SoK: Transparent Dishonesty: Front-Running Attacks on Blockchain

Abstract

We consider front-running to be a course of action where an entity benefits from prior access to privileged market information about upcoming transactions and trades. Front-running has been an issue in financial instrument markets since the 1970s. With the advent of the blockchain technology, front-running has resurfaced in new forms we explore here, instigated by blockchain's decentralized and transparent nature. In this paper, we draw from a scattered body of knowledge and instances of front-running across the top 25 most active decentral applications (DApps) deployed on Ethereum blockchain. Additionally, we carry out a detailed analysis of Status.im initial coin offering (ICO) and show evidence of abnormal miner's behavior indicative of front-running token purchases. Finally, we map the proposed solutions to front-running into useful categories. 1 A block in the stock market is a large number of shares, 10 000 or more, to sell which will heavily change the price.

Resolving the Multiple Withdrawal Attack on ERC20 Tokens

“…3) Bob notices Alice's second transaction after its broadcast to the Ethereum network but before adding to a block. 4) Bob front-runs (using an asymmetric insertion attack [5]) the original transaction with a call to transferFrom(_Alice, _Bob, N). If a miner is incentivized (e.g., by Bob offering high gas) to add this transaction before Alice's, it will transfer N of Alice's tokens to Bob.…”

“…If Alice has many authorizations, she cannot determine if a transfer was initiated by Bob or someone else she has authorized. 5 Therefore Alice cannot always unambiguously rely on events to determine Bob did not transfer funds (See Section 3.1 for more details). If Alice's web app is beyond web3 and runs a full node maintaining blockchain state, it could correctly detect 6 and attribute all transfers initiated by Bob.…”

“…So, any adjustment violates the standard. 5. Even if Bob is listed in _to, another authorized spender might have transferred tokens to Bob to make Alice believe Bob attempted a multiple withdrawal when he actually did not.…”

“…The attack originates from two methods in the ERC20 standard for approving and transferring tokens. The use of these functions in an adverse environment (e.g., front-running [5]) could result in more tokens being spent than what was intended. This issue is still open and several solutions have been made to mitigate it.…”

Match

“…Smart contracts, self-executing programs stored on a blockchain, are capable of executing the matchmaking logic [33]. Even though it seems like an appealing solution to fairness issues, the consensus algorithm managing the blockchain ledger is vulnerable to various attacks against fairness, specically, transaction re-ordering and front-running [21,29,30]. These attacks eectively allow consensus participants to inuence how specic orders are matched.…”