How to understand a sandwich attack

What a sandwich attack is

A sandwich attack is a bot bracketing your swap to make you fill at a worse price. Learning to understand it is about building the mental model of how it actually works.

The signals that matter

When you are understanding a sandwich attack, these are the concrete signals to focus on:

• A fill noticeably worse than the quote
• Two bracketing trades around yours
• High slippage tolerance on a thin pool
• A large, visible pending swap
• Repeated bad fills at size

Where to look

You will mostly observe a sandwich attack in the difference between your quote and realized fill, and the surrounding transactions. To understand it, go straight to these sources rather than relying on chat or hype.

To understand it: the steps

1. Learn the mechanism behind it, not just the symptom.
2. Map how each signal connects to that mechanism.
3. Walk through a concrete example end to end.
4. Test your model against a live case to confirm it holds.

The mistake almost everyone makes

Turning the read into action

Spotting it is only half the job — acting on it under time pressure is the other half. The conditions around a sandwich attack can change in seconds, which is why many traders pair their own reads with real-time alerts that watch continuously and ping the moment something lines up.