MEV and Sandwich Attacks: Ordering Has Value

When a transaction is broadcast, it usually sits visible in a public pool before being included in a block. Anyone can read it. Whoever builds the next block decides what goes in and in what order.

Those two facts together mean ordering has value, and the business of capturing that value has a name.

Where the Value Comes From

A block is an ordered list. Execution follows that order, so the state each transaction sees depends on what ran before it.

A large swap moves a price. A transaction placed immediately before it trades at the old price; one placed immediately after trades at the new one. The right to choose those positions is worth something, and it is sold.

The ecosystem that grew around this has specialists who find profitable orderings, builders who assemble blocks from them, and validators who publish the blocks. The value extracted is shared along that chain.

The Sandwich

The sandwich is the form that takes money directly from an ordinary user.

The attacker observes a pending swap large enough to move the price. They insert a buy of the same asset immediately before it, pushing the price up. The victim’s swap then executes against that worse price. The attacker sells immediately after, into the price the victim’s trade created.

The victim receives fewer tokens than they expected. The shortfall is the attacker’s profit, less fees.

Nothing was hacked and no permission was abused. The victim’s transaction did exactly what it said, at a price the victim had already agreed to accept.

Slippage Is the Lever

That last point is the important one. A swap specifies a minimum acceptable output, derived from the slippage tolerance. If the executed price would deliver less than that minimum, the transaction reverts.

So the attacker can only move the price as far as the tolerance allows. A tolerance set generously, to avoid failed transactions, is an explicit statement of how much value may be taken.

Setting slippage high because transactions kept failing is the most common way users expose themselves. See slippage for how the tolerance interacts with liquidity.

What Reduces Exposure

Tighten slippage. It is the direct control, and reverted transactions are cheaper than sandwiched ones.

Trade in smaller pieces. A swap too small to move the price meaningfully offers nothing worth taking.

Prefer deeper liquidity. The same trade moves the price less where there is more depth, which shrinks the window. See liquidity pools.

Use private order flow where the wallet or interface offers it. The transaction goes to builders directly rather than being broadcast publicly, so searchers watching the public pool never see it.

The trade-off there is real. Privacy from the public pool is bought by giving a specific party advance sight of the transaction, and that party’s incentives and policies are now part of your threat model. It is a change in who can see it, not a removal of visibility.

MEV That Is Not Predatory

Not all of this harms users.

Arbitrage between venues corrects price differences and is the mechanism that keeps prices roughly consistent across the market. Liquidations of undercollateralised positions keep lending protocols solvent and are necessary for those systems to function.

Both are forms of extractable value and both are captured competitively by the same participants. What distinguishes sandwiching is that it depends on inserting transactions around a specific user’s trade in order to worsen their price.

Why It Is Hard to Eliminate

The visibility of pending transactions is a property of an open network. Ordering authority within a block has to sit somewhere. Together they make ordering valuable, and value gets captured.

Approaches exist to reduce it: encrypted mempools that hide contents until ordering is fixed, batch auctions that execute many trades at one price, and application designs that do not expose a price-moving transaction in advance. Each shifts the problem rather than removing it, and each introduces its own assumptions about who is trusted.

For a user, the practical controls remain slippage, size, venue depth, and routing.

What People Get Wrong About This

The first mistake is raising slippage until transactions stop failing. That setting is the attacker’s budget.

The second is believing a sandwich requires something to be broken. It requires only a public pending transaction and a tolerance with room in it.

A third is treating private routing as complete protection. It changes who sees the transaction.

A fourth is assuming small trades are targeted. They are not worth the fee to attack, which is why splitting a large trade helps.

And the last is confusing this with an ordering problem inside your own account. That is the nonce, and it is a different mechanism entirely; see nonce and transaction order.