The BNB Smart Chain implemented BEP 322 (the Proposer-Builder Separation mechanism, PBS) this year, bringing a series of changes to the on-chain ecosystem, creating both risks and opportunities.

BSC chain validators hold a high position in the ecosystem and possess significant influence over the BSC chain's on-chain ecosystem. The entry threshold for BSC validators is high, with the number of validators consistently maintained at over 40, compared to Ethereum's million-level validator nodes, giving BSC validators a stronger influence on the on-chain ecosystem.

After the implementation of PBS, the Builder market has formed a head-body-tail structure. The leading players in the Builder market, Blockrazor and 48Club-pussaint, contributed nearly 80% of block construction, while Bloxroute, Blocksmith, and Nodereal contributed about 19%, with tail players contributing only sporadically. Additionally, the emergence of vertical integration between Validators and Builders on the BSC chain may further lead to centralization risks.

The new mechanism has given rise to on-chain trading risks, leading to the formation of risk prevention products. The unique 0Gwei trading mechanism of BSC reduces transaction costs, resulting in frequent on-chain phishing activities. Under the PBS mechanism, the Builder's acceptance of transaction bundles lowers the cost of sandwich attacks, making transactions more susceptible to such attacks, which has led to the development of privacy RPC products to prevent MEV.

Research Background

The BNB Smart Chain implemented BEP 322 (the Proposer-Builder Separation mechanism, PBS) this year, marking a significant update to the BSC chain's ecosystem mechanism, giving rise to the BSC Builder market and introducing new ecological gameplay. We aim to study the implementation of BEP 322 from the perspective of the differences and similarities between BSC PBS and Ethereum PBS mechanisms, the development of Builders and Validators, and other aspects, to describe the implementation of BEP 322 from multiple perspectives such as underlying mechanisms and ecological performance, as well as potential on-chain security risks, thereby providing our users with recommendations for addressing security risks.

Differences Between BSC and Ethereum PBS Mechanisms

In the PBS mechanism, BSC has adopted most of Ethereum's implementation mechanisms. However, considering the differences in consensus mechanisms, validator network topology, and other factors between BSC and Ethereum, there are some detailed differences in the implementation of the PBS mechanism:

① Elimination of the Relay Mechanism: Due to the relatively small number of BSC validators, there is no need for a centralized Relay to reduce the complexity of communication between Builders and Validators. Additionally, considering the short interval between each BSC block, using a Relay to forward transactions would instead increase the communication link between Builders and Validators, extending interaction time. As a supplement to Relay, BSC introduced the mev-sentry service, where each validator runs its own sentry, which interacts directly with Builders. This separation of sentry and Validator can better protect the validators. Furthermore, unlike Relay, Validators can directly obtain the block content of Builder bids through sentries, allowing them to verify the validity of Builder bids themselves, which further protects the interests of validators. Additionally, during each block interval, Builders can only send no more than three bids to sentries, leading to significant differences in bidding strategies between BSC Builders and Ethereum Builders.

② Differences in Coinbase Transfer Settings: Ethereum's PBS mechanism allows Builders to change the coinbase to their own address, enabling the priority fee to be executed once by Builders and then redistributed. However, BSC's PBS mechanism does not have this capability, which somewhat limits the bidding and allocation capabilities of Builders.

③ Support for 0Gwei Transactions: Before the BEP-322 upgrade, the 0Gwei mechanism was first introduced by 48Club as a membership feature, allowing holders of the 48 membership token KOGE to use it under certain conditions, serving as a value-added service provided by validators. After the BEP-322 upgrade, BSC validators are allowed to accept blocks with 0Gwei transactions. Unlike Ethereum's dynamic Base Fee mechanism, the transaction Base Fee on the BSC chain defaults to 0, meaning transactions with a Gas Price of 0 are permitted. As a supplementary mechanism to ensure a minimum Gas Fee, BSC has set a restriction that the Effective Gas Price of blocks cannot be lower than 1. This special mechanism allows Builders to include transactions with a Gas Price of 0 when constructing blocks, enabling more efficient utilization of block space.

Development of the Builder Market

Similar to Ethereum, after the implementation of PBS, the Builder market formed and underwent a period of development, ultimately resulting in a head-body-tail structure.

According to statistics provided by Dune, a total of 8 Builder players participated in the BSC Builder market. In the early stages of PBS implementation, Nodereal, Blocksmith, and Blockrazor briefly dominated the entire market. However, with the entry of 48Club and Bloxroute at the end of June, the market began to enter a tug-of-war phase. As of now, Blockrazor and 48Club have contracted over 80% of block construction on the entire BSC, becoming the leading players in the Builder market, while Bloxroute, Blocksmith, and Nodereal have become mid-tier players, and Jetbldr, Blockbus, and Darwin have only contributed sporadically.

Development of Validators

Unlike Ethereum, due to different entry thresholds, the number of validators on BSC has remained stable within a certain range.

On Ethereum, one only needs to stake 32 ETH to become a validator, which has led to the number of validators on Ethereum exceeding 1 million. Validators connect to Builders through integrated Relays to obtain block proposals from Builders and complete block production.

On BSC, becoming a validator requires staking a large amount of BNB, significantly raising the entry threshold for validators. Currently, there are only 45 validators on BSC, of which 21 are Cabinet validators and the remaining 24 are Candidates. According to BSCScan statistics, the 45 validators have staked a total of 29,244,219 BNB, with the validator with the least stake having staked 73,446 BNB.

The difference in validator concentration has led to ecological differences between BSC and Ethereum. For instance, on BSC, due to the low connection cost between Builders and Validators, there is no market space for Relay services. Additionally, the influence of validators means that the development of the on-chain ecosystem needs to prioritize the interests of validators, which can affect the competitiveness and enthusiasm of project parties other than the validator community in building the public chain ecosystem.

Potential On-Chain Risks

There is a significant vertical integration phenomenon between Builders and Validators on BSC. We conducted a statistical analysis of the distribution of Builder block production among all Validators from December 1, 00:00:00 to December 18, 00:00:00. Some validator nodes showed block production significantly deviating from the market average, indicating vertical integration between Builders and Validators. (Nodereal has a 100% share in TWStaking, Bloxroute has a 100% share in Figment, and 48Club has a share of over 90% in Turing, The48Club, Shannon, Lista, Feynman, and Avengers). The potential risks brought by this vertical integration differ from the common Searcher-Builder integration seen on Ethereum, as there is a possibility of controlling transaction flow through Builder-Validator integration mechanisms, transmitting transactions only to specific validators, which could lead to user interest loss and further centralization risks.

The 0Gwei transaction mechanism has the potential to be exploited by phishing contracts. The 0Gwei transaction allows phishing contracts to transfer at zero cost, exacerbating the prevalence of phishing attacks. We have already detected multiple 0Gwei phishing contracts on BSC, which initially used 48Club's 0Gwei transactions by holding 48Koge tokens. Although 48Club has implemented certain restrictions, as of the time of this writing, we are still observing several phishing activities conducted through the 48Club 0Gwei transaction service.

To avoid various phishing attacks and track lost assets, further reading: https://blocksec.com/blog/how-phishing-websites-bypass-wallet-security-alerts-strategies-unveiled)

The current PBS mechanism has reshuffled the market for MEV attacks, and users need to master MEV protection measures in the new landscape. Sandwich attacks are currently the most notorious MEV attacks on the blockchain, and the principle of sandwich attacks is:

1. Monitoring Target Transactions: Attackers listen to the transaction pool (mempool) on the blockchain, looking for target transactions. The target is usually a large token swap transaction (for example, exchanging ETH for USDT on a DEX).
2. Front-running: Attackers send a transaction (front-running transaction) before the target transaction to influence the market price before the target transaction is executed. For instance, attackers buy the target token, thereby raising its price.
3. Back-running: After the target transaction is executed, attackers send a transaction in the opposite direction (back-running transaction) to sell the tokens acquired in the front-running transaction, profiting from the price fluctuations caused by the target transaction.

To learn more about the background of MEV, read more here: https://blocksec.com/blog/harvesting-mev-bots-by-exploiting-vulnerabilities-in-flashbots-relay

Before the implementation of PBS, transactions were in a public transaction pool, fully exposed to attackers' view. Attackers could analyze all profitable transactions and control the transaction order by manipulating gas prices to carry out attacks.

The PBS mechanism provides a privacy channel for transactions, allowing users' transactions to be sent to a private transaction pool visible only to Builders, ensuring that transactions are not discovered by attackers (unless Builders intentionally leak them), thus protecting user transactions. We found that a leading sandwich bot (0x00000000004e660d7929B04626BbF28CBECCe534) that previously conducted sandwich attacks by controlling gas prices has completely shut down over 100 days ago, indicating that the BSC PBS mechanism has reshuffled the MEV attack landscape.

However, by observing on-chain behavior and analyzing statistical data (https://dune.com/hildobby/sandwiches?Blockchain_e8f77a=bnb), we found that the number of sandwich attack transactions on the BSC chain has significantly increased after the implementation of PBS (May 2024).

The main reason is that most traders and project parties have not effectively utilized the privacy channel brought by PBS and still send transactions to the public transaction pool. For attackers, the cost of obtaining attack opportunities has not significantly increased. On the contrary, attackers can use the mechanism where Builders accept Bundles to combine the attacked transaction with the attack transaction into a Bundle submitted to the Builder. If the Bundle is successfully added to the blockchain, the sandwich attack is successful; if it fails to be added, the Searcher does not incur any losses, making sandwich attacks lower in cost and more effective.

In the new environment after BSC's PBS implementation, new measures are needed to address the increasingly rampant and diverse MEV attacks.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。