MEV 防御ランドスケープ — F3B · FHE-MEV · POF/PBS · DFBA · ダークプール
Ethereum's public mempool exposes every pending transaction to the world before it is confirmed. This creates a $750M+/year extraction opportunity for sophisticated actors who can observe, reorder, or insert transactions.
フロントラン: MEV bot sees pending swap, submits identical Tx with higher gas — executes first, harms user price.
サンドイッチ攻撃: Bot frontruns user swap (price moves against user), then backtuns (captures profit). User gets worse execution.
バックラン: Follow a Tx to arbitrage resulting price discrepancy across DEXs. Restores price efficiency.
清算: Closing under-collateralized DeFi positions. Required for protocol health — competitive but necessary.
| 戦略 | メカニズム | ステータス | 防止対象 |
|---|---|---|---|
| メンプール暗号化 (F3B) | 最終化まで閾値 BLS 暗号化 | Practical | Frontrun, sandwich |
| FHE ブラインド計算 | 暗号文で計算 — ユーザー Tx を復号化しない | まだ実用的ではない | Frontrun, sandwich |
| ダークプール (Renegade) | P2P MPC ベースのマッチング、パブリック メンプールなし | テストネット | All orderflow MEV |
| バッチオークション (DFBA) | 100ms バッチ — 到着時刻は無価値 | 設計/PoC | Sandwich, frontrun, latency race |
| OFA/PBS (MEV-Share) | ユーザーへの MEV 再配分 | 本番運用 | ユーザー harm (redistributes, doesn't eliminate) |
Pre-confirmation privacy (F3B, FHE-MEV) and post-confirmation privacy (Tornado Cash, Privacy Pools) are orthogonal. A complete solution needs both. These papers focus on the mempool/ordering phase.
Authors: Sousa, Benhamouda, Halevi, Tiwari, Malvai, Shi (EPFL)
Core Idea: Encrypt every transaction until the block it belongs to is finalized. Reveal content only after ordering is immutable — frontrunning becomes impossible because the content is unknown during block construction.
Threshold BLS Encryption with Shamir secret sharing. Key holders: a subset of validators. Decryption requires t-of-n validators to cooperate — no single point of failure.
0.026% latency overhead vs baseline. This is essentially negligible — F3B is among the most practical mempool privacy proposals to date.
F3B encrypts until finalization, then reveals. Any searcher who monitors the chain can still backrun post-reveal. Good MEV (arbitrage, liquidations) is preserved but so is some post-finalization extraction. FHE-MEV takes a fundamentally different approach to eliminate even this.
Author: Jonathan Passerat-Palmbach (Flashbots / Imperial College London)
Core Idea: A searcher executes a backrun on an encrypted user transaction — the user's Tx content is never decrypted, yet the searcher can still extract arbitrage profit. This eliminates even the post-reveal information leakage that F3B allows.
tfhe-rs (Rust)More efficient FHE schemes, better circuit compilation, reduced bootstrapping frequency. Active research area in cryptography community.
GPU/ASIC designed specifically for FHE operations. Companies like Intel, Google, and startups actively developing FHE accelerators. 1000x+ potential speedup.
Community-optimized FHE circuits for specific DeFi primitives (AMM swap, lending check). Fewer gates = faster computation.
| プロパティ | F3B (EPFL) | FHE-MEV (Flashbots) |
|---|---|---|
| Tx content secrecy | Hidden until finalization, then revealed for execution | Never revealed — computed on ciphertext |
| Good MEV (backrun) | ✓ Survives (after reveal) | ✓ Preserved (FHE searcher still backruns) |
| 今日実用的 | ✓ 0.026% overhead | ✗ High compute cost |
| フロントラン | ✓ Prevented | ✓ Prevented |
| Post-reveal information | ✗ Content visible after finalization | ✓ Content never visible |
| Cryptographic basis | Threshold BLS, Shamir | Torus FHE (TFHE), tfhe-rs |
| Validator/key holder trust | Requires t-of-n validators to cooperate | No key holder trust required |
POF = Private Order Flow: Transactions routed directly to block builders with exclusive access deals, bypassing the public mempool.
OFA improves user outcomes — users get MEV rebates, protection from sandwich attacks, better execution. But OFA requires exclusive deals with specific builders, which creates market concentration. The mechanism that protects individual users from MEV may be creating protocol-level systemic risks.
Core Idea: Batch all orders arriving within a 100ms window into a single uniform auction. Within a batch, arrival time has zero value — there is no advantage to arriving 10ms vs 90ms before batch close. This structurally eliminates frontrunning and sandwich attacks.
| 問題 | 継続的トレーディング | DFBA (100ms バッチ) |
|---|---|---|
| Sandwich attacks | ✗ Possible — insert between Txs | ✓ Impossible — no temporal ordering within batch |
| フロントラン | ✗ Possible — submit same Tx faster | ✓ Eliminated — arrival time irrelevant within batch |
| Latency arms race | ✗ Constant pressure — 1ms advantage = profit | ✓ Eliminated — 100ms resolution kills HFT timing edge |
| リアルタイム実行 | ✓ Instant settlement | ~ 100ms delay per batch |
| 価格発見効率 | ✓ Continuous | ~ Slightly delayed (100ms granularity) |
Eric Budish (Chicago Booth) proposed Frequent Batch Auctions in traditional finance as a remedy for the HFT latency arms race. DFBA adapts this concept to DeFi/on-chain contexts where MEV is the equivalent of HFT predation.
Key parallel: In TradFi, HFT bots race to be first by microseconds. In DeFi, MEV bots race to be first by gas price. Both waste resources on pure latency competition. Batch auctions eliminate this by discretizing time.
DFBA introduces a 100ms execution delay for all orders. For most DeFi users this is negligible, but it creates challenges for use cases requiring real-time execution (e.g., liquidations in fast-moving markets). Batch size selection is a key design parameter.
Evaluating all five MEV defense strategies across key properties — practicality, protection scope, and systemic implications.
| 戦略 | Frontrun | Sandwich | Backrun | Post-confirm privacy | Practical now | Decentralized | Latency impact |
|---|---|---|---|---|---|---|---|
| F3B (threshold enc.) | ✓ Blocked | ✓ Blocked | ~ Allowed post-reveal | ✗ None | ✓ 0.026% overhead | ✓ Validator threshold | Negligible |
| FHE-MEV (blind arb) | ✓ Blocked | ✓ Blocked | ✓ Preserved (FHE) | ✗ None | ✗ High compute cost | ✓ No key holders | Very high (FHE) |
| ダークプール (Renegade) | ✓ Blocked | ✓ Blocked | ✓ No mempool | ~ Partial (MPC) | ~ Testnet only | ✓ P2P MPC | Matching latency |
| DFBA (batch auction) | ✓ Blocked | ✓ Blocked | ~ Blocked within batch | ✗ None | ~ 設計/PoC | ✓ Protocol-level | +100ms delay |
| OFA/MEV-Share | ~ Redistributes | ~ Partially mitigated | ✓ Rebated to user | ✗ None | ✓ 本番運用 | ✗ Builder centralized | Minimal |
Use MEV-Share / Flashbots Protect for immediate protection. Rebates for MEV extracted. Available now, no protocol changes needed.
Consider F3B-style threshold encryption for mempool. 0.026% overhead is negligible. Requires validator coordination but highly practical.
DFBA-style batch auctions structurally eliminate sandwich attacks. Good for new DEX designs where 100ms latency is acceptable.
Dark pools (Renegade/Prime Match) for large trades where full orderflow privacy matters. P2P MPC matching, no public mempool.
When FHE hardware accelerators (GPU/ASIC) make TFHE practical, FHE-MEV provides the strongest guarantee — content never revealed, ever.
Combine pre-confirmation (F3B or dark pool) + post-confirmation (Privacy Pools / zkSNARK) for full protection across both phases.
The most promising near-term path: F3B deployed at L2 level (encrypts mempool, negligible overhead) + MEV-Share for redistribution (production-ready) + FHE hardware acceleration watch (orders-of-magnitude improvement coming). Long-term, FHE-MEV eliminates the fundamental information asymmetry entirely.
Sousa, Benhamouda, Halevi, Tiwari, Malvai, Shi. "Flash Boys Back-Blocker." EPFL, 2023. Threshold BLS encryption for mempool privacy.
Passerat-Palmbach. "Blind Arbitrage." Flashbots / Imperial College London, 2023. TFHE-based searcher that operates on encrypted Txs.
Private Order Flow and PBS centralization analysis. Mevboost builder market study, 2023. OFA concentration dynamics.
Dual Flow Batch Auction. Jump Crypto / Archer Exchange, 2025. DeFi adaptation of Budish FBA (QJE 2015).
Budish, Cramton, Shim. "The High-Frequency Trading Arms Race." QJE 2015. Original FBA design for TradFi latency race elimination.
Daian et al. "Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges." IEEE S&P 2020. Foundational MEV characterization paper.