MEV机器人抢先交易以太坊上780万美元的rsETH漏洞

Ethereum MEV robot "Yoink" pre-empted and thwarted a 2,900 rsETH attack on Safe Wallet

The Ethereum Maximum Extractable Value (MEV) robot named "Yoink" pre-executed a transaction before a secure wallet exploit attempt involving 2,900 rsETH (worth approximately US$7.8 million) and paid nearly 19 ETH to ensure first place in the block.

Robots take the lead

PeckShield identified the incident as an attack worth approximately US$7.81 million involving rsETH, a liquidity pledge token associated with KelpDAO. The incident came to light after a MEV robot placed its trade in front of a suspected attacker.

On-chain records cited by security researchers show that Yoink received 2,900 rsETH in Ethereum block 25980525. From the total amount, the transaction sent 2,882.37 rsETH to address 0xC70f00CD7E461686b04B0E912E309 becA8b80ea0. When the address was reviewed, its balance was 2,882.36740883 rsETH. The preliminary report did not describe the transfer from the address, and the available information did not identify its owner or whether the funds would be refunded.

剩余的17.63枚rsETH转移到了Uniswap v4池管理器（Pool Manager）。根据交易路径，池管理器随后向Yoink合约发送了18.95枚ETH，该合约又向区块构建者（Block Builder）转发了18.93枚ETH。向构建者支付几乎全部的ETH金额，使得该部分交易几乎没有直接的ETH利润。这笔大额支付似乎是为了争取优先位置的出价，尽管引用的研究人员并未发布涵盖保留的rsETH或其他交易成本的完整利润计算。

Yoink的交易和原始漏洞利用尝试都落入区块25980525。Yoink出现在区块顶部，而原始交易稍后运行并回滚（reverted）。安全研究人员将这种排序和失败的后续交易视为证据，表明机器人检测到了攻击并抢先行动。

安全模块检查导致漏洞路径

BlockSec将根本弱点归因于与安全模块关联的执行器合约中的授权检查故障。根据其分析，攻击者控制的调用可以通过钱包视为受信任的执行器传递。

Safe是一种智能合约钱包系统，可能需要多个签名者批准交易。其模块框架还允许账户所有者添加可在预定义规则下执行特定操作的合约，从而减少每次操作都需要手动签名的需求。因此，启用的模块成为钱包安全边界的一部分。BlockSec的分析表明，受影响的执行器未能正确确认调用背后的权限，允许外部方通过受信任的路径访问功能。

报告描述了与钱包配置相关的执行器合约中的问题，而非以太坊共识系统的缺陷。现有细节也并未显示核心Safe合约受到损害，因此将整个事件归咎于整个Safe平台超出了安全公司的发现范围。

Blockaid提供了更详细的攻击者试图利用权限失败情况的说明。据该公司称，攻击者访问了一个公共维护者多调用（public keeper multicall），并将自定义Uniswap v4流动性模块引导至攻击者控制的挂钩池（hook pool）。

Uniswap v4挂钩是可以在池操作的特定点运行自定义指令的合约。Blockaid表示，恶意创建的挂钩池随后被用于将aEthrsETH拆解为rsETH，从而产生交易中目标代币。

结合公共维护者功能和受信任的执行路径，使得调用能够到达自定义流动性设置。根据Blockaid的分析，Yoink的机器人在攻击者完成之前看到了机会，并提交了一笔竞争性交易，捕获了相同的输出。

Background and Legal Impact

The report provided did not contain any statements about suspected attackers, Yoink operators or block builders. The report also did not mention whether the resumption of the agreement, reward negotiations or legal proceedings had been initiated.

This rsETH transaction adds to the record for DeFi losses in 2026. A September report on DeFi security losses cited estimates from CertiK and Forbes that showed the agreement lost at least $1.3 billion due to vulnerabilities in the first eight months of 2026. The report found that compromised credentials and privileged access have replaced traditional smart contract failures as the main source of loss by value. Yoink events differ by the mechanism they report because BlockSec traces their cause to authorization logic within the executor associated with the security module.

rsETH also appeared in another major security incident this year. According to previous reports, an attacker minted 116,500 unsupported rsETH in April after promising infrastructure associated with the LayerZero validator. The attackers then used the tokens as collateral on Aave to lend out other assets.

Security researchers have not yet linked the April incident to the transaction in block 25980525. The two incidents involved different reported vulnerabilities, the latest case Concerning moving an existing 2,900 rsETH through a wallet execution path.

对于美国用户而言，Yoink的交易也说明了为什么“抢跑”一词本身并不能确定链上交易的合法地位。联邦当局在某些情况下对MEV操作进行了追查，当时检察官指控其运营者使用欺骗手段或篡改系统以获取资金。2024年5月，美国司法部起诉了两名兄弟，涉嫌一项以太坊计划，在大约12秒内获得了约2500万美元的加密货币。检察官指控Anton和James Peraire-Bueno操纵了以太坊交易者用于排序交易的过程，并欺诈性地获取了待处理的私人交易信息。

司法部指控这两名兄弟共谋实施电汇诈骗、电汇诈骗以及共谋洗钱。其指控Concerning的是 allegedly 用于获取交易信息和操纵过程的方法，而不是将每种交易排序策略自动视为犯罪。基于所提供的信息，没有任何美国监管机构或执法机构宣布针对Yoink或rsETH漏洞利用尝试的行动。引用的区块链安全公司将其发现限制在交易排序、Safe关联的执行器的授权检查以及用于拆解aEthrsETH的Uniswap v4挂钩路线上。