💡 What you’ll learn

• Why “small swaps are safe” is false

• How the mempool reveal lets bots model your slippage and spread

• The complex play: two sandwiches, six TX, shared legs

• Retail impact ranked and where you leak value

• Practical mitigations that actually reduce exposure

🔍 CASE STUDY DETAILS

• Bot Address: https://bit.ly/jaredbot2

• Etherscan Transaction: https://bit.ly/43by1Ey

📚 RESOURCES & LINKS

• MEV Data Dashboard: https://eigenphi.io/

• Full Research 👇

🚨 IMPORTANT NOTE

This is educational content only. We do not endorse MEV bots or provide financial advice. Always DYOR (Do Your Own Research).

You can subscribe to MEV Spaces via Spotify, Apple Podcasts, Pocket Casts, and YouTube Podcast.

Wonder if you have any misconceptions about MEV? Download our latest free e-book: MEV Myth Busters - From Microstructures to Macro Impacts.

Follow us via these to dig more into the hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄 Myth

Many users think MEV bots are like tools in a toolbox—one bot for sandwiches, another for arbitrage, and yet another for liquidation.

But this case shows how elite searchers operate differently.

They don’t specialize—they synthesize.

🧠 What Happened

During the Black Monday crash, searcher 0x0e49 fired a single, gas-optimized bundle with 13 internal trades: eight Aave liquidations triggered sharp price jolts, and 5 arbitrages immediately leveraged the distortions.
The result: one atomic “multi-strategy” pipeline that freed collateral, exploited the self-induced spreads, and settled before rivals could react

🔬Microstructure

The transaction contains 125 steps.

🧬 Key Steps Breakdown

We simplify the strategy shown in the chart.

Each number before the hyphen (e.g., 1, 2, 3) represents an independent trade that can be executed or reverted as a whole within a call trace set. The number after the hyphen (e.g., 5-1, 5-2) indicates a further breakdown into individual trades within the same call trace set.

The 13 internal trades are organized like a custom-built pipeline:

• Liquidations kicked it off—freeing collateral from underwater positions

• That price movement created arbitrage windows, which the bot immediately exploited

• Multiple trades followed in triangular patterns, timed to follow shifts triggered by its own earlier actions

This wasn’t passive routing; it was real-time opportunity synthesis.

For example:

• Trade 4: A liquidation causes a price change in the USDT/WETH pool

• That shift opens two triangular arbitrage paths, using Uniswap

• Trades 9 and 10: 0e49 executes both, capturing the spread before anyone else can react.

This type of chaining offers multiple competitive advantages:

• Gas efficiency (shared calldata, optimized bundling)

• Higher profit density per block

• Reduced replication by competitors (execution order is hard to imitate)

• Stronger bribery competitiveness in builder auctions.

And if any leg of the sequence fails?

0e49 mitigates with partial reverts—a controlled way to drop non-viable trades without losing the entire bundle.

🧑‍🤝‍🧑 Key Entities

0e49 is the most capable searcher bot on Ethereum. As of May 29, over 30 days, 0e49 has submitted:

• 30,174 arbitrages

• 4,083 sandwiches, out of 87,717

• 6 liquidations, out of 190

That’s about 10% of all MEV activity across these categories, by a single searcher.

And interestingly, 0e49 isn’t integrated with any one builder.

Our MEV acceptance data shows it spreads its bids across block builders almost perfectly in line with market share: no favoritism, no access advantage.

Its edge? Execution architecture, not inside lanes.

And it’s not the only one doing so.

⚠️ Your Takeaway

Elite MEV bots no longer specialize; they combine liquidations, arbitrage, and sequencing into a single, atomic bundle.

Read all MEV Myth Buster series here:

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄 Myth

Most users believe that lending protocol risk is primarily related to borrower behavior, including collateral ratios, liquidation thresholds, and missed repayments.

However, this case reveals a deeper truth: Flash loans render repayment irrelevant.

Because in modern DeFi, the biggest threat isn’t a borrower who defaults—it’s an attacker who repays.

🧠 What Happened

Within a single transaction, an attacker drew $3.49 B in flash liquidity—part of three attack transactions totaling $9.75 B, the highest of 2024—to warp the Curve USDE pool, misleading UwU Lend’s sUSDE price-oracle. The oracle overvalued the attacker’s collateral, allowing them to borrow aggressively, drain the pool, repay every flash loan atomically, and walk away with $19.3M in profit—all without ever breaching repayment rules.

🔬Microstructure

We selected the transaction that borrowed $3.49B via a flash loan, and here is its token flow chart with a simplified illustration focusing on flash-loan-related transfers.

🧬 Key Steps Breakdown

The previous chart shows that the attacker took flash loans from Balancer, Uniswap, Morpho, Spark, AAVE, and Sky(MakerDAO), with the total amount reaching $ 3.49 B.

Using these assets, the attacker precisely arranged the following steps.

• The attacker exchanged massive amounts of liquidity in Curve’s USDE pool.

• This manipulated the price oracle for sUSDE, UwU Lend’s synthetic stablecoin.

• The result? The attacker tricked the protocol into overvaluing collateral.

• Then they drained the pool, all within one atomic block.

The final haul: $19.3 million—extracted without ever violating repayment conditions.

This post from SlowMist would help you fully understand the exploit.

🧑‍🤝‍🧑Key Entities

• Spark is MakerDAO's decentralized lending protocol, offering features such as competitive interest rates, flash loans, and integration with the DAI stablecoin.

• Morpho is a decentralized lending protocol that optimizes rates by matching lenders and borrowers peer-to-peer, while falling back to Aave or Compound, enabling better yields and flash loan support.

• UwU Lend is a decentralized lending protocol that allows users to borrow and lend assets using overcollateralized positions, leveraging synthetic stablecoins and DeFi liquidity pools. The protocol was paused due to the exploits and later relaunched with security patches, but its reputation remains affected.

🔁 Not a Fluke

According to the Bank of Canada, over $2 trillion in flash loans were issued on EVM chains in 2024 alone. And they’re not just being used for arbitrage.

A report from Blockthreat confirmed flash loans were used in 5 of the 10 most exploited DeFi vectors last year:

• Price Oracle Manipulation

• Function Parameter Validation

• Reward Manipulation

• Reentrancy Attacks

• Governance Attacks

In total? $357 million in losses across 115 incidents—all powered by instant, uncollateralized capital.

The old model assumed attackers had to build up capital or collateral. Flash loans broke that. They allow anyone with a smart contract to simulate, fund, and execute an attack without persistence or exposure.

⚠️ Your Takeaway

• If you design protocols assuming capital friction, you’re building on sand.

• In DeFi today, the most dangerous borrower could be the one who pays you back immediately.

Read all MEV Myth Buster series here:

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄 Myth

Some people think MEVs like frontrunning are more tech-prone risks, while scam tokens and rug-pulls belong to a whole different category: social engineering.

​​But what if the same actor controls both? This triple-evil sandwich would show you the damning ramifications, making it the thickest sandwich we have ever observed.

🧠 What Happened

Block 19784594 (May 2024)—the same entity deployed, baited, and rugged a malicious token called YIELD Stone:

1. Turned on the switch in the contract (TX 0), activating:

   1. A 35% transfer tax that auto-redirects skimmed tokens to the attacker

   2. The supply minting logic that rug-pulls buyers

2. Front-ran with its own MEV bot (TX 1) to seed liquidity.

3. Sandwiched 74 victims in a 94-layer mega-bundle—each buy taxed, each sell back-ran.

4. Rug-pulled (transactions like TX 5): minted 2 million YIELD into the pool, dumped YIELD at inflated prices, and drained the WETH side.

In 95 scripted transactions, the attacker pocketed 2.9 ETH, proving that MEV can be engineered directly into a scam when the same actor controls the token, the pool, and the bot.

🔬Microstructure 🧬 Key Steps Breakdown

The 35% Taxing

This transaction illustrates how the malicious actor charges a 35% tax on every trade.

• A user sent 0.0239 ETH into Uniswap V2, which is marked red, meaning trades in this pool got sandwiched.

• They received 985K YIELD tokens.

• Meanwhile, 530K YIELD was skimmed off—automatically redirected to the attacker’s wallet.

The Sandwiching

The transaction on position 1 swapped 0.0234 WETH for 994.8K YIELD in the Uniswap V2 pool to raise the price, acting as the front-run of this 94-layer sandwich.

Now let’s look at the victim transaction on position 2.

While paying 35% tax, the victim only received 985.3K YIELD for 0.0239 WETH, suffering from the distorted exchange rate.

The Rug-Pull

At position 5, the malicious actor performed three actions.

• It back-ran previous buyers, dumping YIELD tokens at elevated prices.

• It minted 2 million YIELD into the pool, inflating supply.

• It drained the WETH side of the Uniswap pool—a rug pull.

🧑‍🤝‍🧑Key Entities

By digging on Etherscan, we can find that the issuer of the YIELD STONE token is connected to the sandwich bot.

All the times below are UTC.

1. 2024-05-02 12:31:35: Kraken wallet 0x267b sends 0.05 ETH to 0xAA38.

2. 2024-05-02 12:37:23: Address 0xAA38 forwards 0.05 ETH to 0x018d (the future frontrunner).

3. 2024-05-02 17:52:23: YieldStone Deployer receives 0.03 ETH from Kraken wallet 0x267b.

4. 2024-05-02 18:36:35: YieldStone Deployer mints 100 M YIELD STONE tokens.

5. 2024-05-02 19:42:59: Address 0x018d initiates the frontrunning transaction.

🔁 Not a Fluke

The whole attack was carefully coordinated. And it’s the transaction on position 0 of the block that pressed the launch button.

In this transaction, the attacker flips the “Enable Trading” switch in the contract, activating the tax and supply minting logic.

This is the code that started everything.

⚠️ Your Takeaway

• One actor ran the token, pool, and bot, fusing MEV with the rug-pull, thereby merging the attack surface.

• The security community must monitor contract logic and bundled trades together to defend against this gap; neither layer alone will catch this hybrid exploit.

Read all MEV Myth Buster series here:

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄 Myth

People picture a record-setting MEV haul as a lucky snipe on one wildly mis-priced pool—hit it fast, scoop the spread, and you’re done.

But that story ignores how DeFi’s composability generates the biggest payouts:
A liquidation distorts multiple derivative tokens at once, and the true windfall goes to the searcher who maps those distortions across pools, then chains them into a carefully ordered sequence.

🧠 What Happened

On 13 Apr 2024, ETH’s 15 % crash set off liquidations that warped the prices of a Curve pool.
In block 19649680, a flash-loan bot chained two arbitrages—borrowing 216 WETH and cycling crvUSD ↔ wstETH ↔ WETH—to pocket 90.5 ETH ($271K, 2024’s highest profit from one transaction) in its second leg, proving mega-profits come from multi-pool sequences, not single mis-prices.

🔬Microstructure

This is the arbitrage that generates the $271K profit on position 202 of the block.

https://bit.ly/3ZvWKkw

The token flow chart below is the arbitrage from the same bot on position 201 of the block. Its swap in Curve’s TriCRV(crvUSDETHCRV) pool opened the window for the above windfall.

https://bit.ly/3HduqgE

🧬 Key Steps Breakdown

For this series of transactions, let’s look at the money maker first.
We simplified the 2nd arbitrage as below:

• First, the bot borrowed 216 WETH through AAVE's flash loan.

• Next, it swapped 216 WETH for 600K crvUSD in Curve's TriCRV pool.

• Then, it exchanged for 286 wstETH in the TricryptoLLAMA pool.

• Finally, it converted back to 329 WETH through Balancer.

After returning the loan and tipping the block builder 22.6 ETH, the bot walked away with 90.5 ETH, a $271K profit in a single transaction.

As we pointed out, the 2nd part is crucial for leveraging the pricing opportunities created by the arbitrage on position 201, part of which is exchanging 9.9 WETH for 72.5 CRV.

Looking at the summary section of the Arbitrage Transaction Profit and Loss page, it shows the signal transaction, which is a liquidation transaction on position 0.

The liquidation occurred on Curve’s crvUSD soft-liquidation-related pools, injecting 191,000 crvUSD into Curve's TriCRV pool. The injection triggered a price movement that was seized by the searcher who finished the two consecutive arbitrages.

🧑‍🤝‍🧑Key Entities

In the arbitrage on position 202:

• Curve’s crvUSDETHCRV pool contains crvUSD (Curve's stablecoin), ETH (Ethereum), and CRV (Curve's governance token), allowing users to provide liquidity and earn trading fees from swaps between these three assets.

• Curve’s crvCRVUSDTBTCWSTETH, TricryptoLLAMA pool, bundles CRV, USDT, WBTC, and wstETH in a single AMM pool, letting traders swap seamlessly among them.

• The Balancer wstETH-WETH-BPT pool pairs wstETH with WETH and includes its own Balancer Pool Token (BPT), enabling low-slippage swaps between them.

In the liquidation:

• The crvUSD Controller acts as an on-chain interface for creating loans and further managing existing positions. It holds all user debt information. External liquidations are also done through it.

• LLAMMA-crvUSD AMM is the market-making contract that rebalances the collateral of a loan and is responsible for liquidating and de-liquidating collateral based on market conditions through arbitrage traders.

🔁 Not a Fluke

On April 13th, ETH suffered its biggest two-day loss in years, plummeting from $3,500 to $3,000. This triggered a cascade of liquidations across the ecosystem.

The searcher in this story is sophisticated enough to detect the ripple of price dislocations across derivative tokens and act on it with the two arbitrages.

Moreover, our simulation revealed something remarkable: had the bot executed these in reverse order, the first arbitrage would have failed completely.

The execution was flawless, like a perfectly choreographed dance.
This wasn't just algorithmic speed—it was strategic sequencing. The searcher had carefully optimized the order of execution to maximize profits across both arbitrages.

These transactions actually help the market by bringing prices back into alignment after liquidation events. It's one of those rare cases where profit-seeking improves the system for everyone.

⚠️ Your Takeaway

• In crypto, one trader's disaster becomes another's golden opportunity.

• Compose, sequence, repeat — the fattest MEV gains are choreographed, not chanced.

Read all MEV Myth Buster series here:

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄 Myth

Many traders assume that when an exploit drains one pool, the damage—and any MEV—stops there.

They fail to understand that DeFi’s composability causes chain reactions in unexpected ways, like what we observed after the $1.5 billion ByBit hack.

🧠 What Happened

On 21 Feb 2025 @ 14:13 UTC, a $1.5 B exploit struck ByBit. In 2 hours. The hacker’s money laundering triggered the following arbitrages. In Block 21895553, the exploiter’s swapping 15K stETH for ETH via Dodo impacted prices across Curve, Balancer, Uniswap, and PancakeSwap, leading to 11 arbitrages expanding to 22 pools.

This table illustrates the connections between 11 arbitrages and 22 pools after the hacker's swap. Different colors mark different bots working across various pools.

Column headers indicate the pools involved in a transaction. The numbers in front of each row indicate the positions of each transaction. Cells mark the contracts or bots. For example, in Row 1, which is the transaction on position 1 of Block 21895553, bot 0x9d6b finishes the arbitrage between three pools: Curve sETH/ETH, Balancer pxETH/WETH, and Curve pxETH/stETH.

🔬Microstructure

For the sake of clarity, we choose the exploiter’s swap on Pos 0 and the following arbitrage on Pos 1, and simplify them in the chart below.

• Detailed token flow charts: Pos 0 and Pos 1.

🧬 Key Steps Breakdown

• In the transaction on Pos 0, the hacker sent 15K stETH to the Dodo router first. Then the router managed a series of exchanges on stETH(wstETH) for ETH(WETH), among which the biggest swap was done via Curve, trading 13.4K stETH for 15.1K ETH.

• The grand trade on Curve created the price discrepancy, which Searcher 9d6b detected through a private channel and actioned in the transaction on Pos 1.

• In their arbitrage, Searcher 9d6b flash-loaned 634.6 WETH from Morpho, then they reverse-swapped ETH for stETH in the same Curve pool, exchanged stETH for pxETH via Curve, and finished their arbitrage via trading pxETH for WETH via Balancer.

• In the end, Searcher 9d6b made 1.4 ETH after tipping the builder 0.04 ETH.

🧑‍🤝‍🧑Key Entities

• ByBit Hacker is the one making the whole arbitrage chain possible.

• Dodo Router’s algorithm splits the grand order of the hacker into different pools on different protocols due to the composability APIs they provide.

• Searcher 9d6b demonstrated their acuteness in discovering the opportunity in the blink of an eye.

• Morpho’s flash loan feature enabled Searcher 9d6b to execute the arbitrage with little capital.

🔁 Not a Fluke

9d6b didn't stop there. It executed seven more backruns, using 15 different pools for a total profit of $12K.

But there's a catch. By splitting into multiple transactions, 9d6b revealed room for algorithmic improvement. A more optimized approach would have used fewer transactions, saving gas and eliminating opportunities for competitors.

Indeed, Bots 4c99 and 12e3 picked up the leftovers, earning $79 across three transactions—a perfect illustration of MEV's ripple effect.

Bot 4c99 used the same pools as the hacker and 9d6b, and the bot 12e3 acted on the pool used by 9d6b, displaying the chain reaction.

However, these bots were not the biggest winners of the day. By fulfilling the hacker's limit orders selling 75K stETH for ETH, shown in the image below, Paraswap pocketed $440K in profit.

⚠️ Your Takeaway

• Composability creates ripples across DEXes, implicating much broader audiences than expected.

Read all MEV Myth Buster series here:

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄 Myth

Does Etherscan present the full account regarding transaction costs?

Gas used × gas price = fee paid. Easy.

However, Etherscan only provides basic data. You can’t understand MEV without figuring out the builder tips in some transactions. Because sometimes, the real payment to get into a block isn’t gas—it’s a direct ETH transfer from MEV players, hidden from the surface view. You will see the highest builder tips of 2024 in this liquidation.

🧠 What Happened

Market-wide liquidations hit Aave hard on Black Monday, August 5th, 2024. This liquidation saw 4.6K ETH being liquidated by a searcher, who paid 358.7 ETH to the builder as tips.

🔬Microstructure

https://bit.ly/3DpgVJh

🧬 Key Steps Breakdown

• Step 0: The liquidator/searcher borrowed 4,569.9705 WETH from Balancer using Flash Loan.

• Steps 1-5: The liquidator sent the borrowed 4210.8438 WETH to 1inch, who used the WETH to fulfill an ETH-buy limit order from 0x741, the famous 7 Sibliings fund, and return 9.8M USDC to the liquidator.

• Steps 6-11: The liquidator repaid the borrower’s 9.8M USDC debt and received the 4,569.9705 WETH collateral.

• Step 12: The liquidator repaid the borrowed WETH to Balancer.

• Steps 13-16: The liquidator tipped the builder 358.7164 ETH and pocketed 0.4103 ETH.

🧑‍🤝‍🧑Key Entities

• The liquidator/searcher is 0x645, shown as “to/liquidator” in the token flow chart.

• The borrower is shown as a naval blue pentagon in the token flow chart.

• The builder is shown as MEV Buildr 0x3B…

• 1inch v6 Router and AAVE related addresses are labeled as seen.

Next, we will show you that the liquidator/searcher and the builder are integrated in this case.

🔁 Not a Fluke

In a typical setup, searchers submit bundles to multiple builders—Flashbots, Titan, BeaverBuild—hoping one of them will include their transaction. It’s a competitive, auction-based process where the best bribe often wins.

But in this case, there was no competition. The searcher and the builder were vertically integrated. The searcher didn’t need to bid across the market. It simply constructed the block with its own builder and routed profits directly—privately, and efficiently.

The 358.7 ETH wasn’t a bid to win a slot. It was profit-sharing, internalized. There was no middleman, no auction, no leakage. That’s what full control of the block looks like: searcher-generated value flowing straight through to the builder it controls.

And the data backs it up. From October 2023 to November 2024, over 95% of builder rewards from this searcher—5,049 ETH in total—went to just one destination: 3Bee. Not BeaverBuild. Not Titan. Just 3Bee.

The 358.7 ETH wasn’t just a tip. It was vertical integration in action, which is separate from the gas fee shown on Etherscan.

More on Etherscan’s Transaction Data

The transaction’s detail page on Etherscan only shows Transaction Fee as 0.371006176298024201 ETH, which equals the Gas Price, 604.945101409 Gwei, multiplying Gas Used, 613,289.

In this case, the Burnt Fees equals the Transaction Fee, which is not always true.

This transaction’s detail page shows that the user paid 0.012808553076347518 ETH as Transaction Fee, composed of approximately 0.012751866371789876 ETH burned as base fee and 0.0000566867 ETH paid as a priority fee (tip) to the block proposer, based on 559,534 gas used multiplying the priority gas being 0.101310563 Gwei.

Please note that the above does not include the direct transfer of tips to the builder in this case study, which amounts to 358.7 ETH. You can only find it in the Internal Transactions section of the page, but it is the actual cost to win the block.

⚠️ Your Takeaway

• Etherscan’s surface data can’t expose the true MEV flows.

• Searcher-builder alliances make dedicated MEV analytics a must.

Read all MEV Myth Buster series here:

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Behind every transaction is a battle-tested supply chain of searchers, builders, and validators—an ecosystem that rewards speed, creativity, and, sometimes, downright audacity. In this MEV Myth Busters series, we’ll dissect the real transactions that shatter people's comforting stories about DeFi.

One by one, we’ll place a popular belief under the microscope, replay the raw on-chain evidence, and show exactly how value was extracted.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄 Myth

Many of you must have heard of jaredfromsubway.eth, the most notorious Sandwich chef who has been the top 1 gas spender.

Most users assume that sandwich bots like Jared go after big trades—whale-size swaps with big slippage.

But Jared 2.0 proves that no trade is too small to be exploited.

🧠 What Happened

In Block 18563314, Jared 2.0 chained six transactions into three overlapping sandwiches of two types, recycling a victim’s and its own liquidity to front-run and back-run everyday swaps—proof that penny-sized attacks scale.

🔬Microstructure

Look at this Split-Front-Run Sandwich with two victims, which essentially makes it two sandwiches:

• TX 1, TX2, and TX6.

• TX 4, TX5, and TX6.

The first victim in TX2 swapped 0.1 ETH, and the second victim in TX5 swapped 0.08 ETH. They were both preyed on by Jared 2.0.

The second type of Sandwich, Swap-JIT Sandwich starts with a Just-In-Time liquidity provision—or JIT.

Now, let's look at how these sandwiches happened.

🧬 Key Steps Breakdown

Split-Front-Run Sandwich Combo

Both victims in TX2 and TX5 wanted to swap ETH for ide.

Upon detecting such intents, Jared pushed up the rate in TX1 by using steps 1 & 2, shown in the chart. This made TX1 the frontrun of Sandwich TX1-TX2-TX6.

In TX4, Jared swapped WETH for ide with steps 1 & 2 too, enabling this transaction to be the frontrun of Sandwich TX4-TX5-TX6.

In TX6, Jared traded ide back to WETH, finishing as the backrun for two simple sandwiches.

Such a strategy has three effects:

• Reduce gas overhead and capital lock-up.

• Extract maximum value.

• Lower cost to frontrun the 2nd victim in TX5 by using TX2 to push up the price.

Swap-JIT Sandwich

This sandwich comprises TX1, TX3, and TX4.

In TX1, Jared added ETH/GROK liquidity to a Uniswap V3 pool, then immediately swapped GROK for ETH. This shifted the pool price—the frontrun.

The victim’s swap of GROK for WETH happened in the same pool, but now at a much worse rate.

In TX4, Jared removed the liquidity added in TX1 and finished the backrun of the sandwich.

Jared replaces the usual back-run swap with add/remove liquidity operations, resulting:

• Cheaper execution: avoiding swap fees and reducing slippage cost.

• Profitable tactic of sandwiching smaller trades.

To summarize, Jared reused several transactions to finish his strategy.

• Parts of TX1 and TX4 were used in the Split-Front-Run combo.

• Parts of TX1 and TX4 were used in the Swap-JIT sandwich.

• TX6 was reused as the backrun for both sandwiches in the Split-Front-Run combo.

• Being a victim, TX2 was also reused as part of the strategy to raise the price of WETH against ide.

🧑‍🤝‍🧑Key Entities

Bot 6b75 is the newest sandwich bot used by Jaredfromsubway.eth.

🔁 Not a Fluke

Despite all this sophistication, Jared averages just 20 cents profit per sandwich. But by reducing costs and increasing throughput, it can run hundreds or thousands of these per day.

At its peak, 87% of all sandwich attacks came from Jared 2.0.

⚠️ Your Takeaway

• Jared 2.0 attacks hundreds or thousands of user trades daily by reducing costs and increasing throughput.

• Sandwiching is no longer just targeting fat-margin whale trades. It’s about low-margin, high-frequency, hyper-optimized execution.

Read the previous MEV Myth Busters.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄Myth

But on March 12th, our EigenPhi dashboard told a very different story.

🧠 What Happened

On 12 Mar 2025, the integrated bot-and-builder duo (6B40 + “bob-the-builder”) borrowed millions via Aave to run six back-to-back USDC→USDT sandwich attacks in five minutes, ripping off $714K from one single victim’s six public mempool swaps with zero slippage settings.

🔬Microstructure

The token flow chart below showcases the sandwich that made the victim receive just 5,273 USDT for 220,800 USDC.

https://bit.ly/3DpgVJh

🧬 Key Steps Breakdown

We will use the sandwich shown above to illustrate the attack pattern.

The victim sent their intent – swap 220.8K USDC for USDT - to the public mempool. However, while using Uniswap V3’s Router, based on the transaction detail on Blocksec’s phalcon, the slippage of the swap, sqrtPriceLimitX96, was set to 0, telling everyone that it would accept any swapping price.

Upon detecting the victim's swap intent in the mempool, in the FrontRun, the searcher 6B40 borrowed 1.1 million USDC from Aave using 701 WETH as collateral. They then used Uniswap’s flash-loan-like flash swap feature to exchange 18.65 million USDC for 17.58 million USDT between a Curve pool and the Uniswap V3 pool, significantly altering the rate of USDC/USDT in the Uniswap V3 pool.

The price distortion caused the victim to receive only 5,273 USDT in the Victim Transaction.

In the BackRun, 6B40 repaid their Aave debt and secured an $ 8,700 profit, tipping "bob-the-builder. eth" 100.6 ETH, while the user lost $204K miserably.

🧑‍🤝‍🧑Key Entities

Sandwich bot 6B40 is integrated with the builder of the block - "bob-the-builder. eth."

🔁 Not a Fluke

The attack we showed above wasn’t random mempool sniping.

It’s the same builder who built all six blocks containing these six attacks: bob-the-builder, detailed in this post.

That explains another anomaly: each block contained fewer than 30 transactions, far below the expected 150+.

Regular users were squeezed out, while the bot got an exclusive lane to execute sandwiches with guaranteed priority.

During a Twitter Space with Ben from BTCS, we highlighted a broader trend:

Over the past year, integrated builder-searcher alliances have surged, while smaller builders are disappearing.

This isn’t just about MEV extraction anymore—it’s about control of blockspace, and who gets in.

So here’s what this case makes clear: sandwich attacks haven’t disappeared—they’ve evolved. They’re automated, systematic, and now privately executed inside builder-searcher partnerships.

And even with today’s best tooling, one bad setting—like zero slippage—can turn you into a farmable pattern.

Because in the new MEV meta, you don’t just get sandwiched once.

As to the victim of these six sandwiches, our research shows that they learned the lesson and set the right slippage the next day while swapping $1 million worth of assets.

⚠️ Your Takeaway

• Zero-slippage = zero protection.

• Searcher-Builder integration drives small builders away with insatiable appetites and incomparable profits.

Read the first 2 of the MEV Myth Buster Series.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🦄Myth

But this case proves: even liquidity providers can be ambushed.

🧠 What Happened

A whale tried to add 9.95 wBTC ≈ $851 K to a Uniswap V2 pool.

One searcher smelled blood, front-ran the deposit, distorted the price, let the LP transaction execute at the skewed ratio, then back-ran the pool to reset prices—walking away with all the wBTC the whale brought to the party.

Zero swaps by the victim.
Full sandwich by the bot.

🔬Microstructure

https://bit.ly/4jr6BRc

🧬 Key Steps Breakdown

While adding liquidity to the pool, the whale skipped one essential step: under Uniswap V2, liquidity providers must set AmountAMin, the minimum token amount they will accept.

By omitting this, the LP effectively told the protocol:

“I’ll accept any ratio—even if the price shifts right before my deposit.”

That invitation was all the MEV bot needed.

Step 1: The front-run.

A bot spots the pending LP transaction in the mempool and executes a massive swap just before it. This skews the pool’s price so that WBTC appears cheaper than the paired token.

Step 2: The LP deposit.

The victim adds their WBTC and waBTC into the pool while its price is still distorted. Because the pool overvalues the paired asset, the LP’s contribution is imbalanced: only a tiny amount of waBTC was accepted.

Step 3: The back-run.

The attacker reverses their initial swap—restoring the pool’s true price and locking in the difference as pure profit.

Result? The LP lost $851,000—despite never making a swap.

🧑‍🤝‍🧑Key Entities

• Sandwich Bot 0xe2c is still actively targeting DeFi users.

• Contract 0x3bf, shown in the token flow, is used by 0xe2c as the proxy to execute attacks.

🔁 Not a Fluke

This wasn’t a bug or a code flaw.

It was a legit, on-chain exploit, driven entirely by front‑run and back‑run logic leveraged against an unprotected LP action.

Modern sandwich bots don’t just target traders; they also aim to exploit anyone moving value on-chain without the necessary safeguards.

If you’re adding liquidity, don’t assume safety by default.

In Ethereum’s block-by-block battleground, even builders can get sandwiched.

The following post dives deep into the mathematics of LP-ambush.

Stay vigilant. Stay protected.

⚠️ Your Takeaway

• Always set AmountAMin (or your protocol’s equivalent).

• Use private RPC relays like Flashbots Protect or MEV Blocker.

• Treat LPing like swapping with slippage tolerance—because skipping protections can cost you more than a trade.

Read the first post of the “MEV Myths Buster” series.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

If you’ve spent any time onchain, you’ve seen the whispers:

Limit orders are passive, so they’re safe.

Only whales get sandwiched.

Flash-loan exploits? Just edge cases.

Everyone pays the same gas, so the playing field is fair.

Ethereum’s blockspace says otherwise.

Behind every transaction is a battle-tested supply chain of searchers, builders, and validators—an ecosystem that rewards speed, creativity, and, sometimes, downright audacity. Over the next ten posts, we’ll dissect the real transactions that shatter people's comforting stories about DeFi.

Please think of this series as MythBusters for MEV: one by one, we’ll place a popular belief under the microscope, replay the raw on-chain evidence, and show exactly how value was extracted.

What to Expect

• A crisp myth up top — the sentence you might have heard in Discord.

• A cinematic replay — flow-charts and Lego-diorama visuals of the actual block.

• Microstructure breakdowns — why a bot could act, who got paid, who got drained.

• Takeaways you can use — concrete settings, habits, and mental models to stay safer (or, if you’re a builder, less exploitable).

The Ten Myths We’ll Tackle

1. Unfilled limit orders are harmless.

2. Providing liquidity can’t be sandwiched.

3. Private mempools solved swap-sandwiches.

4. Small trades fly under the radar.

5. Gas fees on Etherscan show the full cost.

6. A single hack affects only one protocol.

7. The “best” arbitrage is a lucky one-off.

8. Scam tokens and MEV are separate worlds.

9. Flash-loan attackers risk their own capital.

10. Bots specialize; they don’t blend strategies.

Each myth corresponds to a case study you can open in your block explorer and verify for yourself. No hypotheticals, no red-lined theory—just live ammunition pulled straight from Ethereum’s dark forest.

Buckle up and let’s go.

🦄Myth:

But in DeFi, even your passive intent can be exploited.

In this case, a searcher made money by triangulating two stale orders left by the same user—and filled them using no upfront capital.

🧠 What Happened

The bot arbitraged a price gap between two stale limit orders—using only the user’s own liquidity.
That’s right: the bot filled one order with the proceeds from the other.

🔬Microstructure

https://bit.ly/4iYK1h3

🧬 Key Steps Breakdown

Before this transaction, the user had set two limit orders on the same token pair and created price discrepancies, unintentionally offering an arbitrage opportunity to searchers.

• Buy Order: One to buy MOODENG with WETH, with a price of 2.5E-08 WETH.

• Sell Order: One to sell MOODENG for WETH with price being 3.3E-08 WETH

Even worse: both orders touched the same liquidity pool – the user’s EOA.

• Step 0: The bot borrows 17M MOODENG from the user’s sell limit order.

• Step 1: It borrows 0.5618 WETH from the user’s buy order on the same token.

• Step 2: It returns the MOODENG to fulfill part of the buy order.

• Step 7: It returns 0.4256 WETH to fulfill part of the sell order.

The user walks away with both orders partially filled.
The bot walks away with 0.1362 WETH in pure arbitrage profit.

No risk. No capital. Just execution.

Steps 3 and 4 are the wrapping and unwrapping of ETH.

The searcher tipped the builder 0.1351 ETH in Step 5 and pocketed the remaining 0.0011 ETH.

It might seem like the searcher only took 0.0011 ETH, but that is not the actual number. Here is why.

🧑‍🤝‍🧑Key Entities

The bot and the builder receiving the 0.1351 ETH tips were integrated, which we will explain next.

🔁 Not a Fluke

The same bot executed 30 similar arbitrages in the same block—positions 1 through 31. Its first transaction even targeted the same token pair again, arbitraging between the same user and a Uniswap V2 pool.

That kind of positional dominance at the top of a block is unusual.

A deeper look reveals why: over 95% of this bot’s builder tips went to a small builder called turbobuilder—far outside the norm.
In comparison, major builders like Titan and BeaverBuild usually control around 90% of block production.

This isn’t a typical MEV flow.
It suggests tight searcher-builder integration—a pattern we’ll revisit in later cases.

But for now, the takeaway is simple:

These weren’t clever market reads.
They were systematic extractions from stale public intent.

Because in DeFi, your orders don’t have to be filled…
They just have to be visible.

⚠️ Your Takeaway

You don’t need to swap tokens to be exploited.
In DeFi, leaving mismatched limit orders open is like offering a zero-risk arbitrage to bots.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Understanding the microstructure of DeFi transactions and strategies is crucial for optimizing financial outcomes, managing risks effectively, and leveraging the full potential of decentralized finance in a rapidly evolving market. This is the goal of our latest E-book—Head First DeFi: Decoding the DNA of Crypto Transactions & Strategies.

Here is the foreword of it.

“In the end, banking is a very good business unless you do it poorly.”

 — Warren Buffett

$418 million—that's the worth of spot Bitcoin ETF shares owned by Goldman Sachs as of August 14th, 2024. At the same time, the global crypto market cap is over $2 trillion. It seems like Goldman Sachs executives are taking DeFi more seriously as part of the banking business. Whether they truly understand the fundamentals of DeFi is another question.

Uniquenesses of DeFi: Building Blocks of a New Financial Era

DeFi is not just a variation of Traditional Finance (TradFi); it's a whole new ball game. Its core features, including atomicity, composability, permissionlessness, and determinism, set it apart. These features create a more efficient, flexible, transparent, and inclusive financial ecosystem. The unique features of DeFi are not only innovative but also hold the potential to reshape the financial industry.

Atomicity: The Unbreakable Chain

In DeFi, atomicity ensures that transactions are either fully executed or not at all, eliminating the risk of partial execution and its associated losses. Simply put, it's like a vending machine- you either get your snack or your money back; there's no in-between. This resembles escrow services in TradFi, where funds are only released when all conditions are met. However, DeFi’s atomicity offers greater efficiency by removing intermediaries. For instance, in “How Enso Solves 73.5ETH in 116 Steps in One Transaction,” atomicity is crucial in ensuring that a 117-step transaction is completed seamlessly between over 40 trading venues via 25 assets.

Composability: The Financial LEGO Set

Composability in DeFi enables seamless interaction between protocols and applications, allowing the creation of complex financial instruments by combining various services and products. It mirrors financial engineering in TradFi, which integrates different financial products. DeFi’s composability, akin to ‘money legos,’ is powered by the programmability of digital assets on the blockchain through smart contracts, making these assets verifiable and traceable. Unlike traditional assets, digital assets in DeFi can perform a wide range of functions, offering broad and flexible financial significance across platforms.

You can find its demonstration in the case “Swinging for Profits: The BANANA Cross-Chain Arbitrages via ApeSwap and Other DEXs,” which highlights how composability enhances liquidity and optimizes returns through sophisticated arbitrage strategies executed via ApeSwap, a popular DeFi platform, on both BNB Smart Chain and Polygon using Anyswap bridge, Curve and Balancer on BNB Smart Chain, and Uniswap V2 on Polygon. Combined with atomicity and shown in the previous Enso case, DeFi’s composability offers more flexibility, enabling real-time integration across platforms.

Permissionlessness: The Open Gateway

The permissionless nature of DeFi allows unrestricted access to financial services, in contrast to TradFi, where eligibility criteria often restrict access. This democratizes finance, making it accessible globally without barriers and creating a lifeline for crypto users in Argentina and Venezuela. In “With NFT Arbitrage, Someone Was Snipping Your BabyDoge, a user executed an NFT arbitrage without needing approval from any centralized authority, illustrating the open-access nature of DeFi and its potential to foster innovation across borders.

Determinism: The Crystal

Determinism in DeFi ensures that transactions, given the same inputs, produce predictable and transparent outcomes, enhancing security and trust in a decentralized environment. It's like a step-by-step recipe; if you follow the steps, you'll get the same dish every time. This predictability is crucial for accurate profit calculation and risk management. The transparency of on-chain transactions further reduces the risk of hidden fees, as each step is visible and verifiable. The case “A $3.2 Million Profit Arbitrage Triggered by the $190M Nomad Bridge Hack. ” exemplifies how determinism enables precise profit outcomes, demonstrating the reliability and transparency of DeFi transactions.

Nevertheless, with all these novelties come challenges as well. Questions need to be answered to reach the one billion users.

Challenges and Dilemmas: Can DeFi Overcome These Key Hurdles?

As DeFi continues to innovate and expand, it faces significant challenges that must be addressed to ensure its long-term success and stability. The following sections explore these hurdles, posing critical questions highlighting the complexities of operating in a decentralized financial ecosystem. From balancing innovation with security to achieving stability in lending protocols, these challenges underscore the need for thoughtful solutions to drive DeFi forward.

Asset Issuance Mechanisms: How to balance innovation with security?

DeFi’s decentralized nature introduces complexities in asset issuance, where token offerings and staking replace traditional methods like central bank security issuances and IPOs. TradFi’s asset issuance is heavily regulated, ensuring transparency and security. DeFi, lacking such oversight, faces challenges in maintaining these standards.

Flash loans exemplify the asset issuance risks in DeFi, where rapid, uncollateralized borrowing can exploit system vulnerabilities. In 2023, Euler Finance suffered a $197M exploit due to flash loans. Even the Ethereum Foundation Couldn’t Escape the Claw of This Flash-Loan-Enabled Sandwich MEV.

Our framework has shown that the token dynamics of blockchain follow the theory of a tokenomic trilemma: being difficult simultaneously to achieve three conditions of free tradability, anchored price, and independent issuance. DeFi's issuance mechanism must balance innovation with the need for secure and fair processes to protect investors and maintain market integrity.

Liquidity Assessment and Derivative Valuation: How to piece together fragmented liquidity?

In the decentralized world of DeFi, traditional liquidity assessment and derivative valuation models are less applicable, leading to challenges in accurate pricing. Liquidity fragmentation across various pools and platforms in DeFi leads to significant price discrepancies, making it difficult to assess overall market liquidity and further complicating derivative valuation. Additionally, the high volatility in DeFi markets, driven by rapid changes in supply and demand, exacerbates these challenges. , as seen in “Arbitrage Strategies Centered on Autonomous Minting and Burning of Synthetic Tokens,” where the dynamic nature of these synthetic assets, influenced by fluctuating market conditions and decentralized oracles, complicates the valuation process, making traditional methods insufficient. This case highlights the need for new approaches to derivative pricing that consider the unique properties of DeFi.

Lack of Settlement Models: How to create standardized processes to reduce uncertainty?

One of DeFi’s fundamental challenges is the absence of standardized settlement models, complicating the finalization of transactions. In TradFi, standardized settlement processes ensure clear reconciliation and reduce disputes. The absence of standardized settlement models in DeFi complicates asset settlement and dispute resolution and poses broader systemic risks. Unresolved disputes can escalate, potentially leading to larger market disruptions and loss of confidence in the ecosystem, as highlighted in “ Coffeebabe.eth’s Masterstroke: $5.4M Arbitrage During the Vyper-Curve Exploit.” This case illustrates how the absence of clear settlement models can lead to rapid exploitation and complex settlement disputes, as the exploit took advantage of a lack of clear reconciliation processes.

Lending Protocols: How to mitigate risks with TradFi-level stability?

DeFi lending protocols face significant challenges in managing collateralization and ensuring security against attacks. TradFi regulates lending with credit checks and collateral requirements, reducing risks. DeFi’s reliance on over-collateralization as a risk management tool often leads to capital inefficiencies in the absence of credit checks. Additionally, the dependence on oracles introduces a single point of failure, making lending protocols vulnerable to manipulation and security breaches. The Defect in a Lending Protocol’s Oracle Module Exploited for Profit shows how vulnerabilities in oracles, critical for determining collateral value, can be exploited to manipulate the lending process, leading to inaccurate collateral assessments and security breaches.

As DeFi continues to evolve, addressing these challenges will ensure its growth and integration into the broader financial landscape.

Decoding DeFi: Your Guide to Navigating the Future of Finance

This Head First DeFi Transactions and Strategies booklet is crucial in understanding DeFi's key features and challenges. It dissects real-world case studies to provide valuable insights into the mechanics, opportunities, and risks inherent in DeFi strategies. Whether you're a beginner looking to understand the basics or an advanced trader seeking to refine your strategies, these case studies offer practical knowledge to navigate the DeFi landscape.

As DeFi continues to evolve, it's essential for participants at all levels—from individual users to institutional players like Goldman Sachs—to deeply understand its fundamentals. These innovations are shaping the future of finance, and staying informed is key to capitalizing on opportunities and mitigating risks.

We encourage you to dive deeper into the case studies at https://bit.ly/head-first-defi and actively engage with the DeFi community. Share your insights, submit transactions you want to understand and contribute to the ongoing dialogue. By collectively exploring and addressing the challenges and possibilities of DeFi, we can work towards a more inclusive, efficient, and innovative financial future.

The journey into DeFi is just beginning, and your participation can help shape its trajectory. Let's decode the DNA of Decentralized Finance together, one transaction at a time.

Click this link or open https://bit.ly/hfdefi to visit the latest booklet: Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Why has Jaredfromsubway.eth been so successful for 18 months until today? His sandwich-making recipes emerge one after another, demonstrating Jared’s versatility and in-depth comprehension of DeFi mechanisms. Adding and removing liquidity, strategically moving assets from one trading venue to another, and acutely monitoring the public mempool enable their gains to outperform other sandwich bots.  

Strategy One-liner

Jaredfromsubway.eth uses three transactions to cook two unique types of sandwiches: a swap-JIT sandwich and a split-front-run one.

Simplified Illustration

All transactions involved are in Block 18563314, occupying from Position 1 to Position 6.

The number after “TX” indicates the current transaction’s position on the block. We will use such representation below. 

Big Picture

Swap-JIT Sandwich

https://bit.ly/3XG7Z8e

Split-Front-Run Sandwich

https://bit.ly/3Y6mVhD

Key Steps

We explain this strategy’s key steps by splitting them into two sandwiches, in which we use each transaction’s steps regarding the current sandwich for clarity. 

Swap-JIT Sandwich

TX1: Swap-JIT Sandwich Front Run. Add ETH and GROK Liquidity, then swap GROK for ETH.

• This transaction serves two roles in this strategy:

  • The front run of the Swap-JIT sandwich, composed of TX1, TX3, and TX4;

  • And the first of the two front-run transactions of the Split-Front-Run sandwich that is composed of TX1, 2, 4, 5, and 6. 

• Steps 3 & 4: swap GROK for WETH in the Uniswap V3 pool. 

• Steps 5-7: Add GROK and WETH liquidities to the Uniswap V3 pool. Visit this page to understand what happens when liquidity providers process liquidity in a Uniswap pool.

• Steps 3 & 4 and 5-7 increase the rate of GROK against WETH in the pool, making the transaction the front run of this Swap-JIT sandwich.

TX3: Swap GROK for ETH.

• This is the victim transaction of the Swap-JIT sandwich. 

• Steps 2 & 3: the victim swaps GROK for WETH in the Uniswap V3 pool, suffering the loss under the influence of their slippage setting. 

TX4: Swap-JIT Sandwich Back Run. Remove GROK and ETH Liquidity.

• This transaction also plays two roles: 

  • The back run of the Swap-JIT sandwich;

  • And the second of the two front-run transactions of the Split-Front-Run sandwich.

• Steps 3-9: Remove GROK and WETH liquidities from the Uniswap V3 pool.

Split-Front-Run Sandwich

TX1: Split Front Run 1. Swap WETH for ide.

• Steps 1 and 2 increase the rate of WETH against ide in the Uniswap V2 pool, making this transaction also operate as the front run of the first normal sandwich. 

TX2: Victim TX. Swap ETH for ide.

• Steps 0 - 4: The victim swaps ETH for ide in the Uniswap V2 pool, suffering the loss of receiving less ide than they should be because of the front run done by Jaredfromsubway.eth.

TX4: Split Front Run 2. Swap WETH for ide.

• Steps 1 and 2 increase the rate of WETH against ide in the Uniswap V2 pool, making this transaction also operate as the front run of the second normal sandwich. 

TX5: Victim TX. Swap ETH for ide.

• Steps 0 - 4: The victim swaps ETH for ide in the Uniswap V2 pool, suffering the loss of receiving less ide than they should be because of the front run done by Jaredfromsubway.eth.

TX6: Split-Front-Run Sandwich Back Run. Swap ide for WETH.

• This transaction acts as the back run of the Split-Front-Run sandwich.

• Steps 1 & 2: Jaredfromsubway.eth swaps back WETH with ide, pocketing the gain from the Split-Front-Run sandwich concerning the Uniswap V2 pool for WETH and ide. 

Key Addresses

• The oval labeled “to MEV bot 0x6b75” is the sandwich contract used by Jaredfromsubway.eth.

• The pentagon labeled “from 0xae2…fae13” is the EOA of Jaredfromsubway.eth.

• All other pentagons labeled “from…” are victims’ EOAs. 

Key Factors

Why the group of TX1, 3, and 4 is a sandwich instead of a JIT? 

We placed TX3 of the sandwiched user at Position 1 of this block for simulation. The returned result showed success, and the user only needs to put in fewer GROK to exchange for 11 WETH in the sandwiched pool,  which would happen if this were a JIT. In actual execution, the user incurred a loss because of Jared's liquidity operations, effectively acting as the front run and back run of a sandwich attack.

Why did the adding liquidity action not mint a Position NFT? 

By invoking the ABI, you can skip the minting of Position NFTs and directly add, remove, or adjust liquidity.

What’s the Profit and Loss of this strategy? 

The intertwining of the two sandwiches makes the PnL calculation mind-boggling. To avoid confusion, we only give the results. 

• The net gain of the Swap-JIT sandwich: 0.046 WETH and 3592 GROK.

• The net gain of the Split-Front-Run sandwich: 0.031 WETH.

Based on the contemporary prices, this strategy brings about $80 profit to Jaredfromsubway.eth.

Why was TX2 not put behind TX4?

We simulated putting TX2 to Position 1, and the result was that the victim could have received more ide with 0.1 ETH, proving this transaction suffered a loss caused by the Split Front Run 1 transaction.

However, when we put it to Position 5, the simulation failed, resulting from the victim’s slippage setting. Thus, Jaredfromsubway.eth could not bundle this transaction with TX5, the other victim, which was why Jaredfromsubway.eth had to split the front run into two transactions. 

The amount of Split Front Run 1 has to ensure the success of TX2, whose same direction exchange also helped push up the price of ETH against ide. Our calculation proved that Jaredfromsubway.eth’s first Split Front Run’s swap amount WAS based on TX2’s slippage, demonstrating the attacker’s expertise.

Want to learn more about DeFi strategies to enhance your trading? Visit our Head First of DeFi to decode the DNA of DeFi Transactions & Strategies.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Have you ever considered creating your own stablecoin? What if you could back it with diverse assets to ensure stability and reduce risk? The Reserve protocol makes this possible by offering a decentralized platform that functions like a central bank but without centralized control.

In traditional finance, stable currencies are backed by reserves held by central banks. The Reserve protocol mirrors this concept by backing its stablecoins, known as RTokens, with baskets of tokenized assets. These assets are diverse, which helps minimize the risk of value loss. Unlike traditional banks, the Reserve protocol allows anyone to issue a stablecoin with their preferred assets and governance structure.

The protocol also supports over-collateralization, ensuring stability even if some assets in the basket fail. This means that RTokens have an added layer of security, maintaining their value in uncertain market conditions. Additionally, the use of yield-bearing collateral enables revenue generation, providing an incentive for users to participate in the ecosystem. This combination of flexibility, security, and potential for revenue makes the Reserve protocol a special solution for creating stable currencies in the decentralized finance space.

Strategy One-liner

In 44 steps via Balancer, Curve, Enso, Kyber, and Solidly, a big whale uses the Reserve protocol to mint 323.522 ETH+ by swapping 330.2836 WETH for sfrxETH, rETH, and wstETH.

Simplified Illustration

We omit the transfer from the whale’s contract to the Reserve protocol for clarity.

Big Picture

https://bit.ly/3TvLhOY

Key Steps

We break the 44 steps of this transaction into four stages. Step 0 transfers the whale’s contract to the Reserve protocol’s Zapper Executor contract, which acts as an asset-exchanging router. 

Stage 1: Reserve Zapper Executor Swaps WETH for stETH.

• Step 1: Zapper Executor sends 110.3241 WETH to Kyber Network’s router. 

• Steps 2-5: Kyper router exchanges 15.4454 WETH for 15.4465 stETH via a Solidly V3 pool.

• Steps 6-9: Kyper router exchanges 7.7227 WETH for 7.4527 stETH via the Maverick Protocol.

• Steps 10-15: Kyper router exchanges 39.7167 WETH for 39.7188 stETH via the Balancer V2 Protocol.

• Steps 16-19: Kyper router exchanges 47.4394 WETH for 47.4419 stETH via the Curve Protocol.

• Step 20: Kyper router sends 110.0599 stETH to the Reserve Zapper Executor.

Stage 2: Reserve Zapper Executor Swaps WETH for frxETH.

• Step 21: Reserve Zapper Executor sends 109.5534 WETH to Kyber Network’s router.

• Steps 22-25: Kyper router exchanges 88.7382 WETH for 88.8782 frxETH via the Curve Protocol.

• Steps 26-28: Kyper router exchanges 20.8151 WETH for 20.8481 frxETH via the Curve Protocol.

• Step 29: Kyper router sends 109.7262 frxETH to the Reserve Zapper Executor.

Stage 3: Reserve Zapper Executor Swaps WETH for rETH.

• Steps 30 - 32: Reserve Zapper Executor sends 110.4061 WETH to EnsoShortcuts contract for 99.4235 rETH via Enso and a Uniswap V3 pool.

Stage 4:Reserve Zapper Executor Generates ETH+ RToken.

• Steps 33-34: Reserve Zapper Executor wraps 109.7262 frxETH as 100.7020 sfrxETH.

• Steps 35-36: Reserve Zapper Executor wraps 110.0599.stETH as 94.0702 wstETH.

• Steps 37-41: Reserve Zapper Executor sends 100.7020 sfrxETH, 93.7849 wstETH, and 98.9566 rETH to its BackingManager contract and mints 323.5220 ETH+ that is sent to the whale’s contract.

• Steps 42-44: Reserve Zapper Executor returns the exchange surplus to the whale’s contract.

Key Protocols

• Zapper Executor is a Reserve Protocol contract that executes a bundle of instructions and data from the user.

  • The Leaf node connected with Steps 38, 39, and 40 is the Reserve ETHPlus Backing Manager contract, which manages the collateral assets backing the ETH+ token. It ensures proper over-collateralization, handles yield generation and executes rebalancing operations to maintain the token's stability and value.

  • The contract labeled “FurnaceP1,” used in Step 37, is Reserve ETHPlus Furnace, designed to systematically burn a portion of the protocol's revenue. By reducing supply and distributing value to token holders over time, this could potentially increase the value of ETH+ tokens.

• Solidly Protocol is a decentralized exchange optimized for trading like-kind assets (e.g., stablecoins). It incentivizes users to lock their SOLID tokens to vote on token pair incentives.

• Maverick Protocol, whose address is shown as 0x0eB1C92f9f5EC9D817968AfDdB4B46c564cdeDBe, is a decentralized exchange platform featuring a Dynamic Distribution AMM (ddAMM) that optimizes capital efficiency by allowing liquidity providers to dynamically allocate assets across customizable price ranges.

• Kyber Network,  whose router address is shown as 0xf081470f5C6FBCCF48cC4e5B82Dd926409DcdD67,  is a multi-chain decentralized exchange protocol that aggregates liquidity from various sources to provide traders with optimal rates for token swaps while offering liquidity providers flexible earning opportunities.

• wstETH: wstETH (Wrapped Staked Ether) is a tokenized representation of stETH issued by Lido that maintains a fixed balance while automatically accruing staking rewards. This makes it easier to integrate with DeFi protocols and provides a more gas-efficient solution for users.

• EnsoShortcuts: Enso Shortcut is a decentralized asset management protocol that allows users to create, manage, and invest in customized on-chain investment strategies. It enables seamless portfolio rebalancing and yield farming across multiple DeFi protocols with a single transaction. We have a case study explaining how Enso Solves 73.5ETH in 116 Steps in One Transaction.

Key Addresses

• The oval “to GnosisSafeProxy” is the contract used by the whale.

• The oval “0xf08…cdd67” is the router of Kyber Network.

• The oval “0x0eb…dedbe” is Maverick Protocol.

• The pentagon labeled “leaf,” connected to Step 28, is Kyber Network’s fee address. 

The oval “leaf” connected with Steps 38, 39, and 40 is the Reserve ETHPlus Backing Manager contract.

Want to learn more about DeFi strategies like this to enhance your trading? Visit our Head First of DeFi to decode the DNA of DeFi Transactions & Strategies.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

In the crypto industry, there are always people who won’t miss a chance to take a free ride. Last year, Elon Mask’s acquisition of Twitter gave birth to memecoins like Grok and X. While these tokens hoped to freeload degens, they became the target of someone more sophisticated.

Recently, we observed 2 arbitrage transactions utilizing the loophole of SPIKE token to generate a profit of $2.1K. The pattern of these 2 transactions is not new. A transaction that happened last June exhibits the same approach, whose victim is the X token. Let’s look at this transaction to understand the new way of exploiting memecoins.

N.B.: For the sake of clarity, different figure formats will be used below. But the serial numbers of the steps are the same.

One Liner

The bot utilizes the methods of the ERC20 X token to create the arbitrage opportunity between a Uniswap V2 pool and a Uniswap V3 pool, and takes advantage of it, making a profit of $4,844.

Big Picture

EigenTX Link: https://bit.ly/3xMOYIt

From the contract page on Etherscan, we can see the EOA labeled as GROK Toekn Exploiter did all the transactions.

Key Steps

Stage 1: Prep the Uniswap V2 X-WETH pool.

Step 0: Borrow 6,493,128,478.6032 X from the Uniswap V3 pool of X-WETH.

Steps 1-6: Swap 3,431,282,845.8058 X for 23.4081 ETH at UNI-V2, and transfer 34,659,422.6849 X back to X contract as a 1% tax.

Steps 7-12: Swap 34,312,828.4581 X for 0.2006 ETH at UNI-V2, transfer 346,594.2268 X back to X contract as a 1% tax.

Stage 2: Overflow the X contract to create the arbitrage prospect.

Step 13: Transfer 2,827,595,502.6415 X back to the X contract, bringing the balance of the X token of the X contract to 10,000,346,595.226849.

The simulation on Blocksec shows the effect.

Steps 14-26: Swap 99,000,000 X for 0.2892 ETH at UNI-V2, and transfer 1,000,000 X back to X contract as a 1% tax.

The swapping of X for ETH this time triggers an internal function, X.shouldContractSwap(), returning true, which is the result of the code below:

 aboveThreshold = balanceOf(address(this)) >= swapThreshold;

The transfer in step 13 satisfies the condition: the balance of X is bigger than the threshold of 10,000,000,000. Before step 13, this code returns False.

You can find it in the contract of the X token.

Next, the X contract injects 10,000,000,000 X tokens into the Uniswap V2 pool and puts the received ETH to its deployer’s EOA.

This huge injection of X inflates its value, causing the exchange rate of X against ETH to surge to 342,323,651 X per ETH. The price gap between this Uniswap V2 pool of X-ETH and the Uniswap V3 pool of X-WETH.

We can split the steps of 14 to 26 as below.

Steps 14-18: X contract transfer 10,000,000,000 X to UNI-V2 and swap X for 41.3756 WETH, unwrap WETH and transfer ETH back to X

Steps 19-20: X contract transfer 20.4830 ETH and 20.9020 ETH to an EOA address

Steps 21-26: To address finishes the swap operation at Uniswap V2 pool and pays tax.

Stage 3: Harness arbitrages.

Step 33: To address repays the flash loan, 6,558,059,763.3892 X, to the Uniswap V3 pool of X-WETH.

Steps 34-39: To address swaps 31,457,966.2838 X for 0.1402 ETH at the Uniswap V2 pool, transferring 317,757.2352 X back to X contract as a 1% tax.

Step 40: Borrow 5.1598 WETH from a new Uniswap V3 Pool of USDC-ETH.

Steps 41-48: To address swap 5.3 ETH for 1,123,530,803.0087 X at the Uniswap V2 pool, which transfers 11,348,795.99 X back to X contract as a 1% tax.

Steps 49-50: Swap 1,123,530,803.0087 X for 7.8274 WETH at the Uniswap V3 pool of X-WETH.

Step 51: To address repay the flashloan, 5.1624 WETH, to the second UniswapV3Pool.

Steps 52-53: Unwrap 2.6651 WETH to 2.6651 ETH.

Simplified Illustration

What about the SPIKE?

Using the SPIKE token’s internal functions to create a price gap between trading venues is exactly how a later bot does arbitrage.

Take this transaction, for example, showing the same pattern with a little divergence.

Stage 1: Preparing the Uniswap V2 pool of SPIKE-WETH.

Steps 0-3: Borrow SPIKE from the Uniswap V3 pool of SPIKE-WETH, swap for WETH in the Uniswap V2 pool of SPIKE-WETH.

Stage 2: Overflow the SPIKE contract to create the arbitrage prospect.

Steps 4-10: Overflow the SPIKE contract to mint 4,206,900,000 SPIKE and inject them into the Uniswap V2 pool of SPIKE-WETH, creating the arbitrage opportunity. Here is the difference. This prospect is not between the Uni V2 pool and Uni V3 pool. Instead, it’s between the old exchange rate and the new one in the same Uniswap V2 pool of SPIKE-WETH.

Stage 3: Harness arbitrage.

Steps 11-19: Swap the left SPIKE for WETH and return the loan to the Uniswap V3 pool of SPIKE-WETH, taking a profit of $1.2K

Conclusion

The X token exploit showcases a clever way of gaming the memecoin market. These arbitrage bots can rake in substantial profits by manipulating the token's internal functions and creating price gaps between different trading venues. The Grok Exploiter follows a similar playbook, with slight variations in execution.

These incidents serve as a reminder that in the world of memecoins, especially those riding on the coattails of tech billionaires or trending topics, there's always someone looking to outsmart the system. While some might see these tokens as a quick path to riches, others view them as prime targets for exploitation.

As the crypto landscape evolves, so do the tactics of those seeking to exploit it. Whether you're a developer, investor, or just a curious onlooker, staying informed about these mechanisms can help you navigate the often turbulent waters of the cryptocurrency world.

Want to learn more about the DeFi lego? Visit our Head First of DeFi to decode the DNA of DeFi Transactions & Strategies.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Our last post explains Enso Finance’s solving transaction with 116 steps. In the description, you can find some of the tokens having the longest names:

💵 eUSD3CRV-f, 💶 cvxeUSD3CRV-f, 💷 stkcvxeUSD3CRV-f.

These 3 tokens play a critical role in the complicated transaction.

What are they? And how do they work together?

Please allow me to take you on a roller coaster ride in an amusement park to understand.

💵 eUSD3CRV-f: The Ownership Certificate

eUSD3CRV-f can be likened to a ticket that represents ownership in a shared amusement park, allowing you to earn profits from park activities. Here are its roles.

Ownership Ticket

When you invest money (eUSD and 3CRV stablecoins) in the amusement park (liquidity pool), you receive a ticket (eUSD3CRV-f).

This ticket certifies that you own a portion of the amusement park, reflecting your investment in it.

Earning Profits

Just as owning a portion of an amusement park allows you to earn a share of the profits from park activities (entrance fees, rides, concessions), holding the eUSD3CRV-f token allows you to earn a share of the trading fees generated by the liquidity pool.

Redeeming Ownership

At any time, you can use your ticket to redeem your original investment and any additional profits you’ve earned. Similarly, you can use your eUSD3CRV-f token to withdraw your share of the liquidity pool, getting back your eUSD and 3CRV, along with any accrued fees.

Summary

The amusement park represents the liquidity pool; your investment in the park is the liquidity you provide (eUSD and 3CRV), and the ownership ticket is the eUSD3CRV-f token. This token certifies your share in the pool and entitles you to a portion of the profits, just like how a ticket would certify your ownership in an amusement park and entitle you to a share of its earnings.

💶 cvxeUSD3CRV-f: The Investment Certificate

cvxeUSD3CRV-f represents staked eUSD3CRV-f tokens on Convex Finance, earning boosted rewards. Let's extend the amusement park analogy to understand this in a real-world context.

cvxeUSD3CRV-f can be likened to a certificate of deposit (CD) from a special investment bank for amusement park ownership. Here’s the detailed breakdown:

Special Investment Bank

You deposit your ownership ticket (eUSD3CRV-f) from the amusement park into a special investment bank (Convex Finance).

The bank gives you a certificate (cvxeUSD3CRV-f) representing your deposited ownership ticket.

Boosted Profits

By depositing your ticket in this special bank, you continue to earn your share of the amusement park’s profits and receive additional boosted rewards from the bank’s investment programs.

This means you get more benefits than you would by simply holding onto the original ticket.

Flexible Management:

You can manage your certificate (cvxeUSD3CRV-f) just like any other asset, potentially earning higher returns due to the boosted rewards from the special bank.

Summary

In this analogy, the special investment bank represents Convex Finance, where you deposit your original amusement park ownership ticket (eUSD3CRV-f). The certificate you receive (cvxeUSD3CRV-f) represents your staked position, providing you with your share of the amusement park’s profits and additional rewards from the bank.

💷 stkcvxeUSD3CRV-f: The VIP Certificate

additional yields on Convex Finance. Let’s continue the analogy.

stkcvxeUSD3CRV-f can be likened to a special VIP certificate from an exclusive club within the investment bank. Here are the benefits of this VIP certificate.

Exclusive Club Membership

You take your certificate (cvxeUSD3CRV-f) from the special investment bank and deposit it into an exclusive VIP club within the bank (another staking mechanism on Convex Finance).

The club gives you a special VIP certificate (stkcvxeUSD3CRV-f) representing your deposited certificate.

Additional VIP Benefits

By joining this exclusive VIP club, you receive even more benefits and additional yields on top of the already boosted rewards you were getting from the special investment bank.

This means you are maximizing your returns by taking advantage of all possible rewards.

Enhanced Earnings

Your special VIP certificate (stkcvxeUSD3CRV-f) allows you to earn the highest possible returns by leveraging both the bank’s and the club’s reward mechanisms.

Summary

In this analogy, the exclusive VIP club represents the additional staking mechanism within Convex Finance. The VIP certificate (stkcvxeUSD3CRV-f) you receive represents your further staked position, providing the highest level of benefits and rewards. This certificate signifies that you are maximizing your returns by participating in multiple layers of the investment and reward programs.

Read the post below to find out more certificates or tokens to see what benefits you can get. 👇

Want to learn more about the DeFi amusement park? Visit our Head First of DeFi to decode the DNA of DeFi Transactions & Strategies.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Enso is one of the leading solvers in the DeFi industry. During DappCon 2024, its founder, Connor Howe, announced the Enso Intent Engine, which helped Enso raise $4.2 million in funds.

During the presentation, Connor illustrated a complicated transaction to showcase Enso’s solver service. Today, let’s examine this transaction using the Head First DeFi way.

One Liner

Acting as a solver, Enso swaps the user’s 73.5 ETH for 216,661.863807 hyUSD, +276.533490 wcUSDCv3, and 80.362625 sDAI via Curve.fi, Compound, Balancer, and Uniswap.

Big Picture

EigenTX Link: https://bit.ly/45AN5el

Key Steps

Stage 1: Preparing.

Enso swaps the user’s ETH for USDC for future uses.

• Step 4-5: Swap ETH for USDC for future use.

Stage 2: Getting DAI.

Enso swaps varying amounts of ETH through a series of tokens using platforms like Curve.fi, Uniswap, and Balancer, ultimately converting into DAI.

• Step 9-26: Swap 0.5945826054 ETH -> frxETH -> WETH -> USDT -> crvUSD -> mkUSD -> FRAX -> USDC -> DAI, via Curve.fi

• Step 27-46: Swap 0.5945826054 ETH -> stETH -> frxETH -> WETH -> ELON -> USDC -> PYUSDUSDC -> mkUSD -> USDe -> FRAX -> DAI, via Curve.fi and Uniswap.

• Step 47-67: Swap 19.40115325 ETH -> stETH -> frxETH -> WETH -> USDC -> XAI -> FRAX -> USDe -> DAI, via Curve.fi and Uniswap.

• Step 68-79: Swap 0.5945826054 ETH -> frxETH -> WETH -> USDT -> USDC -> DAI, via Curve.fi, Balancer, and Uniswap.

• Step 80-87: Swap 3.339958598 ETH -> frxETH -> WETH -> USDT -> DAI, via Curve.fi and Uniswap.

Stage 3: Receiving hyUSD by staking derivative tokens.

Enso uses previous USDC and DAI to get derivative tokens, which are staked to receive the minted hyUSD being sent to the user.

• Step 88-97: Swap DAI -> USDC -> crvFRAX -> eUSD3CRV-f, via Curve.fi.

• Step 98-104: Swap eUSD3CRV-f -> cvxeUSD3CRV-f -> stkcvxeUSD3CRV-f, via Convex.

• Step 105-109: Swap USDC -> cUSDCv3 -> wcUSDCv3, via Compound.

• Step 111-113: Deposit sDAI, stkcvxeUSD3CRV-f, and wcUSDCv3 into Reserve for hyUSD.

Key Protocols

• Enso: acting as the solver for the transaction to swap the user’s ETH for hyUSD. Enso Shortcuts is the DeFi automated strategy and action engine under the hood in the token flow chart.

• Curve.fi: the intermediate exchange of ETH and other stablecoins.

• Balancer: the intermediate exchange of stablecoins.

• Convex: being built on top of Curve.fi. It allows liquidity providers (LPs) and CRV stakers to earn additional interest rewards without locking their tokens directly on Curve.

• Compound: the DeFi lending protocol. When you deposit USDC assets into the Compound, like in this transaction, you receive cUSDC tokens.

• Reserve: the DeFi platform that is designed to create stable, asset-backed currencies known as RTokens. hyUSD is an RToken issued through the Reserve Protocol.

Key Assets

ETH, WETH, USDC, frxETH, USDT, crvUSD, mkUSD, crvFRAX, FRAX, DAI, stETH, ELON, PYUSDUSDC, USDe, XAI, eUSD3CRV-f, CRV, CVX, eUSD3CRV-f-gauge, cvxeUSD3CRV-f, stkcvxeUSD3CRV-f, cUSDCv3, wcUSDCv3, hyUSD, sDAI

Here are the simplified explanations of some of the less-known tokens.

• frxETH: An Ethereum-pegged token used within the Frax Finance ecosystem.

• crvUSD: A stablecoin backed by a basket of assets, issued on the Curve Finance platform.

• mkUSD: A stablecoin issued within the MakerDAO ecosystem, typically pegged to the US dollar.

• crvFRAX: A Curve Finance LP token representing liquidity provided to the FRAX stablecoin pool.

• stETH: A tokenized representation of staked Ether on the Lido Finance platform, accruing staking rewards.

• PYUSDUSDC: A liquidity token representing a pool containing PYUSD and USDC stablecoins.

• PYUSD: PayPal USD (PYUSD) is a stablecoin issued by PayPal, pegged to the US dollar, and designed for use in digital transactions and cryptocurrency trading on various platforms.

• USDe: A US dollar-pegged stablecoin specific to its issuing platform, Ethena.

• XAI: A synthetic asset or stablecoin designed to maintain a stable value, often pegged to the US dollar, issued by the Silo Protocol.

• eUSD3CRV-f: A Curve Finance LP token for a pool containing eUSD and 3CRV stablecoins.

• CRV: The governance and utility token of Curve Finance, used for voting and liquidity incentives.

• CVX: The governance token of Convex Finance, used to manage platform parameters and earn rewards.

• eUSD3CRV-f-gauge: A staking mechanism on Curve Finance for earning rewards by providing liquidity to the eUSD3CRV-f pool.

• cvxeUSD3CRV-f: A token representing staked eUSD3CRV-f tokens on Convex Finance, earning boosted rewards.

• stkcvxeUSD3CRV-f: A token representing staked cvxeUSD3CRV-f, earning additional yields on Convex Finance.

• cUSDCv3: A Compound Finance token representing deposited USDC that earns interest over time.

• wcUSDCv3: A wrapped version of cUSDCv3, potentially for use on different DeFi protocols or Layer 2 solutions.

• hyUSD: A hybrid stablecoin issued through the Reserve Protocol, backed by a diversified asset portfolio and generating yield.

• sDAI: Synthetic DAI, a derivative representing DAI stablecoin, often used in synthetic asset platforms.

Simplified Illustration

The whole process can be illustrated using the 2 diagrams below.

Step-by-step Decoding

The table in the pictures below shows the detailed steps one by one.

• Stage: The phases mentioned above.

• Step: The steps are in the EigenTx token flow chart.

• Mint or Burn: EigenPhi adds these steps to balance protocols' bookkeeping. Many protocols employ internal bookkeeping to save gas fees. Adding Mint or Burn to the chart would make it easier to grasp the internal mechanisms, like Uniswap’s adding and removing liquidity.

• Amount: The token amount of the current step.

• Token: The token of the current step.

• Transfer from: The “from” protocol project of the current transfer step.

• Transfer To: The “to” protocol project of the current transfer step.

• Meaning: The DeFi meaning of the current steps.

Cells with orange backgrounds are the key steps of the transaction.

Conclusion

Using EigenTX bit by bit, we show you how Enso solves 73.5 ETH to over $216K worth of hyUSD in 116 steps. This demonstrates Enso’s capability to engage anyone in various DeFi strategies and simplify and enhance the user experience in DeFI.

In the future, we will break down more complex transactions for you to bring easy access for everyone who wants to tap into the future of the financial industry.

Before that, feel free to visit our Head First of DeFi to decode the DNA of DeFi Transactions & Strategies.

The The Unseen Bidding War Series:

• The Unseen Bidding War That Is Happening Every Second

• Fueling the Win: Analyzing Builders' Gas Bidding Strategy

• The Unseen Bidding War: Beaver's Craft vs. Titan's Strength

• The Unseen Bidding War: The Latest Tactic Shifts of Titan and Beaverbuild

• The Unseen Bidding War: Rsync’s Strategic Maneuvers

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

This analysis explores the relationship between two arbitrage transactions and their signals on Solana. Key observations are:

1. On the Solana blockchain, there isn't always a strong binding relationship between transactions and signals. Bots frequently issue transactions at a high frequency to capture arbitrage opportunities.

2. Built-in computation might possibly execute arbitrage.

How triangle arbitrage is executed can be found here: Transaction Details on Solscan

Triangular Arbitrage Process

• 187.48 SOL -> 17533.99 USDC

• 17533.99 USDC -> 905000000 Bonk (with change amounting to 5.0419 + 0.011969 USDC)

• 905000000 Bonk -> 1382.26 SOL

Profit and Loss Calculation

• Revenue: 1382.26 SOL - 187.48 SOL = 1194.78 SOL

• Cost: 1099.190005 SOL (paid to Jito & Validator)

  • MEV tip: 1099.19 SOL

  • Gas Fee: 0.000005 SOL

• Profit: 95.59 SOL

• CRR: 92%

Affiliated Transactions Analysis

Block Transaction Details

This section explores two transactions within Solana block 237321932, examining their interrelation and their roles in executing a triangular arbitrage strategy.

Context

1. All transactions observed in slot 237321932 were scrutinized, highlighting the transactions before and after a specific trade. Notably, a Solana block often contains a significant number of Vote transactions. The count of non-vote tx is frequently used to measure the activity level on the Solana chain.

2. Transactions appearing later in the block tend to have a higher failure rate but incur very low transaction fees, characteristic of a high-frequency trading market.

Transaction Analysis

1. Transactions in the yellow box: The transaction highlighted in yellow is the first arbitrage transaction in the block. The absence of preceding signal transactions suggests it might be conducting a strategy that doesn't require binding with signal transactions.

2. Transactions in the red box: The red box marks the arbitrage transaction and its signal transaction analyzed in this article. Further investigation reveals that these two transactions have different recent_block_hashes, indicating that their initiators referenced block hashes from distinct moments to anchor time.

According to Solana's documentation, hashes from within the last 151 slots can be used; any older ones are discarded.

Reference: Solana Documentation

A Flipside query of the block hashes corresponding to slots shows that the arbitrage transaction analyzed referenced recent_block_hash 237321866, which is 66 blocks prior.

However, the signal transaction used recent_block_hash 237321919, 13 blocks prior. This implies that the arbitrage transaction might have waited for about 53 blocks (400-600ms/block) for a signal to be packed.

Assuming the searcher acts upon seeing the signal and sends a bundle, it would take no more than 6 seconds for this bundle to be processed onto the chain.

Signal Transaction

The second transaction before the arbitrage trade was executed in the same Raydium Liquidity Pool, involving a large SOL to Bonk exchange: Transaction Details on Solscan

Input data

In Solana, a transaction's instructions are primarily composed of instruction elements. The state is directly retrieved from the token holder address using the Address Lookup feature, and the DEX contract itself does not record state information.

In this arbitrage transaction, the searcher (signature address) is D7K7GCCY76z15Za4hkRBPw7hwKfQXqKSobQFeaiL2Zu, and the Bot contract address is GzxwDvhbNcKTt4LBez3k9CuKZfuq5N3mZKYkBTKn1nKX.

A total of six sets of instructions, numbered from 0 to 5, were executed:

• Instructions 0 and 1 involve the Searcher calling the Bot contract. The Instruction Data is extremely brief but specifies account addresses. Except for the System Program, which is an official address, the other addresses are owned by the Searcher.

• Instruction 2 is related to the expenditure of the gas fee.

• Instruction 3 is the primary arbitrage instruction. The instruction data here is to be analyzed.

Analysis of Swap at Whirlpool Input

f8c69e91e17587c8
28bb0fa72b000000 # 2ba70fbb28 = 187486419752 = Amount
0000000000000000 # OtherAmountThreshold
503b0100010000000000000000000000 # 0100013b50 = 4295048016 = SqrtPriceLimit
01 # AmountSpecifiedIsInput
01 # AToB

The list includes 56 addresses pending balance status lookup, each correlating with subsequent arbitrage swap operations. For instance, the first step involves a swap between SOL and USDC on Orca, comprising one swap and two token transfer actions.

It's important to note that the Bot contract directly calls the DEX contract. The overlap between the parameters passed from the Bot contract to the DEX contract and those from the Searcher to the Bot contract can inform us about the presence or absence of built-in computation.

First Arbitrage Without a Preceding Signal

Transaction on Solscan

The instruction data '0c00' in the main arbitrage instruction strongly suggests that the operation likely did not involve external parameters.

Wrapping Up the Intricacies of Arbitrage on Solana

In conclusion, this detailed analysis discloses intricate details about the arbitrage transactions and their signals on Solana. It not only sheds light on the transaction evaluation process but also provides insight into the complexity of the triangular arbitrage strategy. From the dissection of block 237321932 to transaction instructions to the entire arbitrage process, we find several instances of low latency and high-frequency trading techniques, such as built-in computation and direct calling of DEX contracts. We also emphasize that transactions in the Solana ecosystem are not always strongly bound with signals and may operate independently as per their strategic requirements. The study of specific cases, such as the initial arbitrage without a preceding signal, further enhances this understanding. Therefore, understanding these mechanisms can provide actionable insights into the Solana ecosystem and help to devise more efficient strategies in the future.

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

In 2023, traders reshaped the landscape of smart trading with innovative strategies, from an MEV Blocker funneling 90% of backrun profits to users to a bot generating $3,098 from synthetic token arbitrage, showcasing the high-return arbitrage and strategic liquidity management.

Innovative Liquidation and Arbitrage Techniques

1. A liquidation strategy capitalized on the CRV price fluctuation during the creation of Aave's $1.6 million bad debt, culminating in a staggering $1 million profit.

2. The Shanghai upgrade was expected to have a great impact on Liquid Staking Derivatives (LSD), resulting in increased trading volume and MEV opportunities, particularly in arbitrage.

3. A bot achieved a 100x return by flash-loaning USDC and conducting a series of mints, swaps, and burns across multiple DeFi protocols, resulting in a profit of $3K.

4. By autonomously minting and burning five different synthetic tokens, a bot generated a profit of $3,098 with minimal gas fees.

Advancements in MEV Redistribution

1. With Flashbots' MEV redistribution solution, users share 90% of bundle rewards from arbitrage opportunities as a refund from the builder.

2. Wallchain's arbitrage redistribution mechanism integrates user trades, back-run arbitrage, and refunds into a single transaction, sharing profits with traders and protocols.

3. Leveraging MEV-Share’s refund mechanism, a bot earned $175K in 8 minutes by backrunning order flow for the $FCKIT token.

4. Refunding 90% of the profit generated from backrunning opportunities to the users, an MEV blocker protected them from attacks.

Manipulative Tactics:

1. By manipulating token prices through a series of well-timed transactions, the bot Jaredfromsubway.eth earned $6.3 million in three months using a sandwich attack strategy.

2. A cross-chain arbitrage bot exploited BANANA-USDC pair discrepancies for $150 in one day, proving that time is not friendly for cross-chain transactions.

3. A searcher made $27K using an idle contract and flash loans to manipulate the cDAI contract and Curve.fi’s liquidity pool.

Liquidity Management:

1. By adding and removing liquidity, bundling user swaps, and utilizing virtual contracts, a Just-In-Time (JIT) MEV bot on Uniswap V3 manipulated transactions for a $285.5 profit.

2. A market maker employed a strategy to rebalance liquidity in a Uniswap V3 pool, who swapped USDC for USDT via 1inch to maximize fee revenues, totaling $9.4 million.

From sophisticated liquidation tactics to inventive MEV redistribution mechanisms, these strategies demonstrate the complex interplay of technology and finance and pave the way for future innovations in DeFi trading. Stay informed by subscribing to our channel.

2023 Annual Review Series

• Wild Swings and Whip Lashings: 2023's Unforgettable Impact on DeFi in These Research

• The 5 Most Popular Strategy Analyses Among Our YouTube Viewers: From 290x ROI To $29K Profit

• MEV Spotlight: Unveiling the Tactics and Opportunities in MEV Arbitrage

• Special Feature: Behind the Blocks - Navigating the Silent Power Shifts in the MEV Supply Chain

• Blueprint Conversations of DeFi's Future: Profits, Protocols, and Power Dynamics Unveiled

• Crypto Capers: Exposing High-Stakes Exploits and Advanced Defenses

Tomorrow, we'll be sharing the comprehensive annual review for 2023!

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram