Shoupeng Ren | Searcharxiv

arXiv2026

Ordering Power is Sanctioning Power: Sanction Evasion-MEV and the Limits of On-Chain Enforcement

Centralized stablecoins such as USDT and USDC enforce sanctions through contract-layer blacklist functions. Yet on public blockchains, a freeze is still an ordinary transaction competing with the sanctioned party's transfer for priority. It exposes a gap between contract-layer authority and ordering-layer enforcement: when both race for the same block, the outcome is set not by legal mandate, but by block producers' choices. Because both sides can pay for priority, sanction races create rents for block producers, which we call Sanction-Evasion MEV (SE-MEV). To measure this gap, we build the first longitudinal dataset of on-chain sanctions enforcement and evasion for Ethereum-based USDT and USDC from November 2017 to August 2025, covering more than $1.5 billion in frozen value. At least 7.3% of sanctioned USDT addresses and 18.7% of sanctioned USDC addresses had already been drained to zero before the freeze took effect. We also trace an escalation from issuer-side out-of-gas failures, to public gas auctions, private order flow, and direct payments to block producers, showing that block producers extract MEV from sanction enforcement. We then develop a game-theoretic model of stablecoin sanctions with MEV. It shows that compliant issuers cannot rationally stay outside the ordering market; fixed participation costs concentrate evasion among specialized MEV-aware adversaries; and the implicit MEV tax rises with regulatory penalties, creating incentives for vertical integration into block-building infrastructure. The problem extends beyond stablecoins. Any privileged on-chain action executed as an ordinary transaction -- emergency pauses, governance interventions, or judicial freezes -- faces the same conflict. Where ordering power follows economic incentives, ordering power is sanctioning power; contract-layer authority alone cannot guarantee enforcement.

cs.CR↗

arXiv2024

LookAhead: Preventing DeFi Attacks via Unveiling Adversarial Contracts

The exploitation of smart contract vulnerabilities in Decentralized Finance (DeFi) has resulted in financial losses exceeding 3 billion US dollars. Existing defense mechanisms primarily focus on detecting and reacting to adversarial transactions executed by attackers that target victim contracts. However, with the emergence of private transaction pools where transactions are sent directly to miners without first appearing in public mempools, current detection tools face significant challenges in identifying attack activities effectively. Based on the fact that most attack logic rely on deploying intermediate smart contracts as supporting components to the exploitation of victim contracts, novel detection methods have been proposed that focus on identifying these adversarial contracts instead of adversarial transactions. However, previous state-of-the-art approaches in this direction have failed to produce results satisfactory enough for real-world deployment. In this paper, we propose LookAhead, a new framework for detecting DeFi attacks via unveiling adversarial contracts. LookAhead leverages common attack patterns, code semantics and intrinsic characteristics found in adversarial smart contracts to train Machine Learning (ML)-based classifiers that can effectively distinguish adversarial contracts from benign ones and make timely predictions of different types of potential attacks. Experiments on our labeled datasets show that LookAhead achieves an F1-score as high as 0.8966, which represents an improvement of over 44.4% compared to the previous state-of-the-art solution, with a False Positive Rate (FPR) at only 0.16%.

cs.CR↗