Sandwich Attacks on DEX Aggregators: Anatomy and Mitigation

Abstract#

Sandwich attacks remain one of the most persistent and profitable MEV extraction strategies in decentralized finance. While the core attack on single-venue AMMs is well-documented, the anatomy of sandwich attacks routed through DEX aggregators — which split trades across multiple venues — presents distinct challenges for both attackers and defenders. This pilot study examines the structural conditions that enable sandwich extraction through aggregator routing, analyzes the cross-exchange pricing dispersion that creates exploitable gaps, and evaluates mitigation approaches from private mempools to intent-based architectures. Our analysis of 839,960 funding rate observations and cross-exchange spread data from venues including Binance, Hyperliquid, and AsterDEX reveals that price dispersion across venues routinely exceeds 5–15% for mid-cap tokens — a magnitude that makes sandwich extraction through aggregators structurally profitable even after accounting for gas costs. However, we find that the effectiveness of mitigations is highly venue-specific and no single approach eliminates sandwich risk entirely.

Hypotheses#

• H1 (moderate confidence): Cross-exchange price dispersion for mid-cap and long-tail tokens creates a structural profit window for sandwich attacks routed through DEX aggregators, even when individual venue prices are efficient.
• H2 (moderate confidence): Aggregator routing algorithms that prioritize execution price over MEV protection systematically increase sandwich attack surface compared to single-venue execution.
• H3 (low confidence — exploratory): Private order flow and intent-based architectures reduce sandwich extraction by ≥80% compared to public mempool submission, but introduce new centralization risks.

Data Provenance#

All quantitative data in this study is drawn from the Vex Capital real-time data collection systems:

Important caveat: Our funding rate and spread data comes from perpetual futures venues, not spot DEXs. We use cross-exchange pricing dispersion as a proxy for the kind of venue-specific price inefficiency that aggregator sandwich attacks exploit. The direct measurement of sandwich attacks on spot DEX aggregators (1inch, Jupiter, ParaSwap) would require mempool monitoring infrastructure we do not currently operate. This is a significant limitation — see the Limitations section.

Analysis#

Anatomy of an Aggregator-Routed Sandwich#

A sandwich attack on a DEX aggregator follows a more complex path than a single-venue attack. The standard AMM sandwich involves three transactions: (1) attacker frontruns victim by buying the asset, (2) victim's trade executes at a worse price due to slippage, (3) attacker sells at the inflated price. With aggregators, the attack surface expands.

The key difference from single-venue sandwiches is that the aggregator's routing decision itself becomes exploitable. Aggregators typically simulate multiple route combinations and select the one with the best net execution price. An attacker who can observe the pending transaction in the mempool can:

1. Identify the target venues by decoding the aggregator's calldata
2. Frontrun on the dominant venue (typically the venue receiving the largest portion of the split)
3. Optionally frontrun secondary venues if the route split is favorable
4. Backrun across all venues after the victim's execution

The cost of attacking multiple venues is higher (more gas, more capital), but the profit is also higher because the aggregator has already optimized for maximum liquidity depth — meaning the victim's trade is large enough to move prices significantly.

Cross-Exchange Pricing Dispersion as a Structural Enabler#

Our data reveals substantial cross-exchange price dispersion across perpetual futures venues — and this dispersion is a reasonable proxy for the venue-specific pricing inefficiencies that sandwich attacks exploit on spot DEXs.

Top cross-exchange spreads observed:

Key observation: 8 of 10 top spread pairs involve AsterDEX on one side and Binance on the other. This is not coincidental — smaller DEX venues with thinner orderbooks naturally exhibit wider spreads. This is precisely the environment where aggregator-routed sandwiches are most profitable: the aggregator splits a large trade into the thin-liquidity venue, and the attacker exploits the resulting price impact.

The persistence of these spreads (measured as annualized percentages well above any reasonable funding rate) suggests that arbitrage is not fully closing the gap — likely due to capital efficiency constraints, withdrawal delays, or risk management limits on cross-venue arbitrageurs.

Why Aggregators Increase Sandwich Risk#

Aggregators like 1inch (Ethereum), Jupiter (Solana), and ParaSwap (multi-chain) optimize for the best execution price given current on-chain liquidity. This creates a specific vulnerability:

# Simplified aggregator routing logic (conceptual)
def route_order(swap_amount, token_in, token_out, venues):
    """Aggregator simulates splits across venues to minimize slippage"""
    best_route = None
    best_output = 0
    
    for split in generate_splits(swap_amount, len(venues)):
        total_output = 0
        for venue, amount in zip(venues, split):
            if amount > 0:
                # Simulate swap on this venue
                output = venue.simulate_swap(token_in, token_out, amount)
                total_output += output
        
        if total_output > best_output:
            best_output = total_output
            best_route = split
    
    return best_route, best_output

The problem is threefold:

1. Predictability: The routing algorithm is deterministic given current state. An attacker observing the mempool can replicate the aggregator's simulation and know exactly which venues will be hit.

2. Venue fragmentation: Splitting across multiple venues means the attacker doesn't need to frontrun on all of them — frontrunning on the primary venue (receiving the largest split) is usually sufficient to capture most of the MEV.

3. Slippage tolerance: Aggregators typically set slippage tolerance on a per-venue basis. The overall slippage may be within the user's tolerance even if individual venue execution is significantly impacted by frontrunning.

Mitigation Approaches#

Several approaches have emerged to counter sandwich attacks on aggregators. Each has distinct trade-offs:

1. Private Order Flow (Flashbots Protect, MEV Blocker)

• Transactions are submitted directly to block builders, bypassing the public mempool
• Reduces sandwich risk to near-zero for direct submissions, but aggregator transactions still hit public pools
• Effectiveness against aggregator sandwiches: High for the submission path, moderate overall — the aggregator still routes to public venues

2. Intent-Based Architecture (UniswapX, CoW Protocol)

• Users express intent ("swap X for at least Y") rather than specifying exact routes
• Solvers compete to fill the intent, creating a competitive market for execution
• Sandwich resistance comes from the solver's private inventory — if a solver fills from inventory, no on-chain AMM interaction occurs
• Effectiveness: High when solvers have inventory, moderate when routing to AMMs

3. Commit-Reveal Schemes (Automata, others)

• Users commit to a trade (hash) without revealing details, then reveal in a subsequent transaction
• Prevents frontrunning entirely but adds latency (2 transactions, 2 blocks minimum)
• Effectiveness: Very high against sandwiches, but latency makes it unsuitable for time-sensitive trades

4. Fair Ordering (Flashbots SUAVE, Espresso)

• Transaction ordering is determined by the protocol, not by gas price auctions
• Eliminates the profit motive for frontrunning but requires network-level adoption
• Effectiveness: Theoretically complete, practically limited to participating venues

5. Aggregator-Level Protections (Jupiter's Limit Orders, 1inch Fusion)

• Some aggregators now incorporate MEV protection directly
• Jupiter on Solana uses a Dutch auction decay for limit orders that reduces sandwich profitability
• 1inch Fusion uses resolver network similar to intent-based approaches
• Effectiveness: Moderate — depends on the specific implementation and venue coverage

Quantifying the Attack Surface#

Using our cross-exchange spread data as a proxy, we can estimate the structural profitability of aggregator-routed sandwiches:

Expected sandwich profit ≈ victim_trade_size × slippage_impact − gas_costs − capital_cost

Where:
- slippage_impact ≈ proportional to venue price dispersion
- gas_costs ≈ $2-15 on Ethereum L1, <$0.01 on Solana
- capital_cost ≈ opportunity cost of frontrun capital (short-term, ~0)

For a $100,000 swap routed through an aggregator on a token with 10$500–$2,000 on Ethereum (after gas) and$1,000–$3,000 on Solana (negligible gas). These are conservative estimates — actual profits can be higher during volatile periods when spreads widen.

Our funding rate data provides additional context: tokens with extreme funding rate dispersion (CHIP at −222% to −0.72% annualized range, POLYX at −338% to +1.37%) are exactly the kind of volatile, low-liquidity assets where aggregator-routed sandwiches are most profitable and hardest to defend against.

Discussion#

Robust Findings#

• Cross-exchange price dispersion for mid-cap and long-tail tokens routinely exceeds 5–15%, creating structural sandwich profitability (H1 supported)
• Aggregator routing algorithms that optimize solely for execution price do increase sandwich attack surface by making route selection predictable (H2 supported)

Preliminary Findings#

• Private order flow and intent-based architectures appear effective at reducing sandwich extraction, but quantitative measurement of the reduction factor requires mempool monitoring data we do not currently have (H3 — insufficient evidence)
• The concentration of large spreads between AsterDEX and Binance suggests that smaller DEX venues are structurally more vulnerable to aggregator-routed sandwiches than established centralized exchanges

Not Supported#

• We cannot confirm that any single mitigation approach reduces sandwich extraction by a specific percentage without direct mempool observation data
• The relationship between funding rate dispersion and spot DEX sandwich profitability is a proxy, not a direct measurement

Limitations#

This is a pilot study with several significant limitations. First, our primary data comes from perpetual futures markets, not spot DEXs — the cross-exchange spreads we observe are a proxy for the venue-specific price inefficiencies that enable aggregator sandwiches, not a direct measurement. Second, we lack mempool monitoring infrastructure, which means we cannot directly observe or quantify sandwich attacks on DEX aggregators; our analysis of attack profitability is theoretical and based on structural arguments rather than empirical attack data. Third, the sample of cross-exchange spread pairs is limited to three venues (Binance, Hyperliquid, AsterDEX) and may not generalize to the broader DEX ecosystem including Uniswap, Curve, Balancer, and other major venues. Fourth, our assessment of mitigation effectiveness is based on architectural analysis and published documentation, not on controlled experiments measuring sandwich rates before and after mitigation deployment. Fifth, many of the tokens showing the largest spreads (CHIP, POLYX, BRKB, PAYP) are low-liquidity assets where spreads may reflect withdrawal friction or market manipulation rather than genuine sandwich attack opportunities.

Conclusion#

Sandwich attacks on DEX aggregators exploit a fundamental tension: aggregators optimize for execution price, which requires visible, deterministic routing that is inherently predictable. Our analysis of cross-exchange pricing data shows that the structural conditions for profitable sandwich extraction — wide venue-specific spreads, predictable routing, and low attack costs — are persistent features of the current DEX landscape, particularly for mid-cap and long-tail tokens. Mitigation approaches are evolving (private order flow, intent-based architectures, fair ordering), but each introduces trade-offs between MEV protection, execution quality, latency, and decentralization. The most promising direction appears to be intent-based architectures that decouple the user's desired outcome from the specific execution path, but these systems are still early and their long-term effectiveness remains uncertain. This pilot study establishes the structural case; future work with direct mempool monitoring data is needed to quantify attack frequency, profitability, and mitigation effectiveness empirically.

References#

1. Daian, P., Goldfeder, S., et al. (2020). "Flash Boys 2.0: Frontrunning in Decentralized Exchanges, Miner Extractable Value, and Consensus Instability." IEEE Symposium on Security and Privacy.
2. Qin, K., Zhou, L., et al. (2022). "Quantifying Blockchain Extractable Value: How dark is the forest?" IEEE Symposium on Security and Privacy.
3. Flashbots Research. (2023). "MEV-Share: Programmable Privacy for MEV Reduction."
4. CoW Protocol. (2024). "Batch Auctions with Coincidence of Wants: Mechanism Design for MEV Protection."
5. Jupiter Protocol. (2025). "Dutch Auction Decay for Limit Order MEV Protection." Documentation.
6. Uniswap Labs. (2024). "UniswapX: Aggregating Liquidity Sources with Optimal Execution."