There are a thousand and one ways to lose money in crypto, and a sandwich attack is one of them.

Sandwich attacks are tricky. You ask why? It's difficult to find out that you're under a sandwich attack. It's like a mosquito bite in your sleep. You never get to find out. But in the long run, you get sick.

Sandwich attacks on the Ethereum blockchain accounted for a loss of $190M by users in one year. These are innocent users like you, who probably never found that they lost money. But you don't have to fall victim too.

In this article, I'll walk you through what a sandwich attack is, how it works, and how you can avoid it.

What is a sandwich attack?

A sandwich attack is a situation in DeFi where a trader (attacker) tries to make a profit from another trader's (victim) transaction. It happens on decentralised exchanges such as Uniswap and PancakeSwap.

In a sandwich attack, the attacker picks on a pending transaction in a decentralised exchange such as Uniswap. The attacker sandwiches this pending transaction by placing a transaction before it and after it. Hence the name sandwich.

The goal of the attacker in a sandwich attack is to manipulate crypto prices in their favour. In other words, they try to make a profit off the pending transaction.

Let's explore in detail how a sandwich attack works.

How do attackers execute a sandwich attack?

Let's assume you're a member of a crypto Telegram group. And there's a crypto OG in the group who calls promising new coins before they launch on centralised exchanges.

One day, you get a call to buy a certain coin X that just launched on Uniswap. You decide to swap 3000 USDT with the coin X.

Here's how an attacker could steal part of your money through a sandwich attack:

1. You log in to Uniswap and initiate the swap using 3000 USDT for X coins. 3000 USDT = X coins

2. Your pending transaction goes to the public memory pool (mempool) where validators can pick and confirm it. A mempool is like a waiting room in a doctor's office. You wait till the doctor calls and attends to you. Only then can you say your visit to the hospital was successful.

3. In the public mempool, everyone can see your order including an attacker.

4. Once you've placed the swap order, a bot owned by an attacker initiates an exact transaction like yours. The only difference is that the attacker increases the gas fee to make their transaction faster than yours.

5. So, the attacker swaps their 3000 USDT for the coin X before you. Hence increasing the price of the coin X. Why? More demand causes higher prices. This action is of the attacker known as front running.

6. Next, validators confirm your transaction. But you'll now buy a lesser amount of the coin X than you had planned. Why? The attacker caused the price to increase with their swap.

7. After you swap, there could be another increase in the price of the coin depending on the size of your money. The bigger your capital the higher the price.

8. Once the attacker sees that your transaction is complete and prices have increased again, they swap back coin X to USDT. This is known as back running.

9. At this point, they'll definitely have more than the original 3000 USDT. Whatever they have above the 3000 USDT is the spoils of their attack.

Consequence and real-life examples of sandwich attacks

The ultimate consequence of sandwich attacks is that you lose part of your trading capital. And the shocking part of it is that you may not even be aware!

But why? As an ordinary DeFi user, you'll assume that the prices of assets increased before you bought. Everyone knows that cryptos are volatile. Isn't it?

But you should only be worried about sandwich attacks when you want to swap a significant amount using decentralised exchanges. Otherwise, there shouldn't be any worry, because it costs the attacker some significant sum to make these attacks.

In a single year, researchers recorded 480, 276 sandwich attacks on the Ethereum blockchain. I can't possibly examine all these transactions. So, I've decided to take a look at two notable sandwich attacks in the past few years.

JaredFromSubway.eth sandwich attacks

JaredFromSubway.eth is a bot created by an unnamed attacker specifically for the Ethereum blockchain.

In less than three months of integrating it into the Ethereum network, it has made its creators a revenue of $40.6M and a profit of $6.3M.

This money is an accumulated loss for retail traders like you.

The Ethereum Foundation sandwich attack

On October 9, 2023, the Ethereum Foundation lost $9,101 to a sandwich attack on its blockchain.

If the Ethereum foundation can be attacked in a sandwich attack on their blockchain, then no one is above being attacked. It's like a tenant beating up a landlord in his home and going scot-free.

How to avoid a sandwich attack

The surest way to avoid sandwich attacks is trading only on centralised exchanges and avoiding the decentralised ones. But that doesn't sound smart. Does it?

That would mean missing out on opportunities to jump into new coins. In addition, you'd lose complete control of your cryptos once they're on centralised exchanges.

Another way to reduce the effect of sandwich attacks is by breaking up large trades into smaller ones. For instance, say you want to swap $20,000 worth of coins, you could break it into ten. That means executing $2000 at a go. But this method may be stressful.

Here's a means to avoid sandwich attacks completely: sending your transactions to a private mempool instead of a public mempool. This is like using your private car while travelling instead of using public transport. Therefore, everyone doesn't get to know you're travelling.

In a private mempool, the attackers will lose the opportunity to see your pending transaction. So they can't sandwich attack a transaction they can't see.

Image source

But how do you access a private mempool?

It's simple: by using Flashbot RPC. It's a tool that helps you swap coins without losing part of it to someone else through manipulation.

Image source

It works by visiting the website and connecting your wallet to it. Once your wallet is connected, you can swap sandwich attack-free. Here is a detailed video on how to connect your wallet to Flashbot RPC. But, this method has a limitation: It works only for the Ethereum blockchain.

The bottom line

As a new space, DeFi is at a developmental age. Because of that, a lot of weaknesses and loopholes exist that bad actors take advantage of to steal from other users. In this article, I've explored the case of sandwich attacks.

Following the methods in this article will help you avoid or reduce the effect of sandwich attacks. That is if you must use decentralised exchanges.