Understanding MEV and Sandwich Attacks on Solana

Maximal Extractable Value (MEV) refers to value extracted by adding, excluding, or reordering transactions during block production.

MEV includes several types of on-chain activity. One of its more harmful forms is the sandwich attack, in which an MEV searcher—typically operating through an automated bot—places transactions before and after another user’s swap to profit from its effect on market price.

This article explains how sandwich attacks work, how single-slot and wide sandwich patterns differ, and how detected activity can be examined on Solscan.

How a Sandwich Attack Works

A sandwich attack typically contains three stages:

1. Front-run

The bot places a trade before the targeted swap, moving the pool price toward the least favorable execution price permitted by the user’s slippage settings.

For example, if the user intends to buy a token, the bot buys it first. This initial purchase raises the token’s price in the liquidity pool.

2. Victim Swap

The user’s transaction executes after the bot’s first trade has changed the pool price. As a result, the user may receive fewer tokens than they would have received before the price movement.

The transaction can still succeed if the execution price remains within the user’s permitted slippage range.

3. Back-run

In a sandwich attack, the back-run is the bot’s closing transaction. After the user’s swap moves the price further, the bot reverses its front-run position. In this example, the bot sells the tokens acquired during the front-run at the new price.

The difference between the bot’s entry and exit value represents the gross amount captured by the sequence. This amount is not necessarily its final net profit because transaction fees, priority fees, validator tips, and other execution costs may still apply.

Single-Slot and Wide Sandwich Attacks

Sandwich attacks can be distinguished by where the front-run, victim swap, and back-run appear on Solana.

Type	Transaction placement	On-chain pattern
Single-slot sandwich	All stages occur within the same slot	A compact sequence that can be examined within one block
Wide sandwich	The stages extend across multiple slots	A distributed sequence that must be connected across blocks

Single-Slot Sandwiches

In a single-slot sandwich, the front-run, victim transaction, and back-run are included within the same slot.

Because the complete sequence is contained within one slot, its transaction order and token flows can be examined together.

The bot may use a bundle or another execution method to increase the probability that its transactions land in the required positions. A bundle can contain multiple transactions that execute sequentially and atomically as a group.

However, observing three trades in sequence is not enough on its own to classify them as a sandwich. Their accounts, assets, trade directions, pool interactions, and resulting balance changes must also be related.

Wide Sandwiches

In a wide sandwich, the front-run and back-run occur in different slots. The victim transaction or related order flow appears between them.

The bot establishes a position first, waits for the expected price movement, and exits in a later slot. The number of slots separating these stages can vary.

Because the transactions are not contained within one block, wide sandwiches do not leave the same compact ordering pattern as single-slot sandwiches. Detection requires activity across multiple slots to be reconstructed as one economic sequence.

This distinction is based on transaction placement. It does not indicate how much value was extracted or how many victim transactions were involved.

Viewing Detected Sandwiches on Solscan

The Solscan Sandwiches Activity Leaderboard provides a continuously updated view of detected sandwich activity on Solana.

The leaderboard separates records into Single and Wide views, allowing users to examine each transaction pattern independently.

Depending on the selected view, a record can show:

• The slot and time of the detected activity
• The identified MEV bot
• The affected address
• The block-producing validator
• The token pair or market involved
• The associated program
• The estimated revenue

The available column filters can be used to isolate activity involving a particular bot, address, validator, token, period, or revenue range.

Selecting a slot opens its Block Details page. The dedicated Sandwiches tab connects the leaderboard entry with its underlying transaction flow, including the identified bot, affected address or addresses, trading pool, and extracted amount.

The leaderboard should be treated as an investigative entry point. Its records surface detected on-chain patterns, while the linked account, transaction, and block pages provide the context required for closer analysis.

Conclusion

A sandwich attack extracts value by placing trades around another user’s swap. The bot attempts to move the execution price while keeping the affected swap within its permitted slippage range, then reverses its position to capture the resulting price difference.

Single-slot sandwiches concentrate the front-run, victim swap, and back-run within one slot. Wide sandwiches distribute the sequence across multiple slots, making the relationship more difficult to identify through transaction order alone.

By surfacing detected bots, affected addresses, token pairs, validators, revenue, and related block activity, Solscan makes these patterns easier to monitor and investigate. However, detected revenue and address relationships must still be interpreted within the limits of on-chain data.