If you have ever traded a new, highly volatile token on a decentralized exchange, you might have noticed a strange phenomenon. You click swap, the transaction goes through, but you end up receiving significantly fewer tokens than the screen originally promised you.

Many beginners think the decentralized exchange is broken or that the token itself is a scam. However, the reality is much more technical. You did not experience a glitch. You were likely the victim of an invisible, highly automated trading strategy known as a sandwich attack.

In the world of Maximal Extractable Value (MEV), sandwich attacks are the most common and arguably the most predatory tactic used by algorithmic trading bots. In this comprehensive guide, we are going to explore exactly what a sandwich attack is, how the bots pull it off in the mempool, and the specific steps you must take to protect your wallet.

1. The Invisible Tax of Decentralized Finance

Before we dissect the attack itself, we need a quick refresher on how decentralized exchanges (DEXs) like Uniswap operate. Unlike traditional stock markets that use a central order book to match buyers and sellers, a DEX uses Automated Market Maker (AMM) smart contracts.

These smart contracts hold a pool of two different tokens, such as Ethereum and USDC. The price of the token is determined entirely by the ratio of those two assets inside the pool. If someone buys a massive amount of Ethereum from the pool, the supply of Ethereum drops, and the price automatically goes up for the very next buyer.

Because the blockchain is completely public, trading bots constantly monitor the mempool waiting room. They are looking for users who are about to make large purchases. When a bot spots a large, pending transaction, it knows that the victim's purchase is going to push the price of the token higher. The bot then executes a perfectly timed, three-step maneuver to steal a tiny slice of profit from the victim.

2. The Three Ingredients of a Sandwich Attack

A sandwich attack gets its name because the attacker places their own transactions directly before and directly after the victim's transaction. Let us look at the three layers of this digital sandwich.

The Top Bun: The Front-Run Buy

The MEV bot sees your pending transaction in the public mempool. It immediately creates its own transaction to buy the exact same token you are trying to buy. To ensure the network validators process the bot's transaction first, the bot pays a massively inflated gas fee. This allows the bot to jump the line and buy the token at the current, lower price.

The Meat: Your Transaction

Because the bot just bought a large chunk of the tokens from the pool, the price of the token has now increased. Your transaction is processed next. You are forced to buy the token at this new, artificially inflated price. Because the price is higher than you expected, your money buys fewer tokens.

The Bottom Bun: The Back-Run Sell

Your large purchase pushes the price of the token up even further. In the exact same block, the MEV bot executes its third step. It instantly sells the tokens it bought in step one. Because it bought at the original low price and is now selling at the highest possible price, the bot pockets a risk-free profit. The bot then walks away, leaving you with fewer tokens and less value.

3. A Real-World Example with Math

Let us use simple numbers to illustrate how this extracts value from your wallet.

Imagine a new token called AlphaCoin is trading for $1.00. You want to buy $10,000 worth of AlphaCoin, expecting to receive roughly 10,000 tokens.

An MEV bot spots your pending $10,000 transaction in the mempool. The bot knows your massive buy order is going to push the price of AlphaCoin from $1.00 up to $1.10.

The bot jumps the line and buys $5,000 worth of AlphaCoin at $1.00. This front-run purchase pushes the price up to $1.05. Now, your transaction finally processes. Instead of paying $1.00, you are forced to pay $1.05 per token. Your $10,000 now only buys you about 9,523 tokens instead of 10,000.

Your large purchase pushes the price up again, this time to $1.15. The bot immediately sells the 5,000 tokens it bought. Since it bought them for $1.00 and sold them for $1.15, the bot makes a quick $750 profit in a fraction of a second. That profit came directly out of the hidden price impact forced upon your transaction.

[Image showing the visual flow of a sandwich attack in the mempool]

4. The Role of Slippage Tolerance

You might be wondering why decentralized exchanges allow this to happen. The answer lies in a setting called Slippage Tolerance.

Because crypto prices are highly volatile, the price of a token might naturally change in the few seconds it takes for your transaction to process. To prevent every single transaction from failing due to minor price changes, decentralized exchanges allow you to set a slippage tolerance. This is a safety net.

If you set your slippage to 5 percent, you are legally telling the smart contract, "I expect to get 10,000 tokens, but I am perfectly fine if I only get 9,500 tokens."

MEV bots specifically target users who leave their slippage tolerance set too high. If a bot sees you have a 10 percent slippage tolerance, the bot will mathematically calculate exactly how much it can front-run you to push the price up by 9.9 percent, extracting the maximum amount of profit without causing your transaction to fail.

5. How to Protect Your Wallet from Sandwich Bots

While sandwich attacks are incredibly common, they are also entirely preventable if you know how to configure your trades. Here are the most effective ways to protect yourself.

  • Keep Your Slippage Low: This is the absolute golden rule of decentralized trading. Whenever possible, set your slippage tolerance manually to 0.5 percent or 1 percent. By keeping the window extremely tight, you remove the profit margin for the MEV bots. If a bot tries to attack you, the price will exceed your slippage limit, and your transaction will simply revert, keeping your funds safe.
  • Use an MEV-Blocker RPC: The most advanced way to protect yourself is to hide your transactions from the public mempool entirely. You can add a private Remote Procedure Call (RPC) network to your wallet, such as MEV-Blocker or Flashbots Protect. These services send your transactions directly to trusted validators through a hidden dark pool, meaning the predatory bots can never see your trade coming.
  • Trade in High-Liquidity Pools: Sandwich attacks are most profitable in small, low-liquidity token pools where a single trade can drastically alter the price. When trading major assets like Ethereum or Bitcoin in massive liquidity pools, it takes millions of dollars to move the price even a fraction of a percent, making sandwich attacks mathematically impossible for most bots.

Conclusion

The decentralized finance ecosystem is a dark forest filled with algorithmic predators looking for easy targets. Sandwich attacks represent the harsh reality of public blockchains, where transparency can be used against uneducated users.

However, by understanding how the mempool works, managing your slippage tolerance with strict discipline, and utilizing private RPC endpoints, you can completely neutralize these bots. Education is your best defense in Web3, ensuring that every dollar you invest goes exactly where you want it to go.