code-423n4 / 2021-08-gravitybridge-findings

1 stars 0 forks source link

Mempool attacks can abuse relayers #10

Closed code423n4 closed 2 years ago

code423n4 commented 3 years ago

Handle

nascent

Vulnerability details

If there are multiple valid batches, valset updates, or logic calls sitting in the mempool, an attacker can use flashbots to have a later batch, valset, or logic call execute prior to another. This would result in nonce checks in each of the functions to fail, wasting the relayers gas on lower nonce calls.

Additionally, if relayers don't use flashbots in the first place, they will be frontran.

Recommendation

Implement optional flashbots plugin for relayers.

jkilpatr commented 2 years ago

duplicate of #33, #10, #52

albertchon commented 2 years ago

I guess not all MEV is bad haha, at least from a protocol's perspective