Metraipolis › archive › dc_4031bb124ff2

No Place to Hide: An Analysis on Protected Order Flow Sandwich Attacks — arXiv:2609.28115

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.28115
License (as archived): CC0-1.0
Archived: 2026-10-08T10:13:26.229Z
SHA-256 of the archived text: 43d43fa0f38646224351a7b2ab6c7c79d14415e6b78efee0b01e4fd73edf9dcd
Stable URL of this page: https://metraipolis.com/documento/dc_4031bb124ff2

How to cite

No Place to Hide: An Analysis on Protected Order Flow Sandwich Attacks — arXiv:2609.28115 — arXiv (en), https://arxiv.org/abs/2609.28115 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_4031bb124ff2 (Metraipolis archive dc_4031bb124ff2, sha256 43d43fa0f38646224351a7b2ab6c7c79d14415e6b78efee0b01e4fd73edf9dcd)

BibTeX

@misc{dc4031bb124ff2,
  title = {No Place to Hide: An Analysis on Protected Order Flow Sandwich Attacks — arXiv:2609.28115},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.28115},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_4031bb124ff2; sha256 43d43fa0f38646224351a7b2ab6c7c79d14415e6b78efee0b01e4fd73edf9dcd},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.28115. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Front-running has long plagued Ethereum's public mempool, earning it the nickname of a "dark forest", where predators lurk for profitable transactions. In response, Ethereum and other blockchain ecosystems increasingly rely on private RPCs and native protections to shield transactions from adversaries, which we refer to as protected order flow. Yet the effectiveness of these mechanisms in preventing front-running, and what trust assumptions they entail, remain poorly understood. In this work, we conduct the first longitudinal, three-year measurement study of sandwich attacks against protected order flow across six blockchains: Ethereum, Solana, Tron, Base, Arbitrum, and Monad. We introduce detection heuristics that capture wide attacks, both within and across blocks, and filter on bot behavior to distinguish sandwiches from legitimate trading activity. We identify 28.0 million sandwich attacks on Solana, 38,567 on Tron, 30,607 on Ethereum, and 1,889 on Base against transactions intended to be protected from front-running. Reorged blocks expose a further 2,875 Ethereum victims. Unlike conventional public-mempool sandwiches, these attacks rarely occur tightly around their victims and, outside Solana, are carried out by a small number of entities. Our analysis uncovers exposures at every layer: validator- and application-level exposure on Solana, order-flow auctions and reorged blocks on Ethereum, first-come-first-served ordering that fails to prevent latency-based front-running on Tron, and both an RPC bug that exposes pending transactions and predictable victim behavior on Base. These findings show that existing front-running protections can provide substantially weaker guarantees than users expect, highlighting the need for stronger end-to-end defenses against sandwich attacks.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-24 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2609.28115 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T09:26:35.721Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-24?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).