MEV bot loses $180K in ETH from access control exploit

A maximal extractable value (MEV) bot lost about $180,000 in Ether after an attacker exploited a vulnerability in its access control systems. 

On April 8, blockchain security firm SlowMist reported that the MEV bot lost 116.7 Ether (ETH) because of the lack of access control. Threat researcher Vladimir Sobolev, also known as Officer’s Notes on X, told Cointelegraph that an attacker exploited a vulnerability in the bot, causing it to swap its ETH to a dummy token. 

Sobolev said this was done through a malicious pool created by the attacker within the same transaction. The threat researcher added that this could have been prevented if the MEV owner implemented stricter access controls. 

Just 25 minutes into the exploit, the MEV’s owner proposed a bounty to the attacker. The owner then deployed a new MEV bot with stricter access control validation. 

Sobolev compared the exploit to a similar incident in 2023, where MEV bots lost $25 million after being exploited. On April 23, 2023, bots who performed sandwich trades lost their crypto to a validator that went rogue.