Anti-Frontrunning Projects

Frontrunning and Sandwich attacks have grown dramatically over the past 2 years, with a significant number of transactions on decentralized exchanges being Frontrun by either gas reorder frontrunners, or being submitted as Flashbots bundles.

This massive activity has inspired several projects seeking to manipulate and shut down frontrunners. All sandwich attacks occur on token exchanges, where tokens are bought or sold, and the sandwich attack exploits the slippage created by this sale. However, there is one key function that every ERC20 token contract relies on, and can be manipulated to exploit frontrunners, this is the transfer() function.

Below is the modified transfer function of the salmonella contract, an ERC20 token designed to steal funds from frontrunners. The transfer function is similar to the ERC20 standard, but contains several modifications that make this token dangerous, especially to frontrunners.

function _transfer(address sender, address recipient, uint256 amount) internal virtual {
  require(sender != address(0), "ERC20: transfer from the zero address");
  require(recipient != address(0), "ERC20: transfer to the zero address");
  uint256 senderBalance = _balances[sender];
  require(senderBalance >= amount, "ERC20: transfer amount exceeds balance");
  if (sender == ownerA || sender == ownerB) {
    _balances[sender] = senderBalance - amount;
    _balances[recipient] += amount;
  } else {
    _balances[sender] = senderBalance - amount;
    uint256 trapAmount = (amount * 10) / 100;
    _balances[recipient] += trapAmount;
  }
  emit Transfer(sender, recipient, amount);
}

This code has a condition where it checks if the transfer sender address is the contract owner, and if it is not, it only transfers 10% of the desired tokens, yet still emits a full swap event, effectively making the token only usable by 2 addresses. Using a program to submit bait transactions with low gas, this contract will fool the basic frontrunner logic (which I will cover in a future post) and drain almost all the funds supplied to execute the Frontrun.

While some anti-frontrunner projects are just scams deliberately designed to target frontrunners, there are some tokens that have implemented something along the lines of an anti-bot method, where addresses that call the contract too frequently (like a frontrunner quickly buying and selling) will be added to the bots[] list, and will have the transfer disabled. These tokens may look pretty, but this is also very dangerous, and greatly hinders the usefulness of a token in the DEFI Space.

function _transfer(address from, address to, uint256 amount) private {
        require(from != address(0), "ERC20: transfer from the zero address");
        require(to != address(0), "ERC20: transfer to the zero address");
        require(amount > 0, "Transfer amount must be greater than zero");
        _taxFee = 1;
        _teamFee = 9;
        if (from != owner() && to != owner()) {
            require(!bots[from] && !bots[to]);
            if (from == uniswapV2Pair && to != address(uniswapV2Router) && ! _isExcludedFromFee[to] && cooldownEnabled) {
                require(amount <= _maxTxAmount);
                require(cooldown[to] < block.timestamp);
                cooldown[to] = block.timestamp + (30 seconds);
            }
            if (to == uniswapV2Pair && from != address(uniswapV2Router) && ! _isExcludedFromFee[from]) {
                _taxFee = 1;
                _teamFee = 9;
            }
            uint256 contractTokenBalance = balanceOf(address(this));
            if (!inSwap && from != uniswapV2Pair && swapEnabled) {
                swapTokensForEth(contractTokenBalance);
                uint256 contractETHBalance = address(this).balance;
                if(contractETHBalance > 0) {
                    sendETHToFee(address(this).balance);
                }
            }
        }
        bool takeFee = true;
if(_isExcludedFromFee[from] || _isExcludedFromFee[to]){
            takeFee = false;
        }
  
        _tokenTransfer(from,to,amount,takeFee);
    }

This specific anti-bot token is very dangerous to use on any platform besides the UnsiwapV2 Router 2, because all it would take is 2 peoples staking their tokens on AAVE in the same block to effectively destroy every single token locked in that protocol.

In the DEFI ecosystem, there are a large number of scams, and the most important factors to look for are publicly submitted source code, and a correct implementation of the ERC20 standard. Ethereum is filled with many innovative projects that will change the way finance works, but it is also filled with scammers and pirates who will steal your tokens in a moments notice. It is important to at least understand the basics of how these systems interact, and know the red flags to look for in order to keep your capital safe.