Sandwich Attack

A sandwich attack is a form of Maximal Extractable Value (MEV) exploitation in decentralized finance where an attacker strategically places two transactions around a victim’s pending trade on a decentralized exchange (DEX), one immediately before it (front-run) and one immediately after it (back-run), to extract profit at the victim’s expense. The attacker manipulates the asset’s price by purchasing the same token just before the victim’s trade executes, artificially inflating the price, and then selling immediately after the victim’s trade completes at the inflated price, pocketing the difference.

The attack exploits the transparency of blockchain mempools and the mechanics of automated market makers (AMMs) like Uniswap, SushiSwap, and PancakeSwap. When a user submits a swap transaction to a DEX, it enters the public mempool where anyone can observe the pending transaction details, including the token pair, swap amount, and slippage tolerance. A sandwich attacker (typically an automated bot) detects this pending transaction, calculates the price impact the victim’s trade will cause on the AMM’s liquidity pool, and constructs two transactions designed to extract value from that predictable price movement.

The mechanics work as follows: the attacker submits a buy order for the same token the victim is purchasing, using a higher gas price or a priority MEV bundle to ensure it executes first (front-running). This buy order moves the token price upward on the AMM’s bonding curve. When the victim’s trade then executes at this now-higher price, they receive fewer tokens than they would have without the attacker’s interference. Finally, the attacker immediately sells the tokens they purchased, profiting from the artificial price increase their front-run created. The victim’s trade effectively subsidizes the attacker’s profit, as the victim absorbs a worse exchange rate while the attacker captures the price differential.

Sandwich attacks are among the most discussed forms of MEV extraction in DeFi. Sandwich-specific cumulative extraction on Ethereum is estimated in the hundreds of millions of dollars since AMM-based DEX trading took off, while total MEV extraction across all strategies (arbitrage, liquidations, and sandwiching combined) and across multiple chains has crossed the $1 billion mark cumulatively. The attack is particularly insidious because it is technically legal in most jurisdictions, permissionless, and nearly invisible to the average user. Victims simply receive fewer tokens than expected, with the loss often hidden within their slippage tolerance.

How Did Sandwich Attacks Originate and Evolve?

2017: The theoretical foundations of sandwich attacks were described in research by Philip Daian and colleagues, who began studying the emerging phenomenon of miner-extractable value on Ethereum. Early DEXes like EtherDelta operated on order book models that were less susceptible to sandwich attacks than the AMM models that would later dominate.

2018: As Uniswap V1 launched and the constant product AMM model (x times y equals k) gained adoption, researchers noted that the deterministic price impact of trades on AMMs created a mathematically predictable opportunity for front-running and sandwiching. The term “sandwich attack” began appearing in Ethereum research forums.

2019: Philip Daian, Steven Goldfeder, Tyler Kell, and others published the seminal paper “Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges,” which formally described sandwich attacks and quantified the MEV extraction opportunity on Ethereum. This paper brought mainstream attention to the problem and coined much of the vocabulary still used today.

2020: The DeFi Summer explosion dramatically increased sandwich attack activity. As billions of dollars flowed into AMMs like Uniswap V2 and SushiSwap, sophisticated MEV bots proliferated, conducting thousands of sandwich attacks daily.

2021: Flashbots launched Flashbots Protect, a private transaction relay that allowed users to submit transactions directly to block builders without exposing them in the public mempool, providing the first widely available defense against sandwich attacks. Concurrently, sandwich attack bots became increasingly sophisticated, using multi-block strategies and cross-DEX arbitrage.

2022: Ethereum’s transition to Proof of Stake in September 2022 changed the MEV market by shifting block production from miners to validators, but sandwich attacks continued under the new proposer-builder separation (PBS) model.

2023: MEV-Share and similar mechanisms were introduced to redistribute MEV back to users, partially mitigating sandwich attack losses. Private mempool solutions like MEV Blocker by CoW Protocol gained adoption. An address labeled jaredfromsubway.eth emerged as the single most prolific sandwich bot on Ethereum, spending over $7 million in gas in a single month while extracting millions in profit.

2024: Layer-2 networks including Arbitrum, Optimism, and Base continued relying on centralized sequencers that process transactions on a first-come-first-served basis, significantly reducing sandwich attack opportunities on L2s. On Ethereum mainnet, sandwich extraction remained elevated, with monthly extraction running close to $10 million late in the year.

2025 to 2026: Sandwich extraction on Ethereum fell sharply through 2025 even as DEX trading volumes grew, dropping from roughly $10 million a month in late 2024 to about $2.5 million a month by October 2025, according to EigenPhi-based research, as more traders adopted private transaction relays and MEV-protection tools. Despite the decline in total value extracted, the number of individual attacks stayed high (60,000 to 90,000 per month), and jaredfromsubway.eth alone accounted for roughly 70% of all sandwich attacks during this period, now using more sophisticated multi-victim bundling strategies. Attacker profit margins have also compressed, with block builders capturing most of the extracted value through gas fees rather than the sandwich bots themselves.

“MEV is an invisible tax on every DeFi user. Sandwich attacks are the most visible symptom of a system where transaction ordering is a marketplace, and ordinary users are the product.” Philip Daian, co-author of “Flash Boys 2.0”

How Can You Explain a Sandwich Attack in Simple Terms?

Imagine you are at a farmers’ market and you announce loudly, “I want to buy 100 apples.” A sneaky person standing nearby hears you, rushes to the apple stand first and buys 50 apples, which drives the price up due to limited supply. You then buy your 100 apples at the now-higher price. Immediately after your purchase, the sneaky person sells their 50 apples at the inflated price and walks away with a profit, all because they knew what you were going to do before you did it.

Think of it like someone cutting in line at a ticket counter. You are about to buy concert tickets at face value, but someone jumps ahead of you, buys a batch of tickets (raising the price for the remaining ones), and then sells their tickets at the new higher price right after you have completed your more expensive purchase.

Picture a poker game where one player can see everyone’s cards before betting. A sandwich attacker can see your trade before it executes, because it is visible in the mempool, and uses that information to place bets around yours that guarantee them a profit at your expense.

It is like a stock market manipulation scheme, but in a world where every buy and sell order is broadcast publicly before it executes. The attacker reads your order, trades ahead of you, lets your order push the price further in their favor, and then closes their position, extracting money from the predictable price movement your trade creates.

Important: Sandwich attacks do not steal funds directly from your wallet. Instead, they cause you to receive fewer tokens than you would have gotten without the attack. The loss is typically small per transaction, often 0.1% to 2% of trade value, but it compounds across the tens of thousands of DeFi trades targeted every month, generating substantial cumulative profits for attackers even as average extraction per attack has declined.

What Are the Key Technical Features of a Sandwich Attack?

Mempool Monitoring and Detection

  • Sandwich bots run dedicated Ethereum nodes that monitor the public mempool in real time for pending DEX swap transactions
  • Bots parse transaction calldata to identify the DEX protocol, token pair, swap amount, and slippage tolerance of each pending trade
  • Advanced bots filter targets based on profitability calculations, ignoring small trades where gas costs would exceed potential profit
  • Some bots maintain databases of token liquidity depths across multiple DEXes to estimate price impact with high precision

How Does a Sandwich Attack Actually Work?

  1. A victim submits a swap transaction to a DEX (for example, swapping 10 ETH for Token X on Uniswap) with a 1% slippage tolerance; this transaction enters the public mempool
  2. A sandwich bot detects the pending transaction and calculates the expected price impact on the AMM’s liquidity pool using the constant product formula
  3. The bot constructs a front-run transaction, buying Token X with ETH at the current (lower) price, using a higher gas price or priority fee to ensure its transaction is included before the victim’s
  4. The bot submits both the front-run buy and a back-run sell transaction as a bundle to a block builder (via Flashbots or similar MEV infrastructure), guaranteeing atomic execution of the sandwich
  5. The block builder includes the transactions in order: the attacker’s front-run buy, the victim’s swap, and the attacker’s back-run sell
  6. The front-run buy moves the price of Token X upward on the AMM curve; the victim’s swap then executes at this worse price, but within their slippage tolerance
  7. The back-run sell dumps the attacker’s tokens at the price elevated by both the front-run and the victim’s trade, capturing the profit minus gas fees

How Do Attackers Exploit AMM Price Impact?

  • AMMs use bonding curves (such as x times y equals k for Uniswap V2) where every trade changes the token price proportionally to the trade size relative to the pool’s liquidity
  • Larger trades on smaller pools produce greater price impact, making them more profitable sandwich targets
  • Attackers calculate the exact amount to front-run that maximizes their profit without causing the victim’s trade to revert due to slippage exceeding their tolerance
  • Concentrated liquidity AMMs like Uniswap V3 create more complex price impact dynamics, requiring more sophisticated attack calculations

What Role Do Gas Prices and Block Builders Play?

  • Traditional sandwich attacks relied on outbidding the victim’s gas price (priority gas auctions) to achieve transaction ordering
  • Modern attacks use MEV bundle submission through Flashbots or similar block builder APIs, allowing attackers to specify exact transaction ordering without competing in gas auctions
  • Block builders earn tips from sandwich bots for including their bundles, creating an economic incentive to facilitate the attacks, and by 2025 to 2026 block builders were capturing most of the extracted value through these fees rather than the bots themselves
  • Proposer-builder separation (PBS) on Ethereum PoS means validators (proposers) select the most profitable block from competing builders, many of which include sandwich bundles

What Are Cross-Protocol and Multi-Transaction Strategies?

  • Sophisticated bots execute cross-DEX sandwiches, where the front-run and back-run occur on different DEXes or across multiple liquidity pools
  • Some attackers combine sandwich attacks with flash loans to amplify their capital without requiring upfront funds
  • Multi-victim sandwiches target several pending swaps simultaneously within a single block, optimizing total profit extraction, a technique that became more common as leading sandwich bots grew more sophisticated
  • Attackers may also combine sandwiches with liquidation or arbitrage opportunities in the same transaction bundle

What Are the Advantages and Disadvantages of Sandwich Attacks?

AdvantagesDisadvantages
Price discovery efficiency (for markets): sandwich attacks can theoretically contribute to faster price discovery by correcting temporary AMM mispricing through arbitrageDirect financial loss to users: victims receive fewer tokens than they would without the attack, effectively paying a hidden tax of 0.1% to 2% or more on every sandwiched trade
Market awareness: the existence of sandwich attacks has driven awareness of MEV and transaction privacy, leading to the development of better infrastructure like Flashbots ProtectErosion of DeFi trust: sandwich attacks undermine user confidence in DeFi by demonstrating that ordinary users are systematically disadvantaged compared to sophisticated bot operators
Innovation catalyst: the threat of sandwich attacks has accelerated innovation in private mempools, MEV redistribution, and DEX design improvementsNetwork congestion: sandwich bot activity adds transaction volume to the blockchain, increasing gas prices for all users and competing for block space
Validator revenue: sandwich attack tips contribute to validator and block builder revenue, improving the economic security of Proof-of-Stake networksWealth concentration: MEV extraction funnels value from ordinary users to a small number of sophisticated bot operators and infrastructure providers
Exposed systemic weakness: sandwich attacks revealed fundamental design flaws in AMM architectures, pushing the industry toward better solutionsBarrier to adoption: new users who experience worse-than-expected trade execution may abandon DeFi, stunting ecosystem growth
Research advancement: academic study of sandwich attacks has deepened the understanding of economic mechanism design in decentralized systemsCentralization pressure: MEV infrastructure (block builders, relays) has become increasingly centralized, with a small number of entities controlling the majority of block production

How Do You Manage Sandwich Attack Risk?

Slippage protection: set slippage tolerance as low as practically possible (0.1% to 0.5%) for liquid token pairs. Lower slippage tolerance makes sandwich attacks unprofitable because the attacker’s front-run would cause the victim’s trade to revert. Mitigation: use the “auto” slippage setting in DEX interfaces like Uniswap, which calculates the minimum tolerance needed based on current pool volatility. Be aware that setting slippage too low can cause legitimate trades to fail during volatile market conditions.

Private transaction submission: use private mempool services like Flashbots Protect, MEV Blocker, or Securerpc to submit transactions directly to block builders without exposing them in the public mempool. Mitigation: configure your wallet’s RPC endpoint to point to a private relay instead of the default public Ethereum RPC. Understand that private transaction services do not guarantee execution and may have slightly longer confirmation times.

Trade splitting and timing: split large trades into multiple smaller transactions to reduce per-trade price impact and make sandwiching less profitable. Use DEX aggregators like 1inch or CowSwap that route trades across multiple liquidity sources, reducing the price impact on any single pool. Time trades during periods of lower network activity to reduce exposure to mempool scanning bots.

DEX selection: use DEXes with built-in MEV protection, such as CowSwap (which uses batch auctions to eliminate front-running) or DEXes on L2 networks with centralized sequencers. Consider using limit orders instead of market swaps on DEXes that support them, since limit orders specify an exact execution price and cannot be sandwiched. Monitor for new DEX designs that implement encrypted mempools, time-weighted average pricing, or other anti-MEV mechanisms.

Monitoring and detection: use tools like EigenPhi, Flashbots Explorer, or MEV Inspect to check if your past transactions have been sandwiched. Verify that the tokens received match your expected output after each swap; significant discrepancies may indicate a sandwich attack. Set up alerts for unusual slippage patterns across your trading activity.

Why Do Sandwich Attacks Matter Culturally?

Sandwich attacks have become one of the most discussed and controversial topics in the DeFi ecosystem, representing a flashpoint in the broader debate about the fairness and accessibility of decentralized finance. The discovery and proliferation of sandwich attacks shattered the naive assumption that DEX trading was inherently fairer than centralized exchange trading, revealing that blockchain’s transparency could be weaponized against ordinary users.

“In DeFi, being transparent is a liability. Every pending transaction is a signal, and signals get exploited.” A common sentiment among MEV researchers.

The term “getting sandwiched” has entered the DeFi vernacular as a common expression of frustration, with users sharing screenshots of sandwich attacks on their trades as cautionary tales on social media and Discord. The phrase carries emotional weight, as it encapsulates the feeling of being helplessly exploited by a system that was supposed to be trustless and fair.

The rise of sandwich attacks gave birth to an entirely new industry: the MEV ecosystem. Organizations like Flashbots were founded specifically to address the negative externalities of MEV extraction, developing open-source tools for fair transaction ordering and MEV redistribution. The MEV supply chain, spanning searchers (bot operators), block builders, and validators, has become one of the most sophisticated and economically significant subsystems in the Ethereum ecosystem.

Culturally, sandwich attacks have also sparked philosophical debates about the nature of decentralized markets. Proponents of MEV extraction argue that it is a natural consequence of free markets and that arbitrage, including sandwiching, ultimately improves market efficiency. Critics counter that sandwich attacks are parasitic, extracting value from users who lack the technical sophistication to protect themselves.

The “dark forest” metaphor, popularized by Dan Robinson and Georgios Konstantopoulos in their 2020 essay “Ethereum is a Dark Forest,” captured the reality that the Ethereum mempool is a hostile environment where any exposed transaction is prey for sophisticated predators. This metaphor resonated deeply with the DeFi community and has become a foundational concept in blockchain security thinking.

What Are Some Real-World Examples of Sandwich Attacks?

Uniswap V2 Large Swap Sandwich

Scenario: A DeFi user attempts to swap 50 ETH for a newly launched meme token on Uniswap V2, setting a 2% slippage tolerance due to the token’s volatility.

Implementation: A sandwich bot detects the 50 ETH swap in the mempool, calculates that the trade will move the price by approximately 3% on the relatively shallow liquidity pool, and constructs a front-run buy of 20 ETH worth of the token, followed by a back-run sell after the victim’s trade further inflates the price. The bot submits both transactions as a Flashbots bundle with a tip to the block builder.

Outcome: The victim receives roughly 1.8% fewer tokens than they would have without the sandwich, still within their 2% tolerance, so the trade does not revert. The attacker profits after gas costs and builder tips. The entire attack is invisible to the victim unless they inspect the block’s transaction ordering on a block explorer.

jaredfromsubway.eth: A Persistent Sandwich Bot

Scenario: Since early 2023, an Ethereum address labeled jaredfromsubway.eth has been one of the most prolific sandwich attackers in Ethereum history, and by late 2025 it accounted for roughly 70% of all sandwich attacks tracked by researchers.

Implementation: The bot spent over $7 million in gas fees in a single month (April 2023) while extracting millions in sandwich profits, targeting primarily meme token trades on Uniswap V2 and V3 pools with lower liquidity, where price impact was highest. By 2025, the bot’s successor version had evolved to target up to four victims at once within a single sandwich and to manipulate liquidity directly to widen its profit margin.

Outcome: jaredfromsubway.eth became a symbol of the MEV problem in DeFi, sparking widespread media coverage, community outrage, and renewed calls for anti-MEV infrastructure. Its continued dominance years later illustrates how much of the sandwich attack landscape is now driven by a small number of highly optimized, persistent operators rather than a broad field of casual bots.

CowSwap Batch Auction Defense

Scenario: A DeFi protocol’s treasury management team needs to execute a $2 million token swap and is concerned about sandwich attacks on such a large trade.

Implementation: Instead of swapping directly on Uniswap, the team uses CowSwap, which employs a batch auction mechanism. CowSwap collects multiple users’ swap orders off-chain, matches them peer-to-peer where possible (eliminating AMM price impact), and only routes the remaining volume to on-chain DEXes. The batch auction settles as a single on-chain transaction, with a solver, not the user, submitting the transaction, preventing mempool exposure.

Outcome: The $2 million swap executes with no sandwich attack exposure. CowSwap’s solver finds a partial peer-to-peer match for a portion of the order and routes the remainder across multiple DEXes to minimize price impact. The treasury receives more tokens than it would have on a direct Uniswap trade with typical sandwich exposure.

Layer-2 Sequencer Protection

Scenario: An active DeFi trader migrates their trading activity from Ethereum mainnet to Arbitrum after experiencing repeated sandwich attacks that cost them thousands of dollars over several months.

Implementation: Arbitrum uses a centralized sequencer that processes transactions on a first-come, first-served basis, with no public mempool for pending transactions. The sequencer receives transactions directly and orders them by arrival time, eliminating the transaction ordering manipulation that sandwich attacks depend on.

Outcome: The trader’s swap execution improves significantly on Arbitrum, with trades consistently executing at or near the expected price. While the centralized sequencer introduces its own trust assumption, the sequencer operator could theoretically sandwich users, major L2 sequencer operators have not engaged in MEV extraction in practice, and decentralization roadmaps aim to eliminate this trust requirement over time.

How Does a Sandwich Attack Compare to Other MEV Strategies?

FeatureSandwich AttackFront-RunningBack-RunningJust-in-Time (JIT) Liquidity
Attack StructureFront-run plus victim trade plus back-run (3 transactions)Attacker trade executes before victim’s trade (2 transactions)Attacker trade executes after target trade (2 transactions)Liquidity added before trade, removed after (3 transactions)
Profit SourcePrice impact manipulation around victim’s tradeCapturing opportunity before victim executesCapturing arbitrage opportunity created by target tradeEarning concentrated swap fees from victim’s trade
Victim AwarenessLow; loss is hidden within slippage toleranceModerate; victim may notice unexpected price movementNone; victim is not directly harmedLow; victim gets slightly better price but LP fees are captured
Typical Profit per AttackSmall to significant, depending on trade size and pool depthSmall to significantSmall to moderateSmall to significant
Defense MechanismPrivate mempools, low slippage, batch auctionsPrivate mempools, commit-reveal schemesLimited; back-running is generally considered benignNot considered harmful; provides better liquidity
Ethical AssessmentWidely considered parasitic and harmfulConsidered unethical; directly front-runs usersMixed; may improve market efficiencyGenerally considered neutral or beneficial
Prevalence on EthereumHigh; tens of thousands of attacks per monthHigh; common across all MEV strategiesHigh; common complement to other MEV strategiesModerate; requires significant capital

Related Terms

  • Maximal Extractable Value (MEV): the total value that can be extracted by block producers through transaction ordering, inclusion, or censorship, of which sandwich attacks are one of the most common extraction methods
  • Front-Running: the practice of executing a transaction ahead of a known pending transaction to profit from the predictable price movement, forming the first half of a sandwich attack
  • Automated Market Maker (AMM): a DEX mechanism that uses mathematical formulas and liquidity pools instead of order books to determine token prices, and whose deterministic price impact creates the vulnerability exploited by sandwich attacks
  • Flashbots: an R&D organization dedicated to mitigating the negative externalities of MEV, providing tools like Flashbots Protect that allow users to submit transactions privately to avoid sandwich attacks
  • Slippage Tolerance: the maximum acceptable difference between the expected and actual execution price of a trade, which defines the upper bound of how much value a sandwich attacker can extract from a single trade
  • Mempool: the pool of unconfirmed transactions waiting to be included in a block, whose transparency on Ethereum enables sandwich bots to detect and target pending trades
  • Proposer-Builder Separation (PBS): the Ethereum architecture that separates block proposal from block construction, within which sandwich attack bundles are submitted to specialized block builders for inclusion
  • CowSwap: a DEX protocol that uses batch auctions and intent-based trading to protect users from sandwich attacks by matching trades off-chain before settling on-chain
  • Flash Loan: an uncollateralized loan that must be borrowed and repaid within a single transaction, sometimes used by sandwich attackers to amplify their attack capital without upfront funds
  • Dark Forest (Ethereum): a metaphor describing the hostile nature of the Ethereum mempool environment, where any visible transaction can be exploited by sophisticated predators, including sandwich bots

Frequently Asked Questions About Sandwich Attacks

How much money have sandwich attacks extracted from DeFi users in total? Sandwich-specific cumulative extraction on Ethereum is estimated in the hundreds of millions of dollars since AMM-based DEX trading took off, according to research from EigenPhi and other MEV analytics firms. Total MEV extraction across all strategies (arbitrage, liquidations, and sandwiching) and multiple chains has crossed $1 billion cumulatively, though sandwich attacks specifically make up a smaller share of that total. Extraction has also been trending downward through 2025 as more traders adopt MEV-protection tools, even as the number of individual attacks has stayed high.

How can I protect myself from sandwich attacks? The most effective protection is to use a private transaction relay like Flashbots Protect, which hides your transaction from the public mempool. Additionally, set your slippage tolerance as low as possible, use DEXes with built-in MEV protection like CowSwap, trade on Layer-2 networks with centralized sequencers, and consider splitting large trades into smaller transactions.

Are sandwich attacks illegal? Sandwich attacks occupy a legal gray area. They are not explicitly illegal in most jurisdictions because they operate within the permissionless rules of blockchain protocols; there is no law against submitting transactions to a public network in a particular order. However, they share characteristics with front-running in traditional finance, which is illegal in regulated securities markets. As cryptocurrency regulation evolves, the legal status of MEV extraction, including sandwich attacks, may change.

Can sandwich attacks happen on Layer-2 networks like Arbitrum or Optimism? Current major Layer-2 networks like Arbitrum and Optimism use centralized sequencers that process transactions in first-come-first-served order without a public mempool, which largely prevents traditional sandwich attacks. However, the sequencer operator could theoretically conduct sandwiching, though major operators have not done so. As L2s decentralize their sequencer sets, new MEV dynamics may emerge that could reintroduce sandwich attack opportunities.

Why does setting a lower slippage tolerance protect against sandwich attacks? Slippage tolerance defines the maximum price degradation you will accept. A sandwich attacker’s front-run increases the price before your trade executes. If the combined price impact of the front-run and your trade exceeds your slippage tolerance, your transaction automatically reverts, meaning the attacker cannot profit. By setting slippage to 0.1% to 0.5%, you make most sandwich attacks unprofitable because the attacker cannot front-run enough volume to be profitable without causing your trade to revert.

What is the difference between a sandwich attack and regular front-running? Front-running involves placing a single transaction ahead of a victim’s trade to capture a profitable opportunity. A sandwich attack is a more sophisticated two-part strategy: the attacker places a transaction both before (front-run) and after (back-run) the victim’s trade. The front-run artificially worsens the victim’s execution price, while the back-run allows the attacker to sell at the inflated price, capturing the spread. Sandwiching guarantees the attacker a profit from the price manipulation, whereas simple front-running may not.

Do MEV protection tools completely eliminate sandwich attack risk? Private relay tools significantly reduce sandwich attack risk by keeping your transactions out of the public mempool, but they do not provide absolute protection. Block builders who receive private transactions could theoretically sandwich them, though reputation systems incentivize honest behavior. Additionally, some transactions may still be exposed during propagation, and private relay services may have slightly longer inclusion times. Using multiple layers of protection, private mempools, low slippage, and MEV-resistant DEXes, provides the strongest defense.

Sources

Latest Resources and Blogs