mev-pbslisted

# MEV / PBS risk detection ## When this applies Trigger on any of: - Swaps, mints, or redemptions priced from a spot source without slippage bounds - Liquidations, auctions, or rebalances triggerable by anyone observing the mempool - Logic assuming transactions land via a private orderflow (Flashbots Protect, MEV-Share) - Reveal-then-act flows with no commit phase - Reward/airdrop claims, NFT mints, or oracle pushes that are frontrun-profitable - Time- or block-sensitive state an attacker can backrun ## Detection patterns ### Sandwichable swap, no minOut (HIGH) ```solidity function swap(uint256 amountIn) external { uint256 out = router.swapExactTokensForTokens(amountIn, 0, path, ...); // ^ minOut = 0 } ``` **Signal:** `amountOutMin == 0` (or a deadline of `type(uint).max`) lets a searcher frontrun to move price, then backrun, extracting the full slippage. The user-facing call must accept a caller-supplied `minOut` and `deadline`, never hardcode 0. ### Oracle-update frontrunning (HIGH) A position becomes profitable to liquidate / mint the instant a Chainlink push or `updatePrice` lands. Searchers backrun the oracle tx in the same block. If your protocol grants the *liquidator* a fixed bonus, the value leaks to MEV; if redemptions price off a freshly-updated feed, frontrun the update. ### JIT liquidity (MEDIUM) Concentrated-liquidity add-just-before / remove-just-after a large swap captures fees from passive LP