What are Sandwich Attacks? A potential threat in DeFi Markets

1. What is a sandwich attack in crypto?

A sandwich attack is a type of market manipulation commonly seen in decentralized finance (DeFi) markets, particularly on decentralized exchanges (DEXs). This attack takes place when a malicious actor spots a large pending transaction and strategically places two transactions around it—one before and one after the targeted transaction. The attacker aims to profit from the price difference caused by the transaction.

In a sandwich attack, the attacker buys the asset before the large transaction takes place, which drives up the price. After the large transaction is executed, the attacker sells the asset at a higher price, taking advantage of the price movement. These attacks can occur in both small and large transactions, depending on liquidity conditions. Low liquidity allows attackers to cause a significant price shift with relatively small capital, while high liquidity requires more capital to profit from the attack.

As of January 2024, sandwich attacks have become a prevalent form of market manipulation, ranking as the second most popular Maximal Extractable Value (MEV) activity. According to reports, sandwich attacks amounted to over $2 billion in transactions during the first week of the year.

2. How are crypto sandwich attacks carried out?

To understand how sandwich attacks work, it is important to familiarize ourselves with key concepts:

Automated Market Makers (AMMs): AMMs are decentralized protocols that allow traders to buy and sell assets. They maintain liquidity pools where assets are paired, and the prices are determined algorithmically based on the asset ratio.
Price Slippage: Price slippage refers to the price change that occurs during a transaction. Traders often set slippage tolerance, indicating the maximum price difference they are willing to accept during execution.
Price Impact: Price impact refers to the change in an asset's price due to the execution of a trade within a liquidity pool. The greater the trade size relative to available liquidity, the more significant the price impact.

Here’s how a sandwich attack typically unfolds:

A trader places a large buy order for a particular digital asset, which gets temporarily recorded in the blockchain’s mempool (a queue of pending transactions). A trading bot detects this large pending transaction and performs a front-run transaction by buying the asset before the large order is confirmed. This purchase drives up the asset’s price and increases the slippage tolerance.

Once the large transaction is executed, the bot proceeds with a back-run transaction by selling the asset at the higher price, profiting from the difference between the buy and sell prices. The victim trader, unaware of this manipulation, ends up buying the asset at an inflated price, causing them to incur a loss.

3. How to prevent sandwich attacks?

Detecting sandwich attacks requires monitoring transaction patterns on the blockchain. The key signs include a large transaction sandwiched between two smaller ones within a short time frame. These patterns suggest that an attacker may be manipulating the market by placing transactions around a larger trade to profit from the price fluctuations.

Advanced monitoring tools and algorithms are often necessary to detect these attacks in real-time, as they are difficult to spot manually. Observing liquidity levels and trade sizes can provide additional insights. In markets with low liquidity, sandwich attacks are more easily executed, as smaller trades can create larger price swings.

To prevent sandwich attacks, users can take several measures:

Reduce Slippage: Lowering slippage tolerance limits the price difference users are willing to accept for their transactions, thus reducing the potential for an attacker to profit from price fluctuations.
Use DEX Aggregators: Decentralized exchange aggregators split trades across multiple liquidity pools, minimizing the price impact and reducing opportunities for attackers.
Deploy Custom RPC Endpoints: RPC (Remote Procedure Call) endpoints can link wallets to on-chain transactions, with some offering protection against MEV, including sandwich attacks.

4. How to identify a sandwich attack?

Identifying a sandwich attack involves understanding the signs that an attack is occurring within a decentralized exchange or DeFi platform that uses AMMs, such as Uniswap, SushiSwap, and PancakeSwap. In these platforms, sandwich attacks are typically targeted at liquidity takers, who initiate trades on the platform.

There are two main scenarios in which sandwich attacks might occur:

Liquidity Taker vs. Taker: In this scenario, attackers target liquidity takers by performing both front-running and back-running transactions to profit from the price changes caused by the large trade.
Liquidity Provider vs. Liquidity Taker: Attackers can also manipulate liquidity providers by withdrawing liquidity before a victim’s transaction is executed, increasing the slippage. Afterward, the attacker adds liquidity back into the pool to restore balance, profiting from the slippage.

5. How can you protect yourself from sandwich attacks?

Although sandwich attacks are difficult to completely prevent, users can take several precautions to reduce their risk:

Pay Higher Transaction Fees: By paying higher transaction fees (gas fees), users can expedite the confirmation of their transactions, making it harder for attackers to manipulate pending transactions before they are executed.
Bot Protection: Tools like MEV protection services, which use oracles, algorithms, or smart contracts, can help detect and block sandwich attacks. However, the availability of these services is limited, making it harder for users to leverage them effectively.
Lower Slippage Tolerance: Reducing slippage tolerance can help users avoid paying excessive prices during transactions. By setting a low tolerance for price changes, users can minimize the potential impact of sandwich attacks on their trades.

Conclusion

Sandwich attacks are a sophisticated form of market manipulation in the DeFi space, exploiting vulnerabilities in decentralized exchanges and liquidity pools. By understanding how these attacks work and implementing protective measures such as paying higher transaction fees, lowering slippage tolerance, and using DEX aggregators, users can reduce the risks associated with sandwich attacks and ensure safer trading experiences.

Read more: