Crypto Sandwich Attack: How MEV Works and How to Avoid It

A crypto sandwich attack is a form of MEV (Maximal Extractable Value) exploitation that can cause users to lose value when swapping tokens on a  decentralized exchange (DEX). In this attack, a bot exploits transaction ordering to move the price before a user's swap is executed, then profits after that transaction is completed. As a result, the user may receive fewer tokens than they otherwise would, even though the transaction succeeds.

The problem is that losses from sandwich attacks are not always easy to identify. The price difference may initially look like ordinary slippage, especially when markets are moving quickly. In reality, an MEV bot may have deliberately exploited the transaction. So how does this attack work, and what can users do to reduce the risk?

Key Takeaways

• Sandwich attacks exploit transaction ordering to give DEX users a worse swap execution price.
• MEV bots combine front-running and back-running to profit from price movements.
• Setting appropriate slippage limits, choosing sufficiently liquid pools, and using MEV protection can help reduce the risk of an attack.

What Is a Crypto Sandwich Attack?

A sandwich attack is a transaction-manipulation strategy on the  blockchain in which an attacker places two of their own transactions around a user's transaction.

The term sandwich refers to the sequence of transactions. The attacker executes the first transaction, the victim's transaction is then processed, and finally the attacker executes a second transaction to close the position.

This pattern is commonly found in token trading on DEXs that use  automated market makers (AMMs).

Unlike phishing or private-key theft, a sandwich attack does not require direct access to the victim's wallet. Instead, the attacker exploits how transactions are processed and how token prices change within a liquidity pool.

That is what makes this attack difficult for ordinary users to detect. The tokens still arrive in their wallets, but the amount received may be smaller than it would have been without the manipulation.

Related article: What Is Fraction AI (FRAC)? Exploring the Decentralized AI Agent Platform

What Is MEV in Crypto, and How Does It Relate to Sandwich Attacks?

MEV stands for Maximal Extractable Value, the additional value that can be extracted by influencing which transactions are included in a blockchain block or the order in which they are processed.

In practice, transactions are not necessarily processed in the order in which users click the confirmation button.

Network mechanisms determine which transactions enter a block and in what order. On some blockchains, this process involves validators, block builders, and participants seeking profit opportunities from transaction activity.

The latter participants are known as MEV searchers. They use software to monitor transactions and identify situations that can be exploited for economic gain.

Sandwich attacks are one form of MEV strategy that harms users because the attacker's profits come from deliberately worsening the victim's execution price.

Is All MEV Activity Harmful?

Not all MEV activity constitutes an attack.

For example, arbitrage allows traders to take advantage of differences in token prices between two markets. This activity can help bring prices across DEXs into alignment.

MEV also occurs during liquidations on DeFi lending protocols, when positions that no longer meet collateral requirements need to be settled.

Sandwich attacks are different. Attackers deliberately exploit users' transactions by moving the price before a swap is processed.

Therefore, although sandwich attacks are a form of MEV exploitation, not all MEV activity operates in the same way or necessarily harms users.

How Does a Sandwich Attack Work?

Imagine that you want to buy a token with ETH through a DEX.

Before you confirm, the platform displays an estimated number of tokens you will receive. However, once the transaction enters the network, the price can still change before the swap is executed.

Under certain conditions, a sandwich bot can take advantage of that change.

1. The User Submits a Swap Transaction

When a user submits a swap through a public transaction route on Ethereum, the transaction is usually visible in the mempool before confirmation.

The information includes details that allow others to estimate the trade's impact on the token's price.

An MEV searcher can then monitor pending transactions to identify profit opportunities.

2. The Bot Evaluates Potential Profit

Not every transaction is an attractive target.

Bots typically assess the swap size, liquidity depth, slippage tolerance, and transaction costs.

If the expected price movement is large enough, the transaction may become a target for a sandwich attack.

3. Front-Running Moves the Token Price

At this stage, the attacker attempts to place a buy transaction ahead of the user's transaction.

That purchase changes the balance of assets in the liquidity pool, pushing up the price of the token the victim intends to buy.

By the time the user's transaction is processed, the token price is already higher than the initial quote.

4. The Victim's Transaction Is Executed

The user then purchases tokens at the altered price.

As long as the amount received meets the minimum set by the user's slippage tolerance, the transaction can still succeed.

This is the point at which the victim receives a worse swap outcome than they would have without the attack.

5. Back-Running Closes the Bot's Position

After the user's swap is completed, the attacker sells the tokens purchased earlier.

The goal is to profit from the price difference after accounting for transaction fees and trading costs.

However, this strategy is not always profitable. Competition among attackers, network fees, and changes in transaction ordering can also cause an attack to fail.

In simple terms, the sandwich attack sequence can be illustrated as follows:

Bot buys tokens → User's swap executes at a higher price → Bot sells the tokens.

Related article: What Is DAC Chain (DACT)? Quantum-Secure Blockchain and Its Uses

Example of a Sandwich Attack During a Token Swap

To make this easier to understand, imagine a trader wants to swap US$1,000 for Token A on a DEX.

Before the transaction is submitted, the platform estimates that US$1,000 will yield 100 Token A.

However, a bot succeeds in placing a buy order first, pushing up the price of Token A. When the user's swap is executed, the amount received falls to 97 Token A.

This example is for illustration only and does not represent a real blockchain transaction. It assumes fees and other factors remain unchanged.

In this illustration, the user misses out on three additional tokens. In other words, the swap output is 3% lower than the original estimate.

The swap can still succeed if the user's minimum acceptable output allows for receiving 97 Token A.

However, the three-token difference does not mean the attacker pockets its full value. The sandwich bot's net profit still depends on trading fees, gas fees, and price movements during execution.

This example shows why a transaction marked successful does not necessarily deliver a favorable execution price.

Related article: 10 Elysium Chain Tokens to Watch After Mainnet

Why Can Sandwich Attacks Happen on DEXs?

Decentralized exchanges allow users to trade assets directly through smart contracts without giving up custody of their assets to a centralized exchange.

However, these mechanisms have characteristics that MEV participants can exploit.

Three important factors explain why sandwich attacks can occur.

Transactions Are Visible Before Confirmation

On Ethereum, transactions submitted through public routes can generally be observed before they are included in a block.

This transparency supports an open network, but it also gives bots the opportunity to analyze pending transactions.

It is important to understand that not all blockchains use the same mempool mechanism. For example, the way transactions are propagated and ordered on Solana differs from Ethereum's public mempool model.

Therefore, sandwich attack risks must be assessed according to the characteristics of each network.

Token Prices Depend on Liquidity Pools

Many DEXs use AMMs to determine prices based on the balance of assets held in a liquidity pool.

When someone buys a token, the amount of that token in the pool decreases while the amount of the payment asset increases. This change in the pool's balance affects the price of subsequent trades.

The smaller the available liquidity relative to the trade size, the greater the potential price impact.

This is actually a normal part of how AMMs work. An attack occurs when someone deliberately exploits the resulting price movement by arranging transactions around another user's swap.

Slippage Allows Prices to Change

In crypto trading, slippage is the difference between the expected transaction outcome and the amount actually received.

DEXs usually provide a slippage tolerance setting that allows users to specify how much deviation from the estimated output they are willing to accept.

This setting is useful when prices move before a transaction is completed.

However, a tolerance that is too loose can give sandwich bots more room to worsen execution prices without causing the swap to fail.

That is why slippage should be adjusted to the token's liquidity and market conditions, rather than simply increased to make transactions go through quickly.

Related article: How to Earn on Elysium Chain: Reward Opportunities to Explore

How Do Sandwich Attacks Affect Crypto Traders?

The impact of a sandwich attack often does not appear as a direct deduction from a wallet balance. Instead, the loss comes from receiving a less favorable execution price.

Some of the most common effects include:

1. Fewer tokens received. Users receive a smaller swap output than they would have without the attack.
2. A higher effective purchase price. The value of the assets spent is not matched by the number of tokens obtained.
3. Reduced potential trading profits. Worse execution prices can reduce profits, especially on short-term trades.
4. Greater risk for low-liquidity tokens. Prices can move more easily when a pool lacks sufficient market depth.

Such losses may seem small in a single transaction but become more significant for users who swap frequently.

Therefore, evaluating the cost of trading on a DEX requires looking beyond gas fees and pool fees. The final execution outcome also determines how efficient a trade really is.

Who Is Most Vulnerable to Sandwich Attacks?

Sandwich attack risk depends not only on the platform being used but also on the characteristics of the transaction.

One particularly vulnerable situation occurs when the swap value is large relative to the pool's liquidity.

This situation is common when trading new tokens, memecoins, or assets that do not yet have deep markets.

High volatility can make matters worse. When prices move quickly, users sometimes set excessively high slippage tolerances to prevent their swaps from failing.

The combination of low liquidity, large transactions, and loose slippage tolerances can create more attractive opportunities for bots.

However, using a popular DEX does not automatically make every transaction safe or dangerous. Pool conditions, trade routing, and transaction protection remain important factors.

Related article: What Is QNTB? Quantinuum's Tokenized Stock and How It Works

How Can You Avoid Crypto Sandwich Attacks?

No method can guarantee the complete elimination of sandwich attack risk. Nevertheless, users can reduce their exposure by considering several factors before and after executing a swap.

1. Use a Reasonable Slippage Tolerance

Do not immediately increase your slippage tolerance just because a previous transaction failed.

A lower tolerance can limit how far the swap output deviates from the original estimate. With less room for price changes, the potential profit for sandwich bots may also decrease.

However, an excessively tight slippage tolerance also has drawbacks.

When prices move quickly, the transaction may fail because the tokens received would fall below the minimum acceptable amount. On some networks, a failed transaction may still incur gas fees.

There is no single slippage percentage that is always safe for every token or market condition.

2. Check Liquidity and Price Impact

Before confirming a swap, review the liquidity information and price impact shown by the platform.

Price impact indicates how much your trade is expected to move the price given the pool's current conditions.

If the impact is too high, consider comparing trading routes or finding a pool with more adequate liquidity.

Deeper pools can generally absorb trades with smaller price movements.

However, high liquidity does not guarantee that a transaction is completely protected from MEV.

3. Enable MEV Protection When Available

Some services offer transaction protection through private routes or specialized execution mechanisms.

One example is Flashbots Protect on Ethereum, which is designed to reduce transaction exposure to bots monitoring the public mempool.

Uniswap also offers swap protection features on supported products, while PancakeSwap provides MEV Guard in certain BNB Chain environments.

Such features can help reduce sandwich attack risk, but the scope of protection varies.

Before using them, check whether the service supports your wallet, blockchain, and transaction type.

Remember that a private RPC does not automatically guarantee protection against all forms of manipulation.

4. Adjust Your Trade Size

Large swaps can cause more significant price movements, especially in pools with limited liquidity.

Under certain circumstances, splitting a trade into smaller parts or using another execution method can help control price impact.

However, splitting swaps also has disadvantages.

Each additional transaction may incur network fees, and prices can change between transactions.

Therefore, consider the total cost and expected final outcome, not just the size of each individual transaction.

5. Review the Swap Result After Completion

After executing a swap, compare the estimated token amount with the amount actually received in your wallet.

If the difference is significant, review the price impact, slippage, and market conditions at the time of execution.

You can also use a blockchain explorer to inspect transaction details and other activity that occurred around the same time.

One pattern that may indicate a sandwich attack is the presence of related transactions immediately before and after your swap in the same pool.

However, a poor execution price alone does not prove that an attack occurred. A more detailed analysis of transaction ordering and changes in pool balances may be necessary.

Related article: SNXXB vs. SNDKB: Understanding Their Differences, Risks, and Potential

Are All MEV Bots Dangerous?

MEV bots often have a bad reputation because of sandwich attacks, but not all are used to harm traders.

Some bots carry out arbitrage to profit from price differences across DEXs. This activity can help prices in different markets move closer to equilibrium.

Other bots handle liquidations on DeFi lending protocols.

Even so, arbitrage and liquidation activity can also have negative effects, depending on how they are executed and on network conditions.

What distinguishes a sandwich bot is its strategy of deliberately profiting by making a user's transaction execution price worse.

For traders, the important thing is not to avoid all bot activity on blockchains but to understand execution risks and use available protections.

If you want to learn about crypto transaction security, DeFi risks, and blockchain technology developments, you can sign up for Bittime to access the latest market information and educational articles.

Conclusion

A crypto sandwich attack is a form of MEV exploitation that uses transaction ordering to profit from price changes on decentralized exchanges.

The attack involves the perpetrator's transactions being executed before and after a user's swap. As a result, the victim may receive fewer tokens even though the transaction succeeds.

The risk tends to be higher when liquidity is limited, swap values are relatively large, or slippage tolerances are too loose.

Users can reduce their risk by choosing adequately liquid pools, setting reasonable slippage tolerances, using MEV protection where available, and reviewing transaction execution results.

Understanding how the attack works is an important step toward evaluating DEX trades based not only on the price displayed on screen, but also on the quality of execution actually received.

Bittime is a licensed Digital Financial Asset Trader (PAKD) regulated and supervised by Indonesia's Financial Services Authority (OJK) — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from IDR 10,000. Registration is fast and secure, and you can get started today.

Track USDT to IDR conversions and real-time price movements for your favorite crypto assets. Everything is available in one crypto investment app that you can download for free from the Play Store.

Ready to get started? Sign up for Bittime now and put your investment strategy into action on a platform trusted by millions of users in Indonesia.

FAQ

What is a sandwich attack in crypto?

A sandwich attack is an MEV exploitation strategy in which an attacker places transactions before and after a user's swap to influence the price. As a result, the victim may receive a worse trading outcome while the attacker attempts to profit from the price difference.

How does an MEV bot work in a sandwich attack?

An MEV bot analyzes unconfirmed transactions to identify profit opportunities. In a sandwich attack, the attacker attempts to buy before the user's swap and sell the asset again after the victim's transaction has been executed.

Can sandwich attacks occur on Uniswap?

Yes. Sandwich attacks can occur in AMM-based trading when transaction conditions allow an attacker to influence execution prices. Risk can be reduced through available swap protection features, appropriate slippage settings, and pools with sufficient liquidity.

How can you avoid sandwich attacks when swapping tokens?

Check the price impact before trading, use an appropriate slippage tolerance, and select a liquidity pool with sufficient depth. If supported on your network, enable MEV protection or a private transaction route.

Can setting slippage prevent sandwich attacks?

A tighter slippage tolerance can limit changes in swap output and reduce opportunities for profitable attacks. However, it does not guarantee full protection and may cause transactions to fail when prices move too quickly.