Connect with us

Crypto

Researchers uncover vulnerabilities leading to predatory trading in popular Ethereum cryptocurrency rollups

Published

on

Researchers uncover vulnerabilities leading to predatory trading in popular Ethereum cryptocurrency rollups
Ben Weintraub and his co-authors conducted a large-scale analysis of exploitative trading activities on Ethereum and across popular rollups. Credit: Matthew Modoono/Northeastern University

Ethereum, a decentralized online platform that allows users to conduct financial transactions in Ether cryptocurrency, prides itself on the system’s high security.

But new findings from Northeastern University’s computer scientists and researchers at ETH Zurich, a public research university in Switzerland, show that it might not be so bulletproof, and its users might be susceptible to some market participants’ predatory practices.

“There are direct monetary incentives,” says Ben Weintraub, a Northeastern doctoral student in the Khoury College of Computer Sciences. “So in my view, it’s better if researchers find and publicize it first before people mistakenly lose money.”

Weintraub presented the paper on the findings at the Association for Computing Machinery’s annual Conference on Computer and Communications Security (ACM CCS 2024) held Oct. 14–18 in Salt Lake City. The study is available on the arXiv preprint server.

Advertisement

He and his co-authors conducted a large-scale analysis of exploitative trading activities on Ethereum itself and across so-called rollups, or off-the-platform services that allow faster processing of higher volumes of transactions.

The researchers found evidence that certain actors can manipulate the market on rollups, which was previously thought to be impossible.

“It was known to be possible on regular Ethereum, but it was thought to be impossible on rollups and we showed that it is not impossible,” Weintraub says.

The paper presents three novel types of attacks in which predatory traders could have made about $2 million in profits in the last three years by manipulating transactions within Ethereum trading networks.

Advertisement

Ethereum is a network of independent computers across the world that follows the Ethereum protocol—a set of rules on how the computers in the global network can interact with each other. It uses blockchain technology, pioneered by Bitcoin.

A blockchain is a database of transactions that is shared across computers in a network. Once a new block, or a new set of transactions, is added to the blockchain, that data can no longer be removed by anybody, primarily due to cryptographic techniques that highlight any attempts at tampering.

Anyone can create an Ethereum account from anywhere, at any time. No central authority such as a government or a company has control over Ethereum, which means no individual can change the rules or restrict users’ access. Any Ethereum protocol changes require approval from more than half of the network.

Unlike Bitcoin, which is solely a payment system with a name-sake cryptocurrency, Ethereum allows users to build applications, communities and organizations on its platform.

The Ethereum network, however, has a scalability problem—as the number of people using it has grown, the blockchain has reached certain throughput limitations that further inflated the costs for conducting transactions on the platform.

Advertisement

One solution are the rollups, such as Arbitrum, Optimism and zkSync—which were analyzed by Weintraub—that aim to improve Ethereum’s speed by taking batches of transactions and calculations off Ethereum. This reduced the processing cost of a transaction to roughly 1 cent, Weintraub says.

Some actors make profits trading cryptocurrencies by trying to achieve maximal extractable value, he says, by manipulating the order of transactions that are pending inclusion on the blockchain. The research provides exclusive insights into the volume of maximal extractable value transactions on rollups, costs associated with them, profits made by such exploitative traders, competition between them and response time to such activities across Ethereum and the rollups.

Some methods that malicious actors use are common to financial markets, like arbitrage, when a user buys something on one exchange and quickly sells it for profit on another exchange.

“It’s generally thought to be a good thing because it keeps different exchanges balanced in terms of price,” Weintraub says. “But there are also types [of maximal extractable value] that are not good. One that’s fairly well-known in research is called sandwiching.”

In sandwiching, when a speculator sees someone is about to buy an asset, they buy it first, driving up the price. The speculator then quickly sells it at the higher price.

Advertisement

Sandwiching is considered a “bad,” manipulative trading strategy affecting the price that other traders get. On Ethereum, block producers—people or groups who get paid when their hardware is randomly selected to verify a block’s transactions—can try to maximize the amount of profit they make by manipulating how transactions are ordered or included in a block before it is added to the blockchain.

“The reason we call this an attack is because it is purely damaging to that victim, who now has to pay a little bit more for their transaction,” Weintraub says. “The system broadly does not benefit at all. There’s just the one who profits—the ‘sandwicher.’”

While the researchers didn’t find traditional sandwich attacks on popular rollups, they identified three potential strategies for them when transactions move between Ethereum and rollups with a time delay.

“This just came from analyzing the protocol and looking at the exact flow of transactions—when they get sent, when the rollup seems to respond to them or when they end up on the blockchain,” Weintraub says.

Advertisement

“We tested our attacks on [Ethereum’s] test-net, a network of ‘fake’ money that is used by developers to test their applications,” he says. “And, essentially, we stole all of the money from only ourselves.”

Weintraub is currently in contact with major rollups’ developers to see what can be done about the possibility of the attacks. Two types of these novel attacks can be prevented, Weintraub says, while it is unclear how to protect users from the third type.

“Our view is that it’s better to just get this information out there so people, at least, are aware of the risks,” he says.

More information:
Christof Ferreira Torres et al, Rolling in the Shadows: Analyzing the Extraction of MEV Across Layer-2 Rollups, arXiv (2024). DOI: 10.48550/arxiv.2405.00138

Journal information:
arXiv
Advertisement

Provided by
Northeastern University

This story is republished courtesy of Northeastern Global News news.northeastern.edu.

Advertisement

Citation:
Researchers uncover vulnerabilities leading to predatory trading in popular Ethereum cryptocurrency rollups (2024, November 11)
retrieved 11 November 2024
from https://techxplore.com/news/2024-11-uncover-vulnerabilities-predatory-popular-ethereum.html

This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no
part may be reproduced without the written permission. The content is provided for information purposes only.

Advertisement

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Crypto

XRP Prepares for Quantum Future as Ripple Maps XRPL Strategy for Security Readiness

Published

on

XRP Prepares for Quantum Future as Ripple Maps XRPL Strategy for Security Readiness

Key Takeaways:

  • Ripple outlines a phased roadmap to prepare XRPL for quantum-era cryptography risks.
  • Industry momentum grows as XRPL testing highlights performance and security tradeoffs.
  • Developers at Ripple will expand testing to balance innovation with network stability.

Ripple Maps Quantum Security Strategy

Ripple’s post-quantum strategy reflects a growing shift in blockchain security as quantum computing risks gain credibility. The company’s latest Insight, published April 20 by Senior Director of Engineering Ayo Akinyele, outlined a structured roadmap to prepare the XRP Ledger for future cryptographic disruption while preserving network performance.

The Insight stated:

“Ripple is introducing a multi-phase roadmap to prepare the XRP Ledger (XRPL) for a post-quantum future, with a target for full readiness by 2028.”

It also detailed collaboration efforts: “Ripple is working with Project Eleven to accelerate development, including validator testing and early custody prototypes.”

Akinyele explained that quantum security is becoming more relevant because blockchain networks rely on cryptographic systems that could eventually be broken by sufficiently advanced quantum computers. On XRPL, each signed transaction reveals a public key on-chain, which could weaken long-term wallet security in a post-quantum environment.

He also pointed to the “harvest now, decrypt later” threat, where attackers collect cryptographic data today and wait for future quantum capabilities to exploit it. While this does not indicate an immediate failure of current protections, it increases the urgency of preparing systems that secure long-duration value. These risks reinforce the need for early testing of quantum-resistant cryptographic systems and structured migration planning.

Advertisement

XRPL Testing Targets Long-Term Stability

Ripple’s roadmap consists of four phases, starting with contingency planning for a potential failure of existing cryptographic standards. This includes a “Quantum-Day” framework designed to enable secure migration to post-quantum accounts if vulnerabilities emerge. Additional phases focus on evaluating National Institute of Standards and Technology (NIST)-recommended algorithms under real network conditions, measuring impacts on throughput, storage, and verification efficiency. XRPL’s native features, including key rotation and deterministic key generation, provide a technical advantage by enabling gradual migration without forcing users to abandon existing accounts. Parallel testing on development networks will allow developers to assess performance tradeoffs before broader implementation.

The senior director of engineering emphasized long-term execution and coordination, stating:

“We should not view addressing the quantum threat on XRPL as a single upgrade, but rather a multi-phased strategy of carefully migrating a live, global financial infrastructure without compromising the value of digital assets protected by the XRPL.”

Akinyele indicated that achieving post-quantum readiness requires balancing cryptographic innovation with operational stability, ensuring the network remains efficient while adapting to future security challenges.

Advertisement
Continue Reading

Crypto

Central Banks Say US Stablecoins Threaten Financial Integrity | PYMNTS.com

Published

on

Central Banks Say US Stablecoins Threaten Financial Integrity | PYMNTS.com

Central bank officials are warning of potential threats from the increasing use of U.S. stablecoins for international payments.

Stablecoins — crypto assets pegged to fiat currencies like the dollar — “raise serious risks for financial integrity and can facilitate regulatory circumvention,” the head of the Bank for International Settlements (BIS) said in a speech in Japan Monday (April 20).

The fast-rising use of stablecoins could also “make it easier to evade capital controls” in emerging markets (EMs) and developing countries trying to keep control on financial flows and heighten “dollarisation risks,” said BIS general manager Pablo Hernández de Cos, whose comments were reported by the Financial Times (FT).

Their increasing popularity “opens up new avenues for tax evasion,” he added, citing estimates that “stablecoins now account for most illicit transactions within the crypto ecosystem.”

According to the FT, the increased worldwide use of dollar-denominated stablecoins was mentioned as a threat to financial stability in EMs by multiple financial policymakers when they convened in Washington last week for the IMF and World Bank meetings.

Advertisement

“There will be a focus on the extent to which it moves into domestic currency substitution,” Andrew Bailey, governor of the Bank of England, said during a financial industry event in D.C.

Advertisement: Scroll to Continue

Bailey, who also chairs the Financial Stability Board, said “the rate of progress” on establishing international rules for stablecoins had slowed.

“If you had asked me a year ago, I would have said we are heading very quickly towards it. But I think it is something that we will have to come to terms with pretty soon,” he added.

Meanwhile, French Finance Minister Roland Lescure said last week that European banks should develop more euro-based stablecoins and tokenized deposits to reduce the region’s dependence on non-European payment providers.

Advertisement

Speaking at a cryptocurrency conference in Paris, Lescure said that the small volume of euro-pegged stablecoins compared to dollar-pegged tokens is “not satisfactory” and that a company formed by a group of European banks to introduce a euro-pegged stablecoin later this year is “what we need and that is what we want.”

In other stablecoin news, PYMNTS wrote last week about the implications of recent security incidents such as the North Korea-linked hack that led to losses of up to $280 million.

“The incidents underscore the fact that major stablecoin issuers retain the technical ability to halt transfers of specific tokens, or even eliminate them entirely through what’s termed as ‘burning,’ often in response to regulatory directives, security incidents or compliance concerns,” PYMNTS wrote.

“For CFOs accustomed to the predictability of bank deposits or money market funds, this can introduce a new category of risk: not market risk, but governance risk embedded in code.”

Advertisement
Continue Reading

Crypto

Upcoming ‘Bitcoin’ Movie With Casey Affleck, Gal Gadot Probes Satoshi’s Identity

Published

on

Upcoming ‘Bitcoin’ Movie With Casey Affleck, Gal Gadot Probes Satoshi’s Identity

Key Takeaways:

  • New Bitcoin film stars Casey Affleck and Gal Gadot, probing Satoshi Nakamoto’s identity.
  • Craig Wright’s disputed role deepens divisions across Bitcoin developers and market participants.
  • Industry reaction may polarize further as the film revives debate over Bitcoin’s origins.

Bitcoin Creator Dispute Moves Into Mainstream Film

The mystery surrounding Bitcoin’s creator is moving into the mainstream as “ Bitcoin,” previously referred to in online reports as “ Bitcoin: Killing Satoshi,” adapts one of crypto’s most contested debates to the screen. Ahead of the Cannes market, Patrick Wachsberger’s 193, a film sales and production company, launched international sales on the project, signaling a push to global buyers. Around the same time, Acme AI & FX, the production company behind the film, confirmed it had wrapped production on the Doug Liman-directed feature. The movie, described as the “first fully-generated, studio-quality AI feature film,” centers on the unresolved question of who created Bitcoin and why that issue continues to influence industry discussions and market perception.

The story follows Charlotte “Lotte” Miller, a war correspondent played by Gal Gadot, who is recruited by blockchain investor Calvin Ayre, portrayed by Pete Davidson, to write an investigative report on Australian computer scientist Craig Wright. Casey Affleck plays Wright, with Isla Fisher also appearing in the cast. The film was written by Nick Schenk and produced by Ryan Kavanaugh and Lawrence Grey, with production beginning at the end of February. The synopsis described the film:

“A high-stakes conspiracy thriller that asks the question no one in power wants answered.”

A longer description presents the movie as the story of one man’s effort to prove he created Bitcoin, a claim that allegedly puts his life in danger and sparks a global controversy involving tech billionaires, world leaders, and the future of the financial system.

Craig Wright Claims Renew Industry Polarization

From a Bitcoin industry standpoint, the film enters a highly disputed issue. Wright’s claim that he is Satoshi Nakamoto has been challenged for years by developers, researchers, and other participants in the sector, many of whom point to the lack of accepted cryptographic proof. A 2024 U.K. court ruling also rejected his claim, adding legal weight to that skepticism. Within parts of the BTC community, Wright is widely referred to as “Faketoshi,” and critics have accused him of fraud tied to those assertions.

The production approach has also drawn attention, as the “fully-generated” label refers largely to AI-built environments and visuals, while actors perform traditionally with digital settings added in post-production. At the same time, the subject matter is likely to drive industry reaction, as many bitcoiners view the claims as legally and technically discredited rather than unresolved.

Advertisement

That divide helps explain why the film is likely to provoke a polarized response across crypto. Many will see it as reopening a debate already settled by legal findings and technical evidence, while others may view it as an attempt to revisit unanswered questions around motive and power. The synopsis stated:

“All this leads Lotte, and the audience, to the central question — If Craig Wright didn’t invent Bitcoin, why is a coalition controlling trillions in global wealth spending hundreds of millions and risking everything to destroy him?”

“This is an exciting and gripping story, set in the mysterious and high-stakes real world of crypto,” Wachsberger told Deadline. The positioning underscores how the film is being framed, not just as a thriller, but as a mainstream take on one of bitcoin’s most contested narratives, where claims have long been weighed against verifiable proof.

Continue Reading
Advertisement

Trending