mev-frontrunninglisted

# MEV / front-running detection ## When this applies - Swaps, mints, redemptions on AMMs / vaults - NFT mints with random/reveal mechanics - Auctions, Dutch auctions, English auctions - Liquidations - Trade routers - DEX aggregator paths - Any function with `amountOutMin` or slippage parameters ## Detection patterns ### Missing slippage parameter (HIGH) ```solidity function swap(address tokenIn, uint256 amountIn) external { router.swapExactTokensForTokens(amountIn, 0, path, msg.sender, block.timestamp); // ^ amountOutMin = 0 → 100% sandwichable } ``` ### Manipulable deadline (HIGH) ```solidity router.swap(..., block.timestamp); // ← deadline = now means no deadline at all ``` Searcher can delay your tx indefinitely. Use a real deadline (`block.timestamp + 15 min` or user-supplied). ### Permit + transferFrom front-running (MEDIUM) Submitting `permit()` separately from the consuming tx lets an MEV bot front-run the permit and grief the user. Bundle in one tx. ### Reveal-based randomness without commit-reveal (HIGH) ```solidity function mintRare() external { uint256 r = uint256(keccak256(abi.encode(block.timestamp, msg.sender))); if (r % 100 == 0) _mint(msg.sender, RARE_ID); // ← searcher can simulate and skip } ``` Searcher simulates → only sends tx if outcome is favorable. Use commit-reveal or Chainlink VRF. ### `block.prevrandao` / `block.difficulty` for randomness (HIGH) Proposer can manipulate post-merge `pre