What is a Sandwich Attack in Crypto?
How MEV bots front-run your DEX trades, why high slippage makes you a target, and how to avoid sandwich attacks on the XRP Ledger.
What is a Sandwich Attack?
A sandwich attack is a form of front-running where an attacker places two trades around your trade to profit from the price movement you create. The attacker buys before you (pushing the price up), lets your trade execute at the higher price, then sells immediately after (pocketing the difference).
The name comes from your trade being "sandwiched" between the attacker's buy and sell.
How it Works on the XRPL
Detection. The attacker monitors pending transactions on the XRPL and spots your large swap with high slippage tolerance.
Front-run. They submit a buy order for the same token with a higher fee to ensure it executes before yours in the same ledger.
Your trade. Your swap executes at a worse price because the attacker already moved the market.
Back-run. The attacker immediately sells the tokens they bought, capturing the price difference as profit.
Why the XRPL is Different
The XRP Ledger closes ledgers every 3-4 seconds with deterministic transaction ordering. Unlike Ethereum where miners can reorder transactions freely (MEV), the XRPL's consensus protocol makes sandwich attacks harder but not impossible.
Attackers can still exploit high-slippage trades by submitting transactions in the same ledger window. The XRPL's low fees (0.000012 XRP per transaction) make it cheap to attempt.
When You are Vulnerable
You are most at risk when:
- Trading large amounts relative to the pool's liquidity
- Setting slippage tolerance above 1-2%
- Trading low-liquidity tokens with thin order books
- Using AMM pools that are rebalancing after a large trade
- Executing market orders instead of limit orders
How to Protect Yourself
Keep slippage low. Set your slippage tolerance to 1% or less. This limits how much an attacker can extract from your trade.
Use limit orders. Place offers at a specific price instead of market swaps. Limit orders execute only at your price or better.
Split large trades. Break a big swap into smaller ones to reduce price impact and make sandwiching less profitable.
Check the order book. Before swapping, look at the depth on both sides. Thin books on low-cap tokens are easy targets.
Watch for pool rebalancing. If the AMM pool just had a large trade, wait for arbitrageurs to rebalance the price before swapping.
XRPL vs Ethereum MEV
| Factor | XRPL | Ethereum |
|---|---|---|
| Mempool visibility | Limited | Public |
| Transaction ordering | Consensus-based | Miner/builder chosen |
| Attack cost | ~0.000012 XRP | Gas bidding wars |
| Block time | 3-4 seconds | 12 seconds |
| Sandwich difficulty | Harder | Easy (MEV bots) |
Key Takeaways
- Sandwich attacks exploit your slippage tolerance to extract value from your trades
- The XRPL's consensus model makes them harder than on Ethereum but not impossible
- Keep slippage at 1% or below to minimize risk
- Use limit orders for large trades
- Split big swaps into smaller ones
- XRPL.to warns you when slippage is set above safe levels