Sandwich Attacks on Solana: Mechanics and Defenses

Ethereum traders long ago learned to fear the public mempool — the pool of pending transactions where searchers can read your intent before a single block is confirmed. Solana was supposed to be different. There is no global mempool. Transactions land on the network, get forwarded to the current leader, and settle in roughly 400 ms. Yet a solana sandwich bot still extracts value from unsuspecting traders every day. Understanding why — and what to do about it — is non-negotiable if you trade on Solana or build anything that touches liquidity.

How Sandwiching Survives Without a Public Mempool

Solana validators receive transactions directly via the TPU (Transaction Processing Unit) pipeline. Those transactions are technically private — there is no shared pending queue anyone can query at will. The attack surface comes from a different layer: Jito.

Jito is an alternative validator client that processes a substantial share of Solana's block space. Its defining feature is the bundle: a set of atomically ordered transactions that a searcher submits together with a tip. Critically, Jito also exposes a block engine that allows external parties to stream pending transactions before they are committed. Searchers subscribe to these pre-confirmation transaction streams — effectively a private mempool — via Jito's geyser-compatible infrastructure.

Here is the exact attack sequence:

1. A victim submits a swap on a DEX (e.g., Raydium, Orca, Lifinity) with a slippage tolerance of 1–3%.
2. The searcher's bot picks up the transaction from the Jito block engine stream within milliseconds.
3. The searcher submits a Jito bundle containing three ordered transactions: a front-run buy, the victim's swap, and a back-run sell — all landing in the same slot.
4. The front-run increases the price the victim pays; the back-run captures the difference. The victim's trade executes within their slippage tolerance, so the transaction succeeds; the profit silently leaves their wallet.

The tip paid to the Jito validator replaces the priority fee auction that drives MEV on Ethereum. Higher tips mean more reliable bundle ordering. A competitive solana sandwich bot constantly monitors tip prices and adjusts to win the ordering game.

What Geyser Streams and Priority Fees Actually Change

Two variables shift the risk landscape for attackers and defenders alike.

Geyser streams are the real mempool replacement. Any searcher with access to a Jito block engine subscription — or a custom geyser plugin feeding a co-located validator — sees transaction intent before finality. Latency here is not measured in seconds but in microseconds. The searcher who is closer to the validator wins the race. A victim whose transaction arrives over a public RPC endpoint with high latency is especially exposed.

Priority fees determine slot position when bundles are not used. A transaction with a higher computeUnitPrice is processed earlier in a slot. For defenders, setting a realistic but not recklessly high priority fee matters: too low and your transaction sits behind everything; too high and you make yourself a more attractive sandwich target by signaling you are willing to pay for urgency.

Hardening Your Trades and Protocols

Defense is layered. No single fix eliminates risk, but each layer raises the cost of a successful attack.

• Use private RPC endpoints or send directly to Jito. Submitting through a public endpoint means your transaction is readable by anyone running a geyser plugin. Jito's own transaction submission endpoint allows you to submit directly, bypassing the public gossip layer.
• Set tight slippage, not wide. Wide slippage is an invitation. A 0.1% tolerance on a liquid pair prevents the sandwich from being profitable even if the front-run lands.
• Commit-reveal schemes and versioned transactions with compute limits reduce the window in which intent is legible. Protocols can enforce minimum tick sizes on AMMs that make micro-price manipulation unprofitable.
• Use CLOBs over AMMs where possible. Central limit order book venues like Phoenix match makers and takers at declared prices — there is no slippage parameter to exploit, and your limit order does not expose directional intent in the same way a market swap does.
• For protocols: audit your simulation paths. Anti-rug simulation — running a transaction against the current state before broadcasting — can catch situations where expected output diverges significantly from simulated output, an early indicator you are being front-run.
• Kill-switches on automated strategies. If your bot detects that its fills are consistently worse than simulation predicted by more than a threshold, halt and alert. This is the operational equivalent of a circuit breaker.

The team behind our Solana sniper bot ran into this problem directly: aggressive slippage settings meant the bot was getting sandwiched on almost every entry. The fix involved routing through Jito bundles with a concurrent back-off on slippage when detected fill degradation exceeded a configurable threshold — cutting sandwich losses by over 80% in backtests.

Building MEV-Aware Systems

MEV is not a bug to be patched away — it is a structural property of any blockchain with public ordering. The question is whether your system is designed to account for it.

For trading bot developers, this means co-locating as close to validators as possible, building latency-sensitive subscription clients for geyser streams, and treating bundle submission as a first-class primitive rather than an afterthought. For traders, it means understanding that the swap UI's default settings are rarely optimal, and that the difference between a profitable strategy and a breakeven one sometimes comes down to a single RPC endpoint choice.

Our trading-bot services cover both angles: infrastructure design for low-latency execution and protocol-level MEV hardening for teams building on Solana, Hyperliquid, and Polymarket.

---

Ready to build a sandwich-resistant trading system or harden an existing strategy? Start a project with TierZero and let's talk through your specific execution environment.