Ordering attacks and their cures

Wonder

1. Why does seeing a transaction before it settles create an economic incentive to reorder the block?
2. How can a market mechanism be technically sound yet still extract value from its own users through sequencing?
3. What is the precise difference between a slippage limit that caps loss and one that prevents the attack entirely?

Explore

Part IOrdering attacks: front-running, sandwiches and MEV

1. On Ethereum, pending transactions wait in a public mempool visible to every node; Solana has no public mempool, but whoever relays or leads a block still sees pending transactions. Whoever controls block construction can inspect this queue before finalization. This visibility creates a race condition where speed and information asymmetry determine economic outcomes. The order of execution is not neutral; it is the primary variable that searchers optimize. A transaction included first captures liquidity that would otherwise be available to later participants.
2. Front-running involves observing a pending trade and submitting one’s own identical or complementary trade with higher priority fees, ensuring inclusion before the original. If the observed trade moves price favorably for the front-runner, they profit from the delta. Back-running is the converse: executing after a known state change, such as an oracle update or liquidation trigger, to capture value that becomes available only in the new state.
3. Sandwiching exploits slippage tolerance. A searcher buys an asset immediately before a victim’s large swap, driving up its price. The victim then executes their trade at this inflated price. Immediately after, the searcher sells at the higher price the victim’s buy created. The victim receives fewer tokens than expected; the searcher pockets the difference. This is arbitrage against the user’s own tolerance settings.
4. P. Daian et al. formalized these dynamics in ‘Flash Boys 2.0’ (arXiv 2019), coining the term miner extractable value (MEV), later renamed maximal extractable value. They demonstrated that MEV is not an anomaly but a structural feature of permissionless, sequential execution. Much MEV is arbitrage and liquidation; some of it, such as sandwiching, is paid directly by ordinary traders.
5. Flashbots (founded 2020) introduced a private bundle relay (2021) and, after the Merge, MEV-Boost builder auctions (2022) on Ethereum. This moved MEV extraction off the public mempool into a competitive auction, making it orderly but not absent. On Solana, Jito bundles (2022 onward) created a similar market where validators prioritize bundled transactions with tips. The infrastructure changed; the fundamental incentive for ordering attacks persisted.
6. Slippage limits cap the maximum loss per transaction but do not prevent sandwiches. If a user sets slippage to 1%, a searcher can still sandwich them, pushing their price up to that limit. The root cause is sequential, order-dependent execution against a visible queue. Removing it means either hiding orders until their order is fixed or making order within a block irrelevant, both covered in later lessons.

Part IIBatch auctions and uniform clearing

7. In continuous trading markets, execution speed determines outcome. A trader who sees a price change and submits an order before others captures value that would otherwise be shared or lost to market makers. This dynamic rewards infrastructure over analysis: fiber-optic cables placed near exchange servers, co-located hardware, and low-latency networks become the primary competitive advantages. The result is a market where tiny speed differences translate into significant economic gains, incentivizing an arms race in technology that benefits only those with capital for such upgrades.
8. Budish, Cramton, and Shim proposed an alternative in their 2015 Quarterly Journal of Economics paper: the frequent batch auction. Instead of matching orders continuously as they arrive, the system collects all buy and sell orders over a short interval (they suggested a fraction of a second, such as 100 milliseconds) and clears them simultaneously at a single uniform price. This design eliminates intra-block priority because every order submitted within that window executes at the same clearing price. The first millisecond of the interval offers no advantage over the last; speed becomes irrelevant to execution, shifting competition back to information and valuation.
9. Applied to token markets on blockchain networks, this principle neutralizes two common exploits: sniping and sandwiching. In a standard mempool, a bot can monitor pending transactions, detect a large swap, and insert its own transaction before and after it to manipulate the price. Under batch clearing, the entire block’s order flow is treated as a single set of constraints. The protocol solves for one price that maximizes volume or utility across all orders simultaneously. A sandwich attack fails because the attacker cannot execute separately from the victim; they are part of the same clearing solution.
10. CoW Protocol, launched in 2021 on Ethereum, implements this via batch auctions. Users submit signed order intents to a solver network rather than directly to an exchange. Solvers compete to fill these orders within a block, and the protocol requires trades in the same pair and direction within a winning solution to settle at one price. Penumbra, whose mainnet launched in 2024 (its exchange was switched on in later phases), batches swaps per block. Both show that batch clearing works in production, though they differ in their specific solver architectures and privacy guarantees.
11. The primary cost of this design is latency. Prices update only when a new batch clears, not continuously. If market conditions shift dramatically mid-interval, the clearing price may lag behind real-time spot prices, creating temporary inefficiencies. Additionally, while intra-block priority vanishes, inter-block priority remains: arriving in an earlier block can still confer advantages if liquidity shifts between blocks. This is a residual form of speed competition, but it operates on a slower timescale (block intervals rather than milliseconds), reducing the infrastructure arms race and making participation more accessible to non-institutional traders.
12. Verify this by finding a CoW Protocol settlement transaction on Etherscan or in CoW Explorer: one transaction settles several users’ trades, and trades in the same pair and direction within a solution execute at the same effective price. The uniformity of pricing across disparate orders within the same batch is the visible signature of the clearing algorithm at work.

Part IIIEncrypted mempools and commit-reveal

13. In a public mempool, every pending transaction is visible to all nodes immediately. A searcher can read the contents, simulate the outcome, and submit their own competing transaction with higher gas fees to jump ahead. This front-running extracts value from other users without their consent. The visibility of unconfirmed orders creates an inherent race condition where speed advantages translate directly into financial gain.
14. Commit-reveal schemes address this by splitting submission into two phases. First, the user broadcasts a cryptographic hash of their intended transaction. Later, they reveal the actual transaction. No one can see what is being committed until the reveal phase. Provided execution order is fixed when the commitment is made, this prevents front-running, because no one can know the order’s contents while it waits. The cost is a second step: users must come back to reveal, and the protocol must decide what happens to commitments that are never revealed.
15. Threshold-encrypted mempools take a different approach. Transactions are encrypted to a public key whose decryption key is split among a committee (Shutter calls its members ‘Keypers’). No single member holds the full decryption key; only when a threshold number of nodes cooperate can the transaction be decrypted. The order is fixed before any one party sees the contents, eliminating the window for manipulation. Trust shifts to that committee: if enough members collude, they can decrypt early.
16. Shutter Network implemented this on Gnosis Chain starting in 2024. It uses a committee to manage key shares, allowing users to submit encrypted transactions that are decrypted only after their position in the block is determined. Similarly, Flashbots Protect offers private order-flow channels where transactions bypass the public mempool entirely, sent privately to block builders. Both methods hide transaction data from searchers but introduce new dependencies.
17. Private channels shift trust from decentralized consensus to block builders or committees. If a builder becomes malicious or compromised, they can inspect orders before inclusion. Threshold schemes reduce this risk by requiring multiple independent parties to collude, but the committee’s governance and key management become critical points of failure. Users must verify that no single entity controls enough key shares to decrypt transactions unilaterally.
18. The trade-offs are clear: encrypted mempools add latency due to encryption/decryption overhead and require trust in committees or builders. Public mempools remain transparent but vulnerable to MEV extraction. For a token market, adopting these mechanisms means accepting slower price discovery and complex infrastructure in exchange for protection against predatory trading strategies. The choice depends on whether fairness of execution outweighs the cost of added complexity.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• P. Daian et al., 'Flash Boys 2.0' (IEEE S&P 2020, arXiv 2019)
• Flashbots documentation on private transaction relays
• Jito documentation on bundles and tips
• E. Budish, P. Cramton & J. Shim, 'The High-Frequency Trading Arms Race: Frequent Batch Auctions as a Market Design Response', Quarterly Journal of Economics (2015)
• CoW Protocol Documentation, 'Batch Auctions'
• Penumbra protocol specification: DEX (batch swaps)
• Shutter Network documentation
• Flashbots Protect documentation
• S. Yang et al., 'SoK: MEV Countermeasures: Theory and Practice' (2022)