Last updated
JIT bots perform instant add-liquidity and remove-liquidity operations before and after swap transactions in Uniswap V3 pools to extract fees from other LPs. While this strategy offers users better swap prices, there is a conflict of interest with LPs who passively provide liquidity.
Add Liquidity Steps 0,1: The attacker adds 7,793,784 USDC and 97.926 WBTC to the UniswapV3 Pool. Visit this page to understand what's going on when liquidity is added to a Uniswap pool.
Swap Transaction Steps 1,2,3,4: the aggregator splits the user's huge swap into two. One of them is via the UniswapV3 pool, whose liquidity is provided by the JIT bot.
Remove Liquidity Steps 6,7: UniswapV3Pool removed 89.0881 WBTC and 7,975,062 USDC and sent them to the JIT bot's contract. Visit this page to understand what's going on when liquidity is removed from a Uniswap pool.
UniswapV3: the newest version of the largest DEX, Uniswap.
1 inch: an exchange aggregator that scans decentralized exchanges to find the lowest cryptocurrency prices for traders
The addresses in the black box in Add Liquidity and Remove Liquidity are UniswapV3's addresses. When you add liquidity to UniswapV3, it will return you an NFT for the proof of pledge. And when you want to get your money back, you need to burn the NFT. In these procedures, UniswapV3 may create several temporary addresses. EigenPhi's address aggregate functionality can simplify the token flow by a lot.
The oval "to" in Add Liquidity and Remove Liquidity is the attacker's contact address.
The pentagon "from" in the middle swap is the user's EOA.
The pentagon "builder" in the Remove Liquidity is the block builder's EOA.
WBTC, USDC
To understand the details step by step, we recommend reading What's really going on when processing liquidity in a Uniswap Pool?
Add Liquidity Steps 0,1: The attacker adds 7,793,784 USDC and 97.926 WBTC to the Uniswap V3 Pool.
Add Liquidity Steps 2,3: Uniswap V3 records the liquidity tokens added by LP internally and creates the corresponding NFT.
Add Liquidity Step 4: The Pool returns the attacker a position NFT identified as 350101, representing the corresponding liquidity share, 228,594,721,898,820 added.
Swap Transaction Step 0: a user sends to the aggregator 0xf02 229501 USDC and wants to swap for WBTC.
Swap Transaction Steps 1,2,3,4: the aggregator splits this huge swap into two. One of them is UniswapV3; the other is CLPRDRPL.
Swap Transaction Step 5: the aggregator moves the trading fee to its asset-management address.
Swap Transaction Steps 6,7: the aggregator gives the WBTC back to the user.
Remove Liquidity Steps 0-2: Created the internal account balances, virtualOwed0WBTC, and virtualOwed1USDC, for UNI-V3-POS, and burned the JIT bot's corresponding liquidity share, virtualLiquidity.
Remove Liquidity Steps 3,4,5: Similar to steps 0-2, create the internal account balances for UNI-V3-POS-350101 and burn the corresponding liquidity share, virtualLiquidity-350101.
Remove Liquidity Steps 6,7: UniswapV3Pool removed 89.0881 WBTC and 7,975,062 USDC and sent them to the JIT bot's contract.
Remove Liquidity Steps 8-11: UNI-V3-POS and UNI-V3-POS-350101 burned the corresponding balances of virtual liquidity tokens created in steps 0-5.
Remove Liquidity Step 12: The JIT bot burned the position NFT, UNI-V3-POS-350101.
Remove Liquidity Step 13: The JIT bot paid a tip to the block builder.
After the launch of concentrated liquidity in Uniswap V3, a new form of MEV called Just-In-Time (JIT) emerged; JIT bots perform instant add-liquidity and remove-liquidity operations before and after swap transactions in Uniswap V3 pools to extract fees from other LPs. It is a new form of active liquidity-managing strategy. While this strategy offers users better swap prices, there is a conflict of interest with LPs who passively provide liquidity.
JIT attacker's profit comes from the trading fee of the middle swap. Using the add-and-then-remove trick, the attacker can get most of the trading fee rather than distribute it in proportion with other LPs. For this example, the gross profit (trading fee) is about $500.
