What is a Sandwich Attack in Crypto?
How MEV bots front-run your DEX trades, why high slippage makes you a target, and how to avoid sandwich attacks on the XRP Ledger.
What is a Sandwich Attack?
A sandwich attack is a form of front-running where an attacker places two trades around your trade to profit from the price movement you create. The attacker buys before you (pushing the price up), lets your trade execute at the higher price, then sells immediately after (pocketing the difference).
The name comes from your trade being "sandwiched" between the attacker's buy and sell.
How it Works on the XRPL
Detection. Transactions are passed from server to server before a ledger includes them, so anyone running a server can see your swap, and how much slippage it allows, before it lands.
Front-run. They send a buy for the same token into the same ledger. A higher fee does not move it ahead of yours: the order inside a ledger is shuffled, so they try from several accounts to raise their odds.
Your trade. Your swap executes at a worse price because the attacker already moved the market.
Back-run. The attacker immediately sells the tokens they bought, capturing the price difference as profit.
Why the XRPL is Different
The XRP Ledger closes a ledger every 3-5 seconds, and nobody chooses the order of the transactions inside it. Unlike Ethereum, where a block builder decides the order and can sell the first place, the XRP Ledger shuffles it in a way no one can predict when sending, which makes sandwich attacks harder but not impossible (how the ordering works).
Attackers can still exploit high-slippage trades by submitting transactions in the same ledger window. The XRPL's low fees (0.000012 XRP per transaction) make it cheap to attempt.
When You are Vulnerable
You are most at risk when:
- Trading large amounts relative to the pool's liquidity
- Setting slippage tolerance above 1-2%
- Trading low-liquidity tokens with thin order books
- Executing market orders instead of limit orders
How to Protect Yourself
Keep slippage low. Set your slippage tolerance to 1% or less. This limits how much an attacker can extract from your trade.
Use limit orders. Place offers at a specific price instead of market swaps. Limit orders execute only at your price or better.
Split large trades. Break a big swap into smaller ones to reduce price impact and make sandwiching less profitable.
Check the order book. Before swapping, look at the depth on both sides. Thin books on low-cap tokens are easy targets.
XRPL vs Ethereum MEV
| Factor | XRPL | Ethereum |
|---|---|---|
| Mempool visibility | Seen by any server before validation | Public mempool |
| Transaction ordering | Shuffled, unpredictable | Miner/builder chosen |
| Attack cost | ~0.000012 XRP | Gas bidding wars |
| Block time | 3-5 seconds | 12 seconds |
| Sandwich difficulty | Harder | Easy (MEV bots) |
Key Takeaways
- Sandwich attacks exploit your slippage tolerance to extract value from your trades
- The XRPL's consensus model makes them harder than on Ethereum but not impossible
- Keep slippage at 1% or below to minimize risk
- Use limit orders for large trades
- Split big swaps into smaller ones
- XRPL.to warns you when slippage is set above safe levels