MEV robot front-running trade 7.8 million USD rsETH attack

An MEV bot named Yoink on Ethereum front-ran an exploit attack targeting the Safe wallet, which PeckShield referred to as an approximately $7.81 million rsETH attack. On-chain records show that the Yoink transaction received 2,900 rsETH and sent 2,882.37 rsETH to the address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, which currently has a balance of 2,882.36740883 rsETH.

The same transaction also sent 17.63 rsETH to the Uniswap v4 Pool Manager, which sent 18.95 ETH to the Yoink contract, which then transferred 18.93 ETH to the block builder. The Yoink transaction and the original attack transaction both occurred in Ethereum block 25980525, with the Yoink transaction at the top of the block, and the original transaction executed a rollback, consistent with the front-running judgment of security researchers.

BlockSec attributed the vulnerability to a flaw in the authorization checks of the executor contract associated with the enabled Safe module, allowing calls controlled by the attacker to be executed through a trusted executor. Blockaid stated that the attacker exploited a public keeper multi-call to direct a custom Uniswap v4 liquidity module to a hook pool created by the attacker, which subsequently unpacked aEthrsETH into rsETH.