Solana Sandwich Attacks: Detect Them From Public Data
Originally published on xroot.dev . You bought a token at a quoted price and got filled worse. Not slippage-worse — the pool moved against you in the same block, then moved back. You suspect a bot ate the difference. Until this year, proving it from your own wallet was expensive: the evidence sits in other people's transactions, and address history gave you signatures without saying where in the…
A Solana sandwich attack consists of three transactions on a single pool in a specific order: an attacker buys the token at a higher price, the victim's buy executes at a worse price, and then the attacker sells, capturing the difference. These three transactions usually occur in the same block or adjacent slots. The attacker's profit is the victim's worse fill minus their fees and tips.
On Solana, the pattern of a sandwich attack is easy to detect from a wallet address using recent address history that includes each transaction's position within its block. By checking the balance deltas before and after your transaction, you can confirm if a sandwich attack occurred. The attacker's sell often lands in the next slot, so a scan of the surrounding blocks is necessary.
While the transactions provide evidence of the attack, the actual loss incurred by the victim is an estimate that depends on reconstructing the pool's reserves before the attack. This method of detection is cheap and can be run on demand, but a more comprehensive solution would require a standing index of all blocks and swaps.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.