Even though the title may sound like it, this is not the story of how the cool kids threw food at the nerds back in school but rather about a kind of attack that can happen when using a decentralized exchange.
In my previous article about the DeFiChain DEX, I mentioned that there are bots exploiting users who don’t set a max price when swapping a huge amount. In this post, I want to explain what these bots do.
Consider a DEX pool where you can trade apples and oranges and assume that it contains 300 apples and 200 oranges. So the DEX price of one orange is 1.5 apples while the price of one apple is 2/3 of an orange.
Also assume that you want to swap 100 apples to oranges. By the constant product formula, you would get 50 oranges (since 300•200 = (300+100)•(200–50)).
However, if someone else also swapped 100 apples right before you, they would add 100 apples and take out 50 oranges — thereby shifting the pool ratio to 400 apples and 150 oranges. When your swap is executed next, you only get 30 oranges: 400•150 = (400+100)•(150–30). This is 20 less than you expected and instead of just 2 apples you would have paid a price of 3.33 apples for one orange. Also you would shift the ratio even further to 500 apples and 120 oranges. So the new price of one orange would be 4.17 apples.
Now imagine that the other person used that high price to immediately swap back their 50 oranges. They would then receive a bit more than 147 apples and would have made a profit of 47 apples — at your expense since you lost 20 oranges. If you then swapped your oranges back to apples, you would only get about 53. So you would have lost almost have your apples. (Note that in this example we were ignoring fees. So in reality, the attackers profit would be a bit less while the victim’s loss would be even bigger.)
How can this be used in an attack?
There are bots that do this on purpose and all of it within the same block! So you never even see the temporarily higher price; you only notice that you received much less than what you expected.
A transaction that you submit to the network first goes into the mempool. This is where all pending transactions are stored and from where the masternode that mines the next block picks the transactions that go into the block. Since this mempool is public, everyone can see your pending transaction even before it is put into a block.
Usually, the masternodes prioritize and sort the transactions by fee rate. So a transaction that comes in later can still be placed in front of one that entered the mempool earlier.
There are bots that constantly analyse the mempool for huge swaps and then sent two transactions: One that has a slightly higher fee and will be placed before yours in order to shift the price to your disadvantage (it front-runs your swap) and another one that will be placed after your transaction and shift the ratio back.
Since the bot sandwiches the victim’s transaction (as the ham) between the front- and back-running ones (as the bread), such an attack is also called a “Sandwich Attack”.
How can I protect myself?
On many DEXes there is not much you can do except for splitting the swap into multiple smaller ones to make the attack less attractive.
Luckily, DeFiChain offers some means to protect yourself: You can set a max price. In the above example, if you had set a max price of 2.5 apples, your disadvantageous swap would not have been executed. Or rather: The bot only attacks transactions without a max price; so likely there would not have been an attack and the swap would have been executed at roughly the expected price.
