View source for MEV Bot Tricked And Drained By Dummy Token Swap

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/mevbottrickedanddrainedbydummytokenswap.php}}
{{Unattributed Sources}}

[[File:Mevbotextract.jpg|thumb|The Transaction And IDM]]An MEV (Maximal Extractable Value) bot on Ethereum, which profits by manipulating transaction order within blocks, was exploited due to a critical vulnerability stemming from poor access control. The attacker created a malicious token and a fake liquidity pool within the same transaction, tricking the bot into swapping all its ETH—about 116.78 ETH—for the worthless token. This was achieved by exploiting a poorly validated function and using a private mempool to avoid detection. Despite the bot’s owner quickly offering a bounty and redeploying a more secure version, the attacker has not responded, and the stolen funds are unlikely to be recovered.<ref name="slowmisttweet-19631" /><ref name="officerciatweet-19632" /><ref name="unknown-19633" /><ref name="graphorg-19634" /><ref name="cointelegraph-19635" /><ref name="pleaetherscan-19636" /><ref name="exploitetherscan-19637" /><ref name="firstsmartcontractetherscan-19638" /><ref name="secondsmartcontractetherscan-19639" /><ref name="muststopyetweet-19640" /><ref name="tenarmortweet-19641" />

== About MEV Bots ==
"An MEV bot on Ethereum is a trading bot that exploits maximal extractable value. This is the maximum profit that can be extracted from block production. This is done by reordering, inserting or censoring transactions within a block. 

The bot observes Ethereum’s pool of pending transactions and looks for potential profits. These bots can do front-run, back-run, or sandwich transactions. This makes the bots very controversial as they steal value from regular users during high periods of volatility or congestion. "

== The Reality ==
The MEV bot had a vulnerability which allowed a fake/dummy token to be swapped for all of the ethereum in the bot.

== What Happened ==
"According to the SlowMist MistEye security monitoring system, a MEV bot has lost approximately 116.7 ETH due to a lack of access control."
{| class="wikitable"
|+Key Event Timeline - MEV Bot Tricked And Drained By Dummy Token Swap
!Date
!Event
!Description
|-
|April 7th, 2025 12:10:35 PM MDT
|Attack Transaction
|The MEV Bot is exploited and all 116.782684444757422875 ETH in the MEV Bot are extracted.
|-
|April 7th, 2025 12:57:23 PM MDT
|MEV Bot Reached Out
|The MEV Bot reaches out to the exploiter "Ugh, that one hurts. Can we talk? Happy to offer a bounty ..."
|-
|April 7th, 2025 10:11:00 PM MDT
|SlowMist Reports Tweet
|SlowMist reports a tweet about the incident.
|-
|April 8th, 2025 12:40:00 AM MDT
|Vladimir Sobolev Confirmation
|Vladimir S picks up the incident from SlowMist and shares some additional information.
|-
|April 8th, 2025 1:12:00 AM MDT
|muststopye Tweets More
|Ye (muststopye) shares more information about the specific exploit in the MEV Bot.
|-
|April 8th, 2025 5:27:41 AM MDT
|CoinTelegraph Article Published
|CoinTelegraph publishes an article with further details about the exploit.
|}

== Technical Details ==
"address: 0x49e27d11379f5208cbb2a4963b903fd65c95de09"

"a lack of access control."

"Attacker was able to make vulnerable MEV to call Uni PoolManager.unlock, which triggered unlockCallback from the MEV bot, which got maliciously instructed to swap all the ETH MEV bot had for dummy token via a Pool which was created by attacker in the same tx. (1/3)"

"It appears that the function 0x051e65ae() lacks proper parameter validation and was tricked into performing a two-hop swap using a pool created by the attacker. Worse still, the malicious token was somehow set as the recipient in the second swap, resulting in a loss of 117 ETH!"

"Threat researcher Vladimir Sobolev, also known as Officer’s Notes on X, told Cointelegraph that an attacker exploited a vulnerability in the bot, causing it to swap its ETH to a dummy token. 

Sobolev said this was done through a malicious pool created by the attacker within the same transaction. The threat researcher added that this could have been prevented if the MEV owner implemented stricter access controls."

"attack tx was executed via private mempool, tactic which is employed by black hats more and more frequently."


== Total Amount Lost ==
"approximately 116.7 ETH"

Blockchain: 116.782684444757422875 ETH

The total amount lost has been estimated at $210,000 USD.

== Immediate Reactions ==
"Just 25 minutes into the exploit, the MEV’s owner proposed a bounty to the attacker. The owner then deployed a new MEV bot with stricter access control validation."

== Ultimate Outcome ==
The hacker was offered a bounty and the MEV bot was redeployed with stricter security within an hour.

== Total Amount Recovered ==
It does not appear that the attacker has responded in any way.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
It does not appear there is any likelihood of recovering the funds.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisttweet-19631">[https://twitter.com/SlowMist_Team/status/1909459139715023097 SlowMist - "We have detected that a MEV bot 0x49e27d11379f5208cbb2a4963b903fd65c95de09 has lost 116.7 ETH due to the lack of access control." - Twitter/X] (Accessed May 16, 2025)</ref>

<ref name="officerciatweet-19632">[https://twitter.com/officer_cia/status/1909496455246889371 Vladimir S - "A MEV bot 0x49e27d11379f5208cbb2a4963b903fd65c95de09 has lost 116.7 ETH due to the lack of access control -] (Accessed May 16, 2025)</ref>

<ref name="unknown-19633">[@SlowMist_Team" - Twitter/X @SlowMist_Team" - Twitter/X] (Accessed May 16, 2025)</ref>

<ref name="graphorg-19634">[https://graph.org/MEV-PACK-06-10 MEV / Sandwich / Front-run & Back-run - Graph.org] (Accessed May 16, 2025)</ref>

<ref name="cointelegraph-19635">[https://cointelegraph.com/news/mev-bot-180k-loss-access-control-exploit MEV bot loses $180K in ETH from access control exploit - CoinTelegraph] (Accessed May 16, 2025)</ref>

<ref name="pleaetherscan-19636">[https://etherscan.io/tx/0xf31130c9a9141cf0656381dca532b86e0dedeed407814dbff7ba06afebd7f526 "Ugh, that one hurts. Can we talk? Happy to offer a bounty ..." - MEV Bot To Exploiter] (Accessed May 16, 2025)</ref>

<ref name="exploitetherscan-19637">[https://etherscan.io/tx/0x1681c269e702ccaea4a3595037b7d1c2fa4551330451ef9c61cf1db0e63e7627 Exploit Transaction Takes 116.782684444757422875 ETH - Etherscan] (Accessed May 16, 2025)</ref>

<ref name="firstsmartcontractetherscan-19638">[https://etherscan.io/tx/0xd952dfe038fe81c38e8db91a0cf61c70b7a6c3ac281febd94dd7a3b0febff17f First Malicious Smart Contract Deployed - Etherscan] (Accessed May 16, 2025)</ref>

<ref name="secondsmartcontractetherscan-19639">[https://etherscan.io/tx/0xb3f6c48d374438b5c7e5e3d090f412fb31801a6300932692e0a1df84b7ae1a6e Second Malicious Smart Contract Deployed - Etherscan] (Accessed May 16, 2025)</ref>

<ref name="muststopyetweet-19640">[https://twitter.com/muststopye/status/1909504698568392937 Ye (muststopye) - "Attacker was able to make vulnerable MEV to call Uni PoolManager.unlock, which triggered unlockCallback from the MEV bot, which got maliciously instructed to swap all the ETH MEV bot had for dummy token via a Pool which was created by attacker in the same tx." - Twitter/X] (Accessed May 16, 2025)</ref>

<ref name="tenarmortweet-19641">[https://twitter.com/TenArmorAlert/status/1909465828178690454 Ten Armor - "Our system has detected that a MEV bot on #ETH was exploited, resulting in an approximately loss of $180K." - Twitter/X] (Accessed May 16, 2025)</ref></references>