What Is a Sandwich Attack? MEV Exploit in DeFi Trading

What Is a Sandwich Attack?

A Sandwich Attack is a type of MEV (Miner Extractable Value) exploit where an attacker places two transactions around a victim’s transaction to profit from price movement.

The attacker’s transactions “sandwich” the victim’s trade:

One transaction is executed before the victim
Another transaction is executed after the victim

This manipulation causes the victim to receive a worse price, while the attacker captures the profit.

Why Sandwich Attacks Exist

Sandwich attacks exist because:

Transactions in public blockchains are visible in the mempool
DEX prices are affected by order size and execution order
Miners/validators or bots can control transaction ordering
Automated Market Makers (AMMs) are price-impact sensitive

They are most common in DeFi trading environments.

How a Sandwich Attack Works

Victim Transaction Detected:
- A large swap is detected in the mempool
Front Transaction (Buy):
- Attacker buys the token before the victim, increasing price
Victim Transaction Executes:
- Victim buys at a worse price due to slippage
Back Transaction (Sell):
- Attacker sells the token after the victim, capturing profit

Core Components of a Sandwich Attack

Component	Role
Attacker / Bot	Executes front and back transactions
Victim	Trader whose transaction is exploited
Mempool	Reveals pending transactions
AMM (DEX)	Price adjusts based on trade order
Slippage	Enables profit extraction
MEV	Underlying incentive mechanism

Sandwich Attack vs Front-Running

Feature	Sandwich Attack	Front-Running
Number of Transactions	Two (before & after)	One (before only)
Price Manipulation	Yes (intentional)	Often indirect
Profit Potential	Higher	Moderate
User Impact	Severe slippage	Moderate slippage
MEV Dependency	High	High

Where Sandwich Attacks Occur

Decentralized Exchanges (Uniswap, SushiSwap)
Low-liquidity trading pairs
Large swap transactions
High-slippage tolerance trades

Advantages for Attackers

✅ Highly profitable under correct conditions
✅ Fully automated via MEV bots
✅ Exploits predictable AMM pricing
✅ No protocol permissions required

Risks and Negative Effects

⚠️ Causes financial loss for users
⚠️ Increases gas fees and network congestion
⚠️ Reduces trust in DeFi platforms
⚠️ Encourages centralization of MEV power

How Users Can Protect Themselves

Set low slippage tolerance
Avoid large single swaps
Use MEV-protected RPCs (e.g. Flashbots Protect)
Trade during low congestion periods
Use limit orders where available

How Protocols Mitigate Sandwich Attacks

Batch auctions instead of instant swaps
Private transaction relays
Fair ordering mechanisms
MEV-aware AMM designs

Frequently Asked Questions (FAQ)

What is a sandwich attack?
A DeFi exploit where an attacker places trades before and after a victim to profit from price movement.

Who performs sandwich attacks?
MEV bots, traders, or validators monitoring the mempool.

Are sandwich attacks illegal?
In DeFi, they are generally allowed but considered exploitative and harmful.

Can sandwich attacks be prevented?
They can be reduced using MEV protection tools and better protocol design.

Conclusion

Sandwich Attacks are one of the most damaging MEV-based exploits in DeFi, exploiting transaction transparency and AMM pricing mechanics.

Understanding sandwich attacks helps users protect their trades and developers design safer, fairer decentralized exchanges, improving the long-term sustainability of DeFi ecosystems.