View source for MEV Bot Fallback Function Arbitrary Call Vulnerability Attack

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/mevbotfallbackfunctionarbitrarycallvulnerabilityattack.php}}
{{Unattributed Sources}}

[[File:Mevbotarbitrary.jpg|thumb|Screenshot Of The Transaction]]A MEV bot, created on May 10, 2025, to exploit transaction ordering on Ethereum, was itself exploited due to a vulnerability in its smart contract. The flaw—an arbitrary call vulnerability in the fallback function of contract 0xb5cb...4a87—allowed an attacker to execute unauthorized calls, specifically to the protected 0x0243f5a2() function on victim contract 0xb5cb...e1b0. This was possible because a prior transaction had mistakenly granted the vulnerable contract access. TenArmor initially reported a $1.1 million loss, later updating it to around $2 million after identifying additional attack transactions. SlowMist also reported a $2 million loss. The MEV bot creator remains unidentified, and there is little public information about any recovery efforts or investigations.<ref name="bscscantransaction1-20604" /><ref name="bscscanexploiter-20605" /><ref name="bscscantransaction2-20606" /><ref name="bscscantransaction3-20607" /><ref name="bscscanpermissions-20608" /><ref name="tenarmoralerttweet-20609" /><ref name="bscscancontract-20610" /><ref name="bscscancreation-20611" /><ref name="ethereumfoundation-20612" /><ref name="flashbots-20613" /><ref name="coindesk-20614" />

== About MEV Bot ==
A MEV bot (Miner Extractable Value or Maximal Extractable Value bot) is a program that operates on blockchain networks like Ethereum to profit from the way transactions are ordered within blocks. These bots exploit inefficiencies in the blockchain's transaction execution process by front-running, back-running, or sandwiching other users' transactions. MEV bots scan pending transactions and insert their own in a way that can extract value, often at the expense of regular users. This can include arbitrage between decentralized exchanges or manipulating DeFi protocols.

This particular exploited MEV Bot was created on May 10th, 2025. The MEV bot creator doesn't appear to be published.

== The Reality ==
Unfortunately a vulnerability existed in the smart contract code.

== What Happened ==
An attacker exploited an arbitrary call vulnerability in the fallback function of MEV bot contract 0xb5cb...4a87, allowing unauthorized access to a protected function in contract 0xb5cb...e1b0, resulting in losses of up to $2 million.
{| class="wikitable"
|+Key Event Timeline - MEV Bot Fallback Function Arbitrary Call Vulnerability Attack
!Date
!Event
!Description
|-
|May 10th, 2025 1:47:23 AM MDT
|MEV Bot Contract Created
|The MEV Bot contract which was later exploited was first created.
|-
|June 24th, 2025 1:18:11 PM MDT
|Permissions Granted In Contract
|Access permissions are granted within the MEV Bot contract, which ultimately allows for the later exploit.
|-
|June 24th, 2025 9:44:17 PM MDT
|Malicious Transaction Occurs
|The time of the malicious transaction on the Binance Smart Chain. This is reported by TenArmor as a loss of $1.1m.
|-
|June 24th, 2025 9:45:26 PM MDT
|Second Malicious Transaction
|A second attack transaction draining further funds.
|-
|June 24th, 2025 9:48:58 PM MDT
|Third Malicious Transaction
|A third malicious transaction drains further funds. According to TenArmor, total losses are now $2m. SlowMist also reports a total loss of $2m.
|-
|June 24th, 2025 10:09:00 PM MDT
|TenArmor Posts Tweet
|TenArmor posts a tweet about the suspicious transaction, reporting losses at around $1.1m.
|}

== Technical Details ==
The exploit involves an arbitrary call vulnerability in the fallback function of contract 0xb5cb...4a87, which allows it to execute unauthorized external calls. The attacker used this vulnerability to call the 0x0243f5a2() function on the victim contract 0xb5cb...e1b0, a function that normally requires strict access control. However, due to a prior transaction that mistakenly granted 0xb5cb...4a87 permission, the attacker was able to bypass access restrictions and exploit the victim contract.

== Total Amount Lost ==
TenArmor reports "an approximately loss of $1.1M" initially, and due to "[a]nother two attack t[ransactio]ns", later revised this to a "total loss [of] about $2M". SlowMist reported "losses of approximately $2 million".

The total amount lost has been estimated at $2,000,000 USD.

== Immediate Reactions ==
The attack was noticed by both TenArmor and SlowMist. It is unclear what reaction the MEV Bot creator may have had.

== Ultimate Outcome ==
It is unclear if anything was done to trace or recover the funds.

== Total Amount Recovered ==
The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
There is limited information about whether any investigation is underway.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="bscscantransaction1-20604">[https://bscscan.com/tx/0x7708aaedf3d408c47b04d62dac6edd2496637be9cb48852000662d22d2131f44 Attack Transaction 1 - BSCScan] (Accessed Jul 21, 2025)</ref>

<ref name="bscscanexploiter-20605">[https://bscscan.com/address/0xd5c6f3b71bcceb2ef8332bd8225f5f39e56a122c Exploiter BSC Address - BSCScan] (Accessed Jul 21, 2025)</ref>

<ref name="bscscantransaction2-20606">[https://bscscan.com/tx/0xf9025e317ce71bc8c055a511fccf0eb4eafd0b8c613da4d5a8e05e139966d6ff Attack Transaction 2 - BSCScan] (Accessed Jul 21, 2025)</ref>

<ref name="bscscantransaction3-20607">[https://bscscan.com/tx/0x8c026c3939f7e2d0376d13e30859fa918a5a567348ca1329836df88bef30c73e Attack Transaction 3 - BSCScan] (Accessed Jul 21, 2025)</ref>

<ref name="bscscanpermissions-20608">[https://bscscan.com/tx/0x0c510ce316447e76d5634cc370f13fcf2fb8e5c2519bd63df4ed0ef7378f8e42 Smart Contract Permissions Granted - BSCScan] (Accessed Jul 21, 2025)</ref>

<ref name="tenarmoralerttweet-20609">[https://twitter.com/TenArmorAlert/status/1937724816540279248 TenArmor - "Our system has detected a suspicious attack involving #MEV bot 0xb5cb on #BSC, resulting in an approximately loss of $1.1M." - Twitter/X] (Accessed Jul 21, 2025)</ref>

<ref name="bscscancontract-20610">[https://bscscan.com/address/0xb5cb0555c0c51e603ead62c6437da65372e4e1b0 MEV Bot Contract - BSCScan] (Accessed Jul 21, 2025)</ref>

<ref name="bscscancreation-20611">[https://bscscan.com/tx/0xb730f4358eb1705159ad363a835c675daeee4b841ca1c1fa55e186cd8eebb2f5 MEV Bot Contract Creation - BSCScan] (Accessed Jul 21, 2025)</ref>

<ref name="ethereumfoundation-20612">[https://ethereum.org/en/developers/docs/mev/ Ethereum Foundation’s explanation of MEV] (Accessed Jul 21, 2025)</ref>

<ref name="flashbots-20613">[https://docs.flashbots.net/ Flashbots (a major MEV research group) Documentation] (Accessed Jul 21, 2025)</ref>

<ref name="coindesk-20614">[https://www.coindesk.com/learn/what-is-mev-and-why-it-matters/ What Is MEV and Why It Matters - CoinDesk] (Accessed Jul 21, 2025)</ref></references>