MEV Boost Exploit Hack

MEV-Boost Relay was exploited by the validator and resulted in a loss of 26,123,300 $USD.

MEV-Boost Relay is a software for PoS Ethereum used to implement Proposal/Builder separation. A malicious validator exploited a vulnerability in the MEV-Boost Relay and drained five MEV bots.

starts from the exploiter to trigger MEV bots to buy already prepared tokens from UniV2 pools. Consequently, the validator executed transactions, front-running the bots. When the MEV bot tries to take profit, the attacker sets both the parent root and state root to zero of the block, making it impossible for the block to be accepted by the network after being signed correctly by proposers. As a result, they could take revealed transactions from deconstructed bundles and claim liquidity from unlucky MEV bots included in that block. Approximately, 26,123,300 $USD worth of $WETH, $WBTC, $USDT, and $DAI were siphoned out from the affected contracts.

The patch was rolled out shortly after this incident where now mev-boost-relay will refuse to return transactions if blocks are not successfully sent into networks. In addition, there is now an added delay of one second before responding with any transaction data.

Further investigation led to evidence suggesting malicious actors three EOA addresses funded just 25 days ago were used as part of planning and preparing various token pools. Three out of five affected bots had their entire balances drained due to automated strategies working against them when bought tokens without regard for price impact.

Attacker address:

https://etherscan.io/address/0xf489bd7b…ce746e

Malicious block:

https://etherscan.io/txs?block=16964664

Contract holding funds:

https://etherscan.io/address/0x3c98d617…D1D8Eb

https://etherscan.io/address/0x5B04db6D…3905b6

https://etherscan.io/address/0x27bf8f09…9C8f69

Draining transaction example:

https://etherscan.io/tx/0xa34d79cb…319c85