Artículos Relacionados con Sandwich Attack

El Centro de Noticias de HTX ofrece los artículos más recientes y un análisis profundo sobre "Sandwich Attack", cubriendo tendencias del mercado, actualizaciones de proyectos, desarrollos tecnológicos y políticas regulatorias en la industria de cripto.

David Schwartz Says XRP Ledger Front-Running Risk Is Real But Overstated

David Schwartz, former CTO of Ripple, acknowledges that the XRP Ledger (XRPL) is exposed to sandwich attacks, but views the risk as real yet overstated. A sandwich attack occurs when an attacker exploits transaction ordering, placing trades before and after a victim's transaction to profit from the resulting price movement, leaving the victim with a worse execution price. Schwartz frames this as part of a broader debate about trade-offs in decentralized trading systems, balancing openness and user protection. He argues the issue is not an existential flaw for XRPL but highlights its importance for network credibility as on-chain trading activity grows. The key for XRPL is to ensure users have confidence in fair execution, which involves understanding, mitigating, and clearly explaining such risks rather than dismissing user concerns. Ultimately, this debate underscores that execution quality and protection against predatory trading are becoming critical components of user trust and network adoption.

bitcoinist06/30 01:51

David Schwartz Says XRP Ledger Front-Running Risk Is Real But Overstated

bitcoinist06/30 01:51

Top-Tier MEV Bot Loses $7.5 Million: Is 'Approval' the Most Overlooked Fatal Risk On-Chain?

The article discusses a sophisticated attack on a prominent Ethereum MEV (Miner Extractable Value) bot, Jaredfromsubway.eth, resulting in a loss exceeding $7.5 million. Unlike typical exploits involving key leaks or smart contract bugs, this attack was a carefully orchestrated "reverse hunt." The attacker spent weeks deploying fake tokens and liquidity pools that mimicked legitimate assets like WETH and USDC. These pools were designed to appear as profitable arbitrage opportunities, tricking the automated bot's trading logic. During its normal operation, the bot was induced to grant ERC-20 token approvals to the malicious contracts. Once sufficient permissions were accumulated, the attacker drained the bot's funds by calling these pre-approved allowances. This incident highlights the often-underestimated risks associated with token approvals in Web3. The article explains that approvals are a fundamental mechanism, allowing smart contracts (like DEXs) to move a user's tokens on their behalf. However, risks arise from practices like granting infinite approvals, the persistence of approvals even after disconnecting from a dApp, and the potential for a once-trusted contract to become compromised later. The piece concludes with advice for managing approval risks: users should adopt the principle of least privilege (approving only the needed amount), use separate wallets for storage versus interactions, and regularly audit and revoke unnecessary approvals using tools like Revoke.cash. It also emphasizes the role of wallets like imToken in providing proactive defenses, such as risk warnings and clear, readable transaction signing interfaces, to help users make informed decisions. Ultimately, wallet security must extend beyond private key protection to include active management of token approvals.

marsbit06/24 05:28

Top-Tier MEV Bot Loses $7.5 Million: Is 'Approval' the Most Overlooked Fatal Risk On-Chain?

marsbit06/24 05:28

The Hunter Becomes the Hunted: The Most Profitable MEV Bot Gets Hacked

A well-known and highly profitable Ethereum MEV Bot, Jaredfromsubway.eth, suffered a sophisticated on-chain attack this Saturday, losing over $7.5 million. Analysis by Blockaid and others reveals this was not a conventional phishing or smart contract exploit, but a targeted "counter-MEV honeypot attack." The attacker meticulously laid a trap over several weeks, deploying 66 fake token contracts and liquidity pools disguised as major assets like WETH and USDC. These pools created the illusion of arbitrage opportunities. The MEV Bot's automated system detected these signals, executed trades, and in the process, granted approval permissions to attacker-controlled contracts. These approvals were not revoked, creating a persistent vulnerability. The attacker then exploited this in a single transaction, draining the bot's ETH, USDC, and USDT holdings. Jaredfromsubway.eth is notorious as one of Ethereum's most active and profitable MEV Bots, primarily known for executing "sandwich attacks" to profit from transaction slippage. Estimates suggest it has earned tens of millions in MEV revenue. The incident highlights escalating crypto security threats, demonstrating that even top-tier automated "predators" are vulnerable to novel, logic-based attacks designed to exploit their own operational rules. Following the hack, an unverified X account impersonating Jaredfromsubway.eth emerged, falsely offering a bounty for the return of funds, prompting developer warnings for users to stay vigilant.

marsbit06/21 09:22

The Hunter Becomes the Hunted: The Most Profitable MEV Bot Gets Hacked

marsbit06/21 09:22

活动图片

Project Updatesright-arrow

Market Analysisright-arrow