Yesterday over $70 million in various digital assets were hacked in a series of attacks on the Curve Finance decentralized exchange. The attack targeted various liquidity pools including Alchemix’s alETH-ETH pool, the CRV/ETH pool twice, Pendle’s pETH-ETH pool, and Metronome’s msETH-ETH pool. Now attacks like these are very common in Defi. According to https://lnkd.in/e2qAkGYX since defi hacks have cost various protocols approx $6.76 billion since 2017.

What makes this attack very interesting is that one of the hackers attempts to drain one of the liquidity pools was frontrun by an MEV bot. In some defi arbitrage wizardry the MEV bot took advantage of a price discrepancy in the CRV token which was caused by the activities of the hacker. The arbritiage trade was soo successful that the bot's operator coffeebae.eth netted $5.4 M. The arb breakdown can be found at -->https://lnkd.in/e5bJ4SfJ

This hack and the activities of the MEV bot provides us with several threads to tug at:

1. Could MEV bot operators be charged for front-running smart contract hacks? In the case of the Curve hack the funds were returned by the bot operator. But what if it does not?

2. By extension could validators be charged for accepting fees from an MEV bot operator for front running a smart contract hack? Would the validator also not be benefiting from ill gotten gains via fees paid to accept front running transactions?

4. Can MEV bots be used as a security mechanism as a defensive control to protect smart contracts. What if curve operated a very sophisticated MEV bot that acted as somewhat like a smart contract guard dog. Taking advantage of price discrepancies caused by hacks and returning the proceeds to the DAO.

5. Is any defi protocol safe? Curve has been around since 2020 (eons in defi years), curve has also been subject to many security audits in the past and the hackers still managed to find buggy code.