Front-running attacks in DeFi exploit the public nature of the blockchain where transactions are visible, even before being confirmed (pending). This type of attack occurs when an attacker, seeing a pending transaction in the mempool (the queue of transactions not yet included in a block), inserts a similar but more advantageous transaction for himself, causing it to be processed before the original one (increasing gas fees). Front-running attacks are particularly common in AMMs, where asset prices dynamically change based on the transactions executed (especially for illiquid ones).
For example, on Ethereum, all pending transactions are sent to the mempool before being included in a block by validators. These transactions are public and anyone can view them, including bots or "front-runners" who constantly monitor this queue.
If an attacker sees that a user is trying to swap a token, the transaction goes to the mempool, where it waits to be processed. A front-running bot monitors the mempool and sees that this transaction will affect the price of a token. Front-running can be used with different strategies.
FRONT RUNNING ON AN AMM
The attacker makes a transaction on that same AMM (e.g. Uniswap) that alters the price of the asset before the original user can execute his trade. Imagine a user who wants to buy 10,000 token of a memecoin on Uniswap for a price of 0.6 ETH per token.
The attacker sees this transaction in the mempool and sends an advance buy order of the same memecoin, but paying a higher gas fee than the original transaction. The validator prioritizes the attacker's transaction because it pays a higher fee. The attacker is able to buy the memecoin at 0.6 ETH per token, causing the price to rise (e.g. 0.7 ETH per token) due to the purchase. Now, when the user's original transaction is processed, they have to buy the tokens at a higher price (0.7 ETH per token instead of 0.6 ETH) and will receive less. After the user's transaction takes effect and increases the price even further, the attacker immediately sells the purchased tokens at the higher price (for example, at 0.85 ETH per token). In this way, the attacker has purchased the tokens at a lower price and resold them at a higher price thanks to the original user's transaction.
FRONT RUNNING AND ARBITRAGE
Arbitrage is the process of profiting from market inefficiencies by finding price differences between various markets (buying X and immediately reselling it elsewhere at a higher price). The attacker can get ahead of an arbitrageur when he notices that a transaction is about to be executed that will equalize the prices between two exchanges. The arbitrageur notices that on Uniswap a token is selling for 1000 USDT while on Sushiswap the same token is worth 1005 USDT. The arbitrageur sends a transaction to buy the token for 100 USDT on Uniswap and resell it for 1005 USDT on Sushiswap.
The attacker sees the pending transaction in the mempool and sends a transaction with a higher gas fee to execute the arbitrage before the original user. The attacker buys the token on Uniswap at 1000 USDT and sells it on Sushiswap at 1005 USDT, realizing the arbitrage profit. By the time the original arbitrageur's transaction is processed, the price has already balanced and there is no more price difference.
FRONT RUNNING ON LENDING PLATFORMS
In this type of attack, the attacker exploits transactions that could liquidate user positions in DeFi protocols such as Aave, MakerDAO, and the like. Liquidations are automated processes where lending positions are closed if the collateral drops below a certain threshold, allowing the liquidators to make a profit (liquidation fee and/or discounted collateral).
Imagine a user who has an open loan on Compound that is at risk of being liquidated. If the collateral price drops below a threshold, another user can liquidate the position and earn a fee. The attacker sees a transaction in the mempool that attempts to liquidate the position.
The attacker sends his liquidation transaction with a higher gas fee, causing it to execute first. He will get the liquidation that should have gone to the original user. In this case, the attacker has exploited the slowness of the original transaction inclusion to gain the liquidation gain.
FRONT RUNNING AND SANDWICH ATTACK
This is a very common variant of front-running in dexes. In this type of attack, the attacker "sandwiches" a user transaction between two of his own transactions: one before the user and one after it. The name comes from the fact that the user transaction is "put in the middle".
A user sends a transaction to buy 100 tokens on Sushiswap. The attacker sees this transaction in the mempool and sends a purchase transaction for the same token, paying a higher gas fee to have it execute before the user's. The attacker's purchase increases the price of the token. When the user's transaction is executed, the user buys the tokens at a higher price. Immediately afterward, the attacker executes a second sell transaction of the same token, selling at the higher price (inflated by the user's transaction), making a quick profit. In a sandwich attack, the attacker buys at a lower price before the user and sells at a higher price after the user, exploiting the user's transaction to make a profit.
DEFENSES AND COUNTERMEASURES
Increasing the fees has a relative effect because a bot, knowing them, could increase them in turn. However, with higher fees there is less time for the attacker to notice the pending transaction and execute the attack. Another solution is to hide the details of the transactions until they are executed, like meta-transaction relayers or privacy solutions like zk-Rollups. Another possibility is the Commit-reveal scheme: first, users send a commitment (which hides the transaction details). Then, in a later phase, the content of the commitment is revealed (reveal phase). This makes it difficult for an attacker to know the details of the transaction in time to perform a front-running.
Some DeFi protocols also impose limits on gas fees to prevent attackers from manipulating the order of transactions. Finally, thanks to MEV Auctions (Miner Extractable Value), instead of allowing attackers to exploit MEV (the value extractable by miners), protocols can sell the right to order transactions to miners via auctions. Additional fees and any gains are captured by the protocol itself, rather than by the attackers.
Are you interested in ways to earn crypto bonus? Check it out here: Some Sites To Earn Crypto Bonus (Old & New)
