What is MEV, and how does a sandwich attack work?

What MEV is

ethereum.org defines maximal extractable value (MEV) as the value that can be taken from making a block by including, leaving out or reordering its transactions.¹ This is on top of the normal block reward and fees.¹

Much of it is taken by independent bot operators, which ethereum.org calls "searchers".¹ They watch the mempool, the queue of transactions waiting to go into a block.^1,3

IOSCO, the international body of securities regulators met in Lesson 5, describes one common move in its 2022 report on DeFi. A front-runner pays a higher gas fee so that its transaction is placed ahead of others in the queue.³ It says front-running can leave the people pushed back with worse terms.³

How a sandwich works

ethereum.org gives an example. Someone wants to buy a large amount of a token on a DEX, enough to push its price up.¹

1. A searcher spots the large swap waiting in the mempool.¹
2. The searcher buys the token just before it, while it is cheaper.¹
3. The large swap goes through, at a worse price than it would have got, and pushes the price up further.¹
4. The searcher sells just after it, at the higher price the large swap caused.¹

The same trick works around a large sale. Uniswap Labs describes it in general terms: bots insert their own transactions around yours, to profit from the price move your trade will cause.²

ethereum.org says people who are sandwiched face more slippage and worse execution.¹ Uniswap Labs says sandwich bots prey on wide slippage tolerances, pushing the price just far enough to still trigger your swap.⁴

Not all MEV is bad

ethereum.org notes that some MEV helps. It says arbitrage between DEXs ensures users get the best, most correct prices for their tokens.¹ IOSCO says bots can make markets more efficient, but can also mean worse execution and higher slippage for others.³

Private routes

One response is to keep a swap out of the public mempool, so bots can't see it coming. ethereum.org describes Flashbots as an independent project with a service that lets searchers send transactions to validators without revealing them in the public mempool.¹

As of October 2026, Flashbots' own documentation says its Protect service sends transactions to a private mempool, hidden from frontrunning and sandwich bots.⁵ It also says users do not pay fees for failed transactions sent this way.⁵

Uniswap Labs suggests other steps too: routes that use private pools, limit orders, and a low slippage tolerance.⁴ It adds that no single tactic gets rid of harmful MEV forever.⁴

ethereum.org draws a line here. It warns that private, pay-to-play deals between traders and validators would weaken Ethereum's permissionless design.¹ By contrast, it calls private channels to many competing block builders beneficial, partly because having several builders makes censoring impractical.¹