Ethereum’s decentralized architecture relies on scalable and efficient block production, leading to the adoption of Proposer-Builder Separation (PBS). However, PBS-enabled environments that use standard Builder APIs expose validators to new privacy risks due to transport-layer metadata leakage, including IP addresses linked to public keys. This leakage allows adversaries to target block proposers and disrupt block production through network attacks, undermining decentralization and fairness.

Our experiment investigates how transport-level privacy leaks at validator-relay interfaces allow targeted disruption via metadata analysis and low-cost network-layer attacks. We implemented a transport metadata harvesting pipeline of the full currently most used PBS architecture - MEV-boost stack - to link validators’ public keys to the IP address of their consensus client as well as that of the mev-boost software and executed attacks in a lab setting to demonstrate the practical applications of this work.

Our analysis challenges the trust assumptions of relayers in the current PBS implementation and highlights how these vulnerabilities compromise proposer anonymity and incentivize adversarial actions, such as manipulating RANDAO values to interfere with block proposals. Beyond proposers, relays and builders are also at risk without sufficient transport privacy measures. To address this, we advocate for integrating metadata privacy protocols into PBS designs, particularly as the transition to enshrined PBS (ePBS) advances. Strengthening transport-layer privacy is essential to preserving Ethereum’s decentralization, security, and fairness in block production.