The Fill That Was Arranged: Reading Transaction Order to Find an MEV Sandwich
The challenge
Vertex Desk swapped 40 WETH for ORCA on a public router. The quote on screen said roughly 118,000 ORCA. The fill came back at 104,880, eleven percent worse, and the desk wants to know who took the difference. Here are the router's swap events from four consecutive blocks, in the order the chain executed them: block first, then position inside that block. The desk wallet is 0x4d81ac9f2b7e61d0cc35a84f19e7b2065da3f7c8. Somebody paid fifteen times the going gas price to be standing on both sides of that trade. Name their address.
What you'll learn
- Read block and intra-block position as the ordering that decides a trade's price
- Identify the buy, victim, sell pattern of a sandwich attack in raw swap events
- Use an abnormal gas price as the signal that ordering was purchased
- Separate a sandwich from ordinary arbitrage that happens to buy and sell
- Explain why slippage tolerance, not the router, is what makes the attack profitable
Skills tested
Prerequisites
- What a token swap on an automated market maker is
- That transactions in a block have an order
How it works
On a constant product market maker the price you get is decided by the state of the pool at the instant your transaction executes, and that instant is decided by where your transaction lands in a block. Both of those are public before they happen. A pending swap sits in the mempool announcing its size and the worst price it will accept, which is everything somebody needs to work out how much they can move the price against you and still have you go through with it.
A sandwich is three transactions in one block. The attacker buys first, which pushes the price up. Your order executes against the pool they just moved, so you pay more and receive less. Then they sell into the demand your own order created, and the pool returns to roughly where it started. Their profit is the difference, and it comes out of your fill.
Position in the block is bought, not negotiated. Paying a large gas premium on both legs is what guarantees one lands in front of you and one lands behind, which is why an outlier gas price next to an ordinary trade is the loudest signal in this data. Your slippage tolerance sets the ceiling: it tells the attacker exactly how much they may take before your transaction reverts and they get nothing.
Common mistakes
- Answering 0xa83c15e0. It buys and sells in the same block, but at positions 06 and 71 with nothing large between them and no gas premium. That is arbitrage, not a sandwich.
- Answering 0xb27f604c. It sells and then buys, in block 21594117. The order is backwards, and a sandwich only works in one direction.
- Answering 0x6e0472bd. It pays the same 341 gwei in block 21594119, but only has one leg. High gas alone is not the attack.
- Filtering by sender and stopping. The attacker also makes an ordinary small trade in block 21594116, so their history on its own looks unremarkable.
- Reading the timestamps. Every transaction in a block shares one timestamp. Only
postells you what executed first.
How to defend against it
The desk cannot stop other people from reordering a public queue, so the fix is to make the reordering unprofitable.
- Set slippage to the smallest tolerance the trade can survive. A 40 WETH order with loose slippage is an invitation with the maximum written on it.
- Split large orders across blocks or route them through an aggregator that splits automatically. A sandwich on a small clip is not worth the gas.
- Send the order through a private transaction relay so it never appears in the public mempool before it executes.
- Check fills against quotes automatically and alert on the gap. The desk found this one because somebody happened to look at the number.