The Origins of Bitcoin MEV and Its Antecedents from Ethereum

By Peter Scoolidge, Devin Black, and Alex Luce @ Rebar Labs

Table of Contents:

Introduction

Part One: MEV on Ethereum

Part Two: New Developments Enabling Bitcoin MEV

Part Three: Bitcoin MEV: Observations and Predictions

MEV (Maximal Extractable Value) is the value extracted from blockchain transactions by a third party, known as a “searcher,” typically involving coordination with a miner or block builder. While MEV has been extensively observed and documented on Ethereum, such opportunities have been comparatively scarce on Bitcoin.

However, recent developments — Bitcoin-based token standards, metaprotocols, and decentralized finance (DeFi) platforms — are setting the stage for MEV on Bitcoin. This piece examines the factors that have enabled MEV on Ethereum and explores how similar conditions are now appearing on Bitcoin, offering observations and predictions on how MEV will manifest on the world's longest-running and most valuable blockchain.

Let's begin with a well-documented MEV example on Ethereum: "backrunning":

1. The searcher monitors transactions that are likely to cause significant exchange rate movements between two or more tokens on an automated market maker (AMM) or other decentralized exchange.
2. Upon identifying such a transaction, the searcher submits their own transaction to execute immediately after the original transaction within the same block.
3. The original transaction executes first, typically increasing the received token's price and decreasing the sent token's price.
4. The searcher's transaction executes afterward, capitalizing on the arbitrage opportunity created by the exchange rate impact of the original trade. They may buy the now undervalued sent token on the AMM and sell it on one or more other exchanges where the exchange rate hasn't adjusted yet, profiting from the price difference.

By capitalizing on arbitrage opportunities arising from price imbalances caused by large trades, searchers align asset prices across different exchanges and liquidity pools, contributing to overall market efficiency and more accurate price discovery. Other strategies, meanwhile, may extract value from users on-chain. For example: “sandwich attacks” that exploit slippage tolerance on AMMs, a strategy described later in this piece.

MEV has a well-established presence on Ethereum, on other EVM-based chains, and on Solana. However, certain characteristics of Bitcoin inhibit common MEV strategies. For example, Bitcoin lacks a native Turing-complete scripting language. This is a requirement for more complex on-chain applications like automated market makers, which are the basis for MEV strategies like backrunning mentioned above.

Despite this, the necessary conditions for MEV opportunities to be pursued on Bitcoin have come a long way over the past 12 months. The focus of this piece is to identify the key conditions that enable MEV strategies to exist and thrive on Ethereum. It aims to map these conditions onto the nascent on-chain ecosystem that is growing on Bitcoin in order to provide an understanding of how MEV will arise on the world’s most valuable and longest-running blockchain.

Part One explores platforms and practices that have historically empowered MEV on Ethereum. Part Two examines the current state of Bitcoin-based tokens, DeFi, metaprotocols, and other platforms that are comparable to the items discussed in Part One. Part Three provides predictions and examples of MEV on Bitcoin now and for the next 12 months.

MEV on Ethereum was first detailed in the Flash Boys 2.0 paper in 2019, where researchers highlighted how miners could exploit their control over transaction ordering to gain financial advantages.^[1] Early strategies involved DEX arbitrage (i.e., exploiting price discrepancies between exchanges), sandwiching of trades with high slippage, and backrunning oracle updates to win liquidations.^[2]

The profits earned by searchers, which were easily identified and quantified via their on-chain activity, led to many others seeking to run the same strategies. This in turn led to searchers competitively bidding on gas to ensure their transactions are included as required by their strategy (see: Grim Trigger mechanism described in Part Three of this piece).

At this point in time, the majority Ethereum client, Geth, ordered transactions first by gas fee; then, transactions with the same fee were ordered randomly. This led to some searchers spamming the network to beat competition at the same gas price for certain strategies reliant on positioning a transaction before or after a target transaction (e.g. backrunning).^[2]

In early 2021, Flashbots launched a solution known as MEV-Geth, which received transactions from searchers and forwarded them directly to miners through the Flashbots relay.^[3] MEV-Geth worked by removing the need for searchers to send their MEV transactions to the public mempool, allowing them to bid via a sealed bid blockspace auction within a separate, private mempool (MEV-Relay).

MEV-Geth also introduced the concept of bundles, which consist of one or more transactions to be included within an atomic set. This provided searchers with new potential for extraction techniques, including multi-transaction strategies, such as atomic sandwich attacks. Later, in September 2022, Ethereum moved from proof-of-work to proof-of-stake validation in the Merge, and Flashbots launched a new solution known as MEV-Boost. MEV-Boost provided for out-of-protocol proposer-builder separation (PBS) as an interim solution while in-protocol PBS developed into a production-ready state.^[3]

The result was that block construction was outsourced to block builders who could construct more optimal blocks through better compute, private order flow, and connections with searchers looking for MEV opportunities. The builder passed a fully constructed block to the proposer (i.e., validator), who in turn used less compute power, only performing the function of broadcasting the block to the network. MEV-Boost has caused builders to capture a significant share of value due to their advantageous position in the validation hierarchy.

Any discussion of MEV on Ethereum should include the role of the mempool, where transactions to be added to the Ethereum blockchain are queued and await the attention of a block builder and later selection by a proposer who adds it to the blockchain. As that transaction is propagated throughout Ethereum’s P2P network, it can be seen by searchers who are looking to extract value from the impact of state changes such as changes in exchange rates on decentralized exchanges.

The simple facts of the proposed transaction’s data — such as what asset it transacts in and the addresses involved — are enough to provide the searcher with an opportunity to arbitrage or front-run the transaction, among other things. The mempool’s role in MEV has been discussed at length in Flash Boys 2.0^[1] and Ethereum is a Dark Forest.^[4]

Once a searcher identifies a MEV opportunity in the mempool, they typically coordinate with a block builder on Ethereum to order the searcher’s transactions vis-a-vis the third-party trader’s transactions to execute the searcher’s strategy. Typically, block builders receive transactions directly over RPC and over the P2P network and arrange them into a block, which is sent to proposers that are unable to see the transactions.

Typically, proposers choose the blocks to propose for validation based on the highest ETH reward a block builder is willing to pay in fees.^[5] Often, a searcher’s fee for the block is encoded into the priority fee of their transaction and is proportional to their calculated revenue from an opportunity, or the perceived value of their transaction being included in the chain. This fee is known as an “incentive” or a “bribe,” and contributes to the “value” in the MEV acronym, which is the combined profit of the builder, miner or validator (depending on whether discussing pre- or post- proof of stake Ethereum), and searcher.

To summarize, searchers and the mempool are the basic requirements for MEV to take place. But for MEV to thrive as it has on Ethereum in the past several years, other conditions are necessary; this piece will discuss in Part Two how such conditions are becoming established on Bitcoin.

The launch of decentralized exchanges (DEXs) on Ethereum and the trading of a legion of fungible and non-fungible tokens have provided a high volume of trades that can be utilized in profitable MEV strategies.

The Ethereum Virtual Machine (EVM) and its associated smart contracts acts as a distributed computer, allowing anyone to execute logic on-chain. Smart contracts on Ethereum have fostered MEV activity by enabling the launch of on-chain applications like decentralized exchanges and lending protocols.

Traders looking to take a position in a fungible token typically place an order that allows the transaction to be executed within an exchange rate range specified by the trader, known as “slippage.” Traders specify slippage because the exchange rate of the token they want to swap may change while their transaction is pending in the mempool. Transactions are typically ordered by fee in a block; state changes prior to the trader’s transaction can affect the exchange rate.

Searchers can submit a transaction where they purchase token X using token Y at the highest exchange rate permitted by the trader’s slippage parameter, executing this purchase before the user's transaction. The user's subsequent purchase of token X further affects the token's exchange rate within their slippage tolerance. After the user's trade has elevated the exchange rate, the searcher then sells their token X back for asset Y at this higher exchange rate.

This is known as a “sandwich attack,” a strategy that can extract value from traders on-chain. Via this strategy, the searcher has pushed the third-party trade to the highest amount the trader was willing to pay. The searcher thus benefits from the higher exchange rate when selling the same token following the third-party trade.

In the case of decentralized lending protocols, users lock up a token (Token X) in a smart contract in exchange for a loan of another type of currency (Token Y). In the event that the value of the locked tokens drops to a certain threshold below the value of the collateral, any user can send a transaction to liquidate the loan (Token X in this example) on the open market.

Many liquidation protocols use an oracle to check a token’s exchange rate and determine eligibility for liquidation. Liquidations of collateral in DeFi smart contracts have been a material source of MEV opportunities on Ethereum.

In contrast to Ethereum, Bitcoin has sought since its inception to provide users with a means to transfer value from one party to another in a decentralized and secure manner — and little else. However, changes to Bitcoin around 2017 and thereafter, particularly the SegWit^[6] and Taproot^[7] upgrades, have enabled more functionality to be executed on Bitcoin. These upgrades have led to the development of new metaprotocols^[8], layer-2 solutions^[9], and other innovations that appear to be the beginning of decentralized finance on Bitcoin. The same developments — DEXs, lending protocols, etc. — were the basis for early DeFi on Ethereum, which saw extremely high growth rates in volume in the summer of 2020.

Like Ethereum, Bitcoin features a public mempool, and searchers should be able to see transactions sought by other users and use algorithms to determine if the proposed transaction fits into the searcher’s strategies. Thus, a necessary piece of the picture already exists on Bitcoin. However, many other essential pieces of infrastructure, such as smart contracts and DEXes — which are essential to robust MEV — are still in early stages of development.

So far, the most significant factor in setting the stage for DeFi and MEV on Bitcoin has been the development of protocols that enable new token standards on Bitcoin.

As mentioned above, the SegWit and Taproot upgrades made possible some further functionality in Bitcoin. Following those upgrades, Casey Rodarmor perceived a new opportunity and proposed Ordinal theory, which enabled users to associate data with specific satoshis using metadata in the transaction witness.

The developer known as Domo, building on Rodarmor’s work, further wrote a protocol to create fungible tokens on Bitcoin, known as BRC-20, and Rodarmor subsequently launched another Ordinals-based fungible token standard known as Runes. Consequently, Bitcoin now has native tokens that establish the groundwork for potential MEV strategies.

Bitcoin’s current metaprotocol-based token and NFT standards — namely Ordinals and Runes — are traded on marketplace platforms such as Magic Eden, where sellers list their assets for sale.^[14] These marketplaces provide the ability for MEV searchers on Bitcoin to apply strategies such as frontrunning or statistical arbitrage.

As mentioned previously for Ethereum, lending protocols have historically enabled liquidation opportunities for MEV searchers. Liquidium, a lending platform on Bitcoin L1, allows users to lend and borrow against their Ordinals, Runes, and BRC-20 holdings. Via an oracle, their platform determines whether a user has defaulted on a loan. As volume grows in this segment, we expect to see liquidation strategies emerge.^[15]

With this existing marketplace model, users are experiencing basic MEV in the form of transaction sniping, With decentralized exchanges and AMM models, however, behavior more akin to that found on Ethereum (e.g. sandwich attacks) may arise.

Developers on Bitcoin have been making significant progress in bringing DeFi functionality to Bitcoin via L1-based metaprotocols and L2s networks.

Metaprotocols enhance Bitcoin’s functionality on Layer-1, utilizing Bitcoin transactions without requiring asset bridging or changes to Bitcoin’s core functionality. These metaprotocols are built for the purpose of allowing on-chain financial applications like decentralized exchanges and AMMs. In the examples described below, these protocols abstract programmability to off-chain computation or virtual machines while still settling to Bitcoin’s base layer.

For the purpose of this piece, only Layer-1 metaprotocols will be explored in-depth, as the ecosystem of Bitcoin Layer-2s, sidechains, and rollups is wide enough to require a paper of its own. These Layer-2 networks typically order transactions using centralized sequencers, and in many cases, they use EVM-based infrastructure where the Ethereum MEV described above is more relevant.

The OP_NET metaprotocol abstracts Bitcoin addresses into smart contract addresses. This setup allows for the execution of smart contracts like those from EVM environments on a decentralized off-chain network of nodes. Smart contracts receive calldata via base-layer Bitcoin transactions, and BTC remains as the fee currency for OP_NET transactions. Motoswap is an DEX in development on OP_NET, bringing AMM functionality to this metaprotocol.

Similarly, the Bitcoin Virtual Machine (BitVM) is in development by a group of developers led by Robin Linus. BitVM is configured such that its computations are verified on the Bitcoin network, with execution happening off-chain. It employs fraud proofs to allow for challenges to fraudulent transactions. BitVM does not require any changes to the core Bitcoin software but is currently limited to two-party transactions, making it less suitable for more complex DeFi operations ^[11].

Other protocols like Tap Protocol ^[12] and Arch Network ^[13] are also contributing to the expansion of DeFi on Bitcoin's Layer 1. They facilitate the creation of more complex DeFi applications by using metaprotocols that leverage on-chain token states and proofs combined with off-chain computation.

With these developments, the MEV-friendly conditions of high trading volumes and differential prices across multiple markets (and multiple states) are expected to become more prevalent, similar to what was originally seen on Ethereum. If these DeFi-enabling metaprotocols are successfully launched, searchers will find ample opportunities for MEV strategies, including arbitrage and frontrunning, similar to those employed on Ethereum.

Another potential strategy that a searcher could employ on Bitcoin would be to censor a transaction to delay or avoid its inclusion on the blockchain. In concept, the practice of excluding or delaying a proposed transaction could be used by a searcher to frontrun for some other purpose related to ordering transactions.^[16]

In the current landscape, censorship is generally confined to transactions that come from OFAC-flagged addresses; for example, in 2021, Marathon sought to run a “fully compliant” pool that filtered out sanctioned transactions.^[17] Later, in 2023, a leading mining pool was reported to have excluded a few transactions, and later appeared to have confirmed its actions.^[18] In 2023, on Ethereum, the Flashbots MEV-Boost software run by Ethereum validators was flagged by several news outlets as being used to censor transactions from Tornado Cash.^[19]

Transaction exclusion may be a practice used by searchers on Bitcoin as more DeFi, programmability, and MEV opportunities arise on the network. However, this is difficult to prove or quantify without a full historical record of all mempool activity — a tool that has not yet been built.

In light of the emergence of new token protocols and other extensions of functionality on Bitcoin, and based on the observations of nascent MEV trades on Bitcoin to date, MEV volume is poised for an increase in the next 12 months.

We expect that as new Bitcoin-native opportunities are generated by fungible and non-fungible tokens, DEXs, and lending protocols, searcher teams from Ethereum and Solana will begin to run bots on the Bitcoin public mempool to identify profitable trades. This activity will likely manifest unevenly, with huge spikes resulting from unexpected one-off opportunities capitalizing on large unprotected trades.

Once it’s clear that there is potential for MEV profits on Bitcoin, a critical mass of the largest Ethereum searchers will begin to compete against each other on Bitcoin as they have previously done so on Ethereum. One uncertain factor is whether any of the metaprotocols or L2s will be able to provide enough transaction volume to match the speed and daily volume of Ethereum, and the outcome of that factor will have a large impact on the Bitcoin DeFi ecosystem overall.

One of the simplest examples of MEV on Bitcoin is sniping, mostly commonly in the case of Ordinals transactions. Ordinals allow users to inscribe data onto individual satoshis, effectively creating both fungible (e.g. BRC-20s) and non-fungible (e.g. Ordinals) tokens on Bitcoin. As these inscribed satoshis (or “inscriptions”) gain popularity, competition to acquire rare or valuable Ordinals via on-chain marketplaces has encouraged sniping.

Snipers utilize Bitcoin's replace-by-fee (RBF) mechanism, which allows users to replace a pending transaction with the same one but at a higher fee (a useful feature for common Bitcoin transactions considering the ~10 minute mempool time and potential for fee prices to fluctuate during this time). This technique is used to outbid others and ensure their transaction is prioritized. Snipers can repeatedly broadcast RBF transactions with progressively higher fees to increase their chances of being included in the next block.

Although this strategy can be effective for snipers, it often results in a poor user experience for those transacting with Ordinals. It can lead to network congestion and escalating fees as participants engage in fee bidding wars.

Private transaction orderflow, e.g. Rebar Shield,^[20] can mitigate these issues by concealing transactions from snipers, reducing the competitive bidding for transaction inclusion.^[21]

Bitcoin’s average 10-minute block time introduces arbitrage opportunities between DEXs and centralized exchanges (CEXs). Price discrepancies can arise due to the slower settlement times on Bitcoin compared to limit order books on centralized exchanges — as well as faster on-chain markets like Ethereum. Searchers may exploit these discrepancies by performing arbitrage between the state of an asset’s price on Bitcoin in the mempool and on another platform such as a centralized exchange.

Bitcoin’s block time can be both a challenge and an opportunity. Searchers need to account for the time it takes for transactions to be confirmed, which can affect the profitability of arbitrage strategies. Nonetheless, the potential for significant profits exists for those who can navigate these timing challenges effectively.

As Bitcoin’s ecosystem evolves to include AMMs and DEXs, traditional MEV strategies like frontrunning and arbitrage become possible.

We expect to only see more complex DEX-based MEV strategies such as sandwich attacks once Bitcoin-settled AMM transactions are possible as well as when deterministic transaction ordering is implemented. Deterministic transaction ordering allows searchers to ensure their transactions are executed at a specific position within a block, a crucial factor for the profitable execution of many MEV strategies. At present, Bitcoin's transaction ordering lacks the determinism required to guarantee the precise execution needed for profitable sandwich attacks within a block.

Looking ahead, the “grim trigger” mechanism could become relevant in the competition for MEV extraction. In game theory, a grim trigger is a strategy where cooperative behavior continues until one party defects, triggering a permanent end to cooperation. In regards to MEV: as multiple entities vie for the same profit opportunities, they escalate their bids to validators, prioritizing their transactions. This bidding war continues until profit margins nearly vanish. The scenario mirrors a multi-party prisoner's dilemma: while cooperation could maintain profits, the temptation to outbid leads to collectively reduced gains. This competitive dynamic demonstrates how rational individual actions in MEV extraction can result in suboptimal outcomes for all participants in the blockchain ecosystem.

This increased MEV competition could benefit miners in the short term but might also encourage behaviors that are detrimental to the health of Bitcoin’s growing on-chain ecosystem. Balancing these dynamics will be important in ensuring that MEV contributes positively to Bitcoin’s ecosystem rather than detracting from it.

Sidechains and layer-2 solutions introduce additional complexities and opportunities for MEV on Bitcoin. Incidents in the past have demonstrated the potential for manipulative behavior in these environments. For example, mining pools have replaced low-value transactions on a sidechain, affecting the fairness of transaction processing.^[22][23]

As L2s often interface or merge mine with Bitcoin, it will be important and mitigate MEV risks. The interplay between the main Bitcoin network and its sidechains or layer-2 solutions could be a significant area for MEV activity.

Another researcher has studied non-standard transactions on Bitcoin (as defined by the Bitcoin Core “policy rules”) and detected about 20,000 such transactions over a ~3-year period using a test node on historic blockchain data.^[24] In that article, author 0xb10C noted that non-standard transactions may reflect an effort to help recover UTXOs stuck on non-standard scripts but could also reflect a miner charging a transaction fee to include a larger-than-standard amount of data (such as a JPEG on an inscription).

Data on transaction fees on Bitcoin also reflects a significant volume of fee rates that are more than 50% above the median, with the most notable spike at the Halving on April 20, 2024, when users were presumably paying high fees to obtain notable sats from that event. Such increases and volatility in transaction fees corroborate the concept that transaction ordering competition (and thus a precursor of MEV) is active on Bitcoin.^[25]

In light of these developments, we expect a rapid increase in Bitcoin MEV in the coming year. The emergence of new tokens, metaprotocols, DEXs, and lending protocols will expand the landscape for MEV. Searchers from Ethereum and elsewhere are likely to explore these new opportunities, particularly given the much lower competition on Bitcoin. Miners will benefit from fee competition arising from MEV strategies.

As MEV becomes more prominent on Bitcoin, it’s essential for Bitcoin’s users and developers to be proactive in addressing the associated risks. By fostering good MEV practices and mitigating harmful ones, the Bitcoin community can harness the benefits of MEV while maintaining the integrity and trust that are foundational to the network.

[1] Philip Daian, et al. Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges. arXiv:1904.05234v1 [cs.CR]. Apr. 10, 2019.
[2] Chris Maree. Unbundling MEV Supply Chain Part 1: History and Evolution. https://blog.hack.vc/unbundling-mev-supplychain-part-1-history-and-evolution/. Mar. 7, 2024.
[3] https://www.flashbots.net/.
[4] Dan Robinson and Georgios Konstantopoulos. Ethereum is a Dark Forest. https://www.paradigm.xyz/2020/08/ethereum-is-a-dark-forest. Aug. 28, 2020.
[5] https://ethereum.org/en/roadmap/pbs/.
[6] https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki.
[7] https://github.com/bitcoin/bips/blob/master/bip-0371.mediawiki.
[8] Bitcoin metaprotocols are protocols that add functionality to Bitcoin transactions without changing the core protocol. They operate directly on Bitcoin's base layer.
[9] Protocols built on top of the main blockchain that handle transactions off the main chain but still rely on the main chain for security and final settlement.
[10] Separate blockchains that run parallel to the main blockchain and are interoperable with it. They have their own consensus mechanisms and can process transactions independently, periodically anchoring their state to the main chain for security.
[11] Bitcoin BitVM: What is it, exactly? Kraken. https://www.kraken.com/learn/what-is-bitcoin-bitvm.
[12] Tap Introduction (Whitepaper). Trac Systems. https://github.com/Trac-Systems/tap-protocol-specs/blob/main/README.md
[13] Introducing Bridgeless Bitcoin Programmability. Arch Network. https://docs.arch.network/whitepaper.pdf
[14] A Complete Guide to the Magic Eden NFT Marketplace in 2024! NFTEvening. https://nftevening.com/magic-eden-nft-marketplace-the-only-guide-you-need/. Jul. 11, 2024.
[15] How Does Liquidium Work? Liquidium. https://help.liquidium.fi/en/articles/9189612-how-does-liquidium-work-a-technical-deep-dive
[16] https://leather.io/blog/nakamoto-impact-bitcoin-mev.
[17] https://bitcoinmagazine.com/culture/is-mining-censorship-a-threat-to-bitcoin.
[18] b10c. Six OFAC-sanctioned transactions missing. https://b10c.me/observations/08-missing-sanctioned-transactions/. Nov 20, 2023.
[19] https://www.coindesk.com/tech/2023/12/06/ethereums-censorship-problem-is-getting-worse/. (“Soon after the U.S. government sanctioned Tornado Cash, MEV-Boost's "relayers" were blamed for censoring Ethereum. Relayers are third-party software operators that hand transactions from builders to validators, and in November 2022, Wahrstätter found that 77% of them stopped passing along blocks with OFAC-sanctioned transactions.”). Dec. 6, 2023.
[20] Announcing Rebar Shield: MEV-Protected Transactions on Bitcoin. Rebar Labs. https://rebarlabs.io/writings/announcing-rebar-shield.
[21] Walt Smith, The Spectre of MEV on Bitcoin. https://cyber.fund/content/the-spectre-of-mev-on-bitcoin. Mar. 18, 2024.
[22] https://x.com/blockworksres/status/1659228827820908547.
[23] https://b10c.me/observations/09-non-standard-transactions/. Jan. 29, 2024.
[24] https://dune.com/queries/4012340.
[25] Walt Smith, The Spectre of MEV on Bitcoin. https://cyber.fund/content/the-spectre-of-mev-on-bitcoin. Mar. 18, 2024. (“In all ways, acceleration in fee variance and instability with joint deceleration in block rewards is the herald of greater MEV to come.”).