Skip to content
Attack Paths
← RegistryDossier · 5 steps · 4 edges

MEV bot honeypot → drain searcher

Plant a transaction that looks like easy arbitrage in the public mempool. The MEV searcher bot front-runs into a trap contract whose 'profit' function reverts and seizes the searcher's gas + funds.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: attacker targets an MEV searcher running standard bots (or open-source frameworks like Flashbots Hayden). The contract appears profitable from heuristics but the swap path is rigged.

§ Steps

  1. 01
    Searcher's bundle ends in attacker treasuryExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Deploy honeypot contractInitial Access
    T1078— Valid Accounts
  3. 03
    Submit baiting transaction visible in mempoolImpact
    W3-FRONT-RUN— Front-running (generalised)
  4. 04
    Profit function triggers seizeImpact
    W3-MEV-SANDWICH— MEV Sandwich Attack
  5. 05
    Searcher bot front-runsImpact
    W3-MEV-BOT-EXPLOIT— MEV Bot Exploit (whitehat bait)

§ References

§ Frequently asked

What is the "MEV bot honeypot → drain searcher" attack path?
Plant a transaction that looks like easy arbitrage in the public mempool. The MEV searcher bot front-runs into a trap contract whose 'profit' function reverts and seizes the searcher's gas + funds. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Searcher's bundle ends in attacker treasury (T1041) — a exfiltration primitive. Assumed environment: attacker targets an MEV searcher running standard bots (or open-source frameworks like Flashbots Hayden).
What is the final impact of this kill-chain?
The final step lands on Searcher bot front-runs (W3-MEV-BOT-EXPLOIT), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers