The State of Solana MEV - Focusing on Arbs and Sandwich Attacks

Our comprehensive analysis covers 16 months of blockchain data, examining 8.5 billion trades and over $1 trillion in DEX volume. This deep dive reveals the sophisticated landscape of MEV extraction on Solana, with particular focus on sandwich attacks and their evolution over time.

Atomic Arbitrage Volume

16 months of blocks, 8.5 Billion trades, over $1T in DEX volume. Over this time period, the Atomic Arb volume was $380M.

Daily Arbitrage Peaks

Several notable spikes in arbitrage activity coincided with major token launches and market events. The most significant peaks occurred during high-profile token releases that generated substantial trading volume and price volatility.

Major Peak Events

January 10, 2024 - WIF token launch drove significant arbitrage activity
December 17, 2024 - Pengu token release created massive MEV opportunities
January 18-20, 2025 - Trump and Melania token launches generated sustained high activity

Sandwich Bot Revenue Analysis

Over the 16-month analysis period, sandwich bots extracted between $370 million and $500 million in value from the Solana ecosystem.

Revenue Calculation Methodology

Lower bound ($370M) - Sum of USD value of atomic SOL/USDC/USDT revenue across all sandwich transactions
Upper bound ($500M) - Includes USD value of atomic memecoin sandwich revenue, accounting for the full spectrum of extracted value

November 2024: Peak Extraction Period

Nov 2024 saw the highest sandwich extraction at nearly 600k SOL, despite DEX volume being roughly half of January levels. Compared to atomic arbs, sandwich attacks have a weaker correlation with DEX volume.

Impact of Jito Public Mempool Shutdown

After the Jito public mempool shutdown in March 2024: - Sandwich attacks fall out of cliff - but they quickly adapted, and sandwiching returned within a month.

Sandwich Bot Infrastructure Requirements

Successful sandwich attacks require sophisticated infrastructure and, more importantly, privileged access to transaction flows. Sandwich bots operate by being able to see a user's transaction before it's commited to a block. Understanding these requirements helps explain the concentration of sandwich activity among a relatively small number of operators.

Key Infrastructure Components

Private Transaction Access - Ability to see user transactions
Reliable Execution - Consistent method to execute frontrun and backrun transactions alongside victim transactions

Sandwich Attack Execution Types

Tight vs. Wide Sandwiches

Tight Sandwiches - Bundled transactions executed via Jito block engine or directly by validators, ensuring consecutive execution
Wide Sandwiches - Also known as "Optimistic" or "Blind" sandwiches, these are non-consecutive attacks where frontrun and backrun transactions are sent 50-300 milliseconds apart

Rise of Wide Sandwiches

With the introduction of anti-sandwich mechanisms like jitodontfront (a way for user's to include a sentinel account in their transactions telling validators running the Jito bundler to not allow the transaction to be frontrun in a bundle), we've observed a nearly 30x increase in the percentage of wide sandwiches. We see once again how sandwich bot operators adapt to different mitigation attempts..

Validator Sandwich Rate Distribution

Analysis of epoch 789 reveals a highly right-skewed distribution of sandwich rates across validators. While the network median sandwich rate is 2.4%, some validators have between 20 and 60% sandwich rate.

Stake Amount Impact Analysis

Our analysis found no statistically significant difference in sandwich rates when grouping validators by stake amount (low/medium/large).

epoch 789 sandwich rate distribution by group

Validator Performance Scatter Analysis

Let’s look at a scatter plot where each circle is a validator

y-axis: sandwich rate
x-axis: blocks produced over the last 30 days
Size of circle: absolute number of blocks with a sandwich attack.

Outliers

High-rate outliers - All validators with 30% or higher sandwich rates
High-stake outlier - One validator with nearly 1.5M SOL staked and exceptionally high sandwich rate relative to similar-stake peers

Stake Pool Analysis

Our previous analysis from three weeks ago identified concerning patterns in stake pool delegation to potentially nefarious validators. The evolution of these patterns provides insight into the dynamic nature of validator MEV extraction.

Epoch 779: Initial Stake Pool Distribution

In epoch 779, our analysis filtered for validators with total stake greater than 100,000 SOL. The results showed that potentially nefarious validators received their stake primarily from Jito and Marinade stake pools, representing the initial state of this concerning trend.

Epoch 789: Stake Pool Shift

By epoch 789, the landscape had transformed completely. The majority of potentially nefarious validators now receive their stake from Marinade, while Jito no longer stakes these validators following their governance proposal to blacklist problematic operators.

Key Developments in Epoch 789

Marinade becomes primary source - Majority of stake to potentially nefarious validators now comes from Marinade
Jito blacklisting effective - Jito's governance proposal successfully prevents staking to problematic validators
New high-rate validators emerge - Two new validators with over 60% sandwich rates
"Private" validator connection - Investigation revealed the new validators were funded by the validator known as "Private"
Dormant validator activation - Previously dormant validators awakened, received Marinade stake, and began sandwich operations

Validator Creation and Stake Marketplace

The emergence of new sandwich-focused validators demonstrates how easily operators can spin up new validators, participate in stake auction marketplaces to bid for delegation, and initiate sandwich attacks. This reveals a systemic vulnerability in the current validator ecosystem.

Sandwich Activity by Stake Pool

Where do sandwiching validators get their stake from? This simple chart shows a clear picture.

The Vicious Cycle of MEV-Driven Staking

A concerning feedback loop has emerged where validators can bid for stake, gain more leader slots, increase sandwich attack opportunities, boost their APY, attract more stakers, and gain even more bidding power. This creates a self-reinforcing cycle that concentrates MEV extraction capabilities.

Cycle Components

Stake Acquisition - Validators bid for delegation in stake marketplaces
Increased Leader Slots - More stake translates to more block production opportunities
MEV Opportunities - More blocks enable more sandwich attacks
Enhanced APY - MEV profits boost validator returns
Staker Attraction - Higher APY attracts more delegators
Increased Bidding Power - More stake enables higher bids for additional delegation

Recommended Actions for Ecosystem Participants

Addressing the sandwich attack problem requires coordinated action from all ecosystem participants. Each stakeholder group has specific steps they can take to reduce MEV extraction and protect users.

Retail Traders

Set slippage tolerances tightly to minimize potential extraction from sandwich attacks.

Application Builders

Run regular sandwich audits on your trading interfaces and implement protective measures.

Protocol Developers

Design and ship sandwich-resistant automated market makers (AMMs) that make MEV extraction more difficult or unprofitable through improved mechanisms.

Stakers

Choose validators based on reputation and ecosystem contribution rather than purely on APY. Consider the long-term health of the network when making delegation decisions.

Community Members

Demand accountability from validators and stake pools. Support governance proposals that address MEV extraction and promote transparent validator operations.

Researchers

Leverage Sandwiched.me data for analysis or create your own datasets. Share findings with the community to improve collective understanding of MEV dynamics.

The Transparency Imperative

Remember: we can't fix what we can't see. Maintaining transparency through comprehensive data analysis and public reporting is essential for addressing MEV extraction challenges. Stay informed about MEV trends, implement protective measures, and contribute to community efforts to create a more equitable trading environment.

The data presented in this analysis represents our ongoing commitment to transparency in the MEV space. As patterns evolve and new challenges emerge, continued monitoring and analysis will be crucial for maintaining a healthy DeFi ecosystem.

Join Our Community

Join Ghost Devs on Telegram

Research

Detecting Evasive Sandwich Attacks on Solana

State of Solana MEV May 2025

Sandwiched.me v2 Launch