[Paper Review] Frontrunner Jones and the Raiders of the Dark Forest: An Empirical Study of Frontrunning on the Ethereum Blockchain

Christof Ferreira Torres, Ramiro Daniel Camino+1 more|arXiv (Cornell University)|Feb 5, 2021

Blockchain Technology Applications and SecurityComputer Science16 references58 citations

TL;DR

The paper presents a large-scale, data-driven study of three Ethereum frontrunning attacks (displacement, insertion, suppression), proposing efficient detection methods and reporting substantial attacker profits.

ABSTRACT

Ethereum prospered the inception of a plethora of smart contract applications, ranging from gambling games to decentralized finance. However, Ethereum is also considered a highly adversarial environment, where vulnerable smart contracts will eventually be exploited. Recently, Ethereum's pool of pending transaction has become a far more aggressive environment. In the hope of making some profit, attackers continuously monitor the transaction pool and try to frontrun their victims' transactions by either displacing or suppressing them, or strategically inserting their transactions. This paper aims to shed some light into what is known as a dark forest and uncover these predators' actions. We present a methodology to efficiently measure the three types of frontrunning: displacement, insertion, and suppression. We perform a large-scale analysis on more than 11M blocks and identify almost 200K attacks with an accumulated profit of 18.41M USD for the attackers, providing evidence that frontrunning is both, lucrative and a prevalent issue.

Motivation & Objective

• Motivate and quantify frontrunning as a prevalent, lucrative practice in Ethereum and DeFi environments.
• Develop scalable methods to detect three frontrunning attack types in historical blockchain data.
• Characterize attacker behavior, counts, clusters, and profits to understand the ecosystem.
• Provide evidence-based discussion of implications for miners and the blockchain trust model.

Proposed method

• Define attacker model and three frontrunning attack types: displacement, insertion, suppression.
• Propose scalable detection methodology using block windows, 4-byte n-grams, and Bloom filters to detect displacement via bot contracts.
• Develop insertion-detection heuristics based on ERC-20 Transfer events and order of transactions to identify sandwich-style attacks on AMM/DEXes.
• Formulate suppression-detection heuristics around clusters of high-gas, near-block-full transactions and analyze execution traces for suppression strategies.
• Cluster attacker accounts and bot contracts into attacker groups by analyzing shared transactions and identical bytecode.
• Validate detection with conservative heuristics and manual sampling, aiming for high precision over recall.

Experimental results

Research questions

• RQ1 How prevalent are frontrunning attacks on Ethereum in the wild over a multi-year period?
• RQ2 Can displacement, insertion, and suppression frontrunning attacks be detected efficiently at scale in historical blockchain data?
• RQ3 What are the scale and characteristics of attacker activity (counts, bots, clusters) and profits from these attacks?
• RQ4 What are the implications for miners and the overall Ethereum trust model?
• RQ5 What are the limitations and potential blind spots of the proposed detection methodology?

Key findings

• Identified 199,725 frontrunning attacks across the dataset.
• Detected 1,580 attacker accounts and 526 bots.
• Detected profits totaling 18.41 million USD for attackers.
• Attacker accounts and bots cluster into 137 unique attacker clusters.
• Miner profits attributable to frontrunners amount to about 300 thousand USD.