libevm / subway

A practical example on how to perform sandwich attacks on Ethereum

Subway

A practical example on how to perform sandwich attacks on UniswapV2 pairs.

Having highly optimized contracts is just one part of the equation, a tech stack is just as important as the contracts to execute on the opportunities.

subwap-usage.mp4

Overview

The contracts are written in Yul+ and Solidity, and contains the bare minimum needed to perform a sandwich attack (i.e. swap and transfer). They do NOT protect against uncle bandit attacks so use at your own risk.

The goal of this bot is to act as a low barrier of entry, reference source code for aspiring new searchers (hence, JavaScript). This bot contains:

• read from the mempool
• decode transaction data
• simple logging system
• profit calculation algos
• gas bribe calculation
• bundle firing
• misc
  • doing math in JS
  • calculating next base fee

While the bot is functional, the bot logic is a very simplistic one and does not contain a lot of the features that many advance searchers have (but not including), such as:

• circuit breakers
• poison token checker
• caching system
• robust logging system (e.g. graphana)
• various gas saving ALPHAs

As such, this bot is intended as a piece of educational content, and not for production use.

subway's Issues

Duplicated code in relayer.js

In ./src/relayer.js, line 68-71 are duplicated

getUniv2ExactWethTokenMinRecv for loop never runs / function does nothing

in getUniv2ExactWethTokenMinRecv() all of the logic within the for loop never runs, and instead it just returns the input arg since path always has a length of 2. The loop only runs while i > 1 and i == 1 always.

for (let i = path.length - 1; i > 1; i--)

Yulp Contract deployement

I am facing lots of issues in deploying yulp contract to etherium chain. Can you code and publish a solidity contract?

error while simulating

the source code I cloned, and I just change to sepolia, then I run node index.js , the terminal show me :
txhash=0xe6d0befbc3adc884bfde8f095f78a66da6f683568d927748a4f82ec62563cf40 error while simulating {"error":{},"block":{"hash":"0x5a0b55f2b5139b7ef0112567cb395f432ea6dbd2948d4f9a6e67745bc960a168","parentHash":"0x6744ddb5ff1bc2be1992bb0b744d960501990eb54d99fee91c56db55bb27345d","number":5723668,"timestamp":1713431232,"nonce":"0x0000000000000000","difficulty":0,"gasLimit":"30000000","gasUsed":"9110415","miner":"0x9A6034c84cd431409Ac1a35278c7Da36FfDa53E5","extraData":"0xd883010d0b846765746888676f312e32312e36856c696e7578","transactions":["0x21ff2d9bfe67c6894d351d582dac35b581c054cb8a13d6c337f50f1c5ee12996","0x8661d5f55a9bb3aaa6371f205cf6aacf42f9e1b06c23b4a3da5389575ebcb5cd","0xccef04ee544b6e5146046351788817e3f7137ed5e645c70f73ac92b9c4cda098","0xb49c6c400d6682fe691b934103de2e4334429c8548796a0e0a49eae4b0fd791b","0x022651954883e2bc7e5c042e216918ba08b3df75f6463f19050a6b2711acd76e","0xca6adaf7845eecaa21745c935e0a3a31d2f0f76a3cefbc54ec5cbfa669d7d710","0x2a530e69ba74da52817af63f69cd745d535743d33e031d66482976b6dbd98dc0"],"baseFeePerGas":"85657205499","_difficulty":"0"},"targetBlockNumber":5723669,"nextBaseFee":"81453160567","nonce":740,"sandwichStates":{"revenue":"-2272385280873243","optimalSandwichWethIn":"99609375000000000000","userAmountIn":"100000000000000","userMinRecv":"0","reserveState":{"reserveWeth":"395189742548311856","reserveToken":"150242276943458050067"},"frontrun":{"amountOut":"149646782554073964860","newReserveA":"100004564742548311856","newReserveB":"595494389384085207"},"victim":{"amountOut":"593680214343","newReserveA":"100004664742548311856","newReserveB":"595493795703870864"},"backrun":{"amountOut":"99607102614719126757","newReserveA":"150242276349777835724","newReserveB":"397562127829185099"}},"frontsliceTx":{"to":"0xa1CB03B6bbEEFeDd4eA6799FadCC4E8278E43518","from":"0x2186dd245f6d3d9389248C040975BC89CAfc5571","data":"0x779877a7b0d9e8603169ddbd7836e478b462478998d6153b068a96adac33454a85303acba5a8a06e0000000000000005665b96cf35acf00000000000000000081cc42bdecbb3a13c00","chainId":11155111,"maxPriorityFeePerGas":0,"maxFeePerGas":"81453160567","gasLimit":250000,"nonce":740,"type":2},"backsliceTx":{"to":"0xa1CB03B6bbEEFeDd4eA6799FadCC4E8278E43518","from":"0x2186dd245f6d3d9389248C040975BC89CAfc5571","data":"0x7b79995e5f793a07bc00c21412e50ecae098e7f998d6153b068a96adac33454a85303acba5a8a06e00000000000000081cc42bdecbb3a13c00000000000000056653841648375ce501","chainId":11155111,"maxPriorityFeePerGas":0,"maxFeePerGas":"81453160567","gasLimit":250000,"nonce":741,"type":2}}
I don't know how to simulat and transact correctly. (I delete some transaction hash)

Transcation reverted.

I am getting this error on every attempt : error while simulating

FrontrunTx and BackrunTx contains error : reverted, and value : null.

How can I resolve this?

buy/sell problem

In this build, as I understand it, the bot can only capture and analyze transactions? He can't react to them to buy/sell?

txhash=0xe93542b719b6c9b7de4627ab9743df946964c9b63f25c05dcaa5ec4247476ba2 sandwichable target found {"revenue":"-14354814103714009","optimalSandwichWethIn":"99609375000000000000","userAmountIn":"20000000000000000","userMinRecv":"0","reserveState":{"reserveWeth":"6035304367050064866","reserveToken":"164725468899396930"},"frontrun":{"amountOut":"155288283380542195","newReserveA":"105644679367050064866","newReserveB":"9437185518854735"},"victim":{"amountOut":"1780893929994","newReserveA":"105664679367050064866","newReserveB":"9435404624924741"},"backrun":{"amountOut":"99595020185896285991","newReserveA":"164723688005466936","newReserveB":"6069659181153778875"}}

I quite often see transactions as mentioned above, including without negative profit values. But the bot simply ignores this aspect. Is this how it should be?

Remove Flashbots

I changed some code around and so far its running on AVAX, but I'm curious about how I'd go about removing the Flashbots functions without breaking the entire bot. Do you have any pointers?

Is the math in getUniv2DataGivenIn incorrect?

We are calculating newReserveA as being reserveA + aInWithFee, but aInWithFee is 997 times too big, no?

export const getUniv2DataGivenIn = (
  aIn,
  reserveA,
  reserveB
) => {
  const aInWithFee = aIn.mul(997);
  const numerator = aInWithFee.mul(reserveB);
  const denominator = aInWithFee.add(reserveA.mul(1000));
  const bOut = numerator.div(denominator);

  // Underflow
  let newReserveB = reserveB.sub(bOut);
  if (newReserveB.lt(0) || newReserveB.gt(reserveB)) {
    newReserveB = ethers.BigNumber.from(1);
  }

  // Overflow
  let newReserveA = reserveA.add(aInWithFee); // this is 997 times too big?
  if (newReserveA.lt(reserveA)) {
    newReserveA = ethers.constants.MaxInt256;
  }

  return {
    amountOut: bOut,
    newReserveA,
    newReserveB,
  };
};

weth and token in payloads looks switched. I think it should be the other way around

subway/bot/index.js

Line 163 in 8ea4e86

token,

issue

[2023-09-27T01:32:47.592Z] txhash=0xa2639106a976aeae414521c7374b4a31d3bc816ae0ddb5cc973c6015b8add7f2 error{}

It appears this bug.What issues cause to it?

Could you explain the calling of call() function in Sandwich.sol?

Hi, I'm confused by the usage of the call function in the Sandwich contract.

 let s1 := call(sub(gas(), 5000), token, 0, 0x7c, 0x44, 0, 0)  
 let s2 := call(sub(gas(), 5000), pair, 0, 0x7c, 0xa4, 0, 0)

0x7c is the address of ERC20_TRANSFER_ID/PAIR_SWAP_ID bytes in the memory.
According to https://ethervm.io/ ,

this calls a method in another contract. For example, the first line calls the transfer function (ERC20_TRANSFER_ID) of the token, and the calldata is bytecodes from 0x7c to (0x7c+0x44), which means calling token.transfer(pair, amountIn), right? I'm confused because the amountIn is the amount of WETH and why transfer tokens to the pair address？ And where can I find the signature of the contract function (for example, transfer(address,uint256), 0xa9059cbb) ? Thanks!

此程序本人已吃透，需要用夹子的可以联系Telegram: james1847

1、支持修改solidity代码，添加钱包转入合约再去套利功能，支持修改assembly yul代码。
2、“套利计算需要多少代币去夹”交易算法修改，保证有利润才下单。
3、flashbots 优化。
4、预算低勿扰，程序可以帮助你讲解，帮助你确保能执行成功，有淘宝店可以放心交易

node:events:504 throw er; // Unhandled 'error' event

Hi Guys,
so when i try to run the bot i always get this error
node:events:504
throw er; // Unhandled 'error' event
^

Error: Unexpected server response: 404
at ClientRequest. (/Users/abdelhalimemara/Desktop/AE-CR/Subway Bot/subway/bot/node_modules/ws/lib/websocket.js:604:7)
at ClientRequest.emit (node:events:526:28)
at HTTPParser.parserOnIncomingClient [as onIncoming] (node:_http_client:618:27)
at HTTPParser.parserOnHeadersComplete (node:_http_common:128:17)
at TLSSocket.socketOnData (node:_http_client:482:22)
at TLSSocket.emit (node:events:526:28)
at addChunk (node:internal/streams/readable:315:12)
at readableAddChunk (node:internal/streams/readable:289:9)
at TLSSocket.Readable.push (node:internal/streams/readable:228:10)
at TLSWrap.onStreamRead (node:internal/stream_base_commons:190:23)
Emitted 'error' event on WebSocket instance at:
at abortHandshake (/Users/abdelhalimemara/Desktop/AE-CR/Subway Bot/subway/bot/node_modules/ws/lib/websocket.js:731:15)
at ClientRequest. (/Users/abdelhalimemara/Desktop/AE-CR/Subway Bot/subway/bot/node_modules/ws/lib/websocket.js:604:7)
[... lines matching original stack trace ...]
at TLSSocket.Readable.push (node:internal/streams/readable:228:10)
error Command failed with exit code 1.

any ideas what i can do?

Missing variables despite them all being filled in...

Flashbots: Execution reverted, why?

When bot uses callBundleFlashbots im getting this error all the time:
"error":"execution reverted","revert":"\u0000\u0000\u0000","value":null

Why is this happening?
Any help is appreciated!

Use a wrong variable in univ2.js

In ./src/univ2.js line 82, 'if (newReserveB.lt(0) || reserveB.gt(reserveB)) {'

I think it should be 'if (newReserveB.lt(0) || newReserveB.gt(reserveB)) {'

frontrun tx always reverts with ERC20: transfer amount exceeds balance

It seems that the contract always tries to send some amount of the non-weth token to the pair despite the contract having a balance of 0. What am I doing wrong?

What's next when found potentially sandwichable txs ?

subway found 2 potentially sandwichable txs on bitkubchain (https://bkcscan.com/)
so in this chain WETH = KKUB, ETH = KUB

// txhash = 0xdca2e58ab71bf34369387a28e85af6c0ab6f9dc715e441151734ea361f11cac7;
const sandwich = { 
	"revenue": "-587897585621957342", 
	"optimalSandwichWethIn": "99609375000000000000", 
	"userAmountIn": "40000000000000000000", // 40 KUB
	"userMinRecv": "48957699098951839629", // 48.95 KUSDT
	"reserveState": { 
		"reserveWeth": "898997512032207955367410", 
		"reserveToken": "1112510545004056999410558" }, 
		"frontrun": { "amountOut": "122883351218649447652", // 122.883351218649447652
            "newReserveA": "899097121407207955367410", "newReserveB": "1112387661652838349962906" }, 
		"victim": { "amountOut": "49338443282042384536", // 49.338443282042384536
            "newReserveA": "899137121407207955367410", "newReserveB": "1112338323209556307578370" }, 
		"backrun": { "amountOut": "99021477414378042658", // 99.021477414378042658
            "newReserveA": "1112461206560774957026022", "newReserveB": "899038099929793577324752" } 
	};

// txhash = 0x7c0450660149c8a223738d4e847ad1013f67344bc74f999611f79f66865ee37e;
const sandwich2 = {
    "revenue":"-420718391545396510",
    "optimalSandwichWethIn":"99609375000000000000",
    "userAmountIn":"800000000000000000000", // 800 KKUB
    "userMinRecv":"978026587676590440060", // 895 KUSDT
    "reserveState":{
        "reserveWeth":"899139521064897460269550",
        "reserveToken":"1112341688931425641815072"},
        "frontrun":{"amountOut":"122845297107157114324","newReserveA":"899239130439897460269550","newReserveB":"1112218843634318484700748"},
        "victim":{"amountOut":"985632829950345520614","newReserveA":"900039130439897460269550","newReserveB":"1111233210804368139180134"},
        "backrun":{"amountOut":"99188656608454603490","newReserveA":"1111356056101475296294458","newReserveB":"899939941783289005666060"}
    };

I have a few question ?

• why these 2 are sandwichable
• what is the amountOut that the bot suggest and how can I do with these numbers ?