HostDeFi › Guides › MEV sandwiches for buyers

MEV sandwiches — why your fill was worse than the quote

You quoted one price, confirmed, and received noticeably less. Nothing "failed." You were most likely the meat in someone else's trade.

Educational guide · reviewed August 2026 · not financial advice

A sandwich attack is the most common way ordinary buyers lose money to MEV — "maximal extractable value," the profit that can be squeezed out of the ordering of transactions. The recipe is in the name: a bot inserts a buy immediately before your swap and a sell immediately after it. Their buy pushes the pool price up; your swap executes into that worse price; their sell captures the bump you paid for. Your transaction succeeds, the chart barely moves, and the cost hides inside a phrase everyone has learned to shrug at: slippage. This guide explains how the sandwich works mechanically, how to recognize one in your own fill, and which protections do something versus which just feel protective.

The mechanics, without the folklore

An AMM pool prices by formula: the more of a token one trade buys, the higher the price the next trade pays. A sandwich bot weaponizes that curvature. Watching pending transactions, it spots your swap — size, pair, slippage tolerance, everything is visible before execution on a transparent chain — and computes exactly how much it can buy ahead of you while keeping your execution just inside your slippage limit, so your transaction still succeeds. Then it bids for position: on Ethereum-style chains by paying builders for placement in the block, on Solana through bundle infrastructure that lets a searcher land transactions adjacent to yours. The bot's exit sell is part of the same plan, so its capital is at risk for seconds.

The elegant, ugly part is that your own settings size the theft. The bot's optimal front-run pushes your price as close to your stated tolerance as it dares. Set 1% slippage and the sandwich can take at most about 1% minus fees; set 10% "so the tx stops failing" and you have posted a public bounty of up to 10% of your order, payable to whichever searcher wins the race. High slippage on a visible route is not a convenience setting — it is the price you have volunteered to pay.

Reading a sandwich in the data

You do not need a research desk to confirm a sandwich; you need one explorer tab and ninety seconds. Open your transaction and look at its immediate neighbors — same block on an EVM chain, same bundle-window on Solana. The pattern that convicts is symmetric: a buy of your exact token right before you, a sell of the same size right after you, usually from one address that has done the same dance thousands of times. Compare your execution price to the pool price one block earlier; the gap, minus normal fees, is what the sandwich cost you. On aggregator trades check each leg — a multi-hop route can be sandwiched on its thinnest pool even when the headline pair looks deep.

Not every bad fill is an attack, and honest diagnosis matters. Thin liquidity makes your own price impact large with no help from anyone. Transfer-fee tokens deliver less than the pool math suggests by design. Volatile markets move between quote and inclusion. The sandwich signature is specifically the mirrored trades hugging yours — if they're absent, your bad fill probably has a boring explanation, and the fix is sizing and pool choice rather than MEV protection.

What actually protects a buyer

1. Don't broadcast intent. The attack requires seeing your order before it lands. Private transaction submission — RPCs that route around the public mempool on Ethereum, or venues that quote privately — removes the visibility the bot needs. This is the single highest-leverage protection and the reason serious flow increasingly travels through protected or private routes.
2. Set slippage tight, then handle failure honestly. A tight tolerance turns a would-be sandwich into a failed transaction — mildly annoying, but strictly better than a successful theft. If a swap only succeeds at 8% tolerance, the market is telling you the size is wrong for the pool.
3. Split size against thin pools. Sandwich profit scales with your price impact. Three smaller swaps produce less curvature per trade than one large one, and give bots a smaller target each time.
4. Prefer routes with impact math shown. A quote that shows expected output, minimum output and price impact before you sign lets you see the sandwich budget you're offering. A quote that hides them is asking you to trade blind.

Why this belongs in a risk toolkit

Sandwiches sit in a blind spot: token scanners read contracts, but the sandwich isn't in the contract — it's in the market microstructure around your order. A token can be perfectly honest and still cost you 4% every time you touch it through a visible route. Treat execution the way you treat contract risk: check the token before you buy it, and check the route while you buy it. The first is a scan; the second is tight slippage, private or protected submission where available, and thirty seconds of looking at what landed next to your fill afterward. Buyers who do both stop being the easiest money in the block.

Frequently asked