What is a sandwich attack?#
Last modified: August 10, 2026
A sandwich attack is a form of MEV, or maximal extractable value, where an attacker places one transaction before your swap and one after it to profit from the price movement your swap creates.
What it looks like#
You submit a swap for a token in a small pool and expect to receive about 1,000 tokens. While your transaction is pending, an attacker buys first, pushing the price up. Your swap fills at the worse price and you receive 930 tokens. The attacker then sells after you, capturing the price difference. Nothing in your wallet was hacked, but your execution was worse because of transaction ordering.
How a sandwich attack works#
- You submit a swap, and it is pending confirmation in the public mempool.
- An attacker sees the pending swap and predicts that it will push the token's price up.
- The attacker buys first. This is called front-running.
- Your swap completes at the now-higher price, so you receive fewer tokens than expected.
- The attacker sells at the higher price. This is called back-running.
These attacks are possible because of price slippage, thin liquidity, and the public visibility of pending transactions.
How to reduce the risk#
- Use deeper liquidity pools. Attackers target small pools because a swap moves the price more there.
- Use swap protection if available. It is designed to reduce exposure to front-running and sandwich attacks by changing how a swap is routed or submitted.
- Set an appropriate slippage limit. If the price moves beyond your limit, the transaction should revert rather than fill at a much worse price.
- Be cautious with large swaps in new or thin pools. Splitting a swap can reduce price impact, but it may also create more transactions and network costs.
A slippage limit and swap protection can reduce risk, but they do not guarantee the best possible execution.