Rolling in the Shadows: Analyzing the Extraction of MEV Across Layer-2 Rollups (2405.00138v2)
Abstract: The emergence of decentralized finance has transformed asset trading on the blockchain, making traditional financial instruments more accessible while also introducing a series of exploitative economic practices known as Maximal Extractable Value (MEV). Concurrently, decentralized finance has embraced rollup-based Layer-2 solutions to facilitate asset trading at reduced transaction costs compared to Layer-1 solutions such as Ethereum. However, rollups lack a public mempool like Ethereum, making the extraction of MEV more challenging. In this paper, we investigate the prevalence and impact of MEV on Ethereum and prominent rollups such as Arbitrum, Optimism, and zkSync over a nearly three-year period. Our analysis encompasses various metrics including volume, profits, costs, competition, and response time to MEV opportunities. We discover that MEV is widespread on rollups, with trading volume comparable to Ethereum. We also find that, although MEV costs are lower on rollups, profits are also significantly lower compared to Ethereum. Additionally, we examine the prevalence of sandwich attacks on rollups. While our findings did not detect any sandwiching activity on popular rollups, we did identify the potential for cross-layer sandwich attacks facilitated by transactions that are sent across rollups and Ethereum. Consequently, we propose and evaluate the feasibility of three novel attacks that exploit cross-layer transactions, revealing that attackers could have already earned approximately 2 million USD through cross-layer sandwich attacks.
- Aave. 2024a. Aave - Open Source Liquidity Protocol. https://aave.com/ Online; accessed 20 April 2024.
- Aave. 2024b. Flash Loans - Developers. https://docs.aave.com/developers/guides/flash-loans Online; accessed 20 April 2024.
- Aave. 2024c. LendingPool - Developers. https://docs.aave.com/developers/v/2.0/the-core-protocol/lendingpool#getuseracountdata Online; accessed 20 April 2024.
- Aave. 2024d. Liquidations - Developers. https://docs.aave.com/developers/guides/liquidations Online; accessed 20 April 2024.
- Arbiscan. 2024. Accounts — Arbiscan. https://docs.arbiscan.io/api-endpoints/accounts Online; accessed 20 April 2024.
- Arbitrum. 2024. Arbitrum — The Future of Ethereum. https://arbitrum.io/ Online; accessed 20 April 2024.
- Lanturn: Measuring economic security of smart contracts through adaptive learning. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 1212–1226.
- Arthur Bagourd and Luca Georges Francois. 2023. Quantifying MEV On Layer 2 Networks. CoRR abs/2309.00629 (2023). https://doi.org/10.48550/arXiv.2309.00629 arXiv:2309.00629
- Balancer. 2024a. Balancer DeFi Liquidity Protocol. https://balancer.fi/ Online; accessed 20 April 2024.
- Balancer. 2024b. Flash Loans — Balancer. https://docs.balancer.fi/reference/contracts/flash-loans.html Online; accessed 20 April 2024.
- Ronin Chain. 2024. Ronin Bridge. https://docs.roninchain.com/apps/ronin-bridge Online; accessed 20 April 2024.
- Chainlink. 2024. Chainlink Data Feeds — Chainlink Documentation. https://docs.chain.link/data-feeds#price-feeds Online; accessed 20 April 2024.
- CoinGecko. 2024. Crypto API Documentation — CoinGecko. https://www.coingecko.com/api/documentation Online; accessed 20 April 2024.
- CompaniesMarketCap.com. 2024a. Companies ranked by Market Cap - CompaniesMarketCap.com. https://companiesmarketcap.com/ Online; accessed 20 April 2024.
- CompaniesMarketCap.com. 2024b. Total Value Locked All Chains - DeFiLama. https://defillama.com/chains Online; accessed 20 April 2024.
- Compound. 2024a. Compound. https://compound.finance/ Online; accessed 20 April 2024.
- Compound. 2024b. Compound V2 Docs — Comptroller. https://docs.compound.finance/v2/comptroller/ Online; accessed 20 April 2024.
- Curve. 2024. Curve: Swap. https://curve.fi Online; accessed 20 April 2024.
- Flash Boys 2.0: Frontrunning in Decentralized Exchanges, Miner Extractable Value, and Consensus Instability. In 2020 IEEE Symposium on Security and Privacy (SP). 910–927. https://doi.org/10.1109/SP40000.2020.00040
- Towards scaling blockchain systems via sharding. In Proceedings of the 2019 international conference on management of data. 123–140.
- DappRadar. 2024. Top Ethereum DeFi TVL. https://dappradar.com/rankings/defi/chain/ethereum?category=defi_dex Online; accessed 20 April 2024.
- DeFiLama. 2024. DeFiLama - DeFi Dashboard. https://defillama.com/ Online; accessed 20 April 2024.
- DeFiLlama. 2024. Lending TVL Rankings. https://defillama.com/protocols/Lending/Ethereum Online; accessed 20 April 2024.
- Etherscan. 2024a. Accounts — Etherscan. https://docs.etherscan.io/api-endpoints/accounts Online; accessed 20 April 2024.
- Optimistic Etherscan. 2024b. Accounts — Optimism Etherscan — Optimism. https://docs.optimism.etherscan.io/api-endpoints/accounts Online; accessed 20 April 2024.
- Flashbots. 2024a. Flashbots. https://www.flashbots.net Online; accessed 20 April 2024.
- Flashbots. 2024b. Flashbots Blocks API. https://blocks.flashbots.net Online; accessed 20 April 2024.
- Sok: Layer-two blockchain protocols. In Financial Cryptography and Data Security: 24th International Conference, FC 2020, Kota Kinabalu, Malaysia, February 10–14, 2020 Revised Selected Papers 24. Springer, 201–226.
- Flashbabies: Mev on l2. (2021). https://timroughgarden.github.io/fob21/reports/r11.pdf
- Elan Halpern. 2021. Unmasking the Ethereum Uncle Bandit. https://medium.com/alchemy-api/unmasking-the-ethereum-uncle-bandit-a2b3eb694019 Online; accessed 20 April 2024.
- Ethereum’s Proposer-Builder Separation: Promises and Realities. In Proceedings of the 2023 ACM on Internet Measurement Conference, IMC 2023, Montreal, QC, Canada, October 24-26, 2023, Marie-José Montpetit, Aris Leivadeas, Steve Uhlig, and Mobin Javed (Eds.). ACM, 406–420. https://doi.org/10.1145/3618257.3624824
- Lioba Heimbach and Roger Wattenhofer. 2022. Eliminating Sandwich Attacks with the Help of Game Theory. In ASIA CCS ’22: ACM Asia Conference on Computer and Communications Security, Nagasaki, Japan, 30 May 2022 - 3 June 2022, Yuji Suga, Kouichi Sakurai, Xuhua Ding, and Kazue Sako (Eds.). ACM, 153–167.
- Blindperm: Efficient mev mitigation with an encrypted mempool and permutation. Cryptology ePrint Archive (2023).
- Omniledger: A secure, scale-out, decentralized ledger via sharding. In 2018 IEEE symposium on security and privacy (SP). IEEE, 583–598.
- L2BEAT. 2024. L2BEAT – The state of the layer two ecosystem. https://l2beat.com/scaling/summary Online; accessed 20 April 2024.
- L2Fees.info. 2024. L2 Fees. https://l2fees.info/ Online; accessed 20 April 2024.
- Michael Lewis. 2014. Flash Boys. W.W. Norton & Company.
- Demystifying DeFi MEV Activities in Flashbots Bundle. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 165–179.
- A Large Scale Study of the Ethereum Arbitrage Ecosystem. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, Joseph A. Calandrino and Carmela Troncoso (Eds.). USENIX Association, 3295–3312.
- Raiden Network. 2024. Raiden Network. https://raiden.network/ Online; accessed 20 April 2024.
- Unity is Strength: A Formalization of Cross-Domain Maximal Extractable Value. CoRR abs/2112.01472 (2021). arXiv:2112.01472 https://arxiv.org/abs/2112.01472
- OpenZeppelin. 2024. Proxy Upgrade Pattern - OpenZeppelin Docs. https://docs.openzeppelin.com/upgrades-plugins/1.x/proxies Online; accessed 20 April 2024.
- Optimism. 2024. Optimism — Home. https://www.optimism.io/ Online; accessed 20 April 2024.
- Playing the MEV Game on a First-Come-First-Served Blockchain. arXiv preprint arXiv:2401.07992 (2024).
- Perun. 2024. Perun — Blockchains in real-time. https://perun.network/ Online; accessed 20 April 2024.
- Extracting Godl [sic] from the Salt Mines: Ethereum Miners Extracting Value. arXiv:2203.15930 [cs] (March 2022). http://arxiv.org/abs/2203.15930 arXiv: 2203.15930.
- Polygon. 2024. Web3, Aggregated. https://polygon.technology/ Online; accessed 20 April 2024.
- Joseph Poon and Thaddeus Dryja. 2016. The bitcoin lightning network: Scalable off-chain instant payments.
- Across Protocol. 2024a. Home — Across Protocol. https://across.to/ Online; accessed 20 April 2024.
- Hop Protocol. 2024b. A Short Explainer — User Docs — Hop Docs. https://docs.hop.exchange/basics/a-short-explainer Online; accessed 20 April 2024.
- The Blockchain Imitation Game. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, Joseph A. Calandrino and Carmela Troncoso (Eds.). USENIX Association, 3961–3978.
- Quantifying Blockchain Extractable Value: How dark is the forest?. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022. IEEE, 198–214.
- Solidity. 2024. Contract Metadata - Solidity 0.8.26 documentation. https://docs.soliditylang.org/en/latest/metadata.html Online; accessed 20 April 2024.
- SushiSwap. 2024. Buy and Sell Instantly on Sushi. https://www.sushi.com/ Online; accessed 20 April 2024.
- Frontrunner Jones and the Raiders of the Dark Forest: An Empirical Study of Frontrunning on the Ethereum Blockchain. In USENIX Security Symposium, Virtual 11-13 August 2021.
- A Ripple for Change: Analysis of Frontrunning in the XRP Ledger. In 2023 IEEE International Conference on Blockchain and Cryptocurrency (ICBC). IEEE, 1–9.
- Uniswap. 2024. Uniswap Protocol. https://uniswap.org/ Online; accessed 20 April 2024.
- Towards a first step to understand flash loan and its applications in defi ecosystem. In Proceedings of the Ninth International Workshop on Security in Blockchain and Cloud Computing. 23–28.
- Cyclic arbitrage in decentralized exchanges. In Companion Proceedings of the Web Conference 2022. 12–19.
- A Flash(bot) in the Pan: Measuring Maximal Extractable Value in Private Pools. In Proceedings of the 22nd ACM Internet Measurement Conference (IMC ’22). Association for Computing Machinery, Nice, France. https://doi.org/10.1145/3517745.3561448
- Gavin Wood et al. 2014. Ethereum: A secure decentralised generalised transaction ledger. Ethereum project yellow paper 151, 2014 (2014), 1–32.
- Wormhole. 2024. The best way to build cross-chain. https://wormhole.com/ Online; accessed 20 April 2024.
- Survey: Sharding in blockchains. IEEE Access 8 (2020), 14155–14181.
- Front-running Attack in Distributed Sharded Ledgers and Fair Cross-shard Consensus. arXiv preprint arXiv:2306.06299 (2023).
- zkSync. 2024a. zkEVM FaQ — zkSync Documentaion. https://docs.zksync.io/zkevm/ Online; accessed 20 April 2024.
- zkSync. 2024b. zkSync — Scaling the Ethos and technology of Ethereum. https://zksync.io/ Online; accessed 20 April 2024.
- zkSync. 2024c. zkSync Era Developer Tools — Compiler Toolchain — Overview. https://era.zksync.io/docs/tools/compiler-toolchain/overview.html Online; accessed 20 April 2024.
- zkSync Era Explorer. 2024. ZkSync Block Explorer API. https://block-explorer-api.mainnet.zksync.io/docs Online; accessed 20 April 2024.