Worked example · 2023-20

ERC-4337 Bundler MEV Extraction Cohort — Ethereum / Polygon / Arbitrum / Optimism / Base — 2023–2025

Loss: no single consolidated dollar-extraction figure at v0.1. Bundler MEV extraction is a per-UserOp value-capture leakage rather than a headline-loss event — each individual extraction is small (gas-cost-scale to low-four-figure per UserOp), but the aggregate extraction across the bundler surface is a structural loss imposed on AA wallet users in proportion to their UserOp volume. EigenPhi's AA supply-chain analytics characterise the extraction as a recurring property of the alt-mempool architecture rather than as an isolated incident; no individual bundler operator has been publicly named in the manner of jaredfromsubway.eth for EOA-mempool MEV. The cohort's structural significance is at the architecture and mitigation layer: the bundler's role definition assumes neutral aggregation, but the permissionless alt-mempool architecture gives every bundler a privileged read of pre-confirmation UserOps, creating a standing MEV surface that is structurally analogous to Ethereum block-builder MEV (T13.001 context) but whose mitigation surface is different.
Recovery: not applicable — bundler MEV extraction is a value-capture leakage that reduces the user's execution quality (worse swap price, stranded UserOp, higher effective gas cost) rather than a theft event that can be reversed. Recovery is not a relevant framing; mitigation (MEV-protected bundler endpoints, paymaster allowlists, pre-bundler UserOp encryption) is the load-bearing defender response.
OAK Techniques observed: OAK-T13.002 (Bundler MEV — the bundler exploits its privileged read of pre-confirmation UserOps in the alt-mempool to extract value through front-running, sandwiching, censorship, or collusion with the paymaster). OAK-T13.001 (Paymaster Compromise — contextually adjacent for sub-pattern (d), bundler-paymaster collusion, where the paymaster sponsors UserOps that the bundler then extracts value from and the two split the proceeds). OAK-T5.004 (Sandwich / MEV Extraction — the economic primitive is identical to EOA-mempool MEV (front-run + back-run around a victim swap), but the actor role (bundler rather than generic searcher), observation surface (alt-mempool rather than public mempool), and mitigation surface (bundler-level controls rather than Flashbots Protect-style routing) all differ).
Attribution: pseudonymous Bundler activity is concentrated in a small set of operators (Coinbase, Alchemy, Pimlico, Biconomy, Particle, Stackup); per-bundler MEV-extraction attribution at the operator-name level is not publicly disclosed at v0.1. EigenPhi's AA supply-chain analytics provide per-bundler-address extraction attribution without naming the operators behind the bundler addresses. The attribution pattern is structurally different from EOA-mempool MEV — where jaredfromsubway.eth is a publicly-known operator profile — because bundler operators are typically corporate entities or infrastructure providers whose MEV-extraction posture is a commercially sensitive product attribute rather than a publicly-auditable behaviour.
Key teaching point: The ERC-4337 bundler's role definition assumes neutral aggregation — the bundler is expected to collect UserOperations from the alt-mempool and submit them to the EntryPoint without extracting value — but the permissionless alt-mempool architecture gives every bundler a privileged read of pre-confirmation UserOps, and a bundler that chooses to extract value faces no protocol-level disincentive beyond reputational damage. The structural OAK lesson for T13.002 is that the bundler is a trust-assumed actor in the ERC-4337 architecture whose misbehaviour surface is not constrained by the EntryPoint's on-chain mechanisms (the EntryPoint stake is anti-spam, not anti-MEV), and the mitigation surface therefore lies in off-chain bundler-level controls — MEV-protected bundler endpoints, paymaster bundler allowlists, per-bundler reputation systems, and pre-bundler UserOp encryption — rather than in the EntryPoint contract itself.

Summary

ERC-4337 (EIP-4337) defines an account-abstraction architecture for Ethereum and EVM chains in which user operations (UserOperations) are submitted to a dedicated alt-mempool (a P2P network of bundler nodes distinct from the public EOA-transaction mempool), collected by bundlers, and submitted on-chain via a handleOps call to the EntryPoint contract. The bundler's role — as defined by the ERC-4337 specification — is to aggregate UserOperations from the alt-mempool, execute them against the EntryPoint, and collect the gas reimbursement from the user's smart-contract wallet or paymaster. The bundler is explicitly expected to be a neutral aggregation agent: it should select UserOps based on priority fee and gas economics, and should not reorder, insert, or censor UserOps for its own profit.

The architectural reality diverges from the role definition in one critical respect: the alt-mempool is permissionless. Any node can operate a bundler, and every bundler sees every UserOp broadcast to the alt-mempool before that UserOp is included on-chain. A bundler that observes a profitable UserOp — a large swap, a liquidation opportunity, an arbitrage-relevant oracle update — can insert its own UserOps before (front-run) or around (sandwich) the victim UserOp within the same handleOps bundle, capturing the value that would have accrued to the user. The EntryPoint contract enforces bundle-level validity (gas payment, signature verification, nonce ordering) but does not constrain bundle-internal UserOp ordering — the bundler controls the order of UserOps within the bundle, and the EntryPoint executes them in the order the bundler specifies.

The bundler MEV surface was characterised in bundler-vendor research and AA-supply-chain analytics from 2023 onward:

Etherspot (Skandha bundler) — the Etherspot team published a bundler-MEV analysis in 2023 characterising the alt-mempool's MEV exposure, documenting that any UserOp landing in the canonically alt-mempool is observable by every listening bundler and that a competing bundler with a higher-priority-fee bid can front-run or copy the UserOp. Etherspot positioned MEV protection (private-relay submission paths bypassing the public alt-mempool) as a product feature of the Skandha bundler, indicating that unprotected bundlers are the cohort default.
FastLane — the FastLane team published an intents / 4337 / MEV interaction analysis in 2024 characterising the bundler's privileged position in the AA supply chain and the structural conditions that make bundler MEV extraction economically rational.
BlockPI — the BlockPI team published an alt-mempool failure-mode analysis in 2023 documenting the bundler's front-running, sandwiching, and censorship surfaces, and the block-builder interaction that amplifies the MEV surface when the block builder is also a bundler or has preferential access to bundler-submitted bundles.
GMU empirical AA study (2024) — an academic empirical analysis of mainnet AA adoption documented that approximately 99% of mainnet UserOperations are paymaster-sponsored and that bundler activity is concentrated in a small set of operators (Coinbase, Alchemy, Pimlico, Biconomy, Particle), establishing the structural conditions for sub-pattern (d), bundler-paymaster collusion.
EigenPhi AA supply-chain analytics — EigenPhi extended its sandwich/arbitrage/liquidation MEV taxonomy to AA flows, providing per-bundle attribution of MEV against bundler addresses. This is the closest analogue to the [eigenphijared2023] operator-profile methodology in the AA setting and represents the state of the art in public T13.002 detection.

The four sub-patterns characterised in the research are:

(a) UserOp front-running. A bundler observes a profitable UserOp in the alt-mempool before submission, computes that the EntryPoint reimbursement plus extractable value exceeds gas cost, and submits a competing transaction — either a copy of the UserOp's calldata under its own bundle, or an EOA-level transaction capturing the same opportunity. The original UserOp is either re-bundled at a worse price or stranded (reverts because the opportunity was already captured).
(b) UserOp sandwiching. A bundler brackets a victim UserOp inside its own bundle with an opening swap (front-run) and a closing swap (back-run) on the same pool, capturing slippage. Distinct from (a) because both legs are constructed by the bundler itself within the bundle ordering it controls; the EntryPoint does not constrain bundle-internal ordering.
(c) UserOp censorship. A bundler refuses to include UserOps that are unprofitable to it (low priority fee, or competitive with its own extraction), forcing those UserOps to time out, re-broadcast through MEV-protected paths at higher cost, or fall back to a less-decentralised relay. Observable as a sustained gap between alt-mempool propagation and on-chain inclusion for a specific UserOp class at a specific bundler.
(d) Bundler-paymaster collusion. A bundler and a paymaster operator coordinate so that the paymaster sponsors UserOps which the bundler then extracts value from, splitting the proceeds. Particularly acute for sponsored-gas flows where the user perceives the transaction as "free" and therefore tolerates worse execution price.

For OAK's purposes, the ERC-4337 bundler MEV extraction cohort is the primary worked example for T13.002 (Bundler MEV). The cohort's structural significance is at the architecture and mitigation layer rather than the dollar-extraction layer — the bundler's role definition assumes neutral aggregation, the permissionless alt-mempool gives every bundler a privileged read, and the EntryPoint's on-chain mechanisms (stake, signature validation, gas accounting) do not constrain MEV extraction. The defender's leverage point is at the bundler level — MEV-protected endpoints, paymaster allowlists, per-bundler reputation — rather than at the user level (Flashbots Protect-style routing), because the alt-mempool propagates UserOps to bundlers the user did not choose.

Timeline (cohort-scale)

When	Event	OAK ref
2021-09	ERC-4337 proposed; EntryPoint specification defines bundler as neutral aggregation agent; alt-mempool as permissionless P2P network	(architecture definition)
2023-03	EntryPoint v0.6 deploys on Ethereum mainnet; first bundler implementations (Etherspot Skandha, Stackup, Biconomy, Alchemy) go live; alt-mempool MEV surface is theoretically characterised but not yet empirically documented	(architecture deployment)
2023	Bundler-vendor research (Etherspot, BlockPI) characterises alt-mempool MEV exposure; MEV-protected bundler endpoints marketed as a product feature — indicating unprotected bundlers are the cohort default	T13.002 surface characterised
2023	EigenPhi extends MEV taxonomy to AA flows; per-bundle MEV attribution against bundler addresses begins; bundler-MEV extraction confirmed at the empirical level	T13.002 empirical confirmation
2024	FastLane publishes intents / 4337 / MEV interaction analysis; paymaster-sponsored UserOps documented at ~99% of mainnet volume; bundler concentration documented in GMU study — structural conditions for sub-pattern (d) established	T13.002 sub-pattern (d) surface characterised
2024–2025	MEV-protected bundler endpoints become the standard for institutional AA integration; per-bundler reputation systems proposed; pre-bundler UserOp encryption as active research direction	(mitigation maturation)
2025 (v0.1 cutoff)	Cohort documented as the third T13.002 example in OAK; no individually-named bundler-MEV operator profile at v0.1 (contrast T5.004 `jaredfromsubway.eth`); `emerging` maturity reflects the asymmetry between architecture-research characterisation and per-operator public disclosure	(OAK characterisation)

Realised extraction

Bundler MEV extraction is a per-UserOp value-capture leakage rather than a headline-loss event. Each individual extraction is small — on the order of gas-cost-scale to low-four-figure USD per victim UserOp — and is absorbed by the user as worse execution quality (a swap that fills at a worse price because the bundler front-ran it, a UserOp that strands because the bundler censored it, a sponsored transaction whose execution price embeds the bundler's extraction). The aggregate extraction across the bundler surface is a structural cost imposed on AA wallet users in proportion to their UserOp volume, but the cost is diffuse and not centrally tabulated.

The extraction profile differs across the four sub-patterns:

(a) Front-running: the attacker captures the price movement the victim's swap would have caused; the victim's swap either reverts (if the opportunity was already captured) or fills at a worse price. The extraction is the price delta between the victim's expected execution and the actual execution.
(b) Sandwiching: the attacker captures the slippage on the victim's swap — the front-run leg pushes the price against the victim, and the back-run leg reverts the price. The victim's swap fills at a worse price; the extraction is the slippage delta.
(c) Censorship: the victim's UserOp pays a higher effective cost (re-broadcast at higher priority fee, fallback to a less-decentralised relay, or timeout). The extraction is the difference between the cost the victim would have paid under neutral bundling and the cost they actually paid.
(d) Bundler-paymaster collusion: the extraction is split between the bundler and the paymaster; the victim's swap fills at a worse price than market, and the delta is the collusion profit.

The structural lesson at the extraction layer is that bundler MEV is a value-capture leakage that does not produce a single headline-loss event — it is diffuse, per-UserOp, and structurally analogous to EOA-mempool MEV (T5.004) in economic terms but with a different actor (bundler rather than searcher) and a different mitigation surface (bundler-level controls rather than Flashbots Protect).

References

[erc4337eip] — canonical ERC-4337 specification; defines bundler role, alt-mempool architecture, and EntryPoint contract semantics.
[etherspot2023bundlermev] — Etherspot Skandha bundler-MEV analysis; alt-mempool MEV exposure characterisation; MEV-protected bundler product feature.
[fastlane2024erc4337mev] — FastLane intents / 4337 / MEV interaction analysis; bundler-paymaster collusion surface characterisation.
[blockpi2023bundlermempool] — BlockPI alt-mempool failure-mode analysis; front-running, sandwiching, and censorship surface characterisation; block-builder interaction amplification.
[gmu2024aaempirical] — GMU empirical mainnet AA adoption analysis; 99% paymaster-sponsored UserOp volume; bundler operator concentration.
[eigenphi2023aamev] — EigenPhi AA supply-chain MEV attribution; per-bundler-address extraction analytics.
[daian2019flashboys] — foundational MEV characterisation; economic primitive that T13.002 inherits, adapted to the AA architecture context.
Bundler-vendor documentation — Etherspot Skandha, Pimlico, Stackup, Biconomy, Alchemy bundler endpoints; MEV-protection product documentation; paymaster bundler-allowlist implementation guides.

Public references

See citations in corresponding technique file.

Discussion

The ERC-4337 bundler MEV extraction cohort is structurally important to OAK because it anchors T13.002 (Bundler MEV) at the architecture-research and empirical-extraction layer — the strongest form of per-Technique evidence available at v0.1 for a Technique whose per-operator public disclosure lags its architecture-research characterisation. The existing T13.002 examples (2025-09 EntryPoint v0.9 griefing disclosure, 2023-2024 bundler MEV cohort) cover the EntryPoint-contract-level bundler-revert-cost margin and the architecture-level cohort characterisation respectively. This expanded cohort example adds the empirical-extraction layer — EigenPhi's per-bundler-address MEV attribution, the GMU bundler-concentration study, and the bundler-vendor MEV-protection product positioning — providing the operational evidence that T13.002 is a live, observed extraction class, not merely a theoretical architecture concern.

The cohort also reinforces the structural distinction between T13.002 and T5.004 that is load-bearing for the AA Tactic. T5.004 (Sandwich / MEV Extraction) covers EOA-mempool MEV by generic searchers — the user's mitigation is Flashbots Protect or a private mempool. T13.002 covers AA-mempool MEV by bundlers — the user's mitigation is at the bundler level (MEV-protected endpoints, paymaster allowlists, per-bundler reputation) because the alt-mempool propagates UserOps to bundlers the user did not choose. A defender who treats AA-mempool MEV as "just sandwiching with extra steps" misses that the natural mitigation surface is at the bundler, not at the user. The standalone T13.002 Technique exists to keep that mitigation surface visible, and this cohort example provides the operational evidence that the distinction matters.

The developing maturity rating reflects the asymmetry between architecture-research characterisation (strong — EigenPhi, FastLane, Etherspot, BlockPI, GMU provide a coherent multi-source evidence base) and per-operator public disclosure (weak — no individually-named bundler-MEV operator profile exists at v0.1 in the manner of jaredfromsubway.eth for T5.004). The Technique should be re-rated to stable once at least one publicly-attributed bundler-MEV operator profile lands with the specificity of the [eigenphijared2023] operator profile. Until then, the emerging rating reflects the architecture-level confidence while acknowledging the per-operator disclosure gap.

The broad T13.002 surface — covering front-running, sandwiching, censorship, and bundler-paymaster collusion — is a Tactic-level observation about the AA architecture's trust model. The ERC-4337 EntryPoint contract provides strong on-chain guarantees (gas payment, signature validation, nonce ordering, stake-based anti-spam) but does not constrain the bundler's off-chain behaviour — the bundler's ordering, inclusion, and collusion decisions are outside the EntryPoint's enforcement scope. The structural T13.002 lesson is that a trust-assumed role in a permissionless architecture is a standing misbehaviour surface by construction, and the mitigation surface must be at the same architectural layer as the misbehaviour surface — off-chain bundler-level controls, not on-chain EntryPoint constraints. This lesson generalises beyond ERC-4337 to any architecture where a permissionless actor is trusted to neutrally aggregate user intents: cross-chain solver networks, intent-based DEX aggregators, MEV-Boost relays, and any system where user-submitted operations pass through an intermediary whose ordering and inclusion decisions are not constrained by the settlement-layer contract.