💻 computer science

How to Serve Your Sandwich? MEV Attacks in Private L2 Mempools

This paper demonstrates that while sandwich attacks are profitable on Ethereum L1, they are largely rare, unprofitable, and often misidentified in private L2 mempools due to execution constraints and sequencing policies that render such attacks probabilistic rather than deterministic.

Original authors: Krzysztof Gogol, Manvir Schneider, Jan Gorzny, Claudio Tessone

Published 2026-01-28

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Krzysztof Gogol, Manvir Schneider, Jan Gorzny, Claudio Tessone

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the blockchain as a giant, bustling digital marketplace where people trade digital tokens (like swapping USDC for USDT). In this market, there are "bots" (automated programs) that try to make quick profits by watching what others are about to do.

The Classic "Sandwich" Attack (The Old Way)

In the main marketplace (Ethereum Layer 1), these bots act like ruthless sandwich makers.

The Victim: A regular person posts a large order to buy something. Everyone can see this order in the public "waiting line" (the mempool).
The Attack: The bot sees this coming. It quickly buys the item before the victim (the top slice of bread), pushing the price up. Then, the victim's large order comes in, buying at that new, higher price. Finally, the bot immediately sells the item after the victim (the bottom slice of bread), cashing in on the price hike.
The Result: The bot makes a profit, and the victim gets a worse deal. Because the main marketplace guarantees that these three steps happen instantly and in the exact right order, this attack is very reliable and profitable.

The New Reality: Private "VIP" Lines (Layer 2 Rollups)

The paper investigates what happens when this same attack is tried in newer, faster marketplaces called Layer 2 Rollups (like Arbitrum, Base, Optimism). These places use a "Private Mempool" system.

Think of a Private Mempool as a VIP lounge or a blindfolded auction.

No Public View: Regular bots cannot see the victim's order in advance. The orders are hidden from the public until a central manager (the "Sequencer") decides to process them.
No Guaranteed Order: Even if a bot guesses a victim is coming, it cannot guarantee it will get to buy first and sell last. It's like trying to cut in line at a fast-food restaurant where the cashier (Sequencer) decides who goes next based on who shouts the loudest (tips) or who arrived first, but the line moves so fast and chaotically that you can't be sure you'll get the exact spot you want.

What the Researchers Found

The authors, acting like digital detectives, analyzed millions of transactions from these private marketplaces to see if "sandwich attacks" were actually happening. They used a special magnifying glass to distinguish between real attacks and innocent trading.

Here is what they discovered, translated into simple terms:

1. The "Sandwiches" Were Mostly Fake
They found thousands of patterns that looked like sandwiches (a buy, a victim trade, a sell). However, when they checked the math, 95% of them were false alarms.

Analogy: Imagine seeing three people standing in a row at a bus stop and assuming they are a coordinated team. But upon closer inspection, they are just three strangers waiting for different buses. The "attackers" weren't actually targeting the victim; they were just doing their own thing at the same time.

2. The Math Doesn't Add Up
For a real sandwich attack to be worth the trouble, the bot needs to make more money than it costs to pay the fees and the price slippage (the cost of moving the market).

The Finding: On these private chains, the "victims" were usually trading small amounts (a few hundred dollars). The cost to execute the attack was higher than the potential profit.
Analogy: It's like paying $5 in gas money to steal a $1 candy bar. Even if you succeed, you lose money. The researchers found that the median profit for these "attacks" was actually negative. The bots were losing money on average.

3. The "Timing" Problem
In the old public market, the bot could guarantee the sandwich happened in one split second. In the new private market, the bot has to guess when to send its orders.

The Finding: Because the Sequencer (the manager) orders transactions randomly or by fee, the bot often fails to get the "before" and "after" trades to happen in the same block.
Analogy: It's like trying to catch a specific falling leaf with two nets. In the old market, you could hold the nets perfectly. In the new market, the wind is so chaotic that you usually miss the leaf, or the nets don't close at the same time.

The Bottom Line

The paper concludes that sandwich attacks are rare, unprofitable, and largely non-existent in these private Layer 2 marketplaces.

Why? The "private" nature of the line prevents bots from seeing the victim, and the lack of guaranteed ordering makes the attack too risky to be worth the cost.
The Misconception: Many people assume that because these attacks happen on the main Ethereum chain, they are everywhere. This paper proves that assumption is wrong for these specific private marketplaces. The "sandwich" is mostly a myth in this environment; what looks like an attack is usually just normal, harmless trading activity.

In short: The "ruthless sandwich maker" bot has moved to a new restaurant, but the kitchen is so chaotic and the orders so small that the bot is just standing there, confused, and losing money.

Technical Summary: Sandwich Attacks in Private L2 Mempools

Problem Statement

Sandwich attacks, a prevalent form of Maximal Extractable Value (MEV) on Ethereum Layer 1 (L1), involve an adversary placing a front-run transaction before a victim's trade and a back-run transaction immediately after to capture profit from the resulting price impact. While Layer 2 (L2) rollups often employ private mempools managed by centralized sequencers to mitigate such attacks, early empirical evidence suggested that sandwich patterns persist even in these environments.

The core problem addressed by this paper is the discrepancy between the theoretical expectation of sandwich profitability and the practical reality of executing such attacks on L2s. Specifically, the authors investigate whether the removal of public mempools and the absence of guaranteed atomic inclusion (via builder markets) render sandwich attacks unprofitable or merely probabilistic, and whether existing detection heuristics are accurately identifying genuine attacks or conflating them with benign arbitrage.

Methodology

Theoretical Modeling

The authors extend existing MEV models to the context of L2 rollups with private mempools:

Profitability Model: They derive an optimal attack sizing strategy for both Constant Product Market Makers (CPMMs) and Concentrated Liquidity Market Makers (CLMMs, e.g., Uniswap v3).
- In the "small-trade regime" (typical of L2s), they show that the optimal front-run size ( $V_f$ ) is approximately half the victim's trade size ( $V_v$ ) within a single liquidity tick.
- For CLMMs, they identify that attackers may benefit from pushing trades across tick boundaries into regions of lower liquidity, creating discrete profit jumps.
Execution Feasibility Model: Unlike L1, where bundle markets guarantee atomic inclusion, L2s rely on sequencer ordering. The authors model the probability of successful co-inclusion ( $p_{co-inc}$ $p_{co - in c}$ ) as a function of:
- Batching constraints: The probability that front-run, victim, and back-run transactions fall into the same micro-batch.
- Sequencer policies: Differentiating between First-Come-First-Served (FCFS) and Priority Gas Auction (PGA) ordering.
- Latency: Network variance affecting arrival times.
- The model concludes that co-inclusion probabilities on L2s are low (0.05–0.20), making execution inherently probabilistic rather than deterministic.

Empirical Analysis

The authors conducted a large-scale empirical study using transaction-level data from five major rollups (Arbitrum, Base, Optimism, Unichain, ZKsync) from January to September 2025.

Data Collection: They extracted swap event logs, transaction traces, and pool liquidity data.
Refined Heuristics: To avoid false positives common in naive detection (which often misidentify shared routers as single actors), they implemented a strict attribution methodology:
- Pre-filtering: Excluding atomic arbitrage transactions.
- Actor Attribution: Distinguishing between transactions routed through shared infrastructure (assigning the funding EOA as the actor) and those using custom executor contracts.
- Pattern Matching: Identifying triples $(f, v, b)$ where the front and back legs share the same actor ID, differ from the victim, and satisfy specific ordering and direction constraints.
Economic Consistency Checks: They evaluated candidate triples against theoretical signatures:
- Scaling: Does the front-run size scale proportionally to the victim ( $V_f \approx V_v/2$ )?
- Matching: Are front and back sizes closely matched?
- Profitability: Calculating gross profit, net profit after slippage, and net profit after gas fees.

Key Contributions

Empirical Measurement: This is the first systematic measurement of L2 sandwich activity using strict actor-linking heuristics and swap-event analysis rather than ERC20 transfer inference.
Theoretical Extension: The paper provides a formal model for optimal sandwich sizing in CLMMs and quantifies the execution constraints imposed by private mempools, demonstrating that L2 sandwiching is probabilistic.
Feasibility Analysis: It establishes that the absence of atomic inclusion guarantees significantly limits the expected value of sandwich attacks, often rendering them unprofitable even when economically optimal sizing is attempted.

Results

1. Prevalence and False Positives

High False Positive Rate: Naive heuristics vastly overstate sandwich activity. Across all studied rollups, over 95% of flagged "sandwich triples" fail economic consistency checks.
Lack of Correlation: Genuine sandwiches require front/back trades to scale with the victim. The data shows weak correlations between victim and attacker trade sizes (e.g., victim-front correlation as low as 0.03 on Optimism) and poor matching between front and back legs (median back/front ratios often deviating significantly from 1.0).
Arbitrage Confusion: Most detected patterns are better explained by cyclic arbitrage or unrelated transactions coinciding in the same block rather than coordinated victim targeting.

2. Profitability

Negative Net Returns: The median net Profit-and-Loss (PnL) for candidate sandwiches is negative across all chains.
- Example: On Base, the median net PnL is -$2.23 USD; on Arbitrum, it is -$0.80 USD.
Insignificant Gross Profits: Even before accounting for gas and slippage, median gross profits are negligible (on the order of $0.001 USD).
Thresholds: Theoretical modeling indicates that for a sandwich to be profitable on L2s given low co-inclusion probabilities, victim swap sizes must exceed $1.5k–$ 3k. However, the median victim swap sizes observed were typically between $200 and $1,200, falling below the profitability threshold.

3. Bot Behavior

Low Efficiency: Addresses flagged as sandwich attackers exhibit extremely low "sandwich efficiency" (the share of sandwiches in their total transaction volume), often below $10^{-3}$ .
Generalist Activity: Most flagged bots are engaged in broader arbitrage or market-making strategies, with sandwich-like patterns being accidental by-products rather than the primary objective.

Significance and Conclusions

The paper challenges the prevailing assumption that sandwich attacks on Ethereum L1 generalize to L2 environments. The authors conclude that:

Sandwiching is Rare and Unprofitable: On current L2s with private mempools, sandwich attacks are largely absent, unprofitable, and indistinguishable from neutral arbitrage flows.
Structural Protections are Incidental: The lack of sandwiches is not due to inherent structural protections against MEV but rather a result of private mempools, centralized sequencing, and the prevalence of low-value swaps.
Measurement Refinement: Current detection methods significantly overestimate MEV activity. Accurate measurement requires distinguishing between genuine victim-targeted attacks and benign arbitrage, particularly in private mempool contexts.
Policy Implications: Sequencing policies and defense mechanisms should not simply inherit L1 assumptions. As ecosystems evolve toward public mempools or order-flow auctions, the feasibility frontier for sandwiching may shift, necessitating re-evaluation of economic risks.

The study suggests that while the theoretical framework for sandwich attacks remains valid, the practical execution constraints of today's rollup architectures effectively neutralize their profitability.