe for free to receive new posts and support my work.

Abstract

Two MEV types have been explored in Curve: arbitrage bots have generated more than $10M value involving Curve pools, and sandwich bots have extracted $0.98M revenue from victims that are trading in Curve pools. Arbitrage bots are more active in Curve compared with sandwich bots.

We have also investigated the volume flow for both MEV types. Volume is the key factor to influence the price slippage, and due to the unique slippage design of Curve, the investigation of volume on the sandwich attack is also instructive. We discovered that the volume per transaction for sandwich bots is one magnitude larger than for arbitrage bots. How the volume impacts the sandwich bot’s revenue and the victim’s loss is also listed in detail.

The trading opportunities for arbitrage are relatively related to the intensity of market price fluctuations. However, the opportunities for sandwich bots do not seem to correlate with price fluctuations in the market. Some lucky bots could generate attractive wealth. But not all MEV bots could generate positive profit, where the cost of the MEV is also investigated. The most favorite Curve pool for the arbitrage bot and sandwich bot is also provided in the following content.

When we investigated the sandwich bot’s activities, we discovered that token exchangers could be sandwich victims in the Curve pool. But those adding/removing liquidations to/from Curve pools could also be attacked, where the revenue generated from those victims is considerable. Compared with Uniswap, sandwich attacks are more challenging to execute in Curve pools. But it is worth noticing that the percentage of sandwiches in Curve keeps increasing in the time range we inspected. More and more victims have suffered sandwich attacks and losses since June, with an increasing speed of 300%.

Revenue From MEV

Curve’s MEV revenue comes from two aspects:

• Arbitrage gains when reducing the price spread between markets.

• Sandwich attack gains when front-running users’ transactions

The revenue generated from arbitrage will influence the impermanent loss of liquidity providers (LPs) and the slippage loss of swap users. But sandwich revenue directly causes victims to bear the slippage loss.

Total Revenue by Different MEV Types

Figure 1 shows an overview of the revenue generated from arbitrage and sandwich bots involving Curve pools and lists the total fee revenue from Curve for comparison.

Here is the performance of the two MEV types during the period from June 1st to Oct 31st:

• Arbitrage bots have generated more than $10M in revenue from transactions that involved Curve pools, with total arbitrage counts of 40,419.

• Sandwich bots extracted $0.98M revenue from the victims trading in Curve pools, with total sandwich counts of 970.

• The Curve pools revenue from swap fees is around $15 M (source 🏆Curve.fi trading fee per day.)

Compared with the fee revenue that Curve pools have generated, the total extractable value from the two MEV types crosses 73% of the pool’s revenue.

Figure 1: Total revenue of Arbitrage and Sandwich that happened in Curve pools compared with the fee revenue generated by Curve

Revenue Distribution of Each MEV Type

Here is the examination of revenue distribution for arbitrage and sandwich transactions. As shown in Figure 2, most of the arbitrage bots could generate revenue in the range of $11-$100. And sandwich bots would spread the revenue between $1 to $10K.

Figure 2: Revenue distribution of arbitrage and sandwich

Figure 3 shows the boxplot of the revenue distribution for arbitrage and sandwich, clearly indicating a fat tail distribution on the revenue that the MEV bots generated.

Figure 3: Boxplot of the revenue distribution for arbitrage and sandwich

We have summarized some statistical numbers on the revenue distribution, which intuitively indicate that ‘lucky’ highly profitable bots contributed most of the revenue:

• 75% of arbitrage bots make revenue less than $100. The remaining 25% of transactions made 9.4 M revenue and took over 94% of all the revenue.

• For the sandwich bots, the majority’s revenue of a single transaction is higher than arbitrage bots. 75% of sandwich bots make revenue less than $1000. The remaining 25% of transactions make 0.86 M revenue and took over 87.8% of all the revenue.

Monthly Revenue Trend Since June 2022 by Different MEV Types

By investigating the monthly revenue trend for arbitrage and sandwich bots, we aim to provide an overview of the value extracted by MEV from a timeline perspective. Figure 4 shows the monthly revenue generated by arbitrages and sandwiches from Curve pools and compares them with the fee revenue that Curve generated each month.

Figure 4: Monthly revenue for arbitrage and sandwich bots. The right-hand graph shows the percentage comparison between arbitrage revenue, sandwich revenue,** and fee revenue.**

As shown on the left side of Figure 4, we provided the sum of the revenue for each month since June. The magnitude of the monthly revenue for arbitrage bots is one magnitude larger than the sandwich bots. The total revenue of arbitrage bots, which is much larger than the sandwich bots, originates from highly active arbitrage activities compared with sandwich activities. We will provide more investigations into the MEV bots frequency analysis in the third session.

In June and Sep, arbitrage bots generated more revenue than the rest of the months. To see what happened in those two months, we expand the timeline to investigate the daily revenue trend in more detail. As shown in Figure 5, some extremely profitable arbitrage bots generate more than 1 million dollars, which significantly raises monthly revenue. Our transaction analysis tool, EigenTx, provides a detailed analysis of how the ‘lucky’ bots generate that much revenue. If interested, we have attached the link for reference.

Figure 5: Daily revenue for arbitrage and sandwich bots. The right-hand graph shows the percentage comparison between arbitrage revenue, sandwich revenue,** and fee revenue**.

The transaction generated high revenue on June 13th. This revenue is related to the stETH de-peg, which saw high trading volume on Curve on that day.

Correlation of Revenue From Different MEV Types

We have also conducted a correlation analysis on the revenue for both arbitrage and sandwich bots, aiming to reveal any conflicts between those bots. The calculation of the correlation coefficient disregarded those bots that generate extreme revenue, and the final output is 0.11.

From an overview perspective, it didn’t indicate any negative correlation between the two MEV bots. So we believe there are no apparent interest conflicts between arbitrage agents and sandwich agents.

We also investigated the correlation between the extracted value from arbitrage bots and fee revenue from the swap users. The correlation coefficient is 0.7 when comparing the 7-day rolling average of arbitrage revenue and fee revenue.

Figure 6 shows the correlation between arbitrage and fee revenue. The positive correlation could be associated with the correlation between arbitrage volume and total trading volume. In the next session about the trading volume investigation, the arbitrage revenue is also positively related to the trading volume. More details are in the following session on the research of trading volume for different MEV types.

Figure 6 Correlation between fee revenue and arbitrage revenue

Note that we have also compared the fee revenue with the sandwich revenue. The correlation is much less than with arbitrage. This could be explained by the lower correlation between the sandwich volume change and total volume change.

Trading Volume of Curve Liquidity Pools Involving MEV

Volume contribution from arbitrage and sandwich bots to Curve is also an important metric to evaluate the impact of MEV on the macroscopic level. Volume is also an indispensable feature to interfere with the price slippage of liquidity pools, which is the essence of the mechanism of sandwich attacks. So in this section, we will provide a statistical overview of the volume from arbitrage and sandwich, the distribution, and correlation with revenue. In our session, ‘Detailed analysis on sandwich bots’, we provide detailed information like sandwich volume distribution, hoping to illuminate the investigation on the slippage tolerance design for Curve liquidity pools.

The volume calculation is not simply the sum of the volume of arbitrage transactions or sandwich transactions. Because the volume of arbitrage transactions would include the trading volume of other venues, and the volume for sandwich transactions would involve the volume from other pools unrelated to the sandwich attacks. So we have calculated the arbitrage volume based on filtering out the volume that only occurred directly on Curve pools and used the same logic for sandwich volume calculation.

We converted the final output of the volume to USD and based the token price calculation on our newest version of the price index. More details are in the methodology session.

Here is the summary of the total volume of the two MEV types during the period from June 1st to Oct 31st:

• Arbitrage bots have contributed a total of $2.2 billion volume to curve pools.

• Sandwich bots have contributed a total of $1.2 billion volume to curve pools.

• For comparison, we have also listed the total volume from Curve pools, around $16 billion. (source: 📈Curve.fi total trading volume per day)

Volume Trend by Different MEV Types

To start with, we compared the trading volume of arbitrage and sandwich bots for each day and then compared that with the total volume from the main Curve liquidity pools. The MEV volume crossed 20% of the total volume on most days. And there are some single days when the MEV volume is roaring to dominate the total volume.

Figure 7: Daily volume trend for arbitrage and sandwich bots. The total volume of Curve pools is also listed for comparison. The right-hand side of the graph shows the daily trend on the percentage of MEV volume to total volume.

The daily trend indicates that the total arbitrage volume and total sandwich volume for each day are around the same magnitude. Considering the much more active arbitrage bots than sandwich bots (referring to the next session of the MEV bot frequency analysis), the average volume of single sandwich transactions should be greater than arbitrage transactions. Figure 8 shows the average volume per observation of the arbitrage and sandwich transactions, demonstrating that the average volume of sandwich transactions is one magnitude larger than arbitrage.

Figure 8 Average volume per observation for the arbitrage and sandwich transactions

We provide further comparisons of the volume between arbitrage and sandwich attacks in the following content.

Volume Distribution for Each MEV Type

We have investigated the volume distribution for arbitrage and sandwich bots. Figure 9 describes the transaction counts in each volume range. The majority of arbitrage transaction volume concentrates in the range of 1K-10K. But sandwich volume primarily concentrates in the 100k~1m range.

Figure 9 Volume distribution for arbitrage and sandwich bots

Here is the boxplot to compare the arbitrage volume with the sandwich attacker’s volume. We separate the attacker’s volume because it’s highly related to the slippage tolerance calculation, which is the motivation of a sandwich attack. The median volume of the sandwich attacker is one magnitude larger than the arbitrageur’s volume. This is related to the unique price algorithm, which is different from Uniswap V3 with the constant product formula. Curve enables its pools to suffer less slippage in the stablecoin, which means the attacker will need to input more volume to initiate a price slippage for a sandwich attack. We will investigate further and provide more evidence in our future reports.

Figure 10: Boxplot distribution of arbitrage volume and sandwich attacker’s volume. The left side of the box shows a 25% quartile, the middle line represents the median data, and the right side of the box shows a 75% quartile of the data.

Correlation Between Volume and Revenue

We have analyzed the correlation between revenue and volume. As shown in Figure 11, there is a positive relationship between the revenue extracted and trading volume for both sandwich and arbitrage bots.

Figure 11 Correlation between revenue and volume

MEV Bots Frequency Analysis

The frequency analysis on the counts of each MEV type could reflect how frequently those bots spot MEV opportunities. We based our identification of MEV bots for Curve pools on the minimum set, but comparing the data along the timeline would still be inspiring. We have analyzed the daily observations and compared them with the price fluctuations to overview what will influence MEV opportunities for Curve pools.

Daily Observations Trend of MEV Since June 2022 in Curve Liquidity Pools

Figure 12 Daily counts of arbitrage and sandwich bots

From the above figure, we can see that arbitrage bots have started to be relatively active since June. But the activities for sandwich bots are significantly smaller than arbitrage bots. This indicates arbitrage bots are more likely to find MEV opportunities in Curve pools.

Correlation of MEV Daily Observations and Price Change

The fluctuation of observation frequency positively correlates with the absolute price change of representative crypto assets for both arbitrage and sandwich activities. We have calculated the daily frequency fluctuation with the 7-day price change percent of ETH, BTC, and CRV.

The correlation coefficient is shown below:

Arbitrage vs ETH 0.48

Arbitrage vs BTC 0.46

Arbitrage vs CRV 0.48

Sandwich vs ETH -0.02

Sandwich vs BTC -0.14

Sandwich vs CRV -0.13

The result shows the occurrence of trading opportunities for arbitrage is relatively related to the intensity of market price fluctuations. However, the opportunities for sandwich bots don’t seem to correlate with the price fluctuation in the market. The sandwich result differs from Uniswap (with a 0.6 correlation coefficient of price fluctuation). One reason could be that the sandwich activities are less compared with Uniswap (more evidence on detailed analysis of sandwich bots in the following content), so the influence of the market price will be less. Another reason is that Curve contains more stablecoin pools, meaning sandwich opportunities will rely less on the price fluctuation in the market.

Figure 13 daily observation of MEV bots and price fluctuation of ETH, BTC and CRV.

Profit

MEV bots’ actual profit left in their pockets is another parameter to predict how attractive the MEV market will be for outsiders. Here we should notice that evaluating the profit merely by relying on the on-chain data could be biased because on-chain data does not cover the off-chain trading strategy. But it is still worth investigating the profit MEV bots could generate from an overview perspective.

We based the profit calculation on US dollars on our price index service. Note that if the price error is close to the difference between revenue and cost, it would highly influence the final output result, whether or not a bot generates profit. We believe the profit data is within the error limits based on the latest version of our price index.

Daily Profit Distribution

Figure 14 shows the daily profit distribution and the percentage to each other. Similar to the daily revenue trend, arbitrage and sandwich bots gain an average profit on most days and have a few lucky days to generate attractive wealth. What is the trading strategy of these ‘lucky’ bots? It is a good time to refer to the detailed analysis of transactions on EigenTx (Transaction Flow Chart | EigenTx:0x2a615005a63785284f11a4c5cb803d1935d34e358c10a3b4d76398d2e7bb2f9d)

Figure 14 Daily profit trend of MEV and their percentage to each other.

MEV Profit Distribution

The pdf of profit distribution follows the fat tail distribution. And the maximal profit of sandwich bots is at least two orders of magnitude smaller than arbitrage. Apparently, not all MEV bots can generate positive profit. Some MEV bots also suffer from loss due to transaction costs, which we will introduce next.

Figure 15 The PDF plot on profit and loss of oberservations

Cost

Before the introduction of Flashbots, the challenge for sandwich bots was to order their attacks by strategically setting the gas fee. MEV bots also participate in the gas fee auction market, and the fierce competition drives up the cost of gas fees very high. With the emergence of Institutions like Flashbots, it is now possible for bots to guarantee that their attack transactions order via off-chain auctions, and some of these auction costs convert into miner tips in the form of coinbase.transfer(). The gas fee and miner tips constitute the main explicit cost for MEV bots. We have compared the MEV cost with time, and the cost-revenue ratio.

MEV Cost With Time Since June (Daily)

Figure 16 Monthly average cost per observation and the percentage to total revenue.

The cost of arbitrage is relatively stable and low compared with sandwich bots. The June cost is higher and relates to the volume peak on June 13. The trading volume and revenue peaked on that day, and so did the arbitrage cost.

The cost of sandwich bots fluctuates more intensely, and the average cost is much higher than arbitrage bots.

The proportion of revenue allocated to miners for arbitrage has kept decreasing since June.

However, the proportion of revenue allocated to miners for sandwich bots has grown significantly, approaching 90% in October, indicating an increasing competition for sandwich opportunities in Curve pools.

Pool

We have also investigated which pools are more likely to be involved in MEV activities.

The most popular pool for arbitrage in Curve (by arbitrage trading volume)

Figure 17 The top 10 Curve liquidity pools ranking by arbitrage trading volume(green). The total arbitrage transaction counts (orange) are also listed for comparison.

The pool that has involved the most trading volume is: 0xbebc44782c7db0a1a60cb6fe97d0b483032ff1c7

This is the typical Curve 3 pool with stable coin DAI/USDC/USDT, indicating that the stablecoins have been involved significantly during arbitrages in Curve.

But the Curve pool that provided the most arbitrage opportunities is (with most transaction counts):

0xd51a44d3fae010294c616388b506acda1bfaae46

This is the Curve pool with three tokens: USDT/WBTC/WETH.

The most popular pool for sandwiches in Curve (by sandwich trading volume)

Figure 18 The top 10 Curve liquidity pools ranking by sandwich trading volume(green). The total sandwich transaction counts (orange) are also listed for comparison.

The pool with the most trading volume for the sandwich bot is

0xD51a44d3FaE010294C616388b506AcdA1bfAAE46

This is the same pool with USDT/WBTC/WETH tokens that provide most arbitrage opportunities above. It experienced the most trading volume and is also the most favorite pool for attackers.

Profit breakdown investigation

We also present the histogram of several parameters grouped by pool address. The result also obeys fat tail distributions, which means a small bunch of pools is involved much more than the average level.

Figure 19 Histogram of the occurance/gross revenue/cost/profit of arbitrage and sandwich transactions grouped by pool address.

Participants

Investigations on the count of unique bots

In this section, we have provided the number of unique bot contracts participating in arbitrage and sandwich transactions. It’s better to illustrate how many entities are behind those contracts, and we are actively working on contract address affiliation. We will provide more investigation in future reports. But in this report, we will focus on using the unique contracts and compare them from an overview perspective looking at how many contracts have participated in MEV in Curve.

Figure 20 The left graph shows a monthly count of unique bot contracts for arbitrage and sandwich attackers. The right graph shows monthly count of unique addresses of sandwich victims.

The number of arbitrage and sandwich attacker’s contracts is relatively stable in the time range we investigate. But more and more victims have suffered sandwich attacks and losses since June, with an increasing speed of 300%.

Detailed Analysis of Different MEV Types

In this section, we provide deeper information on each MEV type.

Arbitrage Bots

Figure 21 Top 20 arbitrage contracts sorted by total profit and counts

The plots show the top 20 arbitrage contracts, sorted by total profit and total activity count, respectively. We have also calculated the total profit generated by those contracts, and compared it with the total count of these bots that participated in arbitrage transactions. There is a positive relationship between total profit and total activity count. It is luck if a bot only conducts one arbitrage transaction and generates significant wealth. But most bots generate profit with a lot of effort.

Figure 22 Correlation between total profit per arbitrage contract and count of activities per arbitrage contract.

We can observe the arbitrage transactions’ structure by counting the number of venues and the percentage of Curve pools involved. In most arbitrage observations, tokens are swapped between Curve pools and other venues.

Figure 23 Percentage of Curve pools involved per arbitrage transaction

The most common arbitrage pattern is spatial arbitrage (where the venue count is 2), involving one Curve pool and another venue. This arbitrage type takes a percentage of 38.6%. The second primary common pattern is triangle arbitrage (where the venue count is 3), involving one Curve pool and two other venues.

There are also arbitrage transactions that only happen among Curve pools, where the curve_pct is 100%, indicating the participation of 100% of Curve pools in the arbitrage.

How complex could the arbitrage involving Curve pools be? A single arbitrage transaction can also involve 172 venues, where the Curve pool is one of them. (Transaction Flow Chart | EigenTx:0xd350fcce80d6aab3220b6bb2911e8bb55090d0f261f6cfde987c4433a6ec8cdd)

For the arbitrage transactions involving Curve pools, only 0.03% of the transactions contain taxed tokens. It is one magnitude lower than Uniswap. Since Curve pools do not contain taxed tokens, the result compared with Uniswap is reasonable. Those bots can find wealth even in taxed tokens, and all of them make positive profits.

Sandwich Bots

Only 19 sandwich bot contracts have initiated sandwich attacks in Curve pools. We provided their total profits and total activity counts in Figure 27. The effort pays off since the most active attacker is the second most profitable bot. However, the most profitable sandwich bot has only launched 14 sandwich attacks, using only 2 transactions to generate a total profit of more than $46k in the Curve stETH pool.

Figure 24 Top 20 sandwich attacker’s contracts sorted by total profit and counts

We have also compared the volume distribution of victim and attacker using a boxplot. As shown in the figures, the person conducting trading in Curve pools wouldn’t become a victim until the input volume is more than $100.

Figure 25 Boxplot distribution of the volume per transaction for sandwich victim and attacker

There are two attackers with input volume smaller than $100, and the revenue generated by sandwich attacks is negative. The rest of the attacks with a volume larger than $100 start to generate positive revenue.

Here is the distribution of the volume for both attacker and victim. The majority of volume size prone to getting sandwiched is in the 10k to 1m range. Most of the attacker’s volumes concentrate in the 100k-1m range.

Figure 26 Histogram distribution of the volume per transaction for sandwich victim and attacker

We hope the investigation of volume distribution for attacker and victim could shed light on the design of slippage tolerance when conducting transactions in Curve liquidity pools.

Victims

When we identify the sandwich attack among the transactions on-chain, we also record the behavior of the victim when they got sandwiched. One common understanding of sandwich attacks is when the victim is exchanging tokens in a liquidity pools. But it is worth noticing that when the victim launches transactions like adding liquidity into the pool or removing liquidity from the pool, there is also chance that someone will attack him.

As shown in Figure 27, only 86% of sandwich transactions happened when the victim exchanged tokens in the Curve pool. The rest of the transactions contain the steps of adding/removing liquidity. For example, 63 sandwich transactions attacked their victim while they were adding liquidity to the Curve pool, which takes 6.5% of all sandwich transactions. Note that the average revenue generated from attacking victims when they were adding/removing liquidity is also considerable. Since Curve has a meta pool allowing one token to trade with another underlying base pool, the victims’ behavior could be a combination of swap and add/remove liquidity in the pool.

Figure 27 Tx counts and revenue break down by the victim’s actions when they get sandwiched

We have also calculated the counts of sandwich attacks in the percentage of total MEV types and compared the data with the report we have released on Uniswap. Sandwich attacks are less possible in Curve pools than in Uniswap. But it is worth noticing that the percentage of sandwiches in Curve keeps increasing in the time range we inspected.

Figure 28 The percentage of sandwich transactions counts in all MEV types.

Conclusion

From the above analysis, we can see that we cannot ignore the MEV impact on Curve. Understanding past MEV behaviors and trends could help stakeholders to better predict MEV’s future long-term influence on AMM.

Here are some interesting points we have concluded, hoping to enlighten the design of protocols and trading decision-making for stakeholders and together make a better DeFi world:

• Revenue — Arbitrage bots have generated more than $10 M in revenue from transactions that involved Curve pools, with total arbitrage counts of 40419. Sandwich bots extracted $ 0.98 M revenue from the victims trading in Curve pools, with total sandwich counts of 970. For sandwich bots, most of the revenue of a single transaction is higher than arbitrage bots, but the total revenue each month for arbitrage bots is one magnitude larger than the sandwich bots. There are no apparent interest conflicts between arbitrage agents and sandwich agents.

• Volume — The MEV volume accounted for 20% of the total volume on most days. The average volume of a single sandwich transaction is one magnitude larger than an arbitrage transaction. Compared with the volume distribution of arbitrage and sandwich, the median volume of sandwich attacks is one magnitude larger than arbitrage’s volume.Curve enables its pools to suffer less slippage in the stablecoin, which means the attacker will need to input more volume to initiate a price slippage for a sandwich attack. There is a positive relationship between the revenue extracted and trading volume for sandwich and arbitrage bots.

• Frequency — The activities for sandwich bots are significantly less than arbitrage bots. The result shows the occurrence of trading opportunities for arbitrage is relatively related to the intensity of market price fluctuations. However, the opportunities for sandwich bots do not seem to correlate with price fluctuations in the market.

• Profit — Arbitrage and sandwich bots gain an average profit on most days and have a few lucky days to generate significant wealth. The pdf of profit distribution follows the fat tail distribution. And the maximal profit of sandwich bots is at least two orders of magnitude smaller than arbitrage. Not all MEV bots can generate positive profit. Some also suffer losses.

• Cost — The arbitrage cost is relatively stable and low compared with sandwich bots. The cost of sandwich bots fluctuates more intensely, and the average cost is much higher than arbitrage bots. The proportion of revenue allocated to miners for arbitrage has decreased since June, but for sandwich bots the proportion kept increasing, approaching 90% in October, indicating an increasing competition for sandwich opportunities in Curve pools.

• Pools — The pool with three tokens: USDT/WBTC/WETH, provided the most arbitrage opportunities and is also the favorite pool for attackers. The pool with the most trading volume is the stablecoin pool: DAI/USDC/USDT. From the profit distribution, we can see that a small group of pools is involved much more than the average level.

• Participants — In the time range we investigated, the number of arbitrage and sandwich contracts is relatively stable. But more and more victims have suffered sandwich attacks and losses since June, with an increasing speed of 300%.

• Arbitrage Bot Details — There is a positive relationship between the total profit of arbitrage bot contracts and the total activity count. The most common arbitrage pattern is spatial arbitrage (where venue count is 2), involving one Curve pool and another venue. There are also arbitrage transactions that only happen among Curve pools. A single arbitrage transaction can also involve 172 venues, where the Curve pool is one of them. Only 0.03% of the arbitrage transactions contain taxed tokens. It is one magnitude lower than Uniswap.

• Sandwich Bot Details — Only 19 sandwich bot contracts have initiated sandwich attacks in Curve pools. The most profitable sandwich bot has only launched 14 sandwich attacks, using only 2 transactions to generate a total profit of more than $46k in Curve stETH pool. A person trading in Curve pools wouldn’t become a victim until the input volume is more than $100. Attackers won’t generate positive revenue until the input volume exceeds $100. It is worth noticing that token exchangers could be sandwich victims in the Curve pool. But those adding/removing liquidations to/from Curve pools could also be attacked, where the revenue generated from those victims is considerable. Compared with Uniswap, sandwich attacks are more challenging to execute in Curve pools. But it is worth noticing that the percentage of sandwiches in Curve keeps increasing in the time range we inspected.

Methodology

Data Source

We base our analysis on the raw block data fetched from the full Ethereum node we built. The data range of our investigation is from block number 14881677(include) to 15871479(include). We decode the raw data to get the fine-grained data field we need.

To compare certain parameters with the overall market situation and Curve’s macroscopic parameters, we adopted data from third parties as listed below:

1. ETH’s historical close price from Coinmarketcap. https://coinmarketcap.com/currencies/ethereum/historical-data/

2. Curve’s fee revenue from dune: 🏆Curve.fi trading fee per day

3. Curve’s total trading volume per day: 📈Curve.fi total trading volume per day

How Do We Identify Bots?

• We consider a transaction to be a collection of asset transfers, and we use a set of rules to see if an MEV activity has happened by assessing the outcomes of these transfers. The rule of thumb is that there is more than one transfer (or swap) in the transaction, and the trader ends up with a surplus.

• To identify different types of MEV activity, we collect observations obeying our heuristic rules for each type in the current stage, and we continue enhancing our algorithms according to false negative or false positive detected by comparing the sample results with those from MEV-inspect each day.

• In this report, we identified two types of MEV type for Curve pools. The total number of observation results for arbitrage bots is 40419 and sandwich bots is 970. The investigation time range is from Jun 1, 2022, to Oct 31, 2022.

How Do We Calculate Profit and Cost?

• We are constantly optimizing our price index algorithm. For mainstream stable coins (USDT, USDC, DAI) and assets with relatively good liquidity (ETH, WETH, WBTC), the AMM and on-chain oracles can provide a relatively reliable quote source. With these mainstream assets’ prices settled down, we further calculate the prices of other tokens based on the swap ratio at the time of calculation.

• We only consider on-chain costs for each transaction detected. The calculation process is summing up the gas fee and the *coinbase.transfer() *value (if there is any) of each transaction and convert the result to USD based on the ETH’s price.

Disclaimer

The “Information” contained in this post has been prepared solely for informational purposes, is in summary form, and does not purport to be complete. The Information is not, and is not intended to be, an offer to sell, or a solicitation of an offer to purchase, any securities. The Information does not provide and should not be treated as giving investment advice. The Information does not take into account specific investment objectives, financial situation or the particular needs of any prospective investor. No representation or warranty is made, expressed or implied, with respect to the fairness, correctness, accuracy, reasonableness or completeness of the Information.

We do not undertake to update the Information. It should not be regarded by prospective investors as a substitute for the exercise of their own judgment or research. Prospective investors should consult with their own legal, regulatory, tax, business, investment, financial and accounting advisers to the extent that they deem it necessary, and make any investment decisions based upon their own judgment and advice from such advisers as they deem necessary and not upon any view expressed herein.

*We are open to discussion. Please feel free to contact us via contact@eigenphi.com.

We have presented you with the story of the $CRV short saga, of which we focused on the details of liquidation transactions and liquidators. This time, in the research report we will share with you, we’d like to put on the hat of financial researchers to dissect the event using a thorough analysis of token flows.

In this way, we will reveal one of the emerging risks in DeFi — risk associated with liquidity budding from features of DeFi, i.e., flash loans. And we’d like to propose how to monitor and control such risk.

You must already be familiar with the story: a crypto whale failed miserably against a short squeeze and left an uncovered debt on the lending platform AAVE.

Here are the key takeaways from the report:

• A crypto whale dumped the CRV market with 92 million CRV borrowed from AAVE. This action resulted in a precise short squeeze attack costing the crypto whale an estimated $20 million and creating a bad debt on AAVE worth about $1.6 million.

• The two pull-ups in CRV prices successively caused the shorter’s AAVE position to trigger the liquidation and insolvency threshold. 385 liquidations by 21 unique addresses emptied 63.596 million USDC collateral, leaving 2.456 million CRV unpaid.

• AAVE utilizes quotes fed by on-chain oracles to calculate whether the liquidation threshold is triggered, which has a lag of about 10 minutes compared to Binance’s price information.

• In between the two price pulls, there were more than 3 hours when the liquidation condition was not triggered due to a temporary price drop. At this stage, AAVE may have missed the best time to adopt a contingency strategy.

• We believe the root cause of this event is the transparent nature of a blockchain makes financial information easily accessible, giving attackers more advantages.

• However, the current lending protocols are not designed with a risk control mechanism based on timely adjustment according to both price and liquidity information.

• We propose creating a feedback control system for DeFi based on safety cushions and liquidity sensors to better address risk in the long term.

The figure below illustrates the dumping steps:

And here is the token flow between Ethereum and OKX:

How did bad debts occur? The following figures merge the facts significant in analyzing the cause of bad debts during the liquidation process.

Where did those liquidators find their capital sources? We manually sort them out with the help of our visualization tool EigenTx. The results are shown in the following tables.

AAVE’s bad debt is not a unique case in terms liquidity risk. Recently, in the BSC ecosystem, the Ankr platform was hacked to issue a large number of aBNBc out of thin air due to a vulnerability, resulting in more than a dozen protocols’ associated pools, including Pancake and Helio, suffering heavy damage.

The moral of these stories is: an asset’s level of liquidity and safety margin can change over its life cycle and is also susceptible to contagion risk by associated assets.

To improve the status quo, we propose a feedback system that combines a safety cushion and various sensors based on real-time liquidity vectors to detect defects and respond in time to changes in the market.

There are so much valuable data and information embedded in the report. Please download the research *Report on Code at Risk: An In-depth Analysis of How AAVE’s $1.6 Million Bad Debt Was Created *and leave your comments and questions.

You can also check out the video we made for the saga:

Follow us via these to dig more hidden wisdom of DeFi:

• Youtube

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

Photo by Harry Gillen on Unsplash

What Happened

On November 22, a big whale (ponzishorter.eth) was found trying to short CRV. A large amount of CRV was borrowed from Aave and sold off. The price of CRV fell rapidly. But soon came the white knight. Michael Egorov, the founder of Curve added 20 million $CRV asset to avoid its price falling. After that, the battle ended with the debt of the shorter (@avi_eisen) who borrowed more than 92 million CRV in Aave being liquidated.

Here are the lending profiles of @avi_eisen and Curve founder @newmichwill. It can be seen that after the liquidations, Avi’s debt dropped significantly.

To make the whole story clearer, the following is the action and timeline of both sides in the battle. From 17 to 23 of November, @avi_eisen borrowed a total of $37,583,795.15 worth of CRV (possibly with multiple leverages involved), trying to lower the price of CRV, but he underestimated the CRV held by the Curve founder. In response, @newmichwill deposited $14,896,307.65 worth of CRV, reducing the possibility of CRV’s illiquidity.

This story has been talked about on social media for a while, so what we really want to tell is the story of liquidation transactions after this battle, which we found quite interesting.

Liquidations Overview

The CRV battle seems to have come to an end on 24 Nov. The event brought a surge in liquidation transactions. In the 24 hours from 22 to 23 Nov, basically, the vast majority of liquidation transactions were CRV liquidation transactions.

But during the process, there were about three hours of silence. In these three hours, no CRV liquidation transactions occurred. We don’t yet know what happened, but we will follow up on this. If any of you have leads on this, please feel free to leave a comment.

Who Are the Top Liquidators

We spotted 21 liquidators and 300+ transactions included in CRV liquidation.

The top liquidator obtained over $23.1 million worth of USDC, covering the debt of $22.4 million worth of CRV and making $728K million net revenue. The profit of 19 transactions the liquidator made was between 1K and 10K. And you can also check out the gas prices paid for these profitable liquidations.

However, liquidations with huge amounts may not come with huge profits. Sometimes there are even painful losses. The address ranked sixth in liquidation amount lost $5000+.

And don’t forget that it is still possible to be sandwiched during the liquidation. We found some sandwich attacks that occurred when the liquidators were busy digging for treasure. Like in this transaction, the attacker got around $30 (though not much).

How Did It Work

We were curious about:

• Where did the CRV come from?

• Where did it go?

• How did these liquidation transactions works?

After scanning these 300+ CRV liquidation transactions, we found that these transactions mainly involved the following pools. And about 12% of these transactions used flash loans from dYdX.

These transactions powered by flash loans seem to be larger in amount and follow a similar pattern. Let’s take one of these transactions as an example, and let me break it down for you. See the details of this transaction here.

1. Initially, the liquidator borrowed 140,251 WETH by Flashloan from dYdX (Step 0).

2. Swapped WETH for 214,807.5856 CRV from Curve Pool (Step 1 to 4).

3. Liquidation on Aave for 158,983.6439 USDC (Step 5 to 8).

4. Swapped USDC for 141.0548 WETH from Uniswap V3 pool (Step 9 to 10).

5. Paid the miner (Step 11 to 13).

6. Repaid the flash loan (Step 14).

We also found 6 other patterns in these liquidation transactions. Some are simple but clever, and some are not so worthwhile.

1. The liquidator had all the CRV needed, and he could finish the liquidation directly. See the details here.

2. No CRV.

USDC >>> WETH (UniV3 Pool) >>>CRV (Curve Pool) >>> Make the liquidation in Aave >>> Rake up the profits in USDC

See the details here.

3. No CRV. Only UniV3 pools.

USDC >>> WETH (UniV3 Pool:0x8ad…/UniV3 Pool:0x88e… ) >>>CRV (UniV3 Pool) >>> Make the liquidation in Aave >>> Rake up the profits in USDC

See the details here.

4. No CRV. UniV3+V2.

USDC >>> WETH (UniV2 Pool) >>>CRV (UniV3 Pool) >>> Make the liquidation in Aave >>> Rake up the profits in USDC

See the details here.

5. No CRV. UniV3+SushiSwap

USDC >>> WETH (UniV3 Pool) >>>CRV (SushiSwap) >>> Make the liquidation in Aave >>> Rake up the profits in USDC

See the details here.

6. No CRV. SushiSwap+UniV3

USDC >>> WETH (SushiSwap) >>>CRV (UniV3 Pool) >>> Make the liquidation in Aave >>> Rake up the profits in USDC

See the details here.

Fun facts

• Here’s the CRV in Curve founder @newmichwill’s wallet after the battle. For the moment, he’s the 6th biggest owner of CRV.

• The bad things come in succession. We found Avi had been sandwiched before he got liquidated and lost $190. See more info about the sandwich here.

What’s Next

During this battle, Curve also released the white paper for its new stablecoin. What impact has this battle had on CRV, has it also affected its new stablecoin, and what changes and opportunities will the Curve bring to the DeFi world? EigenPhi is working on it and will soon publish an in-depth report on Curve. Stay tuned.

References

• https://twitter.com/CurveCap/status/1595100002007027713

• https://twitter.com/RudyKadoch/status/1595210314685071363

• https://twitter.com/DefiMoon/status/1594431248956391424

• https://twitter.com/CurveCap/status/1595459882656104451

• https://zapper.fi/account/0x7a16ff8270133f063aab6c9977183d9e72835428?

Photo by Mackenzie Marco on Unsplash

Suppose you are a whale who loves to trade vast amounts of assets via Uniswap, Curve, Dodo, and Balancer; you’d better take precautions from now on. Otherwise, you will fall prey to a sandwich front-running attacker lurking in the darkest corners of these trading venues and lynching uninformed whale traders. I.e., dubstepnerd.eth, the victim of this sandwich enabled by a $153.9M flash loan, the biggest one of November on Ethereum.

MEV Summary

When making the sandwich, utilizing a leveraged position, the MEV Bot collateralized part of its token and flash-loaned 127,006 WETH on AAVE. Then it borrowed DAI to swap USDC in a Curve LP, in which the price of the token pair was impacted. Next, it saved the USDC to MakerDAO, deposited the minted DAI to AAVE, burned part of the debt of DAI, and withdrew 127,006 WETH to pay back the flash loan.

Key Contracts, Roles, and Addresses

Attacker EOA(from address): 0xf480fAb87c07EC2dDd68A83eC0319BB466B1Afa2

MEV Bot: 0x0000000000590b74eb97457bf7b3ff6d63c6fde2

Borrower: 0x2a9152d882ba3fc4265d47447a7a00970f90a25e

The three addresses above can be seen as the same group belonging to the attacker.

Curve LP: 0xbebc44782c7db0a1a60cb6fe97d0b483032ff1c7

Balancer Vault: 0xba12222222228d8ba445958a75a0704d566bf2c8

MakerDAO PSM: 0x0a59649758aa4d66e25f08dd01271e891fe52199

AAVE’s aWETH contract: 0x030ba81f1c18d280636f32af80b9aad02cf0854e

**Uniswap USDC/WETH V2 Pool: **0xB4e16d0168e52d35CaCD2c6185b44281Ec28C9Dc

Frontrun of the Sandwich

Open this link to view the frontrun transaction with features like step-by-step, P/L, and CallTrace Tree.

The goal of this transaction: raise the price of USDC against 3CRV in the Curve Pool.

Here is the token flow chart of it.

The detailed steps explanation:

Step 0–4: From address and MEV Bot transferred their own token: 50.6649 ETH, 77,015.34 DAI, 261,104.4678 USDC, and flash-loaned 127,006 WETH to borrower.

Step 5–14: the borrower address saved all the tokens to AAVE as collateral and acquired aToken provided by AAVE.

Step 15,16: the borrower borrowed 49,065,460 DAI from AAVE and received the corresponding debt token.

Step 17,18: the borrower swapped 49,065,460 DAI for 49,038,215 USDC in the Curve pool, finishing raising the USDC exchange price. This is the crucial step of the whole attack.

Step 19–22: the borrower saved the USDC to MakerDAO and received the same amount, 49,038,215, of DAI, then it paid back the DAI to AAVE to pay part of the debt generated from borrowing the DAI.

Step 23–25: the borrower took out most of the WETH collateral and paid back the 127,006 WETH flash loan.

The MEV Bot suffered a loss of 27,244 $DAI due to paying the debt of 49,065,460 DAI with 49,038,215 DAI.

Victim Transaction

In this transaction, the victim’s EOA took out the liquidity by burning 3Crv for USDC.

Eventually, this whale lost 8.052563 ETH, computed by the revenue of the attacker.

Backrun of the Sandwich

In this transaction, using a flash loan, the MEV BOT borrowed WETH and put into AAVE as collateral to borrow USDC, then it swapped the USDC to CurveLP at a high price to complete the sandwich attack, getting a large amount of DAI. After repaying the debts and miners’ tips, the attacker finally raked profit.

The detailed steps explanation:

Step 0,1,2: The borrower flash-loaned 127,006.0842 WETH from Balancer and saved to AAVE as collateral, receiving aWETH.

Step 3,4: The borrower borrowed 49,038,215.8275 USDC from AAVE and received the dept token.

Step 5,6: The borrower swapped the loaned 49,038,215.8275 USDC for 49,075,250.685 DAI in the Curve pool.

Step 7,8: The borrower returned the 27,244 $DAI debt to AAVE and burnt the debt DAI token from the front-running.

Step 9, 10, 11: The borrower returned the left 49,048,006 DAI to MakerDAO and withdrew 49,048,006 USDC.

Step 12, 13: The borrower paid back 49,038,215.8275 USDC to AAVE to eliminate the debt generated in Step 3 and 4. (In the figure, step 12 is overlapped with step 3.)

Step 14, 15: The borrower burned 127,056.749 aWETH, which is the total of the flash loan and its original position, and took out the WETH.

Step 16: The borrower returned the flash-loaned 127,006.0842 WETH.

Step 17, 18: The borrower swapped the left 9,790.1725 USDC for 8.0526 WETH in the Uniswap V2 pool.

Step 19–24: The borrower took out the collateralized 77,015.34 DAI and 261,104.4678 USDC from AAVE and transferred them back to the MEV Bot.

Step 25–27: The borrower exchanged the left 58.717445 WETH as ETH and transferred it back to the MEV Bot. At this moment, the MEV Bot has repaid all the debt of the front-running transaction and retrieved all the positions, eventually getting a revenue of 8.0525 ETH (58.7174–50.6649).

Step 28: The MEV Bot transferred 57.514216 ETH to the from address.

Step 29: The MEV Bot paid 1.203229 ETH as miner tips.

Profit and Loss Summary

In the end, the attacker profited 6.82 ETH, worth $8,267.

Asset Utilization Efficiency

Let’s do some calculations.

Attacker’s position: 50.6649 ETH($60,642), 77,015.34 DAI, 261,104.4678 USDC，$338,119 in total.

Flash loan: 127006.0842 WETH = $153,907,408.

Curve pool attacking fund: 49,065,460 DAI

Collateral on AAVE: $338,119 + $153,907,408 = $154,245,527

Left debt after the frontrun: 27,244 DAI

Debt to Position rate: 27,244/338,119 = 8%.

This attack’s asset utilization efficiency is not ideal. The fund attacking the Curve pool was 49M DAI, accounting for 31.8% of the collateral amount: $154.2M. The flash loan was paid back by using the withdrawn WETH. After the front-running transaction, the left debt only accounted for 8% of the collateralized assets. At the end of the day, the flash loan was used as a bridging loan, not leveraged position.

But this attack has largely reached the maximum of the MEV, which can be inducted from the calculations below.

The victim’s actual swap amount: 20,609,422.1640 USDC.

The min_amount parameter set by the victim: 20,609,403.453298 USDC.

The difference is 18.71 USDC. And the attacker’s two swaps on the Curve pool increased by 9,790.1725 USDC as a surplus.

The Attacker’s MO and Victim History

To manage attacks like this, the attacker is equipped with three skills:

• Possessing a thorough comprehension of the Curve liquidity pool’s algorithms.

• Monitoring the changes in the mempools of Ethereum to locate the large stablecoin transaction orders on Uniswap, Curve, Dodo, and Balancer.

• Developing smart contracts that can rapidly compute the cost and benefit of sandwich attacking and implement the actual squeeze.

Wonder how much damage this attacker has done? We compile this year’s sandwich data till Oct 19 and make the table below.

The last row of the table is the overall sandwich data during this period.

Here are some facts.

• 13 MEV Bots have been used by this attacker, and only this attacker to squeeze whales 1,022 times till Oct 19, causing a victim loss of $2.93M, raking $1.44M profit for the attacker.

• The total ROI of the attacker, 49%, is much higher than the general ROI of sandwiches, 21%. And 6 out of 13 of the MEV Bots have an ROI of over 50%. So this attacker is really good at what it has been doing.

• The average victim loss per sandwich by the attacker is $2,866, almost 10 times of the overall average loss: $290.

• The average profit per sandwich by the attacker is $1,410, 23.5 times of the overall average profit: $60.

• The average volume per sandwich is $20.1M, 33 times of the overall average volume: $608K. This is a clear indicator that the sandwiches done by this attacker have been targeting whales and their hefty swaps. Please be noted that a flash loan’s amount is not counted as the transaction’s volume.

• The earliest attack can be traced back to May 30 of this year.

We can also check the data from the victim’s side.

We have gathered a spreadsheet of the victims suffering sandwich attacks from the attacker 0xf48. Here are some facts. The data’s deadline here is Oct 19.

• In total, there are 744 victims losing $2.93M to the attacker on 1022.

• 8 victims have been clasped 6 or more times by the attacker.

• The victim who suffered the most, 22 times and a loss of over $170K, is a Uniswap V3 liquidity provider.

• 58 victims have been deprived of more than $10K by the attacker and its MEV Bots.

You may want to find out how many of these 1,022 sandwiches involve flash loans. It’s a pretty big topic, and we will present you the results once finishing crunching the numbers.

Conclusion

It’s no doubt that the attacker 0xf48 has been taking to cooking sandwiches like a duck to water in these pools, in which, however, this duck poses severe threats to the whales doing trading. **We strongly advise whale trades to take special precautions while trading large amounts of assets by harnessing ****Flash Bots Protect RPC point **or CoW Swap. Just don’t go out there swimming naked.

Although the attacker has been using flash loans as aid, luckily, it does not utilize these loans’ full potential, at least not in the transaction this post analyzed employing a $153.9M flash loan.

The posts below demonstrate how searchers use flash loans for arbitrages.

• How to use dYdX Flash Loan for arbitrage?

• Get Everything for Nothing: How to Use Flash Loans to Launch an Arbitrage?

Follow us via these to dig more hidden wisdom of DeFi:

• Youtube

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

Photo by Michael Dziedzic on Unsplash

Here’s a sandwich trade from a genius. In the eyes of MEV searchers, this brilliant new strategy conducts risk-free arbitrage against the change in AMM’s swapping slippage. But in the eyes of the LPs, this may be a new attack vector enough to raise the alarm. LPs should carefully set checkpoint thresholds to avoid losing against such kinds of sandwich bots.

On November 4, 2022, EigenPhi detected a BRAND NEW type of sandwich transaction: a sandwich bot squeezed an add-liquidity transaction, which is weird according to our shared knowledge. Is it profitable to do so? Are there any restrictions? Unlike the previous article on a HUGE sandwich trade, including 37 transactions, this bot shows a rather different and innovative strategy. And this article will take you to find out how DANGEROUS the current situation of AMM’s LPs is.

A Summary and Token Flow Chart

From this trade, the sandwich bot got a revenue of 0.922832 WETH. After subtracting the gas costs of both front-run and back-run transactions, the remaining profit was about 0.023346 WETH. The bot achieved a perfect risk-free arbitrage in a bundle of transactions without risk exposure to assets other than WETH.

Trading Steps

• Front-run Tx: The sandwich bot’s from address called its contract (to address) and swapped 21.477791967255461888 WETH to 458,875.769333569771126592 SYC through Uniswap V2: SYC 6.

• Middle Tx: Someone added 15 WETH and 231,712.963735470964309251 SYC to the pool contract, Uniswap V2: SYC 6, and got 1,792.628826087529628699 UNI-V2 as a voucher. We call it a middle Liquidity Provider (LP) as follows.

• **Back-run Tx: **The sandwich bot swapped 458,875.769333569771126592 SYC, as obtained in the front-run transaction, back to 22.400624171075764224 WETH.

The following figure shows the token flow graphs of each transaction.

A Quantitative Analysis of This Strategy

Why can the sandwich bot make a profit from an adding liquidity transaction? Where exactly does its revenue come from? Is it earning the maximum possible revenue? Who are the victims?

Next, we provide a detailed analysis of this strategy. And you will see that all liquidity providers of this pool bear the most loss compared to the pinched transaction’s user. What’s more interesting is that the sandwich bot may be possible to self-direct this trade without a strict prerequisite.

Constants and Variables

Firstly, we list the constants and variables needed to calculate the revenue of the sandwich bot. As shown in the following table, we use a bunch of characters to denote the parameters corresponding to the pool’s status before, during, and after the sandwich trade. For each character, we use subscripts to represent the corresponding time and superscripts to represent the corresponding token. In this case, token0 means SYC, and token1 means WETH.

Here is the Previous Swap in the table.

Several constants are needed to conduct the calculation, and we can fetch them from event logs and transaction data. To understand the calculation logic here, you may require some background knowledge related to Uniswap V2’s and its Router’s contracts. For example, the logic in functions such as swap() and addLiquidity().

Constraints

Secondly, there are also some constraints that the sandwich bot should obey.

Optimization Problem

Now we focus on the optimization problem. Given the liquidity pool’s initial status and the relative constant parameters, we formulate an attack vector into a constrained optimization problem concerning all the parameters defined.

We can tackle this problem by utilizing either the analytical method or simulation.

Victims In the Dark

Essentially, the bot’s revenue comes from a change in the slippage faced by a swap transaction with the same volume before and after adding liquidity. In other words, it is a risk-free arbitrage against the change in slippage. What about the LPs as counterparties? What are their PnL?

Based on the previous analysis, we continue calculating LP’s profit and loss in this trade. We consider two cases and define parameters as listed below.

Simulation Results

Case 1:

The lower right panel in the above figure shows that the parameters set by the sandwich bot correspond to the maximal loss other LPs bear.

Besides that, we can also find that beyond this threshold, the bot’s revenue comes mainly from the loss of the middle LP, and as more WETH is put into the pool by the bot, other LPs’ swap fee revenue will exceed their loss.

From this point of view, the reversion checkpoint set by the middle LP provides critical protection.

Moreover, the reversion checkpoint set by the middle LP cleverly coincides with the threshold corresponding to the maximum loss of other LPs. One wonders if this is a self-directed sandwich transaction; at least, it is far from being a loser**. **A sandwich bot can initiate both a sandwich transaction and an add-liquidity transaction, provided that the total p&l is guaranteed positive.

From the lower left panel, it seems that the middle LP might even be able to profit from this trade under specific parameter settings, which is worth a careful check.

Case 2:

If we suppose the middle LP is a separate individual ignorant of the sandwich bot, we should calculate its designated principal in another way. And the resulting PnL of the three kinds of participant is shown in the following figure.

In this case, the initial parameter set by the sandwich bot no longer corresponds to the maximum loss of other LPs, and the transaction will be reverted if it were true.

Case 1 is more likely to be consistent with the sandwich bot’s strategy.

To simplify the analysis, none of the above calculations takes into account the actual cost of Gas fees paid by the bot, and the conclusion does not change because of this.

Will a Self-directed Sandwich Trade Make Money?

There are more things to think about and learn from this case. For example,

• Which kind of pool is suitable for making similar trades?

• Can a sandwich bot implement the strategy without a third party initiating an add-liquidity transaction?

A Case-Specific Inference

Finding the answers to the above questions requires one to generalize the model in this article. Before doing a systematic study, we can conduct a brief counterfactual inference to get a sense.

Considering the revenue and profit out of the front-run and back-run transactions are 0.922832 WETH and 0.023346 WETH, respectively, we can conclude that the sandwich bot cannot profit by mocking the middle LP.

Simulation Model

One might ask, does this strategy depend on the pool and its state? Solving this question would require a generalized model and systematic learning. We first give an analytical framework here and share a more profound study in future reports.

We list the effects of these six steps on pool in the following table.

Conclusion

We highlight the key insights obtained from this case:

• A sandwich bot made a surplus of nearly 1 WETH by sandwiching an add-liquidity transaction in Uniswap V2’s SYC-WETH pool. The validator got most of its revenue through gas fees.

• The new strategy can be regarded as a risk-free arbitrage against the change in slippage before and after adding liquidity to the pool.

• Compared to the middle LP, other LPs bear much more loss in this case. The parameters set by the sandwich bot and the checkpoint constraints imposed by the middle LP cleverly coincide with the threshold corresponding to the maximum loss of other LPs.

• LPs should carefully set checkpoint thresholds, such as the minimum liquidity to be added when issuing an add-liquidity transaction. Otherwise, they may bear a complete loss by such a kind of sandwich bot.

• From our preliminary analysis, a bot cannot self-direct the entire trading steps without waiting for a third party’s add-liquidity transaction. But one needs to check this with a more systematic model.

• And the strategy is quite sensitive to the pool’s initial status, and the bot must adjust its parameters to a specific range to get the most surplus from other LPs.

AMM is one of the most relevant components, if not the most important one, during the extraction process of MEV. Users of AMM are unavoidably connected to MEV bots as a result of the transparency of mempools. This tweet directly reflects the trouble users may face. From another point of view, arbitrage bots play a vital role in improving the efficiency of price discovery in AMM markets. When exploring how MEV has impacted users on Uniswap, there are two aspects the stakeholders may consider necessary:

1. To what extent is the impact on the Uniswap community and its users?

2. Which Uniswap users and liquidity pools are more likely to be involved?

In this report, we find some interesting and inspiring conclusions and shed light on these questions. The results are based on a sample of observations and data analysis. While the maximal extractable value from the dark forest is hard to be calculated, we can calibrate the MEV market and its impact by observing the extracted asset values. In the following, we present an analysis focusing on three types of MEV bot activity targeting Uniswap V3’s liquidity pools.

Overview

Revenue of Bots’ Activities

A Comparison of Total Revenue Scales

One part of MEV bots’ revenue comes from the arbitrage gain when reducing the price spread between markets, which is also reflected in the impermanent loss of liquidity providers (LPs) and slippage loss of swap users. And another part of revenue comes from front-running users’ swap transactions and causing them to bear additional slippage losses. JIT bots are unique concerning Uniswap V3’s new feature — concentrated liquidity. They play the role of highly active LP and extract swap fee revenues from other passive LPs.

We intuitively measure the scale of extracted revenue by these bots and compare it to that of the commonly defined supply-side revenue of Uniswap V3.

Let’s look at the performances of different types of MEVs. During the period from January 1st to October 31th, 2022:

• Arbitrage bots have extracted at least $85 M from market price asymmetry involving Uniswap V3 pools.

• Sandwich bots have extracted at least $47 M from Uniswap V3 pools’ swap users.

• JIT bots have extracted $6 M from Uniswap V3’s swap fee revenue.

• The total extracted value of these three types has crossed 25% of the supply-side revenue ( i.e., LP’s revenue from swap fee), $540 M.

Before the dark forest and MEV bots entered the public eye, LPs, swap users, and governance token holders played significant roles in AMM’s community. And TVL, volume, fee rate, slippage, liquidity mining yield were the primary indicators that mattered. Nowadays, from the perspective of the extracted value’s scale, MEV bots are one of the components that this community cannot bear to ignore.

The community has become more diverse and evolved into a more complex value transfer network. Given this pattern, MEV data has become a valuable asset for enhancing decision-making. One of the goals of this report and future work is to outline this network transparently. And tracking its evolution from time to time can help the related parties better understand how MEV affects the Uniswap community in the long term.

Monthly Revenue Trends

Let’s start by examining the monthly revenue data for this year.

From the correlation coefficients below, there is no negative correlation between arbitrage bots’ and sandwich bots’ revenues and that of LPs (Source: Dune, @messari / Messari: Uniswap Macro Financial Statements), which means there are no apparent interest conflicts between these agents. However, their revenues are more likely to fluctuate following the whole market in recent months.

Comparing revenue gain among different kinds of MEV bots, we find that arbitrage bots can extract more values than other types. The monthly revenue of JIT bots is one order of magnitude smaller than that of the other two types and has not yet shown a clear trend, which is also related to the fact that such opportunities are just emerging.

Volume Contribution

Volume contribution to Uniswap from these MEV bots is another way to calibrate the impact on the macroscopic level.

From the histogram below, we can see in most arbitrage observations; tokens are swapped between Uniswap V3 pools and other venues.

Therefore, to investigate the volume contribution of arbitrage events, one cannot simply sum up the volume of arbitrage and compare it with Uniswap V3’s total volume, in which volume contributed to other venues will also be counted. Instead, a more convincing way is to consider the volume that occurred directly at Uniswap V3 pools. The same logic is also applied to calculating volume contribution by sandwich bots.

JIT bots don’t need to issue swap transactions; they add and remove liquidity to extract the swap fee. However, we can measure the volume of targeted swap transactions in a JIT event to study the impact on swap users.

We will explore it in future reports.

Frequency Analysis

Daily Count of Observations

We can also detect how frequently these bots spot MEV opportunities by observing the daily count of observations. Although the following results present an observed minimum set, comparing the data along a timeline or bot type is still reasonable.

The plot below shows a significant increase in arbitrage bots’ activities starting from May this year. In contrast, the observation frequency of sandwich bots remained at a stable level. Apparently, arbitrage bots are more likely to find MEV opportunities than other bots.

Daily Count Fluctuation and Trends

The fluctuation of observation frequency positively correlates with the absolute price change of representative crypto assets in terms of arbitrage and sandwich activities. Here we present an example of ETH’s 7-day price change percent (a moving averaged result of the absolute value, source: historical close price from coinmarketcap.com). And the correlation coefficient between the moving averages is around 0.43 for arbitrage bots and 0.60 for sandwich bots. The result shows to a certain extent that the occurrence of trading opportunities is related to the intensity of market price fluctuations, which is quite reasonable. The structural growth of arbitrage bot’s activities since May could also be related to other factors, such as a reduction in average gas price in recent months, which is not the focus of this report.

Meanwhile, JIT bots have seen an increasing opportunity trend in recent months.

Profit of Observations

MEV bots’ actual profit left in their pockets is another parameter to predict how attractive the MEV market will be for outsiders in the future. Evaluation in this aspect requires more careful and granular processing of the data for two reasons:

• Merely relying on the on-chain data for an accurate answer is not enough because there is survivorship bias. For example, maybe a bot that looks profitable from on-chain transactions still suffers from many failed transactions’ costs or other hedging costs off-chain.

• The process of converting token prices into US dollars may strongly affect the evaluation of bots’ profitability. This is because every penny counts when the price error is close to the difference between revenue and cost, which is the profit data we want. Besides, the realizable liquidity of long-tail assets is also a factor to be considered.

We are working on optimizing the calculation of token prices. The results below are based on the latest version of our price index.

From the daily profit distribution, we can see that arbitrage and sandwich bots gain an average profit on most days and have a few lucky days to make a lot of money. For example, on August 1st, the arbitrage bots’ daily profit reached over $4.47 M. On that day, a simple spatial arbitrage contributed 71.6% ($3.20 M). From the daily profit percentage of JIT bots, they seem to make more money than arbitrage bots sometimes.

Both the profit and loss of a single observation are in line with the fat tail distribution. Compared to arbitrage bots’ profitability, sandwich bots and JIT bots follow the same distribution attributes, yet the maximal profit in a single observation they can extract is at least one order of magnitude smaller. From the perspective of the on-chain transactions, MEV bots will also suffer considerable losses in a single action.

Cost of Observations and Miner Extracted Value

For miners to package their transactions timely, MEV bots participate in the gas fee auction market, and the fierce competition drives up the cost of gas fees very high. Institutions such as Flashbots have launched marketplaces for off-chain auctions, and some of these auction costs are converted into miner tips in the form of coinbase.transfer(). These two parts of the cost constitute the main explicit cost for MEV bots to participate in the MEV market. Using it as a percentage of revenue, we can understand the level of profit margins for bots and how much MEV value is being extracted by miners.

The average transaction cost of bots (gas fees and tips to miners) has a downward trend overall. However, the cost of sandwich bots is higher than the other two kinds, and the proportion of revenue allocated to miners has grown significantly, approaching 90% in October.

The proportion of revenue arbitrage bots paying miners has a downward trend, below 50% in October. The percentage of miner extracted value from JIT bots is the lowest, which is consistent with the less competitive situation they are engaging in right now.

In total, more than half of the extracted value actually flows into the miners’ pockets.

Impact on Pools

We can also observe which liquidity pools are more likely to be involved in MEV activities. Let’s break down this issue into feature analysis and correlation analysis tasks. In this report, we present a general result as a first step.

We merge Uniswap V3 pools’ metadata and the parameters of MEV activities grouped by pool address, as shown in the following picture. Since the profitability parameters of arbitrage bot involve both Uniswap V3 pools and other venues, we put that aside and focus on the frequency of bot activity, tthe profitability of sandwich bots and JIT bots, and the situation of the involved swap users.

The results show that over 80% of sandwich bots’ profit comes from the top 10 pools sorted by trading volume. However, only 20% of sandwich activities occur in these pools, which means pools with large trading volumes are easier for sandwich bots to extract value from, but swap users of other pools may still be sandwiched frequently. This fact is also validated by the distribution of the number of unique swap users that suffer from sandwich activity in each pool. A few pools are also not involved in sandwich activities during the time range we observed.

Regarding JIT bots, they seem to be more focused on the top 10 pools sorted by trading volume. While 84% of profit was extracted from these pools, 56% of JIT activities also happened here.

Pools with a fee tier that equals 0.0005 or 0.0001 are more likely to be extracted in terms of arbitrage bots’ average activity frequency in these pools. Pools with fee tier 0.0005 suffer mostly from sandwich activities. JIT activities also happen mostly in pools with a fee tier 0.0005.

We also present the histogram of several parameters grouped by pool address. The result also obeys fat tail distributions, which means a small bunch of pools is involved much more than the average level.

Compared to other venues, Uniswap V3 pools related to crypto assets, USDC, WETH, and USDT, are the hottest pools that MEV bots like to interact with. You can view statistics of hot liquidity pools sorted by trading volume or trading volume change percentage in MEV activities on our website in real time.

Participants

Interaction relationship among MEV bots and other users is also an attractive topic. The following table and figure compare the number of different agent types involved in MEV activities in our observing scope. From the right panel, we see an increasing trend of unique swap user addresses that can benefit from JIT activities.

However, by counting the number of unique bot contracts and involved users’ addresses, it’s hard to comment on how many entities are behind these addresses since different addresses may belong to one entity. A vivid interaction network mapping transaction relationships of these addresses can help understand this question better, which is not covered in this report.

Arbitrage Bot

Arbitrage Bot Leaderboard (Top 20)

The following plots show the top 20 arbitrage contract addresses sorted by total profit and total activity count, respectively. The relationship between total profit and total activity count shows a positive relationship with a ceiling value of profit a bot can maximally extract.

Frequency of Arbitrage Patterns

We can observe the arbitrage transactions’ structure by counting the number of venues involved and the percentage of Uniswap V3 pools involved. The top 10 possible combinations show that spatial arbitrage involving one Uniswap V3 pool and another venue is the most common pattern. The subsequent two common patterns are triangle arbitrage involving one or two Uniswap V3 pools.

Another interesting finding is that there are also many arbitrage opportunities among Uniswap V3 pools alone. A single arbitrage transaction can also involve more than 100 venues (for example)

Arbitrage Bot as a User Itself

Arbitrage bots, as also a kind of swap user of AMM, suffer from taxed token contracts other than severe gas fee campaigns. The following data and graph show that while most profitable arbitrage transactions do not involve the taxed tokens, it does not rule out that some particularly excellent bots can find wealth in taxed tokens. There is a subtle trend that more profitable arbitrage bots are likely to be involved in fewer percentage of taxed tokens.

A Break Down of Profitability

We also put the distribution of profitability parameters below for the reference of interested parties.

Sandwich

Sandwich Bot Leaderboard (Top 20)

The following panels show the top 20 sandwich contracts’ addresses sorted by total profit or total activity frequency respectively. The relationship between total profit and total activity count shows that most profitable bots are more capable of successfully submitting transactions more than 100 times this year.

Swap Users Get Sandwiched

In most cases, there is only one swap user sandwiched in a single sandwich activity. But sometimes, the sandwich bots can front-run up to 4 swap users’ swap transactions in one shot within our observation scope.

From the top 20 sandwich victim data below, the most suffering swap user was involved in over 300 sandwich transactions this year.

Sandwich Activities in Venues

From the top 10 exploited contracts, which can be viewed on our website in real-time, we see that Uniswap pools are mostly involved in sandwich activities compared to other venues. This is partly due to the vast transaction volume of these Uniswap pools, which is an advantage for sandwich bots.

A Break Down of Profitability

We also put the distribution of profitability parameters below for the reference of interested parties.

JIT

JIT Bot Leaderboard (Top 20)

We only observe 6 JIT bots by detecting unique “to address” in JIT bots’ add liquidity transactions. Two of them haven’t gained profit yet.

Swap Users Benefit from JIT

JIT bots can provide a large amount of liquidity to targeted swap users, making it an advantage for them to have smaller slippage loss. From the top 20 beneficiary data below, many swap users are enjoying this new feature frequently. We calibrate the benefit by simulating possible slippage the swap user may bear without JIT bots’ activity in each observation. From the histogram of both simulated slippage and actual slippage as presented below, a clear shift from larger slippage rates to smaller ones can be seen. During the calculation, we also find that there are negative slippage values in a few cases. By checking the reason manually, we find that in some JIT bots’ transactions that add liquidity, they will perform reverse swap transactions for some reason, which brings a more favorable price to the next swap user.

From a list of top 20 beneficiary below, we see quite a few swap users are already enjoying this new feature frequently.

A Break Down of Profitability

We also put the distribution of profitability parameters below for the reference of interested parties.

Conclusion

From the above analysis, we can see that robots have become an integral part of the AMM community that cannot be ignored. Understanding the transaction relationship between MEV bots and other entities can help stakeholders better understand the long-term impact of MEV on AMM.

In this report, we characterize the above relationship from different perspectives and draw some interesting conclusions based on a solid data source and data analysis:

• Revenue — From the scale of revenue extracted by bots, we see that arbitrage bots have extracted at least $85 M from market price asymmetry involving Uniswap V3 pools. Sandwich bots have extracted at least $47 M from swap users in the form of slippage loss. JIT bots have extracted $6 M from Uniswap V3’s swap fee revenue. The total revenue of bots accounts for 25% of LP’s revenue. However, there are no apparent interest conflicts between arbitrage bot, sandwich bot, and LPs. Their revenues are more likely to fluctuate following the market in recent months. The monthly revenue of the JIT bots is one order of magnitude smaller than that of the other two types and has not yet shown a clear trend.

• Frequency — Arbitrage bots are more likely to find trading opportunities compared to other bots. A significant increase in arbitrage bots’ activities can be seen starting from May this year, whereas the observation frequency of sandwich bots remained stable. Trading opportunities are positively correlated to the intensity of market price fluctuations. JIT bot is seeing an increasing trend of trading opportunities in recent months.

• Profitability — MEV bots gain an average profit on most days and have a few lucky days to make a lot of money. Both the profit and loss of a single observation are in line with the fat tail distribution. The maximum profit sandwich bots can get is one order of magnitude smaller than that of arbitrage bots, due to fewer trading opportunities, more cost, and more fierce competition between bots. JIT bot is still in the early stage.

• Cost — The average transaction cost of bots has had a downward trend in recent months. The cost of sandwich bots is higher than arbitrage bots, and the proportion of revenue allocated to miners has grown significantly, approaching 90% in October, compared to a downward trend reducing below 30% in terms of arbitrage bots. In total, more than half of the extracted value flows into the miners’ pockets.

• Pools — Over 80% of sandwich bots’ profit comes from the top 10 pools sorted by trading volume. However, only 20% of sandwich activities occur in these pools. A few pools are also not involved in sandwich activities during the time range we observed. JIT bots seem to be more focused on the top 10 pools sorted by trading volume with 84% of profit being extracted from these pools and 56% of JIT activities also happening here. Pools with a fee tier that equals 0.0005 or 0.0001 are more likely to be extracted by arbitrage bots. Pools with fee tier 0.0005 suffers mostly from sandwich activities and JIT activities. The fat tail distribution of parameters grouped by the pool also shows that a few pools are involved much more than the average level.

• Participants — There seems to be an increasing trend of unique swap users that can benefit from JIT activities. The slippage data from both actual swap transactions and simulation also validates this point. There are other protocols also offering strategic liquidity providing bot services to LPs who are seeking more yield. Their strategies mainly allocate liquidity in a narrow range and adjust the tick intervals to track market price based on quantitative indicators such as Bollinger Bands. Compared to these kinds of strategies, JIT bots are trying to solve the same problem in an innovative and more capital-efficient way. It is worth considering for related parties such as AMM protocol designers to directly provide similar features, which can connect swap users and LPs in a new way while improving user experience and enhancing LPs’ revenue.

• Bots — We also list the top 20 bot contract addresses sorted by total profit and activity count, respectively. The relationship between total profit and total activity count shows a positive correlation with a ceiling value of profit a bot can maximally extract. Regarding how arbitrage bots treat taxed tokens, most profitable arbitrage transactions do not involve the taxed tokens. But it does not rule out that there are some particularly excellent bots that can find wealth in taxed tokens. In most cases, there is only one swap user sandwiched in a single sandwich activity. But in some cases, the sandwich bots can front-run up to 4 swap users’ swap transactions in one shot within our observation scope. The most suffering swap user was involved in over 300 sandwich transactions this year.

• Transaction Pattern — Through observing the arbitrage transactions’ structure, we find that spatial arbitrage involving one Uniswap V3 pool and another venue is the most common pattern. The following two common patterns are triangle arbitrage involving one or two Uniswap V3 pools. There are also many arbitrage opportunities among Uniswap V3 pools alone. And a single arbitrage transaction involving more than 100 venues can also make a profit.

Methodology

Data Source

The above analysis is based on the raw block data fetched from the full Ethereum node we built. The data range covered is from block number 13916166 (include) to 15871479 (include). We decode the raw data to get the fine-grained data field we need.

To compare certain parameters with the overall market situation and Uniswap V3’s macroscopic parameters, we adopted data from third parties as listed below:

1. ETH’s historical close price from coinmarketcap. https://coinmarketcap.com/currencies/ethereum/historical-data/

2. Uniswap V3’s daily meta data from dune@messari / Messari: Uniswap Macro Financial Statements. https://dune.com/messari/Messari:-Uniswap-Macro-Financial-Statements

3. Uniswap V3’s meta data from https://www.uniswap.shippooor.xyz/. （Chain: Ethereum, Dataset: Pools）

How Do We Identify Bots?

• We consider a transaction to be a collection of asset transfers, and we use a set of rules to see if an MEV activity has happened by assessing the outcomes of these transfers. The rule of thumb is that there is more than one transfer (or swap) in the transaction, and the trader ends up with a surplus.

• To identify different types of MEV activity, we collect observations obeying our heuristic rules for each type in the current stage, and we continue enhancing our algorithms according to false negative or false positive detected by comparing the sample results with those from MEV-inspect each day.

• In this report, we identified three types of MEV activity with Uniswap V3 pools involved. The total number of Uniswap V3 pool addresses we covered is 8837, including those from failed factory transactions, as compared to 8767 pools listed in the third-party data sources. The total number of arbitrage, sandwich, and JIT observations is 663889, 90291, and 13020 respectively.

How Do We Calculate Profit and Cost?

• We are constantly optimizing our price index algorithm. At present, we directly equate USDT, USDC, and DAI to 1 USD. For mainstream assets with relatively good liquidity (ETH, WETH, WBTC), the AMM and on-chain oracles can provide a relatively reliable quote source. With these mainstream assets’ prices settled down, we further calculate the prices of other tokens based on the swap ratio at the time of calculation.

• We only consider on-chain costs for each transaction detected. The calculation process is summing up the gas fee and the coinbase.transfer() value (if there is any) of each transaction and converting the result to USD based on the ETH’s price.

Disclaimer

The information contained in this post (the “Information” has been prepared solely for informational purposes, is in summary form, and does not purport to be complete. The Information is not, and is not intended to be, an offer to sell, or a solicitation of an offer to purchase, any securities. The Information does not provide and should not be treated as giving investment advice. The Information does not take into account specific investment objectives, financial situation or the particular needs of any prospective investor. No representation or warranty is made, expressed or implied, with respect to the fairness, correctness, accuracy, reasonableness or completeness of the Information.

We do not undertake to update the Information. It should not be regarded by prospective investors as a substitute for the exercise of their own judgment or research. Prospective investors should consult with their own legal, regulatory, tax, business, investment, financial and accounting advisers to the extent that they deem it necessary, and make any investment decisions based upon their own judgment and advice from such advisers as they deem necessary and not upon any view expressed herein.

*We are open to discussion, please feel free to contact us via contact@eigenphi.com.

Key Takeaways:

• The market’s collapse is caused by the chain reaction of stETH depeg and Celsius’s user asset freezing.

• With $200B evaporated, people need better tools to identify the systematic risks hidden in DeFi.

• An investigative and interactive data platform backed by a consistent and coherent data model framework is essential for the public to scrutinize the potential peril in the market.

For the first time in over a year, crypto’s global market cap dropped below $1 trillion as $200 billion was wiped off.

Last night, on AAVE and Compound, around one thousand borrowers’ assets got liquidated. The total amount reached about $100M, resulting from recent market volatility.

During the last seven days, ETH has dropped over 37%. Meanwhile, over the previous 24 hours, the rate of stETH to ETH had fallen to the lowest point of 0.9268 ETH.

The downward trend has been severe during the last few days, as shown in the charts below captured from Coinmarketcap.com.

The crash set off a chain reaction, pun intended.

Celsius Network, which has over 1.7 million customers and was valued at $3.5 billion last year, managing $11.8B as of May 17, is freezing all withdrawals and transfers. How serious is this? Here is the opinion of Larry Cermak, the VP of Research at The Block.

At the moment of this writing, according to Larry Cermak, the top 15 wallet addresses owned by Celsius still have over $1.55 billion in different assets, among which 74% of all $wBTC on Maker is in Celsius’s Maker vault, according to @TheDeFiDan. Celsius added more BTC as collateral to avoid being liquidated, which is $544.4M in total, lowering their liquidation price of wBTC to $16,852.

According to aQua, before the top-up, once the price of BTC reaches its 200WMA (Weighted Moving Average), which is $22.4K, the liquidation mechanism would be triggered for Celsius and many other borrowing protocols, which would further worsen the market crash, cascading into another round, or the worst-case scenario, rounds of rounds liquidations, as the result of the chain reaction.

Now that Celsius has some room to breathe, the crypto world in general as well, but not for the thousands of borrowers whose over-$113M assets got liquidated during the last 24 hours. Especially last night, at 20:46:34 EST, the price of BTC was $22,325.2, lower than its 200WMA.

How to Address the Volatility?

The most ironic part is that this systematic risk presenting itself in front of us is precisely what drove people to build DeFi to avoid. Yet here we go again. Celsius, as one of the biggest CeFi in the DeFi world, has been in the eye of the brooding storm, which gives rise to some philosophical-level of questions:

• Do the profit-seeking and risk-avoiding essences of (certain) human beings naturally breed centralized institutions like Celsius, which eventually thwart the utopia of decentralization?

• Or is this just a big speed bump reminding us to be careful while we are still driving in the right direction?

WE the BUIDLERS are glass-half-full people. Otherwise, we would not reach where we are now. I would assume, therefore, that you, as I am, have a strong belief in the future and regard the current predicament as a problem we can and are going to solve.

Part of the problem is data fragmentation. Assets flow freely across protocols, not the data among different protocols with varied dimensions. As a result, a daily trader has no capable tools with proper methodologies to integrate all the information. Whatsmore, most of the current presentation of the data provides no interaction for users to carry out an exploratory analysis. As a result, most of the existing data tools are insufficient for investors to make informed decisions.

To facilitate users making well-informed choices, in April, we released the Liquidation module showing the comprehensive data and detailed asset flows of the liquidation transaction. Behind the scene is our consistent and coherent data analysis framework combining structural, behavioral, and network analysis.

Let’s walk through our liquidation data of yesterday to reveal what’s been happening during the Night of Liquidation, hopefully, the last, not the first in the foreseen future.

An Inspection of the Night

Around 22:00, we noticed the abnormality in our Liquidation module. By then the summary of the 1-day data showed the amount as $100M. When we sent out the first tweet to notify our Twitter audience at 22:10, the amount grew to $125M. $25M in 2 minutes.

The number kept climbing in the next hour and finally died down after 23:00. At 23:10 EST, it was stable around $165M.

What were the biggest liquidations?

Here are the top 10 largest liquidations of last night, ranging from $3M to $5.2M. All the liquidated assets are WETH, and 9 out of 10 happened on Compound.

How many assets were liquidated regarding different protocols?

The majority of last night’s deal occurred on AAVE v2: over $87M. Almost $68.4M was on Compound. And $1M shy was done on AAVE v1.

What about assets?

Here are the top ones: $120M WETH, $40M WBTC, over $3M stETH, and over $1.35M LINK.

Who’s the top liquidator of the night?

This is the top dog that liquidated nearly $69M and reaped about $850K on 320 transactions from 257 borrowers. Its footprints covered both AAVE v2 and Compound and spread among 11 assets.

You can also examine its transaction distribution on the page, showing here how many liquidations are distributed in which profit range.

What about its cost? The gas price chart would give some idea.

Which is the most profitable liquidation?

According to the profit leaderboard below, it was done by the top dog, who earned a profit of $368K under the cost of $67. The 2nd belonged to it as well.

Wonder how the most successful one gets done?

Click the row, and you can inspect the detail, including debt asset and its amount and the asset flow in the chart. We can tell that the liquidator repaid the debt with over $4.9M worth of USDT and received over 244K cETH as a return.

The profit leaderboard above also displays the top 10 liquidators, whom you can examine one by one, and the top liquidated borrowers regarding liquidation amount.

All these data cover the big picture of the liquidation market, the performance of different protocols, the liquidator details, and the liquidation asset transfers. In addition, different levels of data are integrated to leverage users to conduct exploratory analysis on the eventful night with interactive approaches.

How to Help the 1 Billion User?

The collapse is not the first time and definitely won’t be the last time. Even with all the backlashes, the user base of Bitcoin is still predicted to have 1 billion users by 2030.

How can we help this 1 billion crowd? First, the industry needs to provide capable tools for the community to enable them not only to identify the systematic risks but also to discover potential sustainable investments. Failing to do so would drown users in myriad types, quantities, and dimensions of data and keep them trapped forever in the dark forest of DeFi before they swear off cryptos.

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi Official Twitter

• EigenPhi MEV Alert Twitter

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

Key Takeaways:

● Flash Loan is the sharpest double-edged sword in the DeFi world.

● To suppress its ugly side, the public has to obtain a clear view of its transactions and connections with other DeFi businesses, which was harder to achieve because of the data gaps between protocols.

● EigenPhi’s Flash Loan module bridges the data gaps and reveals the behaviors of Flash Loan stakeholders.

April 30, 2022, Saddle Finance, $11M.

April 30, 2022, Fei Rari, $80M.

April 28, 2022, Deus Finance, $13.4M.

April 17, 2022, Beanstalk, $182M, the largest yet of its type.

April 13, 2022, ELEPHANT MONEY, $22.2M.

Causing a total loss of $308.6M in April alone, all of these attacks on DeFi protocols have the same MO.

According to Wall Street Journal, the attack on Beanstalk had a unique advantage.

A $1 billion loan was taken out with no collateral, no proof of income, and no identity verification. The loan had to be repaid in less than a second, but that was all that was needed to steal tens of millions of dollars.

Yep, it’s Flash Loan–a cheap, instant, and anonymous form of financing based on cryptocurrencies–that induces such humongous damages.

The biggest capital source for Flash Loan, AAVE suggested its purpose is to build “a more resilient ecosystem with liquidations”:

By removing the need to hold any capital, we aim to democratize the liquidation market and enable faster and easier liquidations. The safety of the whole ecosystem will be better and the risk of “bad debts” much lower.

Upon seeing the ugly of Flash Loan and being told the good heart behind it, how can we find out what a badass it is to prevent the later malicious intentions? We need to cross data gaps between different protocols to achieve this goal. These gaps have hindered DeFi users from recognizing risks and obstructing the market from generating and broadcasting effective signals.

Welcome to the Flash Loan module released by EigenPhi, which is built on a coherent and unified data model to help you bridge the data gaps by integrating multi-dimensional information.

Let’s dive in.

Unveil The Big Picture

First, you can read the trends in the chosen timeframe, 1 day, 7 days, or 30 days. We will use 7 days as the context for the stuff below.

The Summary section tells you that 244 Flash Loans have occurred during the last 7 days. We also show how many transactions embed these Flash Loans. Sometimes, a transaction can have more than one Flash Loan.

The total amount of the 244 Flash Loans and the fees required to implement these loans can be found here too, which involves 29 borrowers and 10 assets.

The following chart illustrates the trend of the last 7 days, indicating the daily loan amount split by Aave v2 and dYdX. The bar on Jun 1 tells us that 65 Flash Loans happened that day, over $12M on Aave V2 and almost $2.876M on dYdX. And the lowest data point happened on Jun 4.

You can switch the time window to 30 days to get the bigger picture.

May 12, the day UST depegged and LUNA crashed, is the day with the highest Flash Loan amounts and frequency.

Uncover The Hidden Behaviors with Interactive Exploratory Analysis

Let’s switch back to 7 days and check the top Flash Loans.

Some essential information regarding the transaction is shown here, including time, purpose, amount, fee, transaction address, borrower address, loaned asset, and protocol used for the loan.

The most important field here is, of course, Purpose. According to the founder of AAVE, you can leverage Flash Loan in use cases like:

● Arbitrage

● Collateral swaps

● Interest rate and currency swaps

● Self Liquidation

● Leverage aggregator

Usually, the purpose we listed can be attributed to these cases, and we connect the data here with Arbitrage Scan to draw a more in-depth image.

Take this Flash Loan, for example.

Its purpose is spatial arbitrage. Click the row, and you will be directed to the arbitrage transaction detail page, which reveals that the same contract ends with 7475 used the loaned $USDC to buy $DAI from UNISWAP, swapped them with $USDC on CURVE-FI, and earned almost $10K eventually as profit.

In essence, our Flash Loan module integrates the fragmented data and uncovers the cloaked behaviors.

We also broadcast such behaviors to the public like this tweet alert.

Following the Top Flash Loan section is the Latest Flash Loan part. This is the real-time Flash Loan happening on Ethereum now. And you can navigate to the pages you are interested in to find out more.

Several DeFi protocols are supporting Flash Loan on the market. EigenPhi covers the two mainly used ones for now. We show you the amount, fees, Flash Loan count, transactions count, the protocol’s borrowers, and the assets it provides.

These features regarding Flash Loan are just the beginning. In the incoming days, you will be able to examine a protocol’s details, such as the top 10 assets, top destinations, etc., with the same level of data and information interaction and connectivity, all of which can benefit your wise investment decisions.

Stay tuned!

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi Official Twitter

• EigenPhi MEV Alert Twitter

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

Even in a bearish mood, the DeFi market still has been welcoming new yield farming protocols every day. With new protocols come new capitals; with new capitals derive new volatility.

The following chart illustrates the last 7 days’ arbitrage performance expressed in trading profit.

To everyday traders, the profit of arbitrages is not as substantial as trading volumes because we care less about how much money searchers made than how much money they targeted.

Moreover, when you split the last 7 days’ trading volume by type, the following chart unveils the unknown danger we face during each and every token swap.

The danger is in the purple part of the chart: Sandwich arbitrage, the most cloaked, shady, and damaging MEV thing in the DeFi world. And they are effectively out of the public eye without constant monitoring and exposure.

According to the volume chart, Sandwich arbitrage has taken up the majority of Ethereum arbitrages, which means it’s highly likely that your token swap is in the scope of sandwich searchers without any protection.

In this article, we will examine what Sandwich arbitrage is, how it impacts the market, and how to be equipped to protect yourself.

Sandwich module

Since the beginning, EigenPhi has been devoting itself to building a healthier and more robust DeFi ecosystem. In EigenPhi Classroom, you can read our explanation of the mechanism of Sandwich arbitrage. We also showed you our approach to identifying a Sandwich arbitrage.

Moreover, we released the Sandwich module, providing a systematic analysis of Sandwich arbitrage. Here are the features of this module.

• Summary displays some key metrics of the sandwich arbitrage market, including transaction count, total profit, total cost, number of attackers, and number of victims.

• Top Ten Exploited Contracts demonstrates the top 10 protocol contracts attacked by Sandwich arbitrage in percentage, ranked by numbers of Sandwich arbitrage. According to the chart above, Uniswap V3, 1inch v4, and even the Metamask’s router are all exploited by Sandwich arbitrage.

• Profit Leaderboard lists the top 10 sandwich arbitrages ranked by profit in the chosen time duration. You can also sort them using profit, cost, and revenue. Click the address, and then you can examine the details of the arbitrage.

• Attacker Leaderboard shows the top 10 sandwich arbitrage contracts ranked by the total profits through sandwich attacks during the chosen time frame.

• Victim Leaderboard lists the top 10 sandwich arbitrage victims ranked by loss. Click the victim address, and then you can find out the detail of it, including the top attackers and the attacking history chart.

• Real-time Attack is a real-time sandwich arbitrage trading view with profit, cost, and revenue. Click the arbitrage hash address to examine the token flow of the sandwich attack.

We also used the data to generate the Sandwich arbitrage Daily Report to give you an overview of the attack and its specifics on a day-to-day basis. Please read this article to find out the daily impact of Sandwich arbitrage on the market.

Have I Been A Victim of Sandwich Attack?

If you have been a crypto player for a while, you might be interested in finding out if you have been attacked. We released this little kit to help you check.

Put your wallet address in the search box, and you will be able to find out.

Whether or not you are a victim, it’s critical to use protection, like wrapping up your deal. Luckily, the open-source project Flash Bots provides a “Flashbots Protect” tool to protect your transaction from Sandwich arbitrage. All you need to do is some simple Metamask configuration. Please read their quick start for details.

To conclude, if you want to share with your friends about the Sandwich attack, here are the things you could recommend.

• EigenPhi Classroom’s explanation on Sandwich.

• How do we recognize Sandwich?

• EigenPhi’s Sandwich module.

• Our ​​Sandwich arbitrage daily report.

• Our Sandwich victim history checker.

If there is more information you’d like to find out about Sandwich arbitrage, please leave your comment. You can also contact us via the channel below.

Stay Away From Sandwich Arbitrage and Stay Safe!

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi Official Twitter

• EigenPhi MEV Alert Twitter

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

Sandwich arbitrages are the most cloaked, shady, and damaging MEV thing in the DeFi world. Sandwich arbitrages are effectively out of the public eye without constant monitoring and exposure.

Take this victim transaction, for example. The trader had wanted to swap 2.115 million USDT for USDC. However, the attackers detected the deal and mobilized over $8.4 million worth of WETH and DAI for the Sandwich arbitrage. In the end, the attackers’ cost of the arbitrage was USD 2,463 worth of gas fees and reaped $48,692 worth of WETH as a profit.

MEVs with MO like these are happening every minute in DeFi. To raise awareness, EigenPhi released the Sandwich arbitrage module to unveil the Sandwich arbitrage on Ethereum from head to toe, including summaries, leaderboard, attacker and victim details, and real-time attacks. Furthermore, we produce a little tool to help you check if you have been sandwiched. And here is the methodology of how we recognize Sandwich arbitrage.

Now we introduce the latest approach to mitigating the risk of Sandwich arbitrage: Sandwich Arbitrages Daily Report by EigenPhi.

Sandwich Arbitrage Trends of Last 24 Hours and 7 Days

Like our Arbitrage Daily Reports, the Sandwich Daily report is generated automatically from the Ethereum on-chain data between 7 AM EST yesterday and 7 AM EST today.

Let’s open today’s report.

The first chart of the report shows the trend for the last 24 hrs.

The stacked columns of each hour indicate the subtotal revenue of arbitrages that happened during the period, split into profit, the blue bar, and cost, the red bar. And the orange line depicts how many Sandwich arbitrages happened as the right axis measured them.

We can tell that from 14:00 to 15:00 was the hungriest time for Sandwich searchers.

Of course, you can read the exact number of the indicator when you move the cursor to the column and the line.

The following chart displays the trend of the last seven days with the same logic, except for the horizontal axis showing the seven dates.

What’s the change from yesterday compared to the day before? The following table gives you the answer. It contains the total count, attackers’ EOA count, victims’ EOA count, total profit/cost/revenue, total ROI, and the same data regarding arbitrages with profit over 1K USD, and MEV-BOT, all of which let you know the changing rate regarding yesterday’s report.

The data in the table beneath tells us that the overall profit increased 77.7% compared to yesterday. We also read that most of the gain was from Profit >1K USD arbitrages, whose profit is $179,976, increased 96.2%, which eventually resulted in the ROI of this category reaching 594.7%.

What Were the Sandwich Searchers Capable of Yesterday?

The three charts illustrate the overall Sandwich arbitrage capabilities in the market using percentile distribution metics.

It might be a bit confusing at first look. So let’s start with the table below to understand the concept:

The table shows that the lowest 50% of transactions’ profit is mostly less than 2.66 USD; the 90% of transactions’ profit is mostly less than 92.91 USD; about 95% is less than 222.88 USD, and the highest profit is 33,074.98 USD.

Here is the table that exhibits the Total Sandwich Arbitrage Profit/Cost/Revenue Distribution:

The first three rows of the table should now be more apparent. However, it’s important to remember that the same column’s data in no way belongs to the same transaction.

We calculate the profit, cost, revenue, and ROI distribution rankings separately. For example, a transaction’s cost is $42, ranking 50th. But its profit could be $20, more than the 50th profit, $1, and less than the 90th profit, $43, and vice versa.

The ROI in the fourth row is also calculated independent of the data in the same column. It also shows the overall ROI distribution. So, therefore, the best ROI is 139897.7%, and the 95th one is 274.0%, etc.

With the knowledge of the data in the table, let’s examine the chart again.

In order to make the data more understandable, the chart’s vertical axis is scaled in logarithms.

The first one exhibits the profit percentile distribution of the overall Sandwich arbitrages V.S. profit>1K USD arbitrages V.S. MEV-Bot arbitrages marked on Etherescan.

It shows that at the 50th percentile, profit>$1K transactions’ profit is more than that of Total and MEV-Bot, which is obvious. And at the 90th and 95th percentile, the profit of Total and MEV-Bot are about the same, more or less around $100, which we call tell from the data in the tables below:

In terms of the profit at the 100th, The Total’s line meets the Profit>$1K’s line, because the most significant gain is from the Profit>$1K‘s category.

It wouldn’t take too much time to figure out that eventually, in all three charts, at least two lines will meet at the 100th percentile, one of which belongs to the Total category.

We can also read that the line of Profit>$1K is above the another 2, which generally means the profit of this category is more than the other 2.

Now we can move on to the cost distribution chart.

The costs of Total and MEV-Bot at different percentiles are close, which both are less than that of Profit>$1K. And of the two, MEV-Bot usually spent a bit more money than other searchers of Total.

Regarding revenue distribution, the highest revenue came from the Profit>$1K category, not the MEV-Bot one.

Remember that the same percentile’s data does not necessarily belong to the same transaction, except for the 100th one.

The first three rows of the table should now be more apparent. However, it’s important to remember that the same column’s data in no way belongs to the same transaction.

The following three tables show the data in the distribution chart in a different dimension: a summary of profit, cost, revenue, and ROI of a specific category.

The 5 Most Delicious Sandwiches

After the distribution comparison charts and tables, the following table displays the top 5 most profitable Sandwich arbitrages. Tokens involved in the arbitrage are in one column. Clicking the hash addresses of the arbitrage will lead you to the contract detail page, showing different arbitrage types’ performance, profit leaderboard, favorite pools, tokens, and profit distribution.

Watch Out When Using These Protocols and Routers!

The following section is the Top 10 Exploited Contracts by arbitrage count.

We analyzed all the on-chain transactions and summarized the chart and table. Most contracts here are the routers and proxies of different protocols. Traders use these to implement their swaps which get sandwiched unconsciously. If you want to trade with a considerable amount, this chart will help you decide which DEX and protocol are most likely being exploited.

The table displays the percentage of router or protocol accounted for regarding arbitrage count. How many Sandwich arbitrages have happened during the last 24hrs is shown here, too, as the subtotal profit and cost of these arbitrages.

Top Attackers and Victims

Following are the top 3 attackers and victims of the timeframe. The attacker table shows how many arbitrages the attacker had done and related amounts. The victim table examines the loss of the victim and the times of being attacked. All the addresses in both tables will take you to the details of either the attacker or victim.

#DYOR on 🥪

That’s it for the Sandwich Arbitrages Daily Report. However, if you want to do more analysis like this, you can download the historical data of the Ethereum Sandwich Arbitrage Daily Report, starting from Jan 2nd, 2022. You can find the download link at the start and the end of every day’s report.

If you think we are missing some data you need, please feel free to leave your comment or contact us via the channels below. Any feedback is highly encouraged and welcomed!!

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi Official Twitter

• EigenPhi MEV Alert Twitter

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

According to Bloomberg, the increase in crypto adoption globally in the past 12 months reached 881%, all of which can be traced back to the dawn of a new world of finance — DeFi, born in 2020. It’s fundamentally different from the traditional financial world, which is under intense regulation to guarantee the fidelity and authenticity of the data and the underlying assets. However, failing to do so by the incumbent institutions became the midwife of Bitcoin and, eventually, DeFi. And people are embracing it as the alternative to the disappointing conventional system.

Since its birth, openness and accessibility have been the hallmark of DeFi to keep the conventional rigged mechanisms at arm’s length. As a result, assets and products have been issued arbitrarily, resulting in the exponential growth of the data. CNBC reported that, in 2021, the total crypto trade volume is $15.8 trillion, and DeFi transaction volume grew 912%.

With hope comes chaos. Being lack of regulation on the ever-increasing data gives rise to fraud and forgery. Also, in 2021, crypto scammers took a record of $14 billion, among which Cryptocurrency theft managed $3.2 billion, which rose 516% from 2020, scams climbed 82% to reach $7.8 billion, and rug-pull fraud scored $2.8 billion.

Besides security concerns, when prepping for the trading, investors frequently need to answer questions like:

• Where are the alpha opportunities?

• What is the expected ROI?

• Which suspicious assets, vaults, and contracts do I have to avoid?

During the trading, investors are interested in:

• When is the best time to begin?

• How to implement a successful strategy?

• How much is the reasonable cost to trade without spending too much?

• How to avoid being the victim of front-running?

• When to stop?

All these questions need accurate information with precision extracted from the colossal volume of data.

2 Biggest Concerns That Haven’t Been Properly Addressed

Facing the problems caused by data and information overloading, DeFi’s new world urgently needs new methodologies to dynamically parse the market message, warning, and alert in real-time. At the current phase, two aspects are the biggest concern.

1. to discern the veritable liquidity data;

2. to identify the malicious intention;

both of which require active and brisk actions, which is an ongoing process.

The existing products exhibit shortcomings that impede a cohesive solution, including:

• Being short of consistency on statistics.

• Lacking bona fide liquidity data.

• Missing network analysis, which is essential to unveil the connections among multiple transaction structures.

• Missing holistic risk evaluation, which is required to dissect the cross-protocol liquidity.

In EigenPhi’s view, the reason these products fail to deliver is a lack of an in-depth understanding of DeFi’s transaction structures, which should be the foundation of all DeFi data processing.

3 Pillars of DeFi: Structure, Behavior, and Network

As we mentioned in the last post, structures, behaviors, and networks are the invisible pillars of the DeFi that you have to figure out if you want to be a conqueror of the new world.

As the pioneer of the new generation of DeFi data analysis platforms, EigenPhi adopts methodologies focusing on starting from a thorough inspection of transaction structures formed by Smart Contracts.

First, we meticulously dissect and present the asset transfer mechanisms among liquidity pools, EOAs, and protocols in an easy-to-understand manner. Then, based on this solid premise, EigenPhi proceeds with behavior and network analysis to enable you to price the liquidity and recognize the risks, eventually taking in not only the story behind the curtain but also profits and gains from their assets.

It’s a challenging path to take, but an essential one that EigenPhi has been working on since the beginning. And we are the only team in the market capable of managing to get it done.

The EigenPhi Way

To be more specific, EigenPhi provides innovative approaches to accomplish:

• In-transaction and between-transactions structure analysis, simplifying and unveiling the complicated transaction details like cost and profit for investors to understand.

• Behavior analysis, uncovering hidden information entropy by using automatic and productive computing methods.

• Network analysis, unmasking the concealed connections and intentions among entities appearing as patterns.

• Complete data analysis, including on-chain, cross-chain, addresses, tokens, and transaction behaviors.

• All the above can be mathematically and statistically verified.

EigenPhi’s talented engineering team has in-depth industry backgrounds both in cryptocurrency and TradFi. We provide data products in a productive, responsive, and reliable way.

Why MEV & Arbitrage?

To tackle it head-on with MEV, the gravest crisis of DeFi is facing at the moment; EigenPhi chose MEV-related data, which encompasses the most accurate and authentic data regarding DeFi liquidity.

MEV transactions are the most complicated and most concerning transactions of DeFi. Unfortunately, few handy tools on the market can examine the massive capital invested into MEV closely. Based on our data, there are five asset transfers in one MEV transaction on average.

By targeting MEV, EigenPhi looks to enhance the efficiency of the market and build a healthier and more robust DeFi ecosystem.

Presently, EigenPhi provides Arbitrage Scan to help dissect the structure of transactions.

• It helps users to understand how arbitrage strategy works in terms of asset transfer.

• It illustrates opportunities for searchers to take advantage of arbitrages that benefit market productivity, such as Spatial, Triangular, Combination, and Liquidation.

• It exposes nasty arbitrages like Sandwich to raise awareness in the community.

Ultimately, EigenPhi empowers users with information apparatus to explore the new DeFi world.

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi Official Twitter

• EigenPhi MEV Alert Twitter

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

We have explained in our last post how we identify atomic arbitrages like Spatial, Triangular, and Combination. This time, we will lead you through our methodology regarding Sandwich arbitrage.

You might want to first review some of the core concepts, such as CombinedTransferTable and Trade, for a better understanding.

The cross-transaction structural analysis is an extension of the intra-transaction analysis approach.

A Sandwich arbitrage has characters as below.

• In the same Block, the Attacker’s Transactions contain a Start Transaction, an End Transaction, and one or more Victim Transactions in between.

• The combination of Attacker and Victim needs to satisfy an essential condition: the From Address is not the same.

The pattern of Sandwich has the combination of (Attacker Start Transaction, Victim Transaction, and Attacker End Transaction). The CombinedTransferTable of each transaction contains the same Address processing the Trade. Combining the Attacker’s Start Transaction and End Transaction, we get the CombinedTransferTable of this arbitrage having the final net surplus.

Let’s look at this one.

Transaction list on BlockNumber: 14762460

Attacker Start Transaction CombinedTransferTable

The Attacker bought WETH at the following price: 1996 USDT.

Victim Transaction CombinedTransferTable

The Victim bought WETH at the following price: 2031.8 USDT.

Attacker End Transaction CombinedTransferTable

The Attacker sold WETH at the following price: 2005.4 USDT, higher than the buying price.

Signal for Arbitrage Recognition

All three transactions had Trade happened on Address: Uniswap V2: USDT 0x0d4…f1852.

Attacker’s Final Net Profit

Attacker’s Start / End Transaction Combined:

In this Sandwich arbitrage, Attacker MEV Bot: 0x000…e7D’s revenue was 2920.4 USDT before deducting costs like gas fees.

That’s it. Next time, we will discuss why you should find out the transaction structures on DeFi. To put it simply: understanding the underlying structures of DeFi MEV transactions is essential to navigate through the maze built on Smart Contract and establish the new frontier for the new world of DeFi.

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi Official Twitter

• EigenPhi MEV Alert Twitter

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

Unlike the traditional Internet, which comprises web pages and hyperlinks, DeFi is built upon Smart Contracts and their complex transaction interactions and structures. The interplays between Smart Contracts, DeFi assets, and their callers are so diverse and flexible that they are impossible to decipher without a powerful tool, let alone decode the hidden market signal.

For example, consider the Cream Finance Flash Loan attack from last year. There were 29 tokens, 30 liquidity pools, 5 protocols, and 75 transfers involved. These transactional elements formed the behaviors, which in turn established the networks.

Structures, behaviors, and networks are the invisible pillars of the DeFi that you have to figure out if you want to be a conqueror of the new world.

As the pioneer of the new generation of DeFi data analysis platforms, EigenPhi adopts methodologies focusing on starting from a thorough inspection of transaction structures formed by Smart Contracts.

With the rigorous dissection and simplified presentation of the asset transfers among liquidity pools, EOAs, and protocols in an easy-to-understand way, EigenPhi’s behavior and network analysis have a solid premise to help users with means of pricing the liquidity and recognizing the risks, eventually being able to take in not only the story behind the curtain but also profits and gains from their assets.

It’s a challenging path to take, but an essential one that EigenPhi has been working on since the beginning. And we are the only team in the market capable of managing to get it done.

Here is the EigenPhi way of dissecting transaction structures in a nutshell.

Recognizing Atomic Arbitrage Transactions

Given that a transaction can be arbitrarily complex and can have an endless number of unknown transaction patterns, the approach of using specific transaction pattern matching cannot cope with new arbitrage patterns. To determine whether arbitrage occurs in a transaction, we need a universal abstraction for transactions.

Here are the principles we set up for the recognition.

We consider a transaction to be a collection of asset transfers, and we use a set of rules to see if an arbitrage has happened by assessing the outcomes of these transfers. The rule of thumb is that there is more than one transfer (or swap) in the transaction, and the trader ends up with a surplus.

Abstract Approach

A Transaction can be abstracted into the following behaviors: Transfer, Trade, and their combinations. TransferTable is generated by merging the Transfers into a single table called Transfer Table. Then we merge the rows with the same address in the TransferTable to get CombinedTransferTable.

Implementation

Asset

• ETH or ERC20 Token

Transfer method

We use it to describe a flow of Assets between two addresses in a transaction.

• Transfer :: (From Address, To Address, Asset, Amount)

• Meaning: transfer Asset from one Address to another Address。

TransferTable

• makeTransferTable :: [Transfer] -> TransferTable

We use it to describe the** process** of the multiple Assets flows happening between all the involved Addresses in one transaction.

• The columns of TransferTable are the assets.

• Each row of the TransferTable indicates that an Asset of an Address has changed, with a positive value indicating an increase and a negative value indicating a decrease.

• A Transfer corresponds to two rows in the TransferTable: one for the from Address, which corresponds to a negative Asset value, indicating an outflow of Asset, and one for the to Address, which corresponds to a positive Asset value, indicating an inflow of assets.

CombinedTransferTable

We use it to describe the** final outcome** of the multiple Assets flows happening between all the involved Addresses in one transaction.

We merge the rows with the same Address in the TransferTable and add all the Asset values, generating the CombinedTransferTable.

• makeCombinedTransferTable :: TransferTable -> CombinedTransferTable

Trade

An Address is said to have made a Trade when it ends up with changes in assets after a Trade, where there is a decrease in an Asset AND an increase in another Asset.

Rules for Arbitrage Recognition

Arbitrage is considered to have occurred when the following conditions are met after a Trade.

• An arbitrage trader has made more than one Trade at another Address.

• Each Asset involved in the Trades has experienced inflows and outflows in the respective Trade.

• The trader’s net surplus is positive

Example

A typical Triangular arbitrage identified by EigenPhi

• Transaction page on EigenPhi

• Transaction page on EtherScan

The transfers list:

The TransferTable of the transaction:

The resulted CombinedTransferTable:

The Judgment

• According to the CombinedTransferTable, we can tell that–SushiSwap USDC 0x397, SushiSwap USDT 0x06d, and Uniswap V3 USDC-USDT 0x785–this three Addresses have engaged in the Trades.

• The 3 Trades involve USDC, WETH, and USDT, and the columns of each asset have both positive and negative values.

• MEV-Bot 0x80d has no Trade and its net surplus is positive.

Therefore, we identify this transaction as an arbitrage.

OK then, we’ve walked you through EigenPhi’s methodology of identifying atomic arbitrages. In the next post, let’s take a look at how to recognize a Sandwich arbitrage.

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

The past few days have been crazy. Retail investors like you and I are eager to transfer our assets somewhere safe. While in a hurry, we might have set our transaction slippage too high, which eventually made us the victim of Sandwich arbitrages without even knowing it.

The data proves the Sandwich arbitrages’ increasing trend. Take a look at the three charts below.

The first shows the last seven days of Sandwich arbitrages’ cost, profit, revenue, and arbitrage count on Ethereum.

This chart displays the data of Sandwich arbitrages with over $1K profits during the last seven days.

The last illustrates the Sandwich arbitrages done by MEV-bot.

The last three days’ data are outstanding compared with before, fitting the volatile market condition.

In that case, you might want to see if you have been the victim of any sandwich attacks. Usually, it’s hard to do. Well, not anymore. We just launched a search tool to help you.

Visit https://eigenphi.io/sandwich/search, you will see this page:

Put your wallet address in it:

Seems like you have been lucky. But if you see this:

You might want to open the report page and check where it happened to avoid future attacks.

OK, that’s it. With the market going like a roller-coast, it’s always better safe than sorry. If you think this little search tool is useful, please recommend it to your HODLer fellows. Pretty sure they will appreciate it.

Oh, if you want to do some analysis like the charts above, you can always go download our data in the public Google Sheet and #DYOR.

And remember to join our AMA at 10:30 AM EST this Friday morning!

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

First thing first. We have set up the details of the first AMA(Ask Me Anything) of EigenPhi:

Time: EST 10:30 AM, May 13th, Friday.

Venue: Discord Channel.

Can’t wait to talk to you guys!! And write down in the comment section what you want to hear about us, our products, well, Ask Me Anything!

Let’s move on for a bit of retrospecting.

Yesterday, we showed you our latest EigenPhi Classroom and Arbitrage Scan User Guide. It seems people are excited and curious about our understanding of these MEV ideas and concepts. Here are the top 5 most visited pages in the Classroom:

• Sandwich Arbitrage

• Arbitrage Contract

• Retail Investor

• Malicious Token

• What is Arbitrage

How about the User Guide? The top 5 pages are:

• Home

• Transaction

• Contract

• Spatial arbitrage details

• Arbitrage Contract Profit Leaderboard

Today, let’s look at some of the features and data that would make you feel better and more confident when browsing opportunities.

Dark Theme is Here!

If you want to pull an all-nighter to understand how the alphas have been employing their strategies, a dark theme UI will put your eyes at ease. Now you can do it on https://eigenphi.io/.

If you are using the desktop and laptop, navigate to the upper right corner on any page of our website. Click! You may now easily switch between light and dark modes easy peasy.

If you are using your mobile phone right before bedtime, you can do so in the following ways:

That’s everything! Now you can work around the clock like the crypto market! But we strongly advise against doing so.

Have You Checked Out Our Daily Report Yet?

After absorbing the necessity of everyday morning’s caffeine, you might want to check on what’s happening during the last 24 hours, including when you’re sleeping. That’s why we compile the daily report of arbitrages happening on both Ethereum and BNB Smart Chain.

Let’s take a look at today’s report, of which the time period is from EST 7 am, May 9th to 7 am, May 10th.

The whole report has three sections:

• Ethereum Arbitrage demonstrates the summary of arbitrages happening on Ethereum during the time period.

• Ethereum MEV-bot Arbitrage shows you the overview of arbitrages done by MEV-bot on Ethereum.

• BSC Arbitrage displays the summary of arbitrages happening on BSC during the 24 hrs.

The calculation methodologies behind each section are the same. Therefore, we will use the first one as an example.

The first part of each section has three donut charts illustrating the subtotal of profit, cost, and revenue of the four arbitrage types: Combination, Spatial, Sandwich, and Triangular.

Here is the profit donut chart:

Each part of the donut chart shows the percentage of the type against the total profit. We can tell that the Combination arbitrage transactions’ profit is 6.7% of the total profit, Spatial 34.2%, Sandwich 26.4%, and Triangular 32.6%. How much precisely is Sandwich arbitrages’ profit? Move the cursor to its part of the donut chart, showing $281,879.

The same applies to the Cost vs. Arbitrage Type donut chart and Revenue vs. Arbitrage Type chart.

Below the donut charts, a table shows all the crucial arbitrage data regarding each arbitrage type at once. Each data cell shows the corresponding data and the percentage against yesterday.

Here are the columns and their meanings.

• Type: Arbitrage type

• Profit: Subtotal profit of the type.

• Cost: Subtotal cost of the type.

• Revenue: Subtotal revenue of the type.

• ROI: the return on investment of the type. It results from profit dividing cost.

• 1k Trx Count: The count of this type’s transactions with a profit over 1,000 USD.

• MEV-Bot Trx Count: The count of this type’s transactions done by MEV-bot.

• Trx Count: The count of this type’s transactions happened during the time period.

There are five rows of data in the table, showing four types and the total of the time period.

Take Sandwich’s cost, for example. It is located in the cell on the 2nd row and the 2nd column. And the amount is $869,664; compared to yesterday’s same time frame, it increased by 153.5%.

We can also check the ROI of Combination: 56.5%, which decreased by 6.7% from yesterday.

If you are a searcher looking for opportunities, it’s almost impossible to filter the profitable liquidity pools and token pairs without a proper guide. That’s why we provide Hot Liquidity Pools and Hot Tokens on https://eigenphi.io/. And we selected the top 3 of the Hot LPs and Hot Tokens and put them into the daily report, both on Ethereum and BSC, based on the trading volume change %.

Click either the token symbols or the address. You will be directed to the token details page and liquidity pool pages for more details to benefit your trade, including other pools having the tokens, arbitrage profit leaderboard, etc.

Alpha transaction happens every day. It’s essential to observe how they get it done, like using which pools to transfer what kind of assets. We choose the top 3 most profitable transactions to show how these top dogs play. Maybe we all can learn something from them.

That’s it for the daily reports. We have generated them daily since the beginning of 2022, which you can examine here. There are two ways to follow the latest daily report from us:

• Bookmark this page, and check for the updates after 8:30 EST each morning, rain or shine, every day.

• Follow our Twitter, which broadcasts the daily report every day too.

One more thing: if you fancy #DYOR, you might have noticed that we provide all the historical daily report data for download in this public Google Sheet.

You may ask what kind of research can be done with these data. Well, we will make a few and show them to you using another post. Meanwhile, feel free to check the data out and share with us what you can find!

Last but not least, come and join us in our AMA!

Time: 10:30 AM, May 13th.

Venue: Discord Channel.

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

Long time no see, guys!

With so much going on right now, we simply wanted to share a few small updates that we’ve been working on to bring EigenPhi closer to the community and make it the best MEV data service you can imagine.

OK, let’s begin!

1. We just released EigenPhi Classroom.

Whether you are a searcher or a daily trader, it might take some time to be familiar with EigenPhi’s product. So, to make you feel at ease, we share our explanations of concepts, formulas, glossaries, and even our methodologies behind EigenPhi’s products in this classroom.

Visit the classroom and offer your suggestions on what you’d want to see there. We’ll do everything we can to make them more understandable!

2. Along with EigenPhi Classroom, we also released the EigenPhi Arbitrage Scan User Guide.

This user guide focuses on the product, showing you how to use Arbitrage Scan to benefit your daily trading, how to read the strategy of different types of arbitrages, how to interpret the Sandwich recipes, what the hottest tokens and liquidity pools are, and most recently, how to read our latest liquidation module.

3. We published our data sources as the first step of our appreciation to the community.

Since its birth, openness and accessibility have been the hallmark of DeFi to keep the conventional rigged mechanisms at arm’s length. Without the data and projects from the community, EigenPhi would not be here today. The publication of the data source is only the beginning. We’re organizing our arbitrage recognition methodologies, which will be available for everyone to see in the EigenPhi Classroom.

4. MEV.day in Amsterdam. Yes, we were there. Here is the picture of our guy with Vitalik.

And check out the venue used as the co-working space and Hackerthon during the Devconnect Amsterdam. The vibe there was unique! Because people understand what they are doing now is revolutionizing the dysfunctional incumbent financial systems in this ex-commodity exchange since 1903.

We’re putting up a summary of what we learned during MEV.day, which will be posted here. Meanwhile, we strongly advise you to watch the event’s recorded streaming together with the agenda.

5. Last but not least, even if you’ve visited our Classroom and read the User Guide, you may still have questions and want to talk to us. This week, we will be doing our first AMA with you guys via our Discord. So be prepared and leave your questions in the comments section. We will send out the specific timetable later.

Whew, that’s a lot to take in. Don’t worry, and you can always contact us using the channels below. Stay tuned! 😎

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

In 2021, till Nov 19th, 10.5 billion loss was subject to thefts, frauds, and scams.

— CNBC

A few days ago, someone contacted EigenPhi and asked for our help collecting information regarding his fraud case. For the sake of clear description, let’s call him John.

John visited this website: www.ammuni.io, which seemed like a legit DeFi project. Later, the guys running the project coaxed him to authorize them to have unlimited access to John’s MetaMask wallet via the website:

[ALERT: DON’T, REPEAT, DON’T CONNECT YOUR WALLET TO THIS WEBSITE]

https://ammuni.shop/#/. Then they asked John to put into a massive amount of money in the name of staking. During the next few days, the token was gone.

After researching the scenario, while feeling sorry for John, we admit that our hands are tied. Essentially, it’s the situation that needs law enforcement intervention.

However, we still think two simple tricks can reduce the risk of being targeted by scamming gangs.

Trick 1: Open the Phishing Detection setting of MetaMask.

Here are the detailed steps.

Step1: open your MetaMask browser plugin and click your account avatar.

Step 2: Click the Settings in the opened window.

Step 3: Click “Security & Privacy” in the menu of Settings.

Step 4: Switch on the “Use Phishing Detection.”

That’s it. Now when you visit a phishing website that is unknown to you, like the one mentioned above, you will see the message like this:

Trick 2: Verify the team behind the project using a reverse image search.

Open www.ammuni.io, and it looks like everything is there. Of course, for an ordinary #degen, it’s hard to take time to read their whitepaper and financial jargon. But they put the team’s information on the webpage, which you can verify using your browser. Other browsers have similar features, plugins, or extensions.

Step 1: Scroll to the Our Team part of the page.

Step 2: Right-click the team member’s pictures and choose “Search Image with Google Lens.”

Step 3: See what we got from the new tab:

Obviously, this guy’s picture is from some stock photo website, which is enough to raise a red flag: have you met any data scientist who wants to sell his portrait as a stock photo?

Step 4: Let’s check another one. Right-click the photo of the CEO and check the results.

Free photo again.

OK, just forget about this one and move on to the next project.

In conclusion, under the current development, DeFi is the Dark Forest everyone should know. Some simple tricks like the ones in this article are easy to use to alleviate the risks of scamming and fraud.

Even if you don’t use these tricks, there are 2 principles to remember before doing any transaction:

1. Double-check transactions before sending.

2. Set smart contract spending limits.

Please feel free to leave your comments and recommendations that would be helpful in terms of risk-free activities in DeFi.

P.S.: if you want to find out more about Token Approval, which is essential for your asset’s safety, read these two links:

1. https://medium.com/ethex-market/erc20-approve-allow-explained-88d6de921ce9

2. https://learn.zapper.fi/articles/breaking-down-the-steps-of-token-approval

The Ethereum Token Approval tool is also an excellent tool to review and revoke your token approvals for any dApp.

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue

Photo by Louis Hansel on Unsplash

There are good #MEVs, and there are bad #MEVs. The good MEVs increase the DeFi market’s efficiency, like arbitrages between various DEX, which is a net positive for the ecosystem. But, on the other hand, bad MEVs like Sandwich arbitrage have been hurting the community by exploiting the everyday traders.

To utilize the chances from good MEVs and avoid being squeezed by Sandwich, you’d better learn a few things or two about MEV.

As the exclusive arbitrage data platform of the industry, EigenPhi has benefited a lot from the resources below. Therefore, we’d like to recommend them to you for a better investment.

Oh, before starting, we’d like to share our latest released Sandwich Arbitrage module on our website. You can discover how many Sandwich arbitrages have happened during certain times, which contracts and transactions have reaped the most profits, how they did it illustrated in the straightforward token flow chart, and their attacking history chart.

If you want to show more sympathy for the victims, you can check out their victim history chart. In this case, there could not be a more accurate quote from historian Robert Thier:

Knowledge is power is time is money.

Here present two 0–1 MEV guide resources:

• The 0 to 1 Guide for MEV: compiled by BlockChain at Berkeley, a Student-run organization at UC Berkeley focused on blockchain innovation via education, research, and consulting. This guide has a clearly defined structure, including backgrounds and information from easy to hard for different level readers. The most significant benefit might be: “By the end of this you should be able to build your own MEV Bots.”

• The Daily Ape’s MEV resource: Darren Lau, aka Daily Ape, is one of the authors of the famous How To DeFi book series. His page incorporates many insightful Twitter threads, institution research reports, and industry conference slides and summaries. You will be fully equipped after reading all of them, if you can… Also, the deeper rabbit hole on DeFi by this remarkable ape is waiting for the next victim if you can’t help but drench yourself.

The two papers below aim at the same goal as EigenPhi: facilitating transparency in DeFi. A better Web3 needs input across all spectrums.

• A2MM: Mitigating Frontrunning, Transaction Reordering and Consensus Instability in Decentralized Exchanges. The paper introduces a new AMM design: an Automated Arbitrage Market Maker, short A2MM DEX. In expectation, A2MM’s revenue allows reducing swap fees by 90%.

A2MM aims to unite multiple AMMs to reduce overheads, costs and increase blockchain security. With respect to Miner Extractable Value (MEV), A2MM serves as a decentralized design for users to atomically collect MEV, mitigating the dangers of centralized MEV relay services.

• Unity is Strength: A Formalization of Cross-Domain Maximal Extractable Value. The paper names Cross-Domain Maximal Extractable Value, which is MEV happened multi-chain. Its researchers study the scenarios in which there exists such an incentive regarding the specific MEV and list negative externalities that might arise from cross-domain MEV extraction. In the end, the authors hope this paper:

can serve as the basis for formal analysis tools in the style of those presented in Clockwork Finance, as well as for discussion on how to mitigate the upcoming negative externalities of substantial cross-domain MEV.

That’s it. Feel free to leave comments if you find these resources useful. And you are more than welcome to recommend your MEV material found by you, or better, made by you.

In the end, we all need tools and data like our Sandwich arbitrage module to bring more openness and honesty to DeFi.

Follow us via these to dig more hidden wisdom of DeFi:

• EigenPhi’s Twitter

• EigenPhi’s Twitter for MEV alert

• Substack

• Medium

• Mirror.xyz

• Telegram

• Discord

• Revue