How to read a sandwich attack

What a sandwich attack is

A sandwich attack is a bot bracketing your swap to make you fill at a worse price. Learning to read it is about interpreting the on-chain and chart data that reveals it.

The signals that matter

When you are reading a sandwich attack, these are the concrete signals to focus on:

• A fill noticeably worse than the quote
• Two bracketing trades around yours
• High slippage tolerance on a thin pool
• A large, visible pending swap
• Repeated bad fills at size

Where to look

You will mostly observe a sandwich attack in the difference between your quote and realized fill, and the surrounding transactions. To read it correctly, go straight to these sources rather than relying on chat or hype.

To read it correctly: the steps

1. Open the right data source for this signal.
2. Interpret each field in context rather than in isolation.
3. Cross-reference with a second source to confirm.
4. Translate the reading into a clear go/skip/exit decision.

The mistake almost everyone makes

Turning the read into action

Once you can read a sandwich attack, the bottleneck becomes attention: you cannot watch every chart 24/7. This is where automated alerts earn their keep — software watches the on-chain conditions and notifies you, so you act on a fresh signal instead of a stale glance.