US Attorney Damian Williams said the scheme was so sophisticated that it “calls the very integrity of the blockchain into question.”
If that’s actually true, they should be given a sentence of time served and a job writing useful software.
It’s not. They tricked some MEV-Boost bots into doing bad trades.
Still highlights a vulnerability doesn’t it? The system is only as secure as the most vulnerable piece.
No, it really doesn’t. That’s like creating a bot that buys and sells company shares automatically, and saying the stock exchange has a vulnerability because your bot makes bad decisions.
Here is a more detailed explanation of the exploit.
The Pepaire-Bueno brothers exploited a bug in MEV-boost’s code that allowed them to preview the content of blocks before they were officially delivered to validators, according to the indictment.
The brothers created 16 Ethereum validators and targeted three specific traders who operated MEV bots, the indictment said. They used bait transactions to figure out how those bots traded, lured the bots to one of their validators which was validating a new block and basically tricked these bots into proposing certain transactions. […]
So hardly an attack on any core system of cryptocurrencies.
So they discovered faulty code and made some money?
Can anyone explain to me how this is illegal?
The code is a contract. If someone writes bad code and loses money, then write better code - just like if someone writes a bad legal contract and loses money.
The justice system is awful.
This is like saying they discovered how to pick a lock so deserve everything in whats locked by it.
No.
It is more like finding a gold mine on public BLM land. It is over treacherous mountains only experienced climbers can access. There are no signs or doors saying it is licensed to anyone; indeed, it isn’t officially registered with BLM. So the climbers go in and take as many gold nuggets as they can carry.
Unbeknownst to them, it was a mine discovered by rich and connected people who have cronies in BLM. Rangers go and arrest the climbers and say that you aren’t allowed to climb, climbing is illegal, and taking gold from that mine is illegal because someone else found it and dug it, even though they didn’t properly secure it nor did they put up any signs. They assumed the mountain was enough protection.
This is closer to the situation.
I’ll try a simple explanation of what this is about, cause this is hilarious. It’s the kind of understated humor, you get in a good british comedy.
For a payment system you must store who owns how much and how the owners transfer the currency. Easy-peasy. A simple office PC can handle that faster and cheaper than a blockchain. But what if the owner of the PC decides to manipulate the records? No problem, you just go to the police with your own records and receipts and they go to jail for fraud. Their belongings are sold off to pay you damages. That’s how these things have worked since forever. It’s how businesses keep track of their debts.
Just one little problem: What if the government wants your money. Maybe you don’t want to pay your taxes, or some fine. Or maybe you have debts you don’t want to pay, like your alimony. Perhaps the government wants to seize the proceeds from a drug deal. They can just go to the record keeper and force them to transfer currency.
This is where cryptocurrencies come to the rescue (as it were). There are different schemes. ETH (Ethereum) uses validators. The validators are paid to take care of the record-keeping. The trick is, that you have to put down ETH as a collateral (called staking) to run a validator. If you manipulate the record/blockchain, then the other validators will notice and raise the alarm. That results in you losing your collateral.
This means the validators can remain anonymous. You don’t need to know their identities to punish them for fraud. You just take their crypto-money. They need to remain anonymous so that the government (or the mob) can’t get to them.
This is where it gets hilarious. These 2 brothers operated fraudulent validators. The stake/the collateral didn’t matter at all. The whole scheme didn’t matter. It was a horrible waste of money and effort. The indictment even details how they tried to launder the crypto. That is, how they tried to transfer it, so that it couldn’t be traced on the blockchain. The indictment even has the search queries they used to look up the info on how to do that.
The whole point of it all is that you supposedly do not need the government to prosecute anyone. If validators are kept honest by the threat of criminal prosecution, then you do not need the whole Proof of Stake scheme. You do not need the whole expensive overhead.
The only rational reason for crypto to exist, is to avoid laws; buying drugs and what not. I’m not judging. The hilarious fact is that the law knew everything about these guys.
It’s all a sham. The one thing that crypto is supposed to do: Foil the government. And it doesn’t work.
When people want to buy crypto on the blockchain, they put out a request so that a validator will execute that transaction and record it on the blockchain. So, while the request is waiting, a bot comes along and scans it. It may be that a purchase changes the exchange value of a currency. In that case, the bot adds 2 more transactions. First, to buy that currency before the original request, and to sell it afterward. The original request drives up the price in between the buy and sell, so that the bot makes a profit for its operator. The original request has to pay a little extra. That’s where the profit comes from.
Sound shady? I hope not, because that’s what the victims did.
The accused operated their own validators. At the right time, they put out their own buy request to lure in a bot. When the bot proposed the bundled transactions, their validators feigned acceptance. But then switched out the lure transaction of buying for selling.
The indictment makes a fairly good argument. It’s like there is a “contract” between these automatic systems. The trading bot wants the bundled transactions to be carried out exactly so. The validator feigns agreement, but does not follow through.
This is a prime example of why the “code is law” selling point for smart contracts is a disaster waiting to happen. Proponents claim you won’t need lawyers, arbitrators, courts, etc, but in reality you’ll need all those and on top of that programmers to write and verify smart contracts.
“code is law” can become “might makes right” without oversight. Those who lobby against oversight are a problem.
