Imagine watching $38.2 million leave a known criminal wallet — live, on-chain, in a single transaction — and having absolutely nothing to show regulators. No traceable path. No attributable link. Not because the money was hidden in a mixer or tumbled through a chain of wallets. But because, at the transfer layer where every major forensics platform operates, the economic causality simply doesn’t exist.

That’s not a hypothetical. It happened in Ethereum Mainnet Block 15,937,667. And according to a new paper out of EigenPhi, it’s not a bug or an edge case. It’s the future of DeFi-native money laundering — and it’s already structurally generative.

The Foundation of Crypto AML Is a Graph — and the Graph Is Blind

Every major blockchain analytics platform — Chainalysis, Elliptic, TRM Labs — operates by building transaction graphs: maps of who sent what to whom, stitched together into networks of addresses, clusters, and risk scores. The logic is intuitive: follow the money. If a tainted wallet sends tokens, the taint travels with them.

This paradigm powers compliance at every major VASP, underpins FATF Travel Rule enforcement, and drives the suspicious transaction reporting obligations embedded in EU Regulation 2023/1113. It is, without exaggeration, the entire architecture of crypto financial crime detection.

The architecture rests on three assumptions:

1. Flow continuity — value migration can be reconstructed from transfer-layer observations

2. Initiator visibility — illicit actors initiate the suspicious transactions themselves

3. Endpoint linkage — transfer edges reliably proxy for who ultimately controls the funds

The new paper, PEB Separation and State Migration: Unmasking the New Frontiers of DeFi AML Evasion (Cao, Cheng & Liu, 2026), proves formally that all three assumptions collapse in composable smart-contract environments.

The $38 Million Transaction That Left No Trail

In Block 15937667 on Ethereum Mainnet, approximately 38.2 million USDC was converted into 38.1 million DAI — a near-complete asset swap at institutional scale. The source address was flagged as a phishing-linked wallet. The destination was a fresh beneficiary address. And between the two? No direct transfer edge. No detectable causal link. Nothing that transfer-graph traversal could uniquely follow.

Here’s how it worked:

A phishing-labeled address — call it P (Principal) — signed an off-chain limit order using the 1inch Limit Order Protocol. This signed intent never touched the mempool as a transaction from P. An independent MEV bot — E (Executor) — picked up the order, submitted the on-chain transaction (appearing as the msg.sender), sourced DAI via an Aave flash loan, filled the order, and routed the proceeds to a separate B (Beneficiary) address. The entire sequence is executed atomically in a single block.

At the transfer layer, what’s observable is: P transferred USDC to a contract; a contract transferred DAI to B. The economic link between P and B is enforced inside execution logic — AMM invariants, flash loan callbacks, order-fill mechanics — none of which leaves a uniquely attributable path in the transfer graph.

The authors call this PEB Separation: the functional decoupling of the intent originator (Principal), the transaction executor (Executor), and the economic beneficiary (Beneficiary). Under composable DeFi, these three roles are structurally separable. And wherever they’re separated, the foundational assumptions of transfer-based AML are violated.

The Second Attack: Making Laundering Indistinguishable from Arbitrage

PEB Separation requires a willing executor. The paper’s second contribution is more unsettling: a mechanism that requires no role separation at all.

Using a standard constant-product AMM model (the same math underlying Uniswap), the authors construct a four-step atomic transaction sequence — two back-to-back cross-pool arbitrage loops — that achieves a net economic migration of asset A from Principal to Beneficiary without any direct transfer between them. The transfer-layer footprint is observationally identical to routine market arbitrage.

Authors validated this on a real Ethereum Mainnet fork (Block 21808947), using Uniswap V2 (WETH/USDT) and SushiSwap (WETH/USDT). The results are striking:

• 10 WETH migrated from EOA P to EOA B

• Flash loan of 50.49 WETH used for the dislocation phase

• Total protocol fees: ~1.2% (four swaps × 0.3%)

• Net relocation efficiency: 93.5% — only 0.6459 WETH lost as the “cost of washing”

Put differently: an adversary can relocate significant on-chain wealth with greater than 90% efficiency, leaving a forensic footprint indistinguishable from legitimate DeFi activity. No forensic tool restricted to transfer connectivity can uniquely link the 10 WETH outflow at P to the 9.35 WETH inflow at B.

Why Fixing the Graph Won’t Fix the Problem

A natural response is: expand what we monitor. Capture internal calls. Analyze execution traces. The paper anticipates this — and closes the door.

The problem isn’t incomplete data collection. It’s a fundamental abstraction gap: economic causality in composable DeFi is enforced at the execution layer (via AMM state invariants, flash loan callbacks, intent-matching logic), but current monitoring abstracts it away into transfer-layer edge connectivity. Multiple execution paths can produce observationally identical transfer patterns. No amount of additional transfer-layer data resolves this ambiguity — because the ambiguity is baked into the abstraction itself.

This is what the authors call structural generativity: as the number of composable liquidity venues, routing layers, and MEV supply-chain participants grows, the space of undetectable laundering constructions expands superlinearly. The detection problem doesn’t scale — it degrades.

Chainalysis itself has acknowledged in public reports that attribution baselines shift as new intelligence becomes available, and that on-chain observables are frequently limited to high-level transfer metadata. The Elliptic 2024 Typologies Report similarly flags DeFi composition as a growing evasion frontier. What this paper adds is formal proof that the evasion isn’t a workaround — it’s an intrinsic property of how composable execution works.

What Comes Next

The paper doesn’t just diagnose the problem. It calls for a paradigm shift: from transfer-graph monitoring toward execution-semantic AML — systems that reason directly about call graphs, state invariants, and atomic execution logic to reconstruct economic causality, rather than inferring it from transfer edges.

This mirrors a well-worn transition in cybersecurity: from signature-based malware detection to behavioral analysis. Just as advanced malware mutates its binary signature while retaining core functionality, adversarial DeFi constructions can mutate their transfer-layer structure while achieving identical net economic migration.

The regulatory and compliance implications are significant. FATF frameworks and national regulators currently anchor obligations around identifiable intermediaries and visible transfer flows. In permissionless DeFi environments, neither is guaranteed. The authors argue — convincingly — that enforcement built on transfer observability has reached a formal boundary.

If the foundational assumption of crypto AML is broken, the industry needs to know. The tools we’re trusting to catch $38 million in motion are, provably, not equipped to see it.

Wonder if you have any misconceptions about MEV? Download our latest free e-book: MEV Myth Busters - From Microstructures to Macro Impacts.

Follow us via these to dig more into the hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

In this investigation, we dive deep into bot 0x0e49 - the most sophisticated MEV bot on Ethereum. During Black Monday’s crypto crash, this single bot executed 13 trades in ONE transaction: 8 liquidations and 5 arbitrages, perfectly synchronized.

This isn’t about speed anymore. It’s about synthesis.

🔍 CASE STUDY DETAILS

• Bot Address: https://bit.ly/0x0e49

• Etherscan Transaction

• Date: Black Monday 2024

• Strategy: Multi-strategy synthesis (arbitrage + liquidation + sandwiching)

📚 RESOURCES & LINKS

• MEV Data Dashboard: https://eigenphi.io/

• Full Research 👇

🧰 KEY CONCEPTS EXPLAINED:

• MEV = Maximum Extractable Value

• Arbitrage = Profiting from price differences

• Liquidation = Closing underwater positions

• Sandwich Attack = Front and back-running trades

• Synthesis = Combining multiple strategies

💡 WHAT YOU’LL LEARN

✅ How elite bots actually operate

✅ Why synthesis beats specialization

✅ The real MEV game theory

✅ How 0x0e49 dominates without special access

✅ What this means for regular DeFi users

🚨 IMPORTANT NOTE

This is educational content only. We do not endorse MEV bots or provide financial advice. Always DYOR (Do Your Own Research).

You can subscribe to MEV Spaces via Spotify, Apple Podcasts, and Pocket Casts.

Wonder if you have any misconceptions about MEV? Download our latest free e-book: MEV Myth Busters - From Microstructures to Macro Impacts.

Follow us via these to dig more into the hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

As we reach the climax of The Rise of the Sandwich Species, let’s retrace the evolutionary trail we’ve mapped so far—each stop revealing how Ethereum’s mempool morphed from an open river to a hyper-optimized hunting ground:

• Prehistoric Age – Gas-Auction Knife Fights: open mempools, 2,900 rebids, and the first Bancor sandwich proved that paying more gas could trap any trade.

• Assembly-Line Era – Bundle-Boosted Beasts: Flashbots’ private tunnels ended spam but industrialized MEV, handing ordering power to builders and relays.

• Predator Proliferation (A) – Flash-Loan Mega-Fauna: cross-protocol flash-loan sandwiches juggled nine-figure balances in a single block, turning liquidity itself into a weapon.

• Predator Proliferation (B) – Mirage, Assembly Lines & Camouflage: LP-targeting mirage makers, Jared’s conveyor-belt sandwiches, and tax-token tricksters showed that stealth, scale, and smart-contract bait all have their own ecological niches.

Now, in the finale—2025 Reality Check: The Jungle Never Sleeps—we’ll watch those old tricks return with Formula-1 speed, see tiny retail swaps sliced alongside whales, and ask the hardest question yet: who truly controls blockspace when predators, builders, and validators all race for the same slot?

By early 2025, the biodiversity boom had peaked—but the jungle was far from quiet. On March 12, a sandwich bot chained together six leveraged attacks in just five minutes, draining $714,000 with textbook precision. The patterns? Pure vintage 2022—single-target sandwiches, Aave-funded leverage, back-to-back Uniswap pool snipes. But the execution? Formula-1 fast. Same tricks, new reflexes.

It was a reality check for the ecosystem: evolution doesn’t just invent—it optimizes. Even as the MEV scene grows more complex, old playbooks still pay out, because most users still walk into traps unprotected. And as long as that remains true, sandwiching won’t fade—it will industrialize.

Which brings us to the real takeaway.

Five Counter‑Intuitive Truths

1. Old Tricks Still Print Money Despite four years of anti-sandwich tools, private RPCs, and wallet warnings, unprotected trades still flood the mempool. Classic sandwiches, bundled and polished, continue to harvest six-figure days. Bundle protection didn’t kill them—it industrialized them.

2. Victims Aren’t Just Whale Swaps Data show that LPs adding liquidity—or even tiny swap users—get sniped routinely. The myth that only jumbo swaps get bitten is flat‑out wrong.

3. Capital Barriers Have Evaporated Massive treasuries are no longer required. Flashloans, lending markets, and expendable meme inventories grant instant firepower. Attackers strike wherever liquidity pools form, not just on select blue-chip pairs.

4. Sandwiching Is Now an Industry, Not a Hobby Margins should have collapsed as builder fees rose and gas optimization became brutally competitive. Instead, factory-grade bots like Jared dominate through transaction reuse, bundle sharing, and hyper-targeted optimizations. Sophistication—not brute gas money—now wins the day.

5. Ordering Power Has Left the Building In Ethereum’s early years, miners decided transaction order based on gas—a crude but protocol-native mechanism. Today, that power has migrated outside the protocol. With bundles and PBS, block ordering is now outsourced to specialized builders who operate in off-chain markets, using private bids and opaque routing. The result? A more efficient marketplace—but one that concentrates power, reduces transparency, and threatens Ethereum’s neutrality at its core.

Bottom line—Where We Really Stand

Bundle protection didn’t eliminate sandwich attacks. It reshaped the ecosystem—accelerating the diversification, professionalization, and industrial scaling of MEV extraction. The unintended consequence? A broader, faster, and more specialized predator class.

But the real problem isn’t just how sandwich bots exploit the ordering mechanism to attack users—it’s the externalization of Ethereum’s core mechanism: who gets to decide transaction order. When that power moved to builders, it left the domain of public protocol and entered a world of private coordination—opening the door to centralization, censorship, and value capture by the few.

As we build defenses—wallet warnings, slippage protections, encrypted mempools—the predators adapt. This is not a static arms race. It’s a dynamic feedback loop between market structure and attacker behavior.

To break the cycle, we must go deeper:

• Rethink the economics of blockspace inclusion,

• Redesign validator-builder incentives,

• Reassert ordering logic as a protocol-native right.

Until then, the river stays crystal clear, the piranhas stay hungry, and the next generation of sandwich predators is already learning to fly.

The atomicity of bundles and the offloading of ordering power haven’t just changed how Ethereum trades are sequenced—they’ve quietly reshaped what Ethereum’s consensus even means. It’s time the community confronts this head-on.

Read the first four posts of this Sandwich history series.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Flash-loan giants showed how raw capital could weaponize composability.

But capital wasn’t the only edge. In the shadows of bundle tunnels, three even stranger predators emerged—each staking out a brand-new ecological niche in Ethereum’s blockspace.

1️⃣ Liquidity Mirage Makers stopped chasing traders and started stalking liquidity providers, inflating pool prices just long enough to trap LP deposits in a rigged window of time.

2️⃣ Jared’s Assembly Line took sandwiching from side hustle to factory floor—split bundles, JIT hybrids and multi-victim stitching that turned meme-coin pools into conveyor belts of profit.

3️⃣ Tax-Token Tricksters ditched visible ambushes altogether, hiding transfer fees and rug switches inside the token contract, then layering in sandwich bots for a triple-evil combo.

Together they prove a simple rule of the biodiversity era:

If a value path exists—even for a few milliseconds—someone will evolve to exploit it.

Let’s meet the next generation of MEV life-forms—built on illusion, scale, and camouflage.

Liquidity Mirage Makers — Not All Sandwiches Target Swaps

In the early days, MEV bots lurked behind every swap, tailing traders like pickpockets in a crowd. But a smarter predator evolved—one that stopped chasing swappers but liquidity providers (LPs).

The first case surfaced on November 4, 2022, tucked neatly inside what looked like a normal Ethereum block. A user was adding liquidity to a Uniswap V2 pool—standard behavior for an LP. But behind the scenes, a bot had already prepared a three-part ambush.

Packed together in a single bundle were:
1. a price inflation trade to distort the pool’s exchange rate,
2. the LP’s own “add liquidity” transaction—now trapped in the inflated ratio, and
3. a price correction trade to return the pool to normal and extract the spread.

The bot didn’t wait for the LP to act—it already knew what was coming. And within that one atomic bundle, it frontloaded the illusion, captured the LP’s mispriced deposit, and backloaded the profit.

Then came the real slaughter.

On January 20, 2025, a whale added 9.95 wBTC (~$870K) to a Uniswap pool—without setting amountAMin, the only guardrail against slippage. The attacker executed the same blueprint. Curve warped, deposit landed, price snapped back. The LP got dust. The bot got the bag.

What makes LP ambushes so insidious is their subtlety. They use low gas, evade mempool detection, and hide in clean-looking blocks. On the surface, it’s just a liquidity provision. Underneath, it’s a mirage—a rigged price window engineered just long enough to rob the depositor blind.

Jared’s Ascendancy — Apex Predators

The bundle tunnels soon echoed with bigger footsteps.

It began on April 3, 2023, with a shock to the system: a rogue validator exploited a timing vulnerability in MEV-Boost, front-running multiple sandwich bots and siphoning off ~$20 million that was meant for builders.

It was a brutal reminder that even predators have predators, and that validator power could be weaponized with surgical precision.

The impact was immediate—several top-performing sandwich bots were hit hard, with significant profit losses and operational setbacks.

For a time, sandwich activity visibly contracted, as searchers recalibrated their strategies and reconsidered the risks of competing in an increasingly hostile and validator-aware environment.

But the void didn’t last long.

In May 2023, a new name roared to the top of the MEV food chain: jaredfromsubway.eth. Armed with hyper-optimized bots and riding the meme-coin frenzy, Jared spent over $7 million in gas in just weeks, eventually monopolizing 87% of all sandwich attacks. This wasn't one bot—it was a full-scale MEV production line, slicing through meme coin pools with ruthless efficiency.

By August 2024, Jared had evolved again. Jared 2.0 rolled out sophisticated tactics like split-front-run bundles and swap-JIT hybrids—clever designs where three transactions could deliver two distinct sandwiches, with zero wasted movement. Bundles were now shared, costs amortized, and victims stacked side by side. With transaction reuse, just-in-time liquidity, and multi-victim stitching, Jared slashed per-attack costs to the bone. Even tiny retail swaps—once unprofitable to target—were now viable prey.

This wasn’t just an MEV strategy. It was predation as a platform—a scalable, automated, precision-crafted pipeline where capital efficiency, not capital size, determined dominance.

Tax-Token Tricksters Camouflage & Triple-Evil Combos

When the mempool jungle got too competitive, some predators learned to hide in plain sight—donning smart-contract disguises and booby-trapped tokens to lure in unsuspecting prey.

Some attackers will split front-runs across multiple EOAs to bypass per-transaction token limits, carefully timed the back-runs to collect taxed tokens.

One of the most grotesque examples came in 2024, with a token called Yield Stone. On the surface, it looked like just another meme coin. Underneath, it was a trap—a 35% transfer tax, a hidden rug-switch, and a backdoor coordination with a sandwich bot. The result? A 94-layer mega-sandwich that ensnared 74 victims in a single block. It wasn’t just a sandwich. It was a triple combo of front-running, taxing, and rug-pulling, all executed in one atomic bundle.

Wrap-Up

What began as simple sandwiches in the mempool has now evolved into a full-scale arms race of composability, disguise, and precision.

In this era, we saw attackers move beyond the swap—targeting liquidity providers, borrowing massive capital across chains, and embedding themselves deep within protocol logic. Flashloans became tactical bridges. Bundles became multi-victim containers. Tokens themselves were weaponized.

Each new predator brought its own twist:

• Leverage Raiders rewired DeFi’s plumbing to move whale-size capital with pawn-size wallets.

• Liquidity Mirage Makers preyed on good-faith LPs by crafting price illusions timed to the millisecond.

• Jared’s Assembly Line transformed MEV from a craft into an industry, scaling attacks by optimizing every step of the sandwich.

• Tax-Token Tricksters blurred the line between protocol and exploit, hiding multi-stage rug-pulls inside tokens that begged to be touched.

Together, they turned bundle tunnels into a breeding ground for specialized MEV lifeforms, each adapted to a niche of capital, timing, or deception.

But beneath the surface, pressure was building. Builders were consolidating. Validators were watching. And defenses—some structural, some cryptographic—were beginning to emerge.

Coming Up Next: 2025 Reality Check — Old Tricks, New Speed

Think the predator boom has peaked?

Not even close.

In the series finale we jump to today’s blockspace, where:

• ⚡ Six sandwiches land in five minutes — vintage tactics turbo-charged by auto-tuning code and zero-latency relays.

• 🥪 Tiny retail swaps (yes, even your coffee-size trades) get sliced alongside whales.

• 🔁 Defense tools trigger a new feedback loop: every wallet warning, private RPC, and encrypted mempool spawns an even faster counter-measure.

• 🏛️ Protocol questions turn existential — who really decides your transaction order now, and what happens if builders, relays, or validators blink?

Same playbooks, Formula-1 reflexes, and a widening gulf between protected and unprotected flow.

The jungle never sleeps; it just upgrades.

Subscribe to catch Part 4 — The Jungle Never Sleeps as soon as it drops.

Read the previous parts of this series:

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

🧬 Previously on The Rise of the Sandwich Species

In Part 1, Ethereum’s mempool was an open jungle—every transaction visible, every slippage setting a beacon. Primitive bots fought in gas-price knife fights, birthing the first sandwich attacks in a chaotic era of spear-and-stone warfare.

In Part 2, Flashbots built private tunnels beneath that jungle. Bots evolved. With sealed bundles, they gained atomic execution, invisibility, and coordination. What started as a defense for users became a factory for precision predators—MEV industrialized.

But evolution didn’t stop at speed or stealth.

It diverged.

Welcome to the age of biodiversity and specialization. Today, we will be focusing on Sandwich bots enabled by flash loans, due to the limit of Substack posts.

Tunnels Spawn New Life

When private tunnels first sealed off Ethereum’s chaotic mempool, many thought the worst was over. Predators would be tamed. Victims would be safer. Order would return.

They were wrong.

Instead, the tunnels created a fertile darkness—an ecosystem where the smartest predators didn’t just survive. They evolved.

In that darkness, new life-forms bloomed. Bigger, stranger, faster. Below, we trace four of the strangest—and most important—life-forms that crawled out of the bundle era.

Leverage Raiders — Flash-Loan-Powered Mega-Fauna

Why settle for what you own when DeFi lets you borrow millions for free? In the bundle era, some predators figured out how to punch far above their weight—not by bringing more money, but by borrowing physics itself. Two landmark attacks charted this evolution.

The Flashswap-Backed Borrower

This wasn’t your typical flash loan. It was something more elegant—and a little sneakier.

On August 3, 2022, the attacker kicked things off with a flashswap on Uniswap V3, pulling out 8.7 million USDC—but with a ticking clock. As with all flashswaps, the borrowed tokens had to be repaid within the same transaction. So how did they turn this short-term loan into a market-moving sandwich?

The trick was composability.

The attacker immediately deposited the 8.7M USDC into Aave, using it as collateral to borrow 4,297 WETH. But Aave requires over-collateralization—you can’t borrow the full value of your deposit. To bridge the gap, the attacker chipped in 1,250 WETH of their own funds, just enough to make the math work and complete the flashswap repayment.

That handled the frontrun.

Then came the backrun. After the victim’s swap was executed—inevitably at a skewed and painful price—the attacker flashswapped 5,572 WETH from the same Uniswap pool. 4,297 WETH was used to repay the Aave loan, reclaim the USDC collateral, and transfer that 8.7M USDC back to settle the original flashswap. The full lending position was opened and closed within a single bundle.

The result? The attacker sandwiched the victim, used the victim's price impact to generate profit, and walked away with no residual debt, no liquidation risk, and no open positions. The only cost was the bridge capital—a temporary 1,250 WETH—to meet Aave’s over-collateral requirement, and a juicy tip to the builder.

This wasn’t a simple frontrun. It was a capital origami trick, folding flashswaps and collateralized lending into a seamless, delta-neutral bundle. Effectively, they built a leveraged sandwich, nearly 4.5x their starting volume thanks to composability.

The Flash-Loan Leviathan

Then came the beast.

On November 30, 2022, a bot orchestrated what may be a watershed moment in sandwich evolution—not because it was the largest, but because it pushed sandwich to its structural and economic limits. The attacker coordinated $154M in assets across four protocols to intercept a whale’s swap on Curve, but the brilliance lies in how they shaped liquidity, not just chased it. The victim’s minimum acceptable return (min_amount) was set at 20,609,403.45 USDC—they received 20,609,422.16 USDC. The difference? Just 18.71 USDC. Yet the attacker walked away with 9,790.17 USDC in profit, extracted by manipulating pool pricing through a pair of precision-timed swaps.

It began with a massive 127,006 WETH flash loan—borrowed in a blink from Balancer.

Armed with some personal funds (≈50 ETH, 77,000 DAI, and 261,000 USDC), the attacker rushed to Aave and posted everything as collateral. This opened the door to borrow a colossal 49 million DAI—the perfect amount to ambush a whale-sized swap on Curve. See the black path in Fig. 4.

Once the DAI was in hand, it was converted via the Curve pool for 49 million USDC. But the attacker didn’t stop there. They then passed this USDC through MakerDAO’s PSM, converting it 1:1 back into DAI—neatly closing the capital loop.

Swapping DAI to USDC on Curve came at a price: slippage. The attacker didn’t get quite enough DAI to fully repay their Aave loan. But it’s enough to withdraw part of the original collateral (127K WETH), and fully repay the Balancer flash loan within the frontrun transaction. See the pink path in Fig. 4.

At this point, Aave’s position was still open, with 27,244 DAI in unpaid debt. But the attacker wasn't done. That was just Act I.

In the backrun transaction, they struck again—this time in reverse.

Once the victim's trade inflated the Curve pool price, the attacker again flash-borrowed 127,006 WETH, re-collateralized it on Aave (alongside existing leftover collateral), and borrowed 49,038,215 USDC. This USDC was now more valuable, thanks to the victim's trade. The attacker swapped it back to DAI on Curve—this time getting 49,075,250 DAI due to favorable price impact.

From this, 27,244 DAI was used to fully close the Aave debt position from the frontrun. The rest? Sent back to MakerDAO for another round-trip conversion into USDC. With this, the attacker cleared the new Aave loan, reclaimed all remaining collateral, and repaid the flash loan once again.

What was left over? Profit, of course. No debt. No exposure. Just an immaculate, cross-protocol, delta-neutral value extraction.

It was a textbook symphony of DeFi composability—Aave, Curve, Maker, Balancer—each touched just enough to do their job, but not enough to realize they were part of a 9-figure ambush.

The following summary captures the attack’s key performance metrics and highlights just how exceptional it was in scope and execution.

Ecological impact. Flash-loan composability turned the size-of-treasury moat into a mirage. Any coder with a weekend and a good sandwich recipe could marshal nine-figure firepower, hit multiple venues, exit delta-neutral and leave nothing but ripples. Capital efficiency became a weapon; the food chain had to adapt—or get swallowed.

The August and November 2022 attacks represent two milestones in the evolution of sandwich strategies.

The first case introduced a leveraged sandwich model, using flashswaps and Aave lending to amplify capital with minimal risk. It was precise, low-capital, and efficient—marking the shift from simple frontruns to structured financial maneuvers.

The second case took this to another level: a $154M cross-protocol operation, combining flashloans, lending, stablecoin conversion, and Curve pricing dynamics. Its goal wasn’t just profit—it was maximum MEV extraction through liquidity control.

What distinguishes these cases is not just their scale, but their strategy: the attacker used DeFi protocols as building blocks to reshape transaction flow, pricing, and risk—inside a single bundle. Together, they signal the rise of a new MEV archetype: the liquidity engineer, not just a searcher.

The next post will showcase the other three sandwich varieties in the age of biodiversity.

Read the first two parts of this series.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

The first part of this series has reviewed the prehistoric age of Sandwich MEV.

Now let’s move on to the industrial age.

Tunnels Under the Jungle

By mid-2020, a tidal wave called DeFi Summer crashed across the landscape. Decentralised‑exchange (DEX) volume had jumped twenty‑fold. Millions of dollars pulsed through mempools every hour. Slippage limits flashed like neon signs.

For sandwich bots, it was a dream come true, entering a period of MEV gold rush Ethereum had ever seen. Gas wars became daily bloodsport. The pressure was mounting on Ethereum’s block producing model.

Beneath the surface, Ethereum’s long-term roadmap was starting to bite. Two proposals loomed:

• EIP‑1559 would start burning part of every gas fee, cutting miner rewards and smoothing fee predictability.

• Proof‑of‑Stake would eventually replace Proof‑of‑Work mining entirely, reshaping Ethereum’s security and block production.

Both moves pointed to thinner block rewards. Some mining pools began hunting for replacement income—and they didn’t bother to hide it.

One top pool posted a blunt announcement: we will sandwich user trades and share the profits with pool stakers. The message landed badly; traders called it extortion, researchers called it a security risk. And someone decided to teach the pool a lesson.

A lone bot submitted a honeypot swap that looked like free money to the pool’s new strategy. The pool’s nodes dutifully front‑ran the bait—and lost ETH instead of earning it. Overnight, the memo was clear: in the open mempool, bragging makes you a target.

Paradigm’s Dan Robinson published "Ethereum Is a Dark Forest." The essay compared the mempool to sci‑fi wilderness: show your coordinates and you’re instantly hunted. The phrase caught fire on Crypto Twitter. More importantly, it called for private coordination—a way to trade without broadcasting your intentions to every predator.

The promise was simple: if chaos ruled the open road, build tunnels underneath. And the predators? They adapted—fast.

Flashbots Builds the Tunnel

Enter Flashbots and its modified client, MEV‑Geth. Instead of shouting higher gas bids in public, searchers could now seal several transactions into a bundle and send it straight to cooperative miners. Miners opened sealed bids, picked the fattest tip, and published the winning bundle atomically: all trades landed at once or none did. And if a bundle lost the sealed-bid race, it stayed invisible and never hit the chain—meaning no wasted gas fees for the searcher.

Within months, over 80 % of hash‑rate was processing bundles. Competitors like Eden Network and ArcherDAO popped up, but Flashbots remained the main tunnel.

New Life‑Forms Emerge

However, private tunnels didn’t just protect honest users—they empowered smarter predators. With sealed bundles came new powers: atomic execution, invisibility, and tip‑based prioritization. Sandwich bots adapted quickly. And the strategies they evolved weren’t just upgrades—they were mutations.

Here’s how the new species looked in the wild:

The Sandwich Gets Sandwiched

In the early days of this era, not all bots adapted fast. Some continued playing the old game—broadcasting their frontruns openly in the mempool. That made them easy prey.

In one now-iconic case, a legacy bot tried to sandwich a user’s swap, submitting its front‑ and back‑runs through the public queue like it always had. But a bundle‑savvy rival was watching. Within seconds, it assembled its own private sandwich targeting the first bot’s transactions—not the user’s. It bribed the miner with a 569‑gwei tip, slipped its bundle ahead, and extracted the value for itself.

The old bot paid gas... and got nothing. The sandwich got sandwiched.

Not All Bundles Are Predatory – Meet JIT Liquidity

While many predators used bundles to sharpen their attacks, not every use case was hostile. One particularly clever—and arguably beneficial—strategy emerged: Just-In-Time (JIT) liquidity (EigenPhi has published a report, MEV’s impact on Uniswap, covering JIT).

Imagine this: a swap is about to happen, but the liquidity in the pool is thin. A JIT provider sees the swap, adds liquidity just before the trade, collects a share of the pool’s trading fees, then removes that same liquidity right after—all in a single atomic bundle.

From the outside, it may look like a sandwich. But the result is different:

• The user’s slippage decreases thanks to the temporary boost in liquidity,

• The JIT bot earns LP fees, and

• No value is extracted from the user—only from the protocol’s fee distribution.

Even more interesting: this behavior mimics a swap, but without paying Uniswap’s native swap fee. The JIT strategy is capital-efficient, protocol-aligned, and shows that MEV isn’t always adversarial. Sometimes, it’s fee arbitrage with benefits.

One Bot, Dozens of Victims

Before bundles, sandwich attacks were typically one‑to‑one: spot a user’s swap, wrap it with two trades, make a profit. But bundle protection enabled a new trick—atomic stacking.

By grouping many swaps into a single bundle, a bot could target dozens of victims simultaneously, executing all layers in one go or not at all. The result was industrial‑scale sandwiching.

In one real‑world example, a bot launched a 37‑layer sandwich that hit 35 victims in a single block. It was soon outdone by a 54‑layer monstrosity. Each layer was calibrated with precision: how much slippage could be taken, and in which direction to attack.

The age of artisanal sandwiches was over. This was automated lunch‑meat production.

Why Bundles Changed Everything

These weren’t just clever tricks. They were evolutionary leaps—mutations made possible by the privacy and precision of bundle execution. In the old mempool jungle, every predator had to show its teeth. Every frontrun was visible, every move a gamble. But bundles changed the rules of survival itself.

First came atomicity: a guarantee that your front-run and back-run would either succeed together or not at all. No more half-baked attacks. No more wasted gas.

Then came hidden contents: The chaos of public gas wars gave way to quiet, sealed auctions—managed by relay operators who throttled spam and favored strategic bidding over raw noise. While bots could still adjust and resubmit their offers, the process became private, orderly, and largely invisible to rivals.

But bundles didn’t eliminate all risks. They merely shifted them. What’s often overlooked is how these bundles altered Ethereum’s power structure. In the PGA era, miners set the order of transactions by gas bids—chaotic, yes, but directly tethered to Ethereum’s protocol. Bundles broke that tether. With Flashbots, ordering power migrated to whoever controlled the most compelling bundle—often private actors coordinating off-chain, bidding for inclusion via out-of-band tips. It was the birth of a new off-protocol layer, one where execution priority depended not on Ethereum’s rules, but on relays, builders, and private negotiation.

And when Ethereum moved to Proof of Stake, this trend deepened. With Proposer-Builder Separation (PBS), validators outsourced block construction to professional builders entirely—externalizing ordering rights as a formalized role, not just an emergent side-market. This makes the blockspace economy more efficient—but also more hierarchical. The original dream of trustless, protocol-native fairness now runs through builder relays that can reorder, throttle, or censor with little visibility. Efficiency improved, but power consolidated.

The biggest problem of the PGA era—spam flooding the public network—was replaced by a new vulnerability: centralization inside bundle tunnels. Now, relay operators sat at critical chokepoints. They could throttle, reorder, or even censor transactions—raising fresh concerns about trust, fairness, and resilience in this newly privatized layer of the food chain.

Wrap-Up the Era

• Private tunnels replaced public gas wars.

• Atomic bundles turned sandwiches into industrial assembly lines.

• Tip auctions rewarded clever strategy over noisy bidding.

The open jungle didn’t disappear; it simply moved behind a curtain. And in the shadows of this new architecture, a darker class of predators was learning new tricks.

Coming Up Next: The Biodiversity Boom

Private tunnels didn’t tame the jungle—they fertilized it.

In the next chapter, we trace the explosion of new predator species:

🦾 Bots that borrow millions without owning a dime

🎭 Tokens engineered to tax, trap, and rug

🧠 Jaredfromsubway.eth turning MEV into an assembly-line empire

From liquidity mirages to 94-layer sandwiches, MEV isn’t just evolving. It’s speciation on-chain.

Stay tuned for Part 3: Predators Evolve – The Biodiversity Boom.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

In the hidden lanes of Ethereum’s blockspace, a new kind of creature has evolved—stealthy, adaptive, and precision-engineered for profit. These aren’t just bots. They are financial predators with a genetic lineage shaped by protocol quirks, mempool mechanics, and incentive asymmetries.

This multiple-part series dives deep into the evolutionary history of sandwich MEV—one of the most misunderstood yet impactful phenomena in the crypto ecosystem. We’ll track how this strategy morphed from single-line scripts to industrial-scale operations, revealing what each transformation tells us about the economics, architecture, and future of Ethereum itself.

If you think sandwiching is just front-running whales, think again.

Welcome to the Mempool Jungle

Picture Ethereum’s mempool as an endless Amazon River at night: crystal‑clear water, every fish illuminated by a flashlight…while piranhas circle with sniper goggles. Transparency gives us radical auditability—but it also lets predators stalk their prey with millisecond precision. Sandwich attacks are those piranhas. And, like real species, they’ve been evolving fast.

Here is how the story of Sandwich begins.

Gas‑Guzzling Guessers – How Ethereum’s First Predators Learned to Hunt in the Pre‑industrial, “spear‑and‑stone” hunting Era

A Bite Called “Sandwich”

Imagine you’re at an open‑air market, ready to swap apples for oranges. Just as you hand over your basket, someone darts in front of you, buys the last cheap oranges, watches you pay the marked‑up price, then sells those same oranges back at a tidy profit. On Ethereum that maneuver is called a sandwich attack: a bot places one trade just before yours and one just after, trapping you in the middle and pocketing the difference.

Why could it happen at all? Because in Ethereum’s early days the checkout line was sorted by gas price—pay more and you cut to the front.

Enter the Priority Gas Auction

Back in 2014, during Ethereum’s crowdsale, a curious Redditor already asked, “What stops miners from putting their own transactions ahead of mine?” That innocent question foreshadowed the gas‑price bidding wars to come.

With no other sorting rule, trading bots soon turned the mempool into what researchers later dubbed the Priority Gas Auction (PGA). Think of a street auction where every bid must exceed the last by a few pennies—but here each bid is a replacement version of the same transaction, broadcast again and again with a higher fee.

A famous chart from the paper Flash Boys 2.0 captures the frenzy: two bots spotted the same arbitrage, raised their gas bids 2,900 times in fifteen seconds, and drove the price of inclusion from 25 gwei to 8,800 gwei. One bot won; the other burned money on thin air.

2018 — Theory Meets Reality on Bancor

The earliest confirmed sandwich was excavated by 1inch in February 2018.

• A bot paid 37.9 gwei to slip a small buy order into a Bancor pool.

• An unsuspecting trader followed at 33 gwei, buying tokens at a suddenly worse rate.

• The bot immediately sold at 32.9 gwei, restoring prices and netting almost a tenth of an ETH—small in dollars, but priceless as proof of concept.

From that moment, the sandwich moved from whiteboard speculation to everyday hazard.

The Hidden Cost of the Gas War

Within just a couple of years, the mempool looked less like an orderly queue and more like rush‑hour traffic—horns blaring, everyone inching forward by overpaying. The PGA created two systemic aches:

1. Winner‑takes‑all economics. Only the top bid earned profit; every loser still paid real gas, like gamblers covering the house edge.

2. Fee inflation for bystanders. As bots escalated, average transaction costs rose for everyone else. Even slippage settings—meant to protect traders—acted as neon tags telling bots exactly how much value they could safely steal.

All told, the on‑chain incentive scheme no longer felt fair: honest swappers subsidised high‑frequency gas wars, and the whole network groaned for a remedy that could level the playing field.

Wrapping Up the Era

Open mempool, frantic gas spam, and a knife‑fight where predators sometimes slashed one another—this was Ethereum’s spear‑and‑stone age of MEV. The remedy would come in the next chapter: sealed‑bid bundles that whisk trades out of the public queue and into quieter, private tunnels. But as we’ll soon see, a safer road for users also became a super‑highway for a new generation of predators excelling at atomic ambushes, tunnel warfare, and financial camouflage.

Coming Up Next: Gas Wars to Bundle Tunnels

In the next chapter, we follow the rise of Flashbots, the sealing of Ethereum’s public mempool, and how private coordination gave predators their most powerful tool yet: invisibility.

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

In the shadows of Ethereum's block-building arena, a fierce battle has been raging - one that, until now, remained largely hidden from view. Our groundbreaking analysis, the first to dissect millions of individual bids, pulls back the curtain on this digital colosseum where builders wage their daily wars for profitable blocks.

Through the lens of bid-by-bid data, we've mapped an ecosystem where every millisecond counts and each gwei matters. The patterns reveal a ruthless evolution: builders fine-tuning their strategies with surgical precision, launching thousands of bids in carefully orchestrated sequences. But beneath this technical ballet lies a sobering reality - as strategies become more sophisticated and capital requirements more demanding, the arena increasingly belongs to a select few gladiators.

This isn't just about numbers; it's about the future of block building itself. As Titan and BeaverBuild perfect their craft, their growing dominance raises crucial questions about the path toward centralization, as revealed in our MEV Space: How to solve builder centralization crisis w/o using napkin research?

Welcome to our deep dive into 2024's most intense bidding wars, where data tells the story of power, strategy, and the inevitable consolidation of an ecosystem.

What hidden battles rage beneath Ethereum's surface? In the shadows of block building, a fierce auction dance unfolds where timing trumps raw power. Masters of this dark art orchestrate elaborate bidding sequences - feinting with low offers before striking with precision on prize blocks. Like chess grandmasters, builders weave intricate patterns of value signals and calculated retreats, turning the art of block bidding into a high-stakes ballet of profit and patience.

Think gas prices are just numbers? In the high-stakes arena of block building, every unit of gas becomes a strategic weapon. Builders wage a sophisticated battle through precise gas limit calculations and price adjustments, constantly balancing efficiency against profit potential. This technical chess match reveals how builders must master both the art of gas optimization and the science of value extraction to stay competitive in the MEV marketplace.

Want to peek behind the curtain of 1v1, Beaver vs. Titan, warfare? The numbers tell a fascinating tale: BeaverBuild and Titan's bidding patterns reveal a delicate dance of timing and volume. Both focus on blocks with 100-400 transactions, but their rhythms differ - Titan strikes earlier (T-3), while BeaverBuild waits until T-1. Though they share similar gas usage patterns (1.0-2.5M), their bid values paint contrasting pictures: BeaverBuild clusters in the 0-2 ETH range, while Titan spreads across 2-12+ ETH.

The chess masters of blockbuilding have been rewriting their playbooks constantly. June 2024 reveals a dramatic tactical evolution: BeaverBuild now strikes earlier (T-2s) but retreats faster (T+1.5s), showing a more aggressive opening but quicker endgame. Meanwhile, Titan has extended its early-game presence (before T-5s) while adopting a sharper cutoff strategy at T+2s. Among 64 builders in the arena, these giants' refined timing maneuvers showcase the ever-evolving art of bid warfare.

What makes rsync stand out in the builder battleground? Unlike its larger rivals, rsync crafts a distinctive rhythm in the bidding symphony. Their signature move? Precision-timed entries at T-1, coupled with a laser focus on blocks containing 200-300 transactions. While others spread their bets across value ranges, rsync maintains a disciplined approach to gas usage and bid values, proving that in the MEV arena, a specialized strategy can carve out a profitable niche.

Feel free to check out the first 2024 annual review post:

Next time, we will dissect some 2024 transactions that deserve the Hall of Fame. You can also click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Validators are one of the most important parts of the MEV Supply Chain. In the first nine months of 2024, validators extract 146.8K ETH, 75% of total builder rewards, including Priority Fees and Miner Tips. This conclusion, accompanied by the data we will explore below, can be discovered in our Builder Performance Analysis Dune Dashboard.

From January to September of 2024, builders earned 195,056 ETH as rewards. However, they had to pay validators 1467,787 ETH, accounting for 75% of the total.

This table shows individual builders who received more than 50 ETH rewards.

Unsurprisingly, Titan, BeaverBuild, and Rsync take the top 3 positions. A simple calculation shows that validators take 85% of their revenue while they build 74% of all the blocks.

In contrast, two searcher-builders have been enjoying the blessing from their unfair advantages: MEV Frontrunner Yoink, a.k.a. Builder “I can haz block?” who gives out 47.8% of their builder rewards, and c0ffeebabe.eth, who belongs to the same entity behind Builder “Ty for the block.” sending 54.2% of their earning to validators. Overall, Yoink and c0ffeebabe.eth only compensate validators 51% of their total income for their approvals.

The third lowest Validator Payout Percentage is from MEV Builder 0x3b, labeled Vanilla Validators. This entity has also been searching and gave 63.64% of its earnings to validators, as shown in our previous posts examining how they raked $3.5 million on Black Monday.

Next, we will show you how c0ffeebabe.eth employs its MEV power to push other builders out of competition for hundreds of eth rewards per block. And please feel free to check out our trilogy on MEV Frontrunner Yoink.

C0ffeebabe.eth’s Brewing Dominance

On Feb 23, 2024, Blueberry Protocol Foundation got exploited, resulting in a loss of 457 ETH, worth approximately $1.34M. The transaction, on Pos 0 of Block 19287289, was done by c0ffeebabe.eth, who sent the 457 ETH to the builder Ty For The Block.

This is the block’s detail from Payload.de.

Sorella Lab displays the bidding process of the block.

This block only has three transactions. The left transactions are the builder address sending ETHs to c0ffeebabe.eth related EOAs. This is the block with the highest builder reward (priority fees + builder tips) for Ty For The Block from Jan to Sept of 2024.

The second-highest builder reward is 90.6 ETH on Block 19521704, mostly from this transaction on Pos 2, back-running the two transactions swapping MDX on Pos 0 and 1 of the block.

The following images show the swapping of the first two trades.

In this Block 19521704, c0ffeebabe.eth snagged it with just a 5.5 ETH bid for the validator, outsmarting heavyweights like BeaverBuild, Rsync, and Titan, who put up over 12 ETH each, as shown in the images below captured from Payload.de.

Block 18930118 claims the third-highest builder reward with just eight transactions, all linked to c0ffeebabe.eth. Six crafty arbitrages exploit $PNDC's "mining" and "spawning" tactics to unlock opportunities.

The first transaction uses the MiningRig contract of $PNDC to mint $PNDC and gets $PEPE out of the Uniswap v3 pool, essentially exploiting the token's issuing system and raking 0.63 ETH. It gets better in the following trades.

On Pos 1, this transaction leverages the "SpawnManager" of $PNDC to get 19B $PEPE and finishes a 6.6ETH-profit arbitrage. Again, it gets better and better.

Transactions on Pos 2, 3, 4, and 5 follow the same pattern:

1. Borrow a flash loan from Balancer Labs and swap it for $PNDC via 1inch.

2. Swap $PDNC for $PEPE via "SpawnManager"

3. Swap $PEPE for WETH via Uniswap V2, making dozens of ETH as profit.

4. Transfer the profit to its own builder.

These trades on Pos 1 to Pos 5 earned 92.2 ETH for c0ffeebabe.eth, who shared 11.1 ETH with the validator.

The unfair strength of searcher-builder integration could not illustrated better than the cases of c0ffeebabe.eth and MEV Frontrunner Yoink, which has been identified by Danning of Flash Bots and other researchers in this paper, summarized by Danning in this tweet with two charts.

First 3 Quarters Performance Evaluation of C0ffeebabe.eth

Select “Ty For The Block” builder in Section 4 of our Builder Performance Analysis dashboard with the time range setting as the first nine months of 2024, and we can review its productivity with the extraordinary searching ability of c0ffeebabe.eth.

The following numbers reveal that c0ffeebabe.eth values quality more than quantity, similar to the approaches of Yoink and MEV Builder 0x3b.

Using 0.02% of all transactions, c0ffeebabe.eth earned 2,364.8 ETH builder rewards, worth about $6M, 1.21% of all builder rewards. More importantly, after deducting the validator payout of 1,281.3 ETH, its net income is 1,083.5 ETH, accounting for 2.63% of all builder net income.

The dashboard gives another proof of c0ffeebabe.eth being behind Ty For The Block.

Most of the payment for the builder comes from the EOA address 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671, whose first ten digits give the clue.

The top 2 bots in the Miner Tip Leaderboard are the MEV bots used most frequently by c0ffeebabe.eth.

Wanna find out more of its MEV trading tactics? Visit this contract portfolio page on EigenPhi.io.

If you are interested in exploring the 524 blocks built by this searcher-builder, visit this query from the dashboard.

The Rise of Searcher-Builders

The dominance of searcher-builders like c0ffeebabe.eth and MEV Frontrunner Yoink illustrates the evolving dynamics of the MEV supply chain, where validator compensation and builder rewards vary drastically based on strategic integration. While the top builders like Titan, BeaverBuild, and Rsync consistently yield 85% of their rewards to validators, entities like c0ffeebabe.eth and Yoink retain a much larger share, leveraging their MEV capabilities to minimize payouts and maximize profits. The detailed analysis of c0ffeebabe.eth’s block-building tactics reveal its exceptional ability to exploit market inefficiencies, demonstrating the growing influence and profitability of searcher-builders. As MEV strategies evolve, the balance of power between validators and builders will likely see further shifts, with those wielding advanced MEV tools poised to capture an even larger share of the rewards.

Have more questions about this worrisome trend? Leave your comment.

Wanna see how c0ffeebabe.eth managed a $5.4M arbitrage during the Vyper-Curve Exploit? Click this link or open https://bit.ly/hfdefi to visit the latest booklet: Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

This series discloses strategies and the ensuing unparalleled gains of MEV Frontrunner Yoink and the builder, "I can haz block?" being operated by them.

Click this link or open https://bit.ly/hfdefi to visit the latest booklet: Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

The The Unseen Bidding War Series:

• The Unseen Bidding War That Is Happening Every Second

• Fueling the Win: Analyzing Builders' Gas Bidding Strategy

• The Unseen Bidding War: Beaver's Craft vs. Titan's Strength

• The Unseen Bidding War: The Latest Tactic Shifts of Titan and Beaverbuild

Let’s delve into the intriguing world of Rsync’s bidding on the 921 blocks won by Titan in March 2024. With its integration with Wintermute, a well-known fact, Rsync submitted 52,985 bids to relays, roughly 1/10 of Titan’s 524,295 bids and BeaverBuild’s 546,621 records. This unique behavior could be attributed to Rsync's stable high-value order flow, a key aspect of its integration with Wintermute. 

• Concentration of Transactions: Most of Rsync's bids cluster between 200 and 400 transactions per block.

• Timing of Bids: Rsync's bids are mostly concentrated from T-0.5 to T+2 seconds relative to the block creation time (T).

When we compare Titan and Rsync data, a clear pattern emerges. Initially, Titan had a lead, submitting bids 2.5 seconds earlier than Rsync. However, the situation has since evolved, a trend we will explore later. Additionally, Titan's bids span a wider range of transaction counts, from 100 to 400, indicating a more diverse approach. 

In the diagram below, let’s look at the gas_used of bids from Rsync.

Most of Rsync's bids use between 10M and 20M gas units, with a peak of around 15M to 20M. In contrast, Titan’s bids cover a significantly broader range, including 20M to 30M gas units, as shown below.

The total number of Rsync’s bids is only one-tenth of Titan’s and BeaverBuild’s, therefore its bid value distribution is much sparser than the other two, highlighting the unique nature of Rsync's data. 

• The majority of Rsync's bids are low in value, predominantly falling between 0 and 2 ETH.

• High-value bids (above 4 ETH) are rare. The few instances of bids between 4 and 8 ETH are spread out and not clustered. 

• However, a notable outlier at 12 ETH represents an aggressive bid but is an exception rather than the norm for Rsync.

If you overlay Titan’s bid value with Rsync, the latter is hardly seen, while the former’s spread shows more variety. 

We mentioned in the last post that we now have the latest bid data, thanks to the team of flashbots. Let’s examine how Rsync adapts to the new context. 

The biggest change is the timing of bids. 

• Before: Bids were spread across a broader time range, from T to T+4 seconds, with higher-value bids spread evenly within this range.

• Now: The timing of bids is more clustered towards the block creation time, specifically from T-4 to T+0.5 seconds. This indicates a strategy shift towards concentrating bids closer to the block creation time. 

This change indicates that the tactics of The Timing Game have evolved, which can be found in Titan and BeaverBuild’s timings as well. 

Here are the key elements of Rsync's Bidding Strategy:

1. Transaction Concentration: Rsync’s bids cluster between 200 and 400 transactions per block.

2. Bid Timing: In the past, most bids occurred from T-0.5 to T+2 seconds, initially lagging 2.5 seconds behind Titan. Recent data shows Rsync’s bid timing is now clustered closer to T, from T-4 to T+0.5 seconds, similar to Titan and BeaverBuild.

3. Gas Usage: Bids use between 10M and 20M gas units, peaking at 15M-20M, compared to Titan’s broader 20M-30M range.

4. Bid Value Distribution: Bids are sparse, mostly 0-2 ETH, with rare high-value bids up to 12 ETH.

Now, we’ve done the general bidding analysis, specifically on BeaverBuild, Titan, and Rsync, and we have examined how their tactics evolved during the past 3 months to remain competitive in the bidding war. These changes highlight their adaptive strategies, emphasizing the dynamic nature of the block-building landscape in the PBS era. 

Please feel free to leave a comment about the data dimensions you are interested in.  

The The Unseen Bidding War Series:

• The Unseen Bidding War That Is Happening Every Second

• Fueling the Win: Analyzing Builders' Gas Bidding Strategy

• The Unseen Bidding War: Beaver's Craft vs. Titan's Strength

• The Unseen Bidding War: The Latest Tactic Shifts of Titan and Beaverbuild

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

• The Unseen Bidding War That Is Happening Every Second

• Fueling the Win: Analyzing Builders' Gas Bidding Strategy

• The Unseen Bidding War: Beaver's Craft vs. Titan's Strength

War, war never changes.

So is the bidding war. Today, we have the newest data to remove the fog of war.

Today, Chris Hager of flashbots announces that everyone can check out the MEV-Boost Bids Archive!

It provides data from 2024.6.3 to 2024.6.18 now, containing fields:

We downloaded and analyzed the bids of 2024.6.18, which we can see:

• There are 12,416,649 bids submitted.

• These bids were submitted by 64 builders, among which:

  • 27 builders have identifiable labels,

  • one label is “default key,” meaning the pubkeys behind this label are either default keys in mev-boost or are being used by many builders or imposters,

  • 36 builders were labeled as “BIDDING_BUILDER_” and the first 8 hex digits of their pubkeys.

Here is the chart showing the bid value from all builders.

The key findings are:

• Concentration of Bids Around Block Creation Time (T): The highest density of bids is centered around the block creation time (T), with a noticeable peak between T-3 and T+3 seconds.

• Bid Value Distribution: Most bids fall within the 0-2 ETH range, with a significant number of bids around 1 ETH.

• Higher Value Bids: There are noticeable instances of higher value bids, ranging from 3 to 6 ETH, particularly concentrated around the critical time interval (T-3 to T+3).

• Temporal Spread of Bids: Bids are spread across the entire time interval, but their frequency decreases significantly as we move away from T. Few bids are placed before T-6 and after T+6 seconds.

Let's split the data by builders.

The labels are:

We highlight the top 3 builders: @BeaverBuilder, @titanbuilderxyz, and @rsyncbuilder. Here are their bid value distribution charts.

We can summarize these charts in the table below.

However, it’s obvious that both Titan and BeaverBuild have changed a lot in terms of bidding tactics.

For BeaverBuild:

The most meaningful difference is about the bid timing.

• Before, the bid value started to increase around T-1.5s. Now, most bids come around T-2s.

• Before, BeaverBuild gradually stopped submitting bids starting from T+3s. Now, it just stops all the bids starting from T+1.5s.

For Titan:

• Titan’s bid submission used to start from T-3s, but now, it starts its engine before T-5.

• Titan used to slowly reduce its bids from T+3s, and the current tactic is more clear-cut: huge reduction at T+2s, then all stops at T+3s.

To find out more about Titan’s old strategy, visit

The BeaverBuild’s old ways of bidding can be read here:

Interested in their old ways of gas_used in their biddings?

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

The The Unseen Bidding War Series:

• The Unseen Bidding War That Is Happening Every Second

• Fueling the Win: Analyzing Builders' Gas Bidding Strategy

We’ve analyzed Titan's bidding strategy on the 921 blocks it won. It’s time to check the other 2 of the top 3 builders. We will take a look at BeaverBuild today.

Out of the 1,698,090 bids, BeaverBuild submitted 546,621 records, while Titan had 524,295. 

This chart shows the transaction counts from BeaverBuild's bids. The red dots in the chart below are transaction counts of bids for Titan’s 921 blocks.

We can summarize the following points.

• Concentration of Bids: Most of BeaverBuild’s bids are between 100 and 400 transactions. There is a significant cluster of around 200 transactions, indicating a strategic focus on this range to maximize the chances of winning. Some bids reach over 500 transactions, although these are less frequent.

• The timing of bids is concentrated around T (block creation time) with a peak from T-1 to T+2 seconds. Fewer bids are placed significantly earlier (before T-3) or later (beyond T+3) than the block time.

How is this compared to Titan? The next chart overlaps the data of beaverbuild with Titan’s. The green dots are Titan’s bids. 

We can see that: 

• Both Titan (blue) and BeaverBuild (green) show a high concentration of bids between 100 and 400 transactions.

• Titan’s on-chain bids (red dots) are densely packed around the 200 transaction mark, indicating strategic placement within this range.

• Most of Titan’s bids are submitted from T-3, while Rsync T-1. 

• The tails of the two are similar, indicating that both receive similar order flows. However, Titan submits earlier than BeaverBuild. 

The following chart is about the gas_used of BeaverBuild’s bids. 

The findings are: 

• The majority of BeaverBuild's bids (blue) use between 1.0 to 2.5 million gas units, into which most of Titan’s on-chain bids (red dots) fall.

• There is a noticeable concentration of bids around 1.5 million gas units, indicating a common strategy in the volume of gas used for BeaverBuild’s bids.

Putting the gas_used of Titan and BeaverBuild together, we have the chart below.

The diagram shows that: 

• The overlap in gas usage and timing highlights that both builders are operating with similar levels of gas efficiency.

• This similarity in strategy implies that both Titan and BeaverBuild are likely to engage in direct competition, particularly during the critical time window close to the block creation time.

Last but not least, let’s examine BeaverBuild’s bids’ value, which is shown in the chart below. 

Once again, please remember that the data is based on the 921 blocks won by Titan, meaning there is some data gravitation toward Titan. 

The diagram shows that: 

• The majority of BeaverBuild's bids fall within the lower value range of 0-2 ETH.

• There are notable clusters of higher-value bids between 6-8 ETH and a few around 12 ETH, suggesting occasional aggressive bidding to secure critical blocks.

Overlapping Titan and BeaverBuild’s bid values, we have the chart here.

The readings are: 

• Both Titan and BeaverBuild have a significant number of bids within the lower value range of 0-2 ETH.

• Titan's bid values are more dispersed across the higher value range (2-12+ ETH) compared to BeaverBuild's more concentrated lower and mid-range values.

• Titan places a considerable number of high-value bids (6-12+ ETH), especially close to the block creation time (T). 

That’s it for today. We will show you how Rsync versus Titan tomorrow.

The The Unseen Bidding War Series:

• The Unseen Bidding War That Is Happening Every Second

• Fueling the Win: Analyzing Builders' Gas Bidding Strategy

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Our last research on block bidding received great feedback from the community. One of them is suggested by antonydenyer.eth, asking about gas-related comparisons.   

Here are the charts. 

This chart shows the gas_used field of all the 1,698,090 bids for the 921 blocks. (For the data scopes, Visit the previous post.)

We can see that:

• Concentration of High Gas Amounts Around Block Creation Time (T): Most bids with high gas amounts, ranging from 1 million to 3 million units,  are concentrated within T-3 to T+3 seconds.

• Early and Late Bidding Patterns: Bids placed significantly earlier (before T-3) or later (after T+3) show lower and more scattered gas amounts, implying that bids placed too early or too late tend to include fewer transactions or lower-priority transactions, potentially reducing their competitiveness.

• Sparse Low Gas Amount Bids: Throughout the time range, there are scattered bids with lower gas amounts (below 1 million units).

Next, look at how each builder submits their gas_used in their bids. 

Here is the combined table summarizing the bidding strategies of Titan, Beaverbuild, Rsync, and other notable builders:

We have shown that Titan won a large part of these 921 blocks after the block production time T. 

It’s time to examine the gas_used. 

Here are the key findings.

• Most of Titan's bids with high gas amounts (1-3 million units) are concentrated within T-3 to T+3 seconds.

• The red dots, representing on-chain bids, are mostly concentrated between T-1 and T+1 seconds, with gas amounts ranging from 1 to 2 million units. A big part of this cluster is between T and T+1, illustrating Titan’s “Timing Game” strategy. 

• Bids placed significantly earlier (before T-3) or later (after T+3) have lower gas amounts and are less dense.

• There are scattered bids with lower gas amounts (below 1 million units) throughout the time range, but these are less frequent.

The chart below examines the average and median gas_used of the 921 blocks won by Titan. 

It shows that: 

• In most time intervals, the average and median gas values are close to each other, suggesting a relatively symmetric distribution of gas usage in winning bids. This implies that Titan's gas strategy is balanced. 

• Significant average and median gas usage peaks are observed at T-2 to T-2.1 seconds and T+1.9 to T+2. These peaks highlight intervals where Titan places especially high gas bids, which are likely to secure critical blocks and maximize MEV extraction.

Data like this reflects the broader dynamics and challenges within the Ethereum bidding ecosystem. Improved data and strategic insights are crucial for evolving Ethereum's design. From the data we can summarize that:

• The precise timing of bids around block creation time (T-3 to T+3 seconds) is crucial. Higher gas bids are strategically placed during these moments to maximize the chances of winning blocks.

• Titan's bidding strategy focuses on high gas usage during critical timing windows, leveraging significant gas bids just before and after block creation to outcompete other builders and capture maximum MEV rewards.

Next, we will show more builders’ bidding patterns to foster a more balanced and resilient blockchain environment. 

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

The Unseen Bidding War Series:

• The Unseen Bidding War That Is Happening Every Second

• Fueling the Win: Analyzing Builders' Gas Bidding Strategy

• The Unseen Bidding War: Beaver's Craft vs. Titan's Strength

• The Unseen Bidding War: The Latest Tactic Shifts of Titan and Beaverbuild

• The Unseen Bidding War: Rsync’s Strategic Maneuvers

On Ethereum, the unseen bidding war for block creation is fierce and relentless. This process, rooted in the Proposer-Builder Separation (PBS) mechanism, is where builders like Titan compete to win blocks by submitting the highest bids. PBS allows proposers to auction off the right to build a block, leading to a competitive bidding environment. However, this has also led to concerns about centralization, as dominant builders can monopolize the bidding process. The nature of this bidding war is intricate, involving precise timing, high-frequency transactions, and strategic placement of bids. Titan's success in this arena highlights the critical importance of understanding these hidden dynamics. At the same time, the high-frequency bidding environment of PBS creates significant barriers to entry for smaller builders, discouraging innovation and participation.

This article's goal is to uncover the sophisticated tactics that enable builders like Titan to consistently secure blocks by analyzing bidding data and strategies. It will also offer insights into the competitive mechanisms driving the blockchain ecosystem.

Data Scope

Our data primarily comes from 2 sources. 

• Block data: we use the mevboost-data project from @Data_Always. 

• Bidding data: the only public bid data we can get is from Eden’s MEV-Boost Bids.

• Builder labels have 2 sources: the mevboost-data project from @Data_Always, and the MEV-Boost Decomposition presentation during the 2024 TLDR DeFi Research conference. 

Due to the huge data size of bids, we only selected 921 blocks won by Titan, one of the biggest neutral block builders. From these 921 blocks, Titan received 213 ETH from parties sending all kinds of transactions. 

• Block range: 921 blocks between 19433573 ~ 19440930

• Time range: 2024-03-14 13:34:23 UTC ~  2024-03-15 14:25:47 UTC

• Number of biddings of these 921 blocks: 1,698,090

• Number of builders involved during the period: 27

Now, let’s look at how these 1.7 million biddings played out.

30,000-foot Birdview of Bidding Patterns on Block Building

This chart shows the bidding data, focusing on transaction counts of each bidding, from 27 builders regarding the 921 blocks won by Titan.

In a count-down manner, the X-axis represents the time difference (ts_diff) in seconds, showing when bids are placed relative to the block creation time, which will be presented as T in the 12-second slot. Negative values indicate bids placed after T, and positive values indicate bids placed before T.

The Y-axis represents the number of transactions in each bid, indicating the volume of transactions builders include in their bids, ranging from 0 to over 600.

Here are the key observations from the chart. 

• Before T, there are 3 obvious times seeing more bids coming: 

  • 8 seconds to T, with most bids having transaction numbers lower than 100.

  • 4 seconds to T, with most bids having transaction numbers lower than 200.

  • 3 seconds to T, with most bids having transaction numbers lower than 400.

• High Concentration of Bids During the 6 Seconds Around T.

  • There is a significant concentration of bids within the range of 3 seconds before T and even more within the 3 seconds after T.

  • This indicates that most builders focus their bidding efforts close to the block creation time and compete during the Timing Games to maximize their chances of winning. These builders try to place their bids as late as possible to maximize their chances of winning the block with the most up-to-date transactions possibly carrying more value.

• Dense Clusters of High Transaction Counts.

  • Dense clusters of bids with transaction counts between 200 and 500 are observed, suggesting that high transaction volumes are a common strategy among builders.

  • The highest density of bids is seen around T to T+2 seconds, highlighting the critical time window for placing high transaction count bids.

  • The focus on strategic, resource-intensive bidding close to block creation time may lead to over-optimization, diverting resources from network development and security.

• Early and Late Bidding Patterns:

  • While most of the bids are concentrated close to T, there are also clusters of bids from T+5 to T+10 seconds, indicating that some builders place bids too late. 

  • However, some builders start bidding as early as T-10, employing too-early bidding strategies.

  • Strategies that are either too early or too late have lower chances of winning.

• Scattered Low Transaction Bids:

  • There are scattered bids with lower transaction counts (below 100) spread throughout the range, which may be part of a strategy to maintain a presence without committing significant resources.

We can’t fully grasp the bidding overview without looking at the bidding values shown in the chart below.

The key findings are:

• Most bids fall within the lower value range: 0 - 2 ETH, showing a high density of lower-value bids, especially close to block time.

• There are noticeable clusters in the moderate range of 2 - 6 ETH, particularly around T-1 to T+4 seconds.

• Fewer but significant high-value bids, 6 - 12+ ETH, especially the majority of high-value bids, over 12 ETH, happen around T to T+ 4 seconds, indicating strategic high-stakes bidding from Timing Game players during critical moments.

• Early bids, before T-3, and late bids, after T+3, generally have lower values, typically below 2 ETH.

In conclusion, aggressive late bidding with high transaction volumes is a common approach. It gives block builders the advantage of high bid values, eventually making them winners of the bidding war. However, it also creates some level of economic inefficiencies. But you can’t blame the players. 

Now, it’s time to put specific builders into the picture. 

The Colorful Picture of Different Players in the Auction House

First, the analysis puts emphasis on the top 3 builders: Beaverbuild, Rsync, and Titan. 

Some builders, without known labels, are marked with FAILED_BUILDER and the first 8 hex digits of their pubkeys. 

Please be advised that there are builder imposters categorized under the same label: imposter. 

The label “default key,” marked in the data from the MEV-Boost Decomposition presentation, indicates that there are 2 keys either as default keys in mev-boost or as being used by many builders or imposters. 

Titan (blue)

• Transaction Count Range: Titan’s bids range from 0 to over 600 transactions.

• Bid Timing: Titan places bids from 3 seconds before the block creation time to approximately T+12 seconds.

• Bid Clusters: Titan shows a dense cluster of bids from T+1 to T+4 seconds, with the highest concentration of bids between 200 and 500 transactions.

• Insights: Titan employs a highly aggressive strategy, focusing on placing a high volume of transactions close to T. This strategy maximizes their chances by frequently updating bids and adapting quickly to market conditions. The broad range of transaction counts indicates flexibility and responsiveness to competitive pressures.

• We will have more details on Titan later.

Beaverbuild (orange)

• Transaction Count Range: Beaverbuild’s bids typically range from 0 to 400 transactions.

• Bid Timing: Bids from beaverbuild start around T. A few scenarios extend to approximately T+12 seconds.

• Bid Clusters: Dense clusters of bids are seen from T+1 to T+4 seconds, with a significant number of bids in the 100 to 300 transaction range.

• Insights: Beaverbuild focuses on maintaining a competitive edge within the crucial few seconds after T, similar to Titan but with slightly fewer transactions.

rsync (green)

• Transaction Count Range: rsync’s bids range from 0 to 400 transactions.

• Bid Timing: Rsync-builder places bids from around T to approximately T+10 seconds.

• Bid Clusters: There are dense bids from T+1 to T+4 seconds, with transactions between 100 and 300.

• Insights: Rsync-builder follows a strategy similar to beaverbuild, focusing heavily on the few seconds after T with moderate transaction volumes. 

The table below summarizes the rest of the builders’ bidding strategies. 

Now, we can color the bidding value points with the matching builders, giving us the builder bid value distribution as below.  Please remember that these are the blocks won by Titan, meaning the data is biased on Titan bidding high with more order flows.

We summarize the bid value distribution of the top 3 builders in the table below.

The other builders can be put into categories as below:

How did Titan, among all builders, win these 921 blocks? The following charts focusing on Titan reveal its secrets. 

Titan's Strategic Bidding: Analyzing 524,295 Bids to Win 921 Blocks

Of the 1.7 million bids, Titan submits 524,295. 

This chart shows the relationship between bid transaction counts and block production time T concerning Titan. The red dots indicate the on-chain bids. 

Here are key observations:

• For the on-chain bids:

  • On-chain bids are mostly concentrated between 100 and 300 transactions, with a significant cluster of around 200 transactions. The timing is mostly from T-1 to T+1, as the following chart shows. 

  • The presence of on-chain bids within the high-density bid area suggests that these bids are critical and strategically placed during the most competitive moments.

• 3 seconds before T is when Titan starts bidding, and the process usually dials down around T+3. This period is when the majority of high transaction count bids are submitted.

• There is a significant concentration of bids with transaction counts between 200 and 400,

• Less frequent but noticeable peaks in transaction counts, reaching over 600, can be observed. These peaks likely represent high-stakes bids intended to secure block production.

Again, the next chart’s data is biased toward Titan since it only shows the bids of the blocks won by Titan. The values of the on-chain bids are shown as red dots. 

We walk through the on-chain bids first. 

• For the on-chain bids:

  • The majority are low-value bids, 0 - 2 ETH. Moderate-value bids, 2 - 6 ETH, are less frequent and scattered rather than clustered. High-value on-chain bids, 6 - 12+ ETH, are rare but present.

  • On-chain bids are concentrated close to the block creation time, especially from 0 to T+1.  

• The findings regarding on-chain bids can be applied to all bids from Titan. It’s worth noting that few bids landed on-chain after T+3. 

As a result of the half million bids, Titan won 921 blocks. Let’s see what we can find from them.

A Deep Dive Into the 921 Blocks

This diagram displays Titan's winning blocks distribution based on the timing (ts_diff in seconds) of their winning bids for the 921 blocks.

Here are the key observations and insights:

• 1-Second Peak Window of Winning Blocks Close to T:

  • The chart shows a clear peak window in the number of blocks won by Titan around the block creation time: T to T+1 seconds. The number of blocks won drops sharply as we move away from this period.

  • The highest number of blocks won occurs just before T, between T and T+0.1 seconds, with the peak reaching over 80 blocks. 

• Asymmetry in Timing: The distribution is asymmetric around T, suggesting the effect of the Timing Games. 

• Sparser Wins After T+1: There are fewer winning blocks after T+1, indicating that winning bids placed after this time are less common and less successful. 

• Very Early and Very Late Bids: The chart shows few winning blocks for bids placed significantly earlier (before T-2) or later (beyond T+2) relative to the block time. This emphasizes that bids placed too early or too late are generally unsuccessful.

Next, let’s dive into the transaction counts of these blocks. The next chart shows the average (avg_num_tx, red bars) and the median (med_num_tx, blue bars) transaction counts for each time interval.

• In most intervals, the average and median transaction counts are close to each other, indicating a relatively symmetric distribution of transaction counts in winning blocks.

• The few intervals where the average significantly exceeds the median suggest the presence of some outlier blocks with very high transaction counts.

• The transaction counts tend to be lower in the intervals before T-1, suggesting that bids placed are generally less successful or involve fewer transactions.

The last chart of this post examines Titan’s average and median bid values during T-3 and T+3. 

We can see from the chart that:

• Overall, the average bid values tend to be higher than the median bid values, indicating the presence of higher-value outlier bids that raise the average. However, there are many intervals, and the median bid values are close to the average, indicating a relatively symmetric distribution of bid values.

• The average bid values peak significantly at specific time intervals, particularly around T-2 to T-2.1 seconds and T+1.9 to T+2. These peaks indicate that Titan places higher-value bids to secure critical blocks at these intervals.

In the end, let’s summarize this behind-the-scene bidding war. 

Strategic Dynamics of the Ethereum Bidding War

We look at three aspects of the battle.

• Critical Timing Window: The highest concentration of bids occurs within a few seconds before and after the block creation time (T), particularly from T-3 to T+3 seconds. This indicates that builders strategically place their bids close to the block creation time to maximize their chances of winning with the most current and relevant transaction data. The emphasis on precise bid timing in PBS, especially the Timing Games, gives builders an advantage with better infrastructure, increasing the risk of centralization.

• High Transaction Volume: Builders frequently submit bids with high transaction counts, often ranging from 200 to 600 transactions. This strategy suggests that including more transactions in a bid increases the chances of winning by offering higher potential rewards from transaction fees and MEV (Miner Extractable Value).

• Variable Bid Values: The bid values are distributed across a wide range, with most bids falling within the lower value range of 0-2 ETH. However, there are noticeable clusters of moderate (2-6 ETH) and high-value bids (6-12+ ETH), especially during critical moments close to the block creation time. This indicates a mix of conservative and aggressive bidding strategies among different builders.

Titan's Winning Strategies and Tactics

There are 3 outstanding characteristics of Titan’s way of block-building.

• Aggressive and Dominant Presence: Titan submitted 524,295 bids out of 1.7 million, highlighting its aggressive strategy to dominate the bidding landscape. This large number of bids indicates a commitment to maintaining a competitive edge by frequently participating in the bidding process.

• Strategic On-Chain Bidding: Titan strategically places on-chain bids within the critical time window, with a significant concentration close to the block creation time (0 to T+1 seconds). These bids are primarily low value (0-2 ETH), ensuring continuous presence while occasionally placing higher-value bids (6-12+ ETH) to secure critical blocks during competitive moments.

• High Transaction Count Bids: Titan's winning bids often include high transaction counts, especially within the critical window from T-3 to T+3 seconds. The dense clusters of bids with 200 to 500 transactions indicate a strategy focused on maximizing transaction volume to increase the likelihood of winning blocks and capturing higher rewards from transaction fees and MEV.

Let’s Improve the Game

The Proposer-Builder Separation (PBS) mechanism, while designed to create a competitive bidding environment for block creation, has inadvertently triggered an intense and relentless bidding war among builders like Titan. Though this system fosters competition, it has led to centralization concerns, with dominant builders monopolizing the process. The intricate nature of this bidding war, involving precise timing, high-frequency transactions, and strategic bid placements, highlights the need for better data and design improvements.

To facilitate a healthier and more robust ecosystem, it is crucial to address the barriers to entry for smaller builders and mitigate the economic inefficiencies caused by aggressive bidding strategies. Ensuring transparency and fairness in the bidding process and reducing vulnerabilities from timing games are essential steps towards achieving this goal. By collecting and analyzing comprehensive bidding data, Ethereum can refine its PBS mechanism, promoting a more decentralized and competitive environment that benefits the entire community.

The The Unseen Bidding War Series:

• The Unseen Bidding War That Is Happening Every Second

• Fueling the Win: Analyzing Builders' Gas Bidding Strategy

• The Unseen Bidding War: Beaver's Craft vs. Titan's Strength

• The Unseen Bidding War: The Latest Tactic Shifts of Titan and Beaverbuild

• The Unseen Bidding War: Rsync’s Strategic Maneuvers

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Researchers in the DeFi community and our friends from partners have been asking about how EigenPhi figures the profit and loss of an MEV transaction. Here is how we do it.

1. Identify all transfers in the transaction.

2. Combine these transfers to obtain the balance delta of this transaction.

3. Filter out the items in the balance delta that belong to arbitrageur accounts (usually the "from" and "to" addresses of the transaction, as well as some fund collection addresses), and calculate their total, resulting in an arbitrageur tokens balance delta.

4. Identify any Builder Payment in $ETH in the balance delta.

5. Add the identified Builder Payment in ETH to the arbitrageur token balances. That gives us the Revenue of this transaction in the form of the token balances.

6. Multiply each Revenue of the token balance (Ri) by its corresponding exchange rate (Ei) and sum them up to obtain Revenue in USD.

   Let's assume:

   1. Ri is the Revenue of the i-th token balance.

   2. Ei is the exchange rate of the i-th token balance.

      The total Revenue of the transaction is:

7. Transaction Fee In USD = gasPrice * gasUsed * $ETH Price

8. Builder Payment In USD = Builder Payment in $ETH * $ETH Price

9. Cost = Transaction Fee In USD + Builder Payment In USD

10. Profit = Revenue - Cost

In general, these are the steps of how we get the job done. Please feel free to leave your questions and comments.

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

The MEV communities understand how crucial Top-of-the-Block bidding is, as it enables arbitrageurs to back-run transactions in the last block, causing price discrepancies between trading venues. However, an increasing number of people are noticing how the searcher-builder integration is transforming the MEV landscape, leading to back-running within the same block after signal transactions.

• Monoceros's comprehensive report about OFA suggests the emergence of the BOFA(Builder-oriented Order Flow Auction) design. Builders can run “their own proprietary MEV strategies that extract value by inserting new transactions, reordering and merging bundles.”

• Blair Marshall of Blocknative found a bot doing the same block back-running. He tweeted: “Since bundles are typically first, then most builder algorithms will place a reverting tx deeper in a block, but this is what the bot wants since it is backrunning the block,” which prompted Flashbots’ Robert Miller’s response.

• danning.eth also acknowledged: “Introducing MSS for all atomic End-Of-Block searcher-builder: Merging Searching Separation.”

• Even Rsync revealed the same kind of strategy in the Scraping Bits podcast.

The latest research on MEV Supply Chain by Uniswap has a clear message: Trust but Verify. The EigenPhi research team conducted this study, providing a perfect means to verify if you should trust your private order with some current builders. Of significant note for validators, the supply chain's value stands to be redistributed.

Privilege Unveiled: The Battlefield on Transaction Observability

By Sophie Liu, EigenPhi Research

Key Takeaways

1. Ethereum transactions have shifted their competitive focus from the order of transactions in a block to the observability of these transactions.

2. Builders receive private order flow and have the privilege of knowing which orders might appear on-chain in the next block. They integrate vertically with searchers to use this advantage and back-run private orders sent exclusively to them. Since builders are the only ones who can observe these exclusive private orders, back-running them could yield huge profits with significantly lower fees paid downstream in the MEV supply chain.

3. Searcher-builder vertical integration has also targeted OFA bundles. While OFA searchers must redistribute the MEV value, the Searcher-builder is not bound by the same rule.

4. Competitive bidding among searchers for the top block position directs a significant portion of the revenue towards builders and, subsequently, validators. However, the MEV market is transforming due to Builder-Searcher vertical integration. Previously, validators received most of the revenue, but now builders are using their privilege of private order flow to reclaim MEV flow from validators.

5. The current PBS system outsources the MEV-Boost and Replay designs, outsourcing consensus. In this system, builders receive bundles and transactions through their private RPCs, operating on a trust basis. However, there are no guarantees that builders will adhere to the gentlemen's agreement, avoiding practices like breaking bundles or engaging in front-running or back-running.

Introduction to Transaction Observability 

A transaction on Ethereum can follow different paths:

• it may either enter the public mempool, wait for inclusion in the next block by builders,

• or travel through private channels to prevent front-running.

Transactions in the public mempool are widely observable and risk front-running, particularly with unreasonable slippage settings. In contrast, transactions via private channels have restricted visibility. While some orders sent to Order Flow Auctions (OFAs) are visible to a limited number of searchers, orders sent directly to builders' RPCs remain visible only to the block builders.

The level of transaction observability critically influences the flow of Maximum Extractable Value (MEV) through the supply chain—from searchers to builders and, ultimately, to validators. Public mempool transactions spark intense competition among searchers, leading to higher bribe payments to block builders and validators. Conversely, transactions with limited access through OFAs return some value to the orders. However, transactions being visible only to block builders eliminates the need for high bribes, as these orders are exclusively accessible to them.

EigenPhi's data indicates that, from October 15, 2023, to November 15, 2023, the market of atomic arbitrage generated $7.2 million in revenue. Notably, at least 18.5% of this revenue now comes from orders exclusive to builders, which bribe far less than others. This shift in MEV value results from the vertical integration of builder-searcher relationships, diverting value from validators.

Examples of Builder-Searcher Vertical Integration Using Builder's POF

The vertical integration of builder-searcher roles has sparked considerable debate. Builders enjoy the privilege of 'seeing' transactions before a block's creation, and they also receive information about the target block for private orders awaiting inclusion. When builders identify any private opportunities that could initiate an arbitrage transaction, they can send a back-run transaction to all other builders within the same block as the private order's target block. Suppose any builder includes the private order signal. In that case, they are also likely to include the subsequent back-run transaction, especially if the arbitrage transaction offers a significant tip to the builder.

Builders have exclusive visibility to several types of private order flow:

1. MEV searchers submit transaction bundles to builders. Except for some probabilistic searchers who don't use 'signals' and send the transaction to a public mempool, most MEV searchers, especially sandwich searchers, send their bundles privately to builders to maintain their "atomic" nature.

2. User orders go through OFAs and are bundled and redistributed by OFA searchers, which are sent privately to the builder's RPC.

3. Aggregators or Telegram bots, offering transaction protections, send user orders directly to the builder's private RPCs, ensuring private sandwich-free transmission.

We have observed the above private order flow, exclusive to builders, being utilized by searchers. Here are some examples:

Back-Run Builder’s POF From Telegram Bots

This transaction, originating from the Telegram bot ‘Banana Gun,’ does not appear in the public mempool (source: https://mempool-dumpster.flashbots.net/index.html). The bot has informed its users that it offers a service designed to prevent sandwich attacks, strongly suggesting that it routes its orders directly through the builder’s private RPCs. This transaction is positioned at number 3 within its block and aims to purchase HAY tokens using WETH.

However, a back-run transaction directly profits after it. EigenPhi identified this particular transaction, back-running the same pool that the Telegram bot used for exchange, and generated a revenue of $606. The arbitrage bot uses a simple spatial arbitrage strategy between UNI-V2 and UNI-V3 pools, a method common among many arbitrage bots. Typically, the median cost-revenue ratio for spatial arbitrage in UNI is around 99%. Yet, in this case, the cost-revenue ratio is about 11%, significantly lower than the usual rate. The cost-revenue ratio implies that other arbitrage bots likely didn't see the signal, enabling the bot to operate without competition and obviating the need for substantial bribes to builders.

This nuance raises the question of whether the bot must 'observe' the telegram bot’s signal that is only visible to builders to initiate the arbitrage transaction. To test this hypothesis, one could conduct a simple experiment. If we place this transaction before the user's transaction and simulate it, the result would be a reverted failed message.

The simulation suggests that there is no arbitrage opportunity between the two pools this bot uses when the last block is done, making it improbable for this arbitrage transaction to occur without detecting the signal.

It's crucial to note that the user sends a bundle to the builder, and the arbitrage transaction follows the user's transaction. While many builders exist in the market, only Flashbots disclose bundle information in their blocks. The absence of bundle information in this block complicates determining whether this user transaction is part of the same bundle as the back-run transaction. However, builders could unbundle the user transaction and then re-bundle it for dispatch, considering that the agreement to keep the bundle atomic is based solely on an informal agreement.

Back-Run Builder’s POF From MEV Searchers' Bundles

MEV searchers rely on a bundling mechanism. Sandwich searchers typically bundle front-run, victim, and back-run transactions in the required order.

Moreover, arbitrage searchers often bundle signals with back-run transactions to ensure both execute as planned. Generally, MEV searchers send their bundles to the builder's private RPC, making them visible only to the receiving builders. Here are some examples of how these searchers have used bundles from other MEV searchers for back-running.

EigenPhi labels Positions 0-2 as sandwich attacks in the mentioned block. Immediately following the sandwich bundle, an arbitrage transaction capitalizes on the pools under the influence of the sandwich.

Similarly, if you place this transaction before the sandwich bundle, it also reverts.

The searcher profits more than $1000 in a single transaction by back-running the sandwich bundle.

This block contains a back-run transaction using an arbitrage signal. Position 0 features a user transaction visible in the public mempool. Position 1 includes a typical arbitrage transaction with a bundle and back-run. Position 2 presents an arbitrage transaction that uses the arbitrage bundle as a signal. If one were to shift this transaction before the arbitrage bundle, it would fail and revert.

Here, we have the arbitrage transaction using a public mempool signal.

Here is the arbitrage transaction that back-runs the private signal.

A direct comparison of the costs associated with back-run transactions using similar strategies shows that traditional searchers pay 99% of their revenue, whereas the transaction relying on private signals incurs only 30% of the cost.

Back-Run Builder’s POF From OFAs

Here's another example of a signal visible only to the builder. This arbitrage transaction takes advantage of signals from an MEV-Share bundle, as Flashbots' API indicates. The MEV-Share bundle, originating from their OFA, remains invisible to ordinary searchers. However, this bot capitalizes on it to generate profit.

In the above example, the user who sends transactions to MEV Share successfully receives a portion of the MEV share in return.

Conclusion

In conclusion, Ethereum transactions are transitioning from competing based on transaction order to focusing on the observability of transactions. The Builder-Searcher vertical integration allows builders to 'observe' private order flow and back-run exclusive orders, thereby gaining significant profits while reducing fees paid downstream in the MEV supply chain. The current PBS system, based on trust, needs more solid verification that builders will stick to informal agreements. As MEV becomes a primary incentive for block building, the searcher-builder vertical integration will reshape the value distribution in the supply chain.

※    ※    ※

A big shout-out goes to the SMG team. We also extend huge thanks to Blair Marshall, Arthur Bagourd, and Eugene Chen for providing invaluable feedback!

Visit DeFi Strategies Case Studies by EigenPhi or bit.ly/head-first-defi to learn more trading tactic analyses.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

Today, we release our BNB Chain Mempool Transaction benchmarking research.

We have 2 objectives regarding this research.

Objective

• Rapid identification of mempool transactions is crucial for DeFi traders to stay ahead of the game and capitalize on potential trading opportunities before their competitors. 

• This survey gives DeFi traders an authentic and objective evaluation of mempool latency performance across major service providers. It allows traders to make informed decisions and choose the most efficient and reliable platforms for their trading needs.

Key Takeaways

• There are only two major BNB Chain mempool data service providers in the market: bloXroute and QuickNode.

• Mempool Coverage: Our test apparatus receives more transactions from bloXroute than QuickNode (exhibited in the visibleTxCount data).

• Latency for all mempool transactions: In most cases, EigenPhi receives transactions from bloXroute faster than from QuickNode, shown in the Received Time Difference charts and firstSeen data.

• Latency for confirmed transactions: Out of all the pending transactions from bloXroute and Quicknode that eventually landed on the chain, bloXroute receives the transactions first 96.44% of the time.  

Tested Plans

• Quick Node - Scale Tier:  the fastest paid tier available

• bloXroute - Enterprise Tier: mid-tier with faster plans available 

Test Methodology

Setup

• Start time: random

• Duration: 25 hours with the data from the first hour omitted.

• Test region

  • Virginia, U.S

• Data fields

  • txHash: transaction hash received by the geth client.

  • timestamp: transaction timestamp (Unix time in milliseconds) received by the geth client.

• Data Subscription:

  • Quicknode: websocket (gRPC not available)

  • bloXroute: websocket (gRPC available - potentially faster than websocket)

• Mempool feed methods:

  • Quicknode: newPendingTransactions

  • bloXroute: pendingTxs (bloXroute states its newTxs stream is significantly faster than pendingTxs)

Processed Data

• All transactions landed on-chain within the test time frame

• All mempool transactions from bloXroute within the test time frame

• All mempool transactions from Quicknode within the test time frame

Data Definition

• receivedTx: for a transaction that was eventually included on-chain, EigenPhi's receiver received this transaction from a provider, regardless of whether it was before or after the corresponding block timestamp. This metric can be used to identify transactions broadcast through the public mempool.

• firstSeenTx: for a transaction that was eventually included on-chain, EigenPhi's receiver first received this transaction from a specific provider before the corresponding block timestamp.

• firstSeenTxShare: Fraction of firstSeen transactions by a specific provider relative to the union of firstSeen transactions from all providers.

• visibleTx: for a transaction that was eventually included on-chain, EigenPhi's receiver received this transaction from at least one tested provider before the corresponding block timestamp.

• visibleTxCount%: VisibleTxCount/TotalTxCount. 

• TotalTxCount: TotalTxCount refers to the total number of transactions included on-chain within the observed time range, whether EigenPhi’s detector has received it.

• notLandedTxCount: refers to transactions received by EigenPhi from a tested provider that were not included on-chain within the observation time range.

• receivedTxCount%: receivedTxCount/(receivedTxCount + notLandedTxCount)

• received time difference: = received ts of bloXroute - received ts of QuickNode (in milliseconds)

  • When calculating the received time difference, we only include cases where EigenPhi's receiver received the same visibleTx from both providers. And the sample set removes extreme values in the top 5% by absolute value.

  • The Violin Plots below show the received time difference distribution by hour. Negative values indicate instances where EigenPhi's detector received a visibleTx from bloXroute earlier than from QuickNode, and positive values indicate the reverse.

  • It should be noted that hours without a violin plot correspond to cases where EigenPhi's receiver was disconnected from the provider. In such cases, we only receive mempool txs from one provider and thus cannot compare time differences.

Without further ado, here are the results.

BNB Mempool Transaction Comparison Result

Time range: UTC 2023-08-19 00:00:00, 2023-08-20 00:00:00

Overlapping Transactions Between Quicknode & bloXroute

Received Time Difference

The violin plot illustrates the time-series distribution of the received time difference. It shows that EigenPhi receives visibleTxs from bloXroute in most cases faster than from QuickNode. 

The white dot in the centered thin box is the median point for each hour. The box’s upper end is the third quartile data point, and the lower end is the first quartile. Please refer to the N.B. section for how to read the violin plot.

The median data point across the testing time range shows that bloXroute is faster by around 400 to 500ms. In 25% of cases, which is the lower end of the box, bloXroute is faster by over 500ms, with the lower adjacent value, which is the lower end of the violin, showing it can be as fast as 700ms. In most cases, bloXroute is faster than QuickNode, with the upper adjacent value only slightly larger than 0.

The table below shows the aggregated percentile statistics of two scenarios: bloXroute is faster, and QuickNode is faster. It tells us that: 

• When bloXroute is faster, the mean time difference is 350 milliseconds. On the other hand, when  QuickNode is faster, the mean time difference is 92 milliseconds.

• On the 25% percentile, when bloXroute is faster, 75% of the testing time difference equals or exceeds 81 milliseconds. For QuickNote, it’s 27 milliseconds. 

• Take a look at the 50% percentile. When bloXroute is faster, 50% of the testing time difference equals or exceeds 455 milliseconds. When QuickNode is faster, the mean time difference equals or exceeds 59 milliseconds.

• At the level of 75% percentile, when bloXroute is faster, 25% of the testing time difference is equal to or exceeds 527 milliseconds. For QuickNote, it’s 85 milliseconds. 

Follow us via these to dig more hidden wisdom of DeFi:

Website | Discord | Twitter | YouTube | Substack | Medium | Telegram | EigenTx

Key Takeaway

1. Stablecoin trades, particularly sandwich attacks involving USDC-USDT and DAI-USDT pairs, drive DODO's significant trading volume, accounting for over 60%. Attackers contribute 58.7%, while targeted trades comprise 2.13%.

2. 1inch's "Fusion" mode provides varied trading options, but depending on user choices and slippage considerations, it may cause trade speed inconsistencies or an increased risk of sandwich attacks. Many trades routed through the 1inch Aggregator to DODO are vulnerable.

3. Evidence of sandwich attacks on DODO has surfaced; it would be better for relevant parties to take action to protect users and liquidity providers.

Decentralized exchanges (DEXs) have gained prominence in the evolving cryptocurrency market landscape. Amidst this backdrop, DODO has emerged as a standout. Surprisingly, despite a market cap of just $42 million, it ranks consistently in the top three in DEX trading volume. What's the secret behind this disproportionately high trading volume? 

Preliminary research reveals that nearly 99% of DODO's trading volume is from stablecoin trades, with pairs like USDC-USDT and DAI-USDT frequently falling victim to sandwich attacks. Regardless, DODO continues to collect modest transaction fees, which has become its primary source of revenue. Astonishingly, sandwich attacks account for over 60% of its trading volume alone. 

In this context, the role of the 1inch aggregator cannot be overlooked. Due to some modes of 1inch lacking slippage restrictions, users may incur significant losses when redirected to DODO. A concern that could potentially exacerbate user losses. 

This article aims to uncover the truth behind DODO's high trading volume, juxtaposed with an analysis of 1inch Aggregator's slippage settings mechanism. We hope to provide readers with a clear perspective, understanding the causes and consequences of these phenomena.

DODO's Market Cap and Trading Volume 

DODO's performance in the decentralized exchange landscape has caught many eyes. Statistics from Dune show a comparison of DODO's trading volume with its competitors. 

Consider Uniswap, for example, which has an annual trading volume soaring to $39.4 billion, while DODO trails closely behind at $3.3 billion. But the difference becomes even more pronounced when you juxtapose this against market capitalization. Uniswap has a $41 billion market cap, while DODO is a mere $42 million. This stark discrepancy undoubtedly prompts questions: How can DODO command such a high trading volume with a relatively low market cap? Could this indicate an underlying factor that is out of the ordinary? Let's delve deeper to explore the reasons behind this phenomenon. 

DODO's Stablecoin Trading: Immense Volume, But Why? 

Data from Dune reveal that the primary trading pairs on DODOEX's Ethereum platform predominantly involve stablecoin exchanges. 

This discovery raises even more questions.  Why is the significant trading volume observed in the stablecoin pair? What secrets might lie behind this phenomenon?

DODO's Stablecoin Pool Trading Analysis

The Main Stablecoin Trading Pairs on DODO Subject to Sandwich Attacks

Based on our research, there are significant sandwich attack activities on the DODO platform, primarily concentrated in two major stablecoin trading pairs: USDC-USDT and DAI-USDT. Upon analysis, the total number of transactions on DODO subject to sandwich attacks reaches 1,322. Of these, transactions involving USDC-USDT amount to 739, constituting 55.99% of the total, while those involving DAI-USDT account for 583, or 44.01%. These numbers clearly unveil the concentration of sandwich attack activities within these two trading pairs on DODO.

Here is the volume distribution for the two stablecoin trading pairs, illustrating that approximately 60% of the trading volume originated from sandwich trades.

Hidden Fee Mechanism within DODO's Stablecoin Pool 

Although the Fee Rate for USDC-USDT and DAI-USDT is set at 0%, a more in-depth investigation reveals that DODO actually imposes a 0.001% (0.1 basis points) fee on these stablecoin transactions.

EigenTx shows evidence of this subtle but continuous charging method, where a portion of the fee from each transaction is transferred to DODO's Proxy wallet. Here is an EigenTx example of how the fee is collected to the proxy wallet: 0x03b7a09e878f8bed9c481e36e0a802a78a1c533be563e1dbb26b8d7394121e5c.

DODO Sandwich Attack Analysis

3 Sandwich Attackers Dominate DODO

After filtering through AttackerEOA, we found that in the first half of 2023, sandwich attacks targeted a total of 1322 transactions, involving only 3 unique AttackerEOA, with one accounting for 51.3% of trade volume, reaping as much as 84% in profits.

Upon further analysis of the volume, revenue, and profit, we obtained the following results:

Among them, account 0xf480 contributed to 51.3% of the volume and earned a profit share of 84%, totaling over $430,000.

Sandwich Attacks (attack + victim transactions) Contributed Over 60% of Trading Volume to DODO Pools, with Attack Volume Vastly Outpacing Victim 

Our further investigation into the overall impact of attacker and victim on the total volume yielded these results:

1. Victim transactions have a volume of $292,14 million, contributing 2.13% to the total volume. This means that attacks have targeted 2.13% of the trade volume on DODO.

2. The volume from the attacker's sandwiching is $8,03 billion USD, comprising 58.7% of all trades.

3. From points 1 and 2, we deduce that the full suite of sandwich trades accounts for over 60% of the volume.

4. The volume of the attackers is substantially larger than the victim transactions, averaging 27 times greater. This figure represents a significant deviation from what one would normally expect. 

Sandwich Attack Case Analysis: Victim Receives 0.87 USDT in Exchange for 1 USDC 

Using the sandwich attack with the highest revenue as an example:

0xe6b0426d150eda46094d3785a14fa7830245daea50ad685bfdf05b34603efc2d 

Front-run:0x591ce52528b7c293ebc27ca106086dc3659b459ea19dd322516676e359ce88a0

• In: 4,693,406.864341 USDC 

• Out: 4,687,529.485349 USDT 

• Ratio: 1 USDC can be exchanged for 0.998747737163668 USDT

Victim: 0x03b7a09e878f8bed9c481e36e0a802a78a1c533be563e1dbb26b8d7394121e5c

• In: 977,479.767689 USDC 

• Out: 851,720.5951 USDT 

• Ratio: 1 USDC can be exchanged for 0.8713434520631305 USDT

For stablecoins, this 1:0.87 exchange ratio is quite astonishing, and it has also brought substantial profits to the attackers.

Back-run: 0x4ef89839e75a3175fa7821160e0de352e7fc2b3cb59728c9ae66ebb108e5f36e

• In: 4,687,529.485349 USDT 

• Out: 4,818,314.422425 USDC 

• Ratio: 0.9728567034838342 USDT can be exchanged for 1 USDC

Further, in the USDC - USDT and DAI - USDT pools, the following table/chart illustrates the proportion of volume that sandwich attacks (attacker + victim) contribute to the total trading volume.

Distribution of Victim Transaction 'To' Addresses, with the Top Two Originating from 1inch

The 'To' Address in this context refers to the contract address that the transaction calls. The following table displays the distribution of the 'To' addresses for Victim Transactions (only those with numbers greater than 20 are listed):

Analysis of Sandwich Attack Causes on DODO Trades

Following our analysis, we've identified the 1inch Aggregator as a significant source of 'To' addresses (contract addresses). We'll now explore the causes of the aforementioned sandwich attacks from both DODO's and 1inch's perspectives:

1. DODO does not have a whitelist, but its swap page does mention "private transactions" or non-public mempools, positioning them as a protective measure against potential losses from sandwich attacks. It's worth noting that DODO's slippage settings vary depending on the trading pair: a default slippage of 0.01% for stablecoins, 0.5% for mainstream pairs, and 3% for other pairs. When compared to mainstream platforms like Uniswap, which has a slippage set at 0.1%, certain trading pairs on DODO might appear to have a notably higher rate. Adjusting the default slippage settings might help DODO improve its stance on sandwich attacks.

2. 1inch functions as a sophisticated decentralized trading platform, including both centralized and decentralized sources, facilitated by top-tier market makers. Their innovative 'Fusion' mode offers three tailored options:

• Fast: For those seeking immediate execution, even if it means a slightly less favorable rate.

• Fair: Allows users a short wait in exchange for a more attractive rate.

• Auction: Users can wait up to ten minutes, aiming for the pinnacle of trade rates. 

In conclusion, if a user chooses slower transactions to limit slippage, they could compromise speed. On the other hand, seeking fast transactions could lead to higher slippage. This increases the risk of sandwich attacks, which is why many trades via the 1inch Aggregator are at risk.

EigenTx is essential for such research. Now you can make a dent for its future and earn $100U. Click here to attend the 3-minute survey!

Using MEV Evaluation, wallets, market makers, and RPC providers can quantify the impact of MEV on different sources of order flows. Watch the video below to get more benefits of MEV Evaluation.

Are you interested? You can download the template here!

Follow us via these to dig more hidden wisdom of DeFi:

Website | Discord | Twitter | YouTube | Substack | Medium | Telegram | EigenTx

Traders face fierce competition, making finding arbitrage opportunities increasingly challenging daily.

In April, we put out our initial analysis on PancakeSwap V3. Today, after 3 months, we release the comprehensive research investigating the impact of the PancakeSwap V3 launch on the MEV market.

Here are 7 key takeaways.

1. Since PancakeSwap V3 launched, the share of arbitrages involving it on BNB Chain has soared, making up 25.8% of the total arbitrage revenue, 14.72% of the overall arbitrage count, and 37.07% of the total arbitrage volume.

2. PancakeSwap V3 on the BNB Chain has experienced remarkably few sandwich attacks since its launch. In fact, the sandwich revenue it generated constitutes merely 2.26% of the total sandwich revenue. Meanwhile, on Ethereum, we've not observed any sandwich attacks on PancakeSwap V3.

3. Regardless of whether it's the BNB Chain or Ethereum, MEV activities involving PancakeSwap V3 yield greater revenue and profit than those without PancakeSwap V3. By the week ending on 6/4, the proportion of profits that arbitrages involving PancakeSwap V3 contributed to all arbitrage profits on BNB Chain already hit 40%.

4. The profit from each MEV activity involving PancakeSwap V3 exceeds that from activities involving V2. However, V3's total volume and revenue from MEV activities fall short of those generated by V2. Several factors influence MEV, with market opportunities standing out as a significant one. We have found that:

   1. Market Volatility: A positive correlation exists between arbitrage frequency and price volatility, as we demonstrated in Section 3.2. This correlation makes sense because larger price fluctuations tend to create more arbitrage opportunities.

   2. Total Trading Volume: There's also a positive correlation between arbitrage volume and total trading volume. In Section 2.2, we found a correlation coefficient of 0.6 between the trading volume (excluding arbitrage volume) and arbitrage volume and a correlation coefficient of 0.62 between trading volume (excluding sandwich volume) and sandwich volume. This connection is intuitive since trading creates price differences and MEV opportunities. Consequently, the larger the total trading volume, the greater the MEV volume becomes. We base this conclusion on the total trading volume and transaction count from 4/1 to 6/4 on PancakeSwap.

      

      The total trading volume of PancakeSwap V3 is just 32.26% of that of PancakeSwap V2. This disparity explains why there are more MEV opportunities on PancakeSwap V2 than on PancakeSwap V3.

   3. Pool Liquidity plays a crucial role too. Given the recent launch of PancakeSwap V3, its pools are quite new. The liquidity in these new pools is often more unstable and likely to create MEV opportunities, thus leading to potentially greater profits.

5. Before PancakeSwap V3 came into existence, arbitrage opportunities on PancakeSwap on Ethereum were scarce. However, after the launch of PancakeSwap V3, arbitrage bots began to monitor PancakeSwap V3 on Ethereum.

6. The most popular pools are the primary magnets for MEV activities. On the BNB Chain, the top 10 pools account for 61.93% of arbitrage counts involving PancakeSwap V3. On Ethereum, this proportion leaps to 93.31%.

7. When it comes to arbitrage bots, the most profitable one does not always have the most transactions, regardless of whether they operate on the BNB Chain or Ethereum. In contrast, sandwich bots that earn more generally carry out more transactions.

Moreover, we break down revenue, volumes, and profits by MEV types (arbitrage or sandwich) and whether involving PancakeSwap or PancakeSwap V3, on BNB Chain, from April 1st to June 4th.

Here are two highlights from the data below.

1. Over 90% of the total MEV on the BNB Chain comes from activities on PancakeSwap.

2. Sandwich attacks on PancakeSwap V3 are quite rare, with the revenue they generate constituting a mere 2.32% of the total sandwich revenue.

To read and download the full report, please click here.

Wanna understand how to use EigenTx to analyze structures, behaviors, and affiliations? Visit: bit.ly/eigentx

Follow us via these to dig more hidden wisdom of DeFi:

Website | Discord | Twitter | YouTube | Substack | Medium | Telegram | EigenTx