Sandwich attacks may not be as popular in the crypto space as other common DeFi hacks and scams, such as rug pulls or flash loan attacks. However, their deceitful nature makes them troublesome for the DeFi ecosystem, especially for trading platforms.

In this article, we’ll see what a sandwich attack is, how it works, and how you can avoid it.

What is a Sandwich Attack?

In DeFi markets, a sandwich attack is a form of market manipulation on Decentralized Exchanges (DEXs). It involves a malicious actor who identifies a large pending transaction and then carefully places two transactions around it: one before and the other after the targeted transaction.

The attacker purchases the asset before a significant transaction, which increases its price, and then sells it right after the transaction at a higher price, making a substantial profit from the price difference.

The impact of a sandwich attack on your trades can vary based on network liquidity. In low liquidity environments, even a small front-run buy can significantly affect the price, forcing the targeted transaction to execute at a higher price. In contrast, high liquidity environments require more capital to move the price, making sandwich attacks more costly for the attacker.

How Does a Sandwich Attack Work?

Consider a trader who wants to trade digital asset X for asset Y and places a large purchase order. This order is then broadcast to the blockchain and temporarily sits in the mempool awaiting block confirmation.

A trading bot detects this pending transaction and executes a front-run transaction by buying asset Y before confirming the original transaction. This purchase increases the price of asset Y and pushes the slippage tolerance to its maximum.

As a result, the trader unknowingly buys asset Y at a higher price. The trading bot then back-runs and sells asset Y at this inflated price, profiting from the difference.

A simple example…

Placing these two orders around pending transactions aims to manipulate asset prices.

First, the attacker buys the asset the user is swapping to—such as using LINK to exchange for ETH—knowing that the price of ETH will rise. The attacker purchases ETH at a lower price, causing the victim to buy it at a higher value. The attacker then sells ETH at this elevated price.

This transaction sandwiching reduces the amount of ETH the initial user will receive. The subsequent trade becomes more expensive as the attacker fills their order at a favorable price. This sequence causes the ETH price to increase, allowing the attacker to profit by front- and back-running the trader and creating an artificial price spike.

How to Avoid Sandwich Attacks and Protect Yourself?

• Set a Low Slippage

Slippage is the difference between expected and actual transaction prices in volatile crypto markets. Think of it like a rollercoaster, where prices can rapidly change. By setting a low slippage, your transaction will only execute if the token price remains within a narrow range. If an attacker tries to orchestrate the price beyond your tolerance, your order will be canceled, protecting your tokens.

• Use Larger Liquidity Pools

Choose larger liquidity pools for your transactions. These pools provide trading stability by minimizing price fluctuations from individual trades. Manipulating a large liquidity pool requires substantial capital, acting as a deterrent against attackers.

• Paying Higher Gas Fees

Consider paying higher gas fees for larger trades. While it increases the cost, it accelerates your transaction, making it more expensive for attackers to front-run. This added security measure can help protect your assets.

• Use Telegram Bots

Telegram crypto bots can automate and quickly execute trades. Some bots have features to protect against sandwich attacks by hiding transaction details until execution, preventing malicious bots from front-running. However, be cautious, as bots can access your private keys, posing security risks.

• Use a Private RPC Network

A private RPC network conceals your pending transactions from potential attackers, preventing them from scanning the mempool for targets. This adds a layer of confidentiality to your trades.

• Run Your Own Node

Running your node gives you greater control over transactions, reducing your reliance on other platforms. You can submit your transactions directly and control their processing and timing.

• MEV Blocker

MEV Blocker is a free RPC endpoint designed to protect your trades from MEV attacks. It directs your transaction to a network of searchers who can identify back-running opportunities but are unable to front-run your trades. You can increase your trade security by integrating MEV Blocker into your wallet.

• Flashbots

Flashbots is a research organization dedicated to fair trading practices. Integrate them into your wallet to shield against front-running by MEV bots and benefit from features like transaction prevention.

Solana Foundation’s Strict Action Against Sandwich Attack

The Solana Foundation has expelled a group of validator operators from its delegation program for their involvement in sandwich attacks on users. Solana Validator Relations Lead Tim Garcia announced the decision on Discord. The decision is final, and ongoing actions will target more such operators. Mert Mumtaz, co-founder of Solana RPC provider Helius, highlighted that this move protects retail users from validators exploiting MEV (Maximal Extractable Value) practices. 

MEV issues arise when validators manipulate transaction ordering for profit, including front-running and sandwich attacks. These exploits lead to higher costs and slippage for users. The foundation’s action underscores its commitment to user protection and network integrity. Sandwich attacks involve an attacker placing transactions around a victim’s transaction to manipulate prices for profit.

Previously, the Solana Foundation set rules against such attacks in a May 7 Discord post by Garcia, warning that violators would be expelled from the program and lose their stake. The Solana Foundation Delegation Program supports validators by delegating SOL tokens to them based on performance and adherence to good practices.

Although expelled operators can still participate in the blockchain as Solana is a permissionless network, they will no longer receive SOL staked by the foundation.

Disclaimer: Cryptocurrency is not a legal tender and is currently unregulated. Kindly ensure that you undertake sufficient risk assessment when trading cryptocurrencies as they are often subject to high price volatility. The information provided in this section doesn't represent any investment advice or WazirX's official position. WazirX reserves the right in its sole discretion to amend or change this blog post at any time and for any reasons without prior notice.