Polygon

On May 15, the United States Department of Justice (DOJ) charged two brothers, Anton and James Peraire-Bueno, with allegedly carrying out an attack on the Ethereum network that resulted in $25 million being transferred from maximal extractable value (MEV) bots to the defendants. The indictment claims that the attackers, through their Ethereum validators, proposed blocks whose ordering was so malicious that it constituted the crime of wire fraud.
The charges <a href="https://cointelegraph.com/news/ethereum-blockchain-theft-manipulation-justice-department">were revealed in a grand jury indictment</a> that laid out the DOJ’s view.
The case has divided the crypto community. Some claim that the MEV bots were themselves attempting to defraud the brothers and that the defendants should not be seen as victims, while others say the brothers were in the wrong for exploiting bad code. Some have also argued that the case sets a dangerous precedent and will lead to full-scale regulation of Ethereum. 
The technical nature of the case has only compounded the controversy further, as terms like “MEV,” “searchers,” “relays,” “sandwich attacks” and others that may not be understood by all Ethereum users are being tossed around in the discussion.
The following is an exposition of how the brothers allegedly carried out their attack.&nbsp;
<h2 id="what-is-maximal-extractable-value">What is maximal extractable value?</h2>
According to Ethereum network documents, MEV&nbsp;<a href="https://ethereum.org/en/developers/docs/mev/" target="_blank" rel="noopener nofollow">refers</a> to the maximum value that can be extracted from a block of transactions based on their ordering.
Some on-chain trades will be more beneficial to a user if they go through in a particular order. For example, a trader who wants to use their stablecoins to buy a large amount of Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>) when it’s at a low price will not want another trader to be able to buy it in size first, as the first trader’s purchase may cause the price to increase. In some cases, the user may prefer not to trade at all if they can’t place their trade in priority.
Under normal circumstances, when a user posts an Ethereum transaction, it gets sent to the network’s memory pool, or “mempool,” where it is stored until it is either canceled or confirmed and added to the blockchain. Once it is in the mempool, any device on the network can view its contents.
This means that if a trade is placed through the normal method, another trader can potentially copy it and have it executed first. In this case, the trader who originally posted the trade will pay a higher price for the asset they are buying. The process of copying other traders’ transactions and executing them first as su is called “front-running.”
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/917d36e4-320b-446a-8d50-0571f6d4ffce.png" alt="" title="">
 <figcaption style="text-align: center;">
 Visual representation of front-running. Source: Medium
 </figcaption>
</figure>
If a trader can front-run a trade, they can potentially profit by performing a “sandwich attack,” which involves first buying up the asset to make the subsequent trader pay a higher price, then selling into the liquidity pool after the subsequent trader’s transaction has been executed.
To defend against sandwich attacks, most decentralized exchanges today submit transactions directly to a whitelisted group of block-builders, bypassing the mempool entirely. This prevents bots from detecting the users’ transactions and copying them.
Related: <a href="https://cointelegraph.com/news/1inch-releases-new-tool-to-protect-traders-against-sandwich-attacks">1inch releases new tool to protect traders against ‘sandwich attacks’</a>
However, some traders still submit their transactions directly to the mempool, thereby opening themselves up to the possibility of a sandwich attack.
If a user does submit a trade to the mempool, other users — which are typically bots — will compete with each other to sandwich-attack the original user. In this case, the bot that pays the highest gas fee to the validators will have their transaction executed first and will, therefore, be able to perform the attack.
However, the attack will only be profitable if the gas fee paid is less than the profit from the attack. Therefore, the bot should theoretically only be willing to pay an amount equal to or less than the profit. This amount, the maximum amount of gas a user should be willing to pay to execute an arbitrage, is called the “MEV.”
MEV doesn’t only refer to the extraction that occurs in sandwich attacks or front-runs, though. It can also&nbsp;<a href="https://cointelegraph.com/learn/what-is-mev-ethereums-invisible-tax">describe</a> other arbitrage opportunities that arise from the order of transactions, such as profits from liquidating bad loans. 
However, the Peraire-Bueno case specifically involves bots that were attempting to perform a sandwich attack, so the other types of MEV are not relevant in this instance.
<h2 id="the-mev-ecosystem">The MEV ecosystem</h2>
To understand the claims made in the indictment, it’s also helpful to consider how the MEV ecosystem works today.
In the early days of Ethereum, individual firms ran MEV bots that were also validator nodes. This led to rampant competition and a reduction in profits. However, most nodes today use the Flashbots system, which allows bots to hide their profitable arbitrages until the moment their transactions are added to the blockchain.&nbsp;
This allows them to earn bigger profits through custom coding, as their arbitrage transactions are never added to the mempool and cannot be copied.
Flashbots has also allowed traders to hide their own trades to defend themselves against sandwich attacks.
According to its documents, in the Flashbots system, some computers <a href="https://docs.flashbots.net/" target="_blank" rel="noopener nofollow">play</a> the role of “searchers.” They use proprietary code to scan the blockchain for arbitrage opportunities. Once they find a set of profitable transactions, they order them into a bundle and send them to a “builder” computer.
The builder computers collect bundles from the searchers, as well as transactions from traders who want to bypass the mempool. These bundles and extra transactions are sent to relays, which take in transactions from multiple builders and use them to create a proposed block. 
Once a relay has created a proposed block, it offers a gas fee to the validators in exchange for a commitment to confirm its block after publishing. The relay attempts to propose a high enough gas fee that its block will likely be published, but not high enough to make the various individual trades unprofitable for its clients — the individual builders, searchers and users.
If a validator node wants to publish a relay’s block, it responds with a signature committing itself to confirming that block. Only once the signature is transmitted does the relay reveal the transactions within the block. The block is then added to the blockchain after other validators on the network confirm it.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/ef489ca0-ce58-42a0-9060-e604c5c5744e.png" alt="" title="">
 <figcaption style="text-align: center;">
 Flashbots “MEV-Boost” architecture. Source: Flashbots
 </figcaption>
</figure>
The Peraire-Bueno brothers are accused of exploiting this flashbots MEV system, transferring $25 million to themselves by tricking the system into believing that a profitable arbitrage existed, when, in fact, the “arbitrage” resulted in losses for the searchers who discovered it.
Related: <a href="https://cointelegraph.com/news/solana-mev-bot-pulls-1-7-m-profit-from-a-single-dogwifhat-trade">MEV bot pulls $1.7M profit from a single ‘inefficient’ Dogwifhat trade</a>
<h2 data-ct-non-breakable="true" id="how-they-allegedly-exploited-the-mev-system">How they allegedly exploited the MEV system</h2>
According to the indictment, the two brothers <a href="https://www.justice.gov/opa/media/1351996/dl" target="_blank" rel="noopener nofollow">carried out</a> the exploit by first creating 16 Ethereum validator nodes. Through these nodes, they published a set of “bait” transactions that appeared to be lucrative MEV opportunities. Relays picked up some of these transactions and included them in blocks, while others were not included. Over time, the accomplices used these test transactions to determine how to guarantee that their transactions would be included in a relay’s block.
Once they were sure they could get their transactions included in a block, they waited for one of their 16 validator nodes to get chosen as a block producer. They then published eight “lure” transactions that they wanted included in a block. These transactions were picked up by three different searchers and were ultimately included by a relay. After building blocks that included the transactions, the relay published the header for its block and requested the brothers’ node to confirm it.
The brothers’ validator node responded by producing a fake signature committing to propose the relay’s block, the indictment alleges. Due to a flaw in the cryptographic system used to produce the signature, it was possible for the node to fool the relay into believing it had signed the message, but in fact, the signature was not valid and would not be accepted by other validator nodes as a firm commitment. The indictment states:
<blockquote data-ct-non-breakable="true">
 “After the Relay released the blockheader for the proposed block which contained the Victim Traders’ ordered transactions, [...] the defendants, exploited a vulnerability in the Relay’s computer code by sending the Relay a false signature [...] in lieu of a valid signature. Based on their research and planning prior to the exploit, [the defendants] knew that the information contained in the False Signature could not be verified for ultimate publication to the blockchain.”
</blockquote>
Once this fake signature was transmitted, the relay published the contents of its block. In response, the validator reordered the block and signed it with the real signature, officially proposing the reordered block instead of the one the relay had preferred. As a result, this reordered block was confirmed by other validators, the indictment claims.
In the original block proposed by the relay, the three searchers first used stablecoins to purchase a large number of highly illiquid tokens, pushing up their prices. Afterward, the brothers purchased these same tokens at a higher price. This resulted in a large amount of stablecoins being transferred into the exchange’s liquidity pool. 
The searchers then unloaded the tokens they had just purchased, draining the pool of the stablecoins that both parties had just put into it. Finally, the brothers sold their tokens into the now-drained pool, causing them to receive much less for the tokens than they originally paid. In essence, the original block executed a classic sandwich attack against the brothers.
However, the reordered block did something very different. In it, the brothers purchased the tokens first, pushing up their prices. Then, the searchers purchased more tokens, draining them from the pool and replacing them with stablecoins. After the searchers made their purchase, the brothers sold their tokens into the pool, draining most of the stablecoins out of it.&nbsp;
Finally, the searchers attempted to resell their tokens. But at this point, the pool no longer had enough liquidity to buy back the tokens. As a result, the final transaction failed, and the searchers were stuck with essentially worthless tokens. 
Because the reordered block was confirmed instead of the original, the brothers profited $25 million in stablecoins from the trade, while the searchers lost $25 million. Essentially, the brothers reversed the sandwich attack, causing the attackers to lose money instead of themselves.
In the Justice Department’s view, this action constituted “wire fraud” because the lure transactions and false signature were “material representations,” binding statements made from one party to another in a commercial transaction, and because they were knowingly sent to deceive the MEV bots. As the indictment states:
<blockquote data-ct-non-breakable="true">
 “The defendants [...] engaged in a scheme to defraud the Victim Traders, by making material representations, [including] the Lure transactions and False Signature, in order to fraudulently obtain cryptocurrency.”
</blockquote>
The Peraire-Bueno brothers have not been arraigned, and no trial date has been set as of the time of publication.
<h2 id="the-crypto-community-responds">The crypto community responds</h2>
The case has been controversial within the crypto community.
Some Ethereum users have expressed incredulity at the DOJ’s view that MEV bots, which were allegedly attempting to sandwich-attack traders themselves, deserved to have their opponents thrown in jail.
For example, on May 15, Helius Labs CEO Mert Mumtaz <a href="https://x.com/0xMert_/status/1790782092357271788" target="_blank" rel="noopener nofollow">asked</a> rhetorically on X, “Hold up. These guys are being charged with wire fraud for *checks notes* baiting MEV bots on Ethereum??????” TradingStrategy co-founder Mikko Ohtamaa <a href="https://x.com/moo9000/status/1790795263881134503" target="_blank" rel="noopener nofollow">argued</a>&nbsp;that the DOJ is practicing a double standard. “You are only allowed to sandwich retail users,” he claimed. “When you sandwich MEV bots then you are a criminal and MEV bot operator sues you in the nearest US court.”
AllianceDAO contributor Mohamed Fouda <a href="https://x.com/MohamedFFouda/status/1790812568526704849" target="_blank" rel="noopener nofollow">argued</a> that the case creates a slippery slope, as it may lead to full-scale regulation of Ethereum. The indictment is both “a recognition of the power of Ethereum to settle financial transactions” and simultaneously “a trap to pull every operator on Ethereum into a web of legal compliance requirements,” he claimed.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/89732162-1813-4e09-9bb5-f4a48d7d199b.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/MohamedFFouda/status/1790812568526704849" target="_blank" rel="noopener nofollow">Mohamed Fouda</a>
 </figcaption>
</figure>
The indictment “legitimizes the harmful behavior of Sandwich attacks and frontrunning,” treating them as normal, Fouda <a href="https://x.com/MohamedFFouda/status/1790812573165666551" target="_blank" rel="noopener nofollow">stated</a>, which he considers to be “catastrophic.”
In addition, it “draws a faulty picture of the roles of relayers in the Ethereum system,” treating them as escrow services. Fouda <a href="https://x.com/MohamedFFouda/status/1790812575489200543" target="_blank" rel="noopener nofollow">claimed</a> that this treatment was “probably to tie them to specific ‘responsibilities’ and ‘duties’ they owe to the MEV searchers,” which can cause Ethereum operators to be subjected to “multiple compliance requirements.”
While some users shared these criticisms, others defended the DOJ’s actions. Crypto trader Beanie <a href="https://x.com/beaniemaxi/status/1790821792132546623" target="_blank" rel="noopener nofollow">posted</a> to X on May 15 to argue that “exploiting software for gain is always illegal,” adding that “code isn’t law. Lots of precedence here.”
Polygon Labs vice president Hudson Jameson <a href="https://x.com/hudsonjameson/status/1790936564614517218" target="_blank" rel="noopener nofollow">expressed</a> a similar view in a reply to Fouda’s post. “It wasn’t simply baiting bots and sandwiching,” he claimed. “They actually exploited a flaw in MEV boost itself.” In response, Fouda <a href="https://x.com/MohamedFFouda/status/1790954112051269803" target="_blank" rel="noopener nofollow">conceded</a> that “what they did is probably a crime” but argued that it “doesn’t negate the fact that sandwich bots are Ok or business as usual.”
The practice of obtaining MEV has been controversial since the beginning of the Ethereum network. Some networks have attempted to prevent what they consider to be “malicious” MEV in various ways. For example, Shutter <a href="https://cointelegraph.com/news/protecting-web3-users-integrity-by-preventing-malicious-mev-heres-how">claims to use threshold encryption</a> to stop front-running and sandwich attacks, whereas Neo X has stated that it accomplishes a similar aim <a href="https://cointelegraph.com/news/this-evm-compatible-blockchain-seeks-to-annihilate-toxic-mev">using a delegated Byzantine fault tolerance</a>&nbsp;consensus mechanism.
However, these are technical solutions to the perceived problem. So far, there are no known cases of sandwich attack victims attempting to prosecute MEV bots for wire fraud.
Related:&nbsp;<a href="https://cointelegraph.com/news/vitalik-buterin-proposes-solutions-ethereum-mev-problem">Vitalik Buterin proposes solutions for Ethereum’s MEV problem</a>

How the Peraire-Bueno brothers allegedly drained $25M from their MEV bots exploit

Table of Contents

Cointelegraph

Other articles published on May 22, 2024

MoonBag Presale Soars: Investors Shift from Pepecoin and Blastup for Long-Term Gains

Bitcoin Adoption Increases as Wallet Addresses Surge

Should I Buy Crypto Today?! Ethereum ETF Poised to Ignite a Massive Bull Run, According to Experts

Good News from the USA to Binance! The Court Cancelled the Prohibition Decision!

Bitcoin Price To Face Potential Correction If It Hits This Level

99Bitcoins Token ICO Blasts Past $1.5m For Crypto’s First Learn To Earn BRC-20 Token

Join our free newsletter for daily crypto updates!