Even the “MEV big brother” has today—automatic authorization has become Achilles’ heel

Wu Shuo learned that security company Blockaid stated that the well-known Ethereum MEV bot JaredFromSubway was attacked, resulting in approximately $7.5 million in assets stolen.
The attacker constructed fake token wrappers and liquidity pools to trick its automated MEV execution system into granting token approvals to a contract controlled by the attacker.
Subsequently, the attacker exploited the unrevoked approvals to transfer out assets such as WETH, USDC, and USDT held by the bot via transferFrom.

Blockaid stated that this incident was not a traditional phishing attack, nor was it due to a smart contract vulnerability in the victim contract itself, but rather a flaw in the bot's mechanism that automatically identifies arbitrage opportunities and generates approvals.