Lioba Heimbach

2024

1. AFT 24

   SoK: Attacks on DAOs

   Rainer Feichtinger, Robin Fritsch, Lioba Heimbach, and 2 more authors

   Forthcoming in Sixth International Conference on Advances in Financial Technologies (AFT), Sep 2024

   Non-archival: 4th Workshop on Decentralized Finance (DeFi), March 2024
   Non-archival: The Latest in DeFi Research (TLDR) Conference, May 2024
   Non-archival: European DAO Workshop (DAWO) 2024, July 2024
   

   Abstract Bibtex PDF Database Code

   Decentralized Autonomous Organizations (DAOs) are blockchain-based organizations that facilitate decentralized governance. Today, DAOs not only hold billions of dollars in their treasury but also govern many of the most popular Decentralized Finance (DeFi) protocols. This paper systematically analyses security threats to DAOs, focusing on the types of attacks they face. We study attacks on DAOs that took place in the past, attacks that have been theorized to be possible, and potential attacks that were uncovered and prevented in audits. For each of these (potential) attacks, we describe and categorize the attack vectors utilized into four categories. This reveals that while many attacks on DAOs take advantage of the less tangible and more complex human nature involved in governance, audits tend to focus on code and protocol vulnerabilities. Thus, additionally, the paper examines empirical data on DAO vulnerabilities, outlines risk factors contributing to these attacks, and suggests mitigation strategies to safeguard against such vulnerabilities.

   @InProceedings{feichtinger2024attacks,
     title = {Non-Atomic Arbitrage in Decentralized Finance},
     author ={Feichtinger, Rainer and Fritsch, Robin and Heimbach, Lioba and Vonlanthen, Yann and Wattenhofer, Roger},
     booktitle ={Sixth International Conference on Advances in Financial Technologies (AFT)},
     year = {2024},
     month = sep,
     }

2. S&P 24

   Non-Atomic Arbitrage in Decentralized Finance

   Lioba Heimbach, Vabuk Pahari, and Eric Schertenleib

   In IEEE Symposium on Security and Privacy (SP) 2024, May 2024

   Non-archival: 4th Workshop on Decentralized Finance (DeFi), March 2024

   Abstract Bibtex External PDF Code Slides Talk

   The prevalence of maximal extractable value (MEV) in the Ethereum ecosystem has led to a characterization of the latter as a dark forest. Studies of MEV have thus far largely been restricted to purely on-chain MEV, i.e., sandwich attacks, cyclic arbitrage, and liquidations. In this work, we shed light on the prevalence of non-atomic arbitrage on decentralized exchanges (DEXes) on the Ethereum blockchain. Importantly, non-atomic arbitrage exploits price differences between DEXes on the Ethereum blockchain as well as exchanges outside the Ethereum blockchain (i.e., centralized exchanges or DEXes on other blockchains). Thus, non-atomic arbitrage is a type of MEV that involves actions on and off the Ethereum blockchain.
   In our study of non-atomic arbitrage, we uncover that more than a fourth of the volume on Ethereum’s biggest five DEXes from the merge until 31 October 2023 can likely be attributed to this type of MEV. We further highlight that only eleven searchers are responsible for more than 80% of the identified non-atomic arbitrage volume sitting at a staggering 137 billion US$ and draw a connection between the centralization of the block construction market and non-atomic arbitrage. Finally, we discuss the security implications of these high-value transactions that account for more than 10% of Ethereum’s total block value and outline possible mitigations.

   @inproceedings{heimbach2024nonatomic,
     author = {Heimbach, Lioba and Pahari, Vabuk and Schertenleib, Eric},
     title = {Non-Atomic Arbitrage in Decentralized Finance},
     booktitle = {IEEE Symposium on Security and Privacy (SP) 2024},
     year = {2024},
     month = may,
   }

2023

1. IMC 23

   Ethereum’s Proposer-Builder Separation: Promises and Realities

   Lioba Heimbach, Lucianna Kiffer, Christof Ferreira Torres, and 1 more author

   In 2023 ACM Internet Measurement Conference (IMC), Montreal, QC, Canada, Oct 2023

   Abstract Bibtex External PDF Code Slides Talk

   With Ethereum’s transition from Proof-of-Work to Proof-of-Stake in September 2022 came another paradigm shift, the Proposer-Builder Separation (PBS) scheme. PBS was introduced to decouple the roles of selecting and ordering transactions in a block (i.e., the builder), from those validating its contents and proposing the block to the network as the new head of the blockchain (i.e., the proposer). In this landscape, proposers are the validators in the Proof-of-Stake consensus protocol, while now relying on specialized block builders for creating blocks with the highest value for the proposer. Additionally, relays act as mediators between builders and proposers. We study PBS adoption and show that the current landscape exhibits significant centralization amongst the builders and relays. Further, we explore whether PBS effectively achieves its intended objectives of enabling hobbyist validators to maximize block profitability and preventing censorship. Our findings reveal that although PBS grants validators the opportunity to access optimized and competitive blocks, it tends to stimulate censorship rather than reduce it. Additionally, we demonstrate that relays do not consistently uphold their commitments and may prove unreliable. Specifically, proposers do not always receive the complete promised value, and the censorship or filtering capabilities pledged by relays exhibit significant gaps.

   @inproceedings{heimbach2023ethereum,
     title = {Ethereum's Proposer-Builder Separation: Promises and Realities},
     author = {Heimbach, Lioba and Kiffer, Lucianna and Ferreira Torres, Christof and Wattenhofer, Roger},
     booktitle = {2023 ACM Internet Measurement Conference (IMC), Montreal, QC, Canada},
     month = oct,
     year = {2023},
   }

2022

1. AFT 22

   SoK: Preventing Transaction Reordering Manipulations in Decentralized Finance

   Lioba Heimbach, and Roger Wattenhofer

   In 4th ACM Conference on Advances in Financial Technologies (AFT), Cambridge, MA, USA, Sep 2022

   Non-archival: SNB-CIF Conference on Cryptoassets and Financial Innovation, May 2023

   Abstract Bibtex External PDF Slides

   User transactions on Ethereum’s peer-to-peer network are at risk of being attacked. The smart contracts building decentralized finance (DeFi) have introduced a new transaction ordering dependency to the Ethereum blockchain. As a result, attackers can profit from front- and back-running transactions. Multiple approaches to mitigate transaction reordering manipulations have surfaced recently. However, the success of individual approaches in mitigating such attacks and their impact on the entire blockchain remains largely unstudied.
   In this systematization of knowledge (SoK), we categorize and analyze state-of-the-art transaction reordering manipulation mitigation schemes. Instead of restricting our analysis to a scheme’s success at preventing transaction reordering attacks, we evaluate its full impact on the blockchain. Therefore, we are able to provide a complete picture of the strengths and weaknesses of current mitigation schemes. We find that currently no scheme fully meets all the demands of the blockchain ecosystem. In fact, all approaches demonstrate unsatisfactory performance in at least one area relevant to the blockchain ecosystem.

   @inproceedings{Heimbach2022sok,
     author = {Heimbach, Lioba and Wattenhofer, Roger},
     title = {SoK: Preventing Transaction Reordering Manipulations in Decentralized Finance},
     booktitle = {4th ACM Conference on Advances in Financial Technologies (AFT), Cambridge, MA, USA},
     month = sep,
     year = {2022},
   }