From the perspective of experts at Tan Phat Digital, the evolution of blockchain infrastructure from experimental systems to global financial payment layers has given rise to sophisticated forms of economic exploitation, in which mempool manipulation has emerged as a core challenge to market fairness and efficiency. The mempool, or transaction waiting pool, serves as a temporary buffer where unconfirmed transactions reside before being included in an official block. However, the transparent and unstructured nature of mempools on networks like Ethereum has turned it into a "dark forest" where maximum value mining bots (MEV bots) continuously scan and manipulate transaction ordering (tx ordering) for profit. This manipulation not only causes direct financial loss to users through price slippage and increased gas fees, but also erodes trust in the decentralization of the entire ecosystem.
Mempool Architecture and Trading Order Market Mechanism
Mempool is not a single entity but a collection of local databases maintained by each node in the blockchain network. When a user sends a transaction, it is broadcast via the gossip protocol. Each node that receives a transaction checks its technical validity, such as the digital signature and account balance, before putting it into its mempool and continuing to forward it to neighboring nodes.
Analyzing Mempool Structure and Information Dispersion
In modern Proof-of-Stake (PoS) based networks, the power to decide the content of a block lies in the hands of validators or professional block builder. This process has created a complex MEV supply chain including searchers (opportunity seekers), builders (block builders), relays (relayers) and proposers (block proponents). Searchers monitor the public mempool to identify mineable transactions, then package them into "bundles" and send them to the builder.
The information asymmetry in the mempool stems from the ability to observe and react quickly to pending transactions. Strategic actors often optimize the network layer to achieve the lowest latency in receiving mempool data. By strategically selecting peer nodes based on latency and historical transaction value, an actor can observe a profit opportunity before the rest of the network is aware of its existence.
Comparing mempool characteristics and placement mechanisms on mainnets (2024-2025)
Ethereum Mainnet:
Nature of Mempool: Public and transparent.
Arrangement mechanism: Private auction via MEV-Boost.
Manipulators: Professional Searchers, Builders.
Priority fee: Based on EIP-1559 and Tips.
Level of transparency: Very high.
Solana:
Mempool nature: No traditional mempool (Gulfstream).
Sorting mechanism: Stream auction via Jito.
Manipulators: Jito-Solana Validators, Latency bots.
Priority fees: Jito Tips and Priority Fees.
Level of transparency: Low (due to Leader-based structure).
Layer 2 (Base/Optimism):
Nature of Mempool: Usually centralized through Sequencer.
Sorting mechanism: Time priority (FCFS) or Spam.
Different technical strategies, each targeting a specific vulnerability in the order matching mechanism of decentralized applications (dApps) or the network's consensus mechanism.
Sandwich Attacks
Sandwich attacks are the most common and harmful form of manipulation for DeFi users. In this scenario, a MEV bot detects a large trade order in the mempool that has the potential to significantly change the price of an asset on a decentralized exchange (DEX). The bot will execute two transactions surrounding the user's order:
- out.
Sandwich Attack:
Main mechanism: Command injection before and after the victim transaction.
Consequences: Maximum financial loss due to price slippage.
Popularity: Very high (accounting for over 50% of MEV).
Front-running:
Main mechanism: Copying and paying higher fees to gain priority first.
Consequences: Loss of profit opportunities, transaction failure.
Popularity: High.
Mempool Flooding:
Main mechanism: Sending a series of junk transactions to clog the network.
Consequences: Delayed transactions, sudden increase in gas fees
Popularity: Medium (usually occurs when the market fluctuates).
Oracle Manipulation:
Main mechanism: Manipulating transaction order to skew oracle price.
Consequences: Risk of collateral liquidation.
Popularity: Low but the impact is huge.
Main mechanism: Bundle Auction.
Data from EigenPhi shows that in the period from November 2024 to October 2025, sandwich attacks on Ethereum accounted for about 51.56% of the total MEV transaction volume, reaching a value of about 289.76 million USD. A well-known entity known as "jaredfromsubway.eth" has dominated this market using sophisticated strategies that can target up to four victims at the same time in a single block.
Front-running And Displacement
Front-running is not limited to token swaps but also extends to other areas such as NFT minting and execution arbitrage opportunities. When a user sends a transaction to perform a profitable action, the MEV bot copies the transaction content but replaces the receiving address with its own and pays a higher gas fee to "steal" the opportunity. This often happens during NFT sales or when smart contract vulnerabilities are publicly discovered in the mempool.
Mempool Flooding and Denial of Service (DoS)
Mempool Flooding is a form of attack on the infrastructure layer, where the attacker sends a large amount of junk transactions (spam) with low gas fees but enough to fill the nodes' mempool. The goal of this strategy is usually to slow down the propagation of valid transactions or cause noise to price oracles.
During MakerDAO's "Black Thursday" event in March 2020, attackers used "Hammerbots" to clog the Ethereum network by continuously spreading alternative transactions with the same nonce but without increasing gas fees. This caused the transactions of valid bidders to be removed from the miners' mempool, allowing the attacker to win $8.32 million worth of collateral liquidation auctions at a zero bid.
Classification and impact of mempool manipulation strategies
Direct Implications for End Users
Mempool manipulation is no longer a theoretical problem but has become a "hidden tax" levied on every user transaction on the chain.
Financial Loss and Negative Slippage
The most obvious consequence is the loss of cash. When subjected to a sandwich attack, users are forced to buy assets at a higher price and sell at a lower price than the actual market rate at that time. Although the average profit per sandwich attack dropped to around $3 by the end of 2025 due to competition between bots, the total cumulative damage to the community is still significant. In particular, about 12% of attacks target stable swaps, where users typically expect near-zero price slippage, leading to unforeseen financial shocks.
Rising Gas Fees and Network Inefficiency
Competition between MEV bots creates public or hidden gas fee auctions, driving up transaction costs for everyone. On Layer 2 networks like Base, MEV spambots consumed up to 56% of total gas but contributed only 14% of total fees collected to the network in early 2025. This creates a negative externality, where real users have to pay higher fees to compete for block space with bots running millions of test transactions.
Network efficiency analysis shows that one bot can consume up to 132 million gas (equivalent to 4 full Ethereum blocks) just to execute a single successful arbitrage transaction, after having sent hundreds of previous failed transactions to probe for opportunities.
Risks of Liquidation and Transaction Failure
Manipulating the mempool can prolong the waiting time of a valid transaction, leaving it "stuck" while market conditions change adversely. For users trying to add collateral to avoid liquidation during periods of volatility, transaction delays due to mempool flooding (flooding) can result in the total loss of assets. Furthermore, if sandwich bots push the price beyond the user's slippage tolerance, it will cause the transaction to be reversed, wasting gas without achieving the purpose of the transaction.
Decreased Trust and Opportunity Difference
The dominance of a few large entities in MEV extraction creates an "oligopoly" (oligopoly) environment. As validators and builders prioritize the transaction packages of professional searchers, regular users and retail traders are pushed lower in the block priority order. This lack of fairness reduces the incentive for institutional and individual investors to participate in DeFi, threatening the long-term goal of an open and transparent financial system.
Technical Analysis: Auction Mechanisms and Yield Arbitration
The extraction of value from the mempool is not a random process but follows complex mathematical and behavioral economics models.
Model Figure Bertrand Competition in MEV Mining
Competition among MEV searchers is often described as a Bertrand-style competition, where participants bid for priority in arranging transactions until the profit margin is almost zero. In a game where $n$ searchers find an opportunity worth $v$, the optimal bidding strategy has them pay a fee of $p$ to the builder/validator:
$$p^* = v \cdot \frac{n-1}{n}$$
As $n$ goes to infinity, the fee paid to the validator approaches the full value of the opportunity, leaving little profit for the searcher but causing a loss maximum for users. This explains why in 2025, more than 90% of arbitrage revenue on Ethereum actually went to validators through priority fees and tips.
Mathematical Analysis of the Breadcrumb Attack Optimal Point
To carry out an effective sandwich attack, the bot must accurately calculate the size of the front-run order. Suppose a liquidity pool has reserves of two assets $R_x$ and $R_y$, and the user wants to place a buy order for $x$ amount of assets with size $dx$. The Searcher needs to determine the amount of front-run $a$ so that the profit earned from the back-run order after deducting gas fees is the largest.
Based on the constant product formula $x \cdot y = k$, the raw profit $\pi$ is determined by the difference between the buy price and the sell price after the victim's transaction has changed the state of the tank. The Nash equilibrium for front-run size $a^*$ is defined as:
$$a^* = \sqrt{R(R + dx)} - R$$
This calculation takes place in milliseconds as soon as a user transaction appears in the mempool, showing the sophistication of modern bot systems.
Comparing revenue and MEV extraction efficiency (2025)
Core entities: Less than 20 entities.Solana (Jito):
Annual MEV revenue: About 540 million USD.
Percentage of fees paid to Validator: Over 60%.
Average profit per transaction: About 1.58 USD.
Number of core entities: Top 3 account for 60%.
Main mechanism: Stream Auction.
Polygon:
Annual MEV revenue: About 1% of total TVL.
MinimizeFlashbots Protect:
Success rate: 98.5%.
Response time: 245ms.
Protection level: Excellent.
Refund mechanism (Rebate): 90% of backrun value.
MEV Blocker:
Success rate: 96.2%.
Response time: 180ms.
Protection level: Good.
Refund mechanism (Rebate): Based on registration fee builder.
Merkle:
Success rate: 94.8%.
Response time: 220ms.
Protection level: Very good.
Refund mechanism (Rebate): Fixed payment according to delivery Transaction.
Blink:
Success rate: 92.1%.
Response time: 165ms.
Protection level: Good.
Refund mechanism (Rebate): Fixed payment according to delivery Transaction.
Slippage Tolerance: Keeping slippage low (e.g. 0.1% - 0.5%) will make sandwich attacks financially unfeasible economics for bots, as profit margins are significantly narrowed.
Order Splitting:Executing many small transactions instead of one large order reduces the price impact in each block, thereby reducing the appeal for MEV bots.
Expert Mode and Auto Tax Features: In DEXs like Uniswap or PancakeSwap, "Expert Mode" allowing users to execute trades with extremely high slippage without warning. If not used carefully, this is an "invitation ticket" for sandwich bots. In contrast, the "Auto Tax" feature helps automatically calculate conversion fees for tokens with burn or tax mechanisms, preventing transactions from failing due to a shortage of actual receipts.
Gas Fee Optimization: Set gas fees that are competitive but not too high to avoid being targeted by front-running bots looking for "lucrative" transactions that can pay high fees.
Sandwich (Public Mempool): Risk under securities laws is low to moderate; Risk under the average commodity law. Classification: Infrastructure mining.
Sandwich (Private Order): Risk under securities laws is very high; Risks under commodity law are very high. Classification: Insider trading.
Oracle Manipulation: High risk under securities laws; Risks under commodity law are very high. Classification: Price manipulation.
Front-running: High risk under securities laws; Risks under commodity law are high. Classification: Transactional identity theft.
To deal with increasing manipulation, users and protocol developers have implemented a series of protections from the wallet level to the network consensus level.
Using Private RPC Endpoints
The most effective solution for individual users in 2025 is the use of private RPC endpoints such as Flashbots Protect, MEV Blocker, Merkle or Blink. Instead of broadcasting transactions to a public mempool where bots can observe, these RPCs send transactions directly to trusted block builders.
These services not only prevent sandwich attacks but also implement an Order Flow Auction (OFA) mechanism, where back-running opportunities created by user transactions will be auctioned and a portion of the profits (usually 90%) will be returned directly to the user in the form of "MEV rebate". In 2025, Flashbots Protect processed approximately 2% of all transactions on Ethereum, with the highest return for a single transaction reaching 10.83 ETH.
See also: What is Transaction ID (TxID)
Comparing Top MEV Protection RPC Services (Test Data 2025)
Adjust Trading Parameters and Expert Mode
Users can proactively configure wallets and DEX interfaces to minimize the risk of being targeted by bots:
Resistance Protocols MEV Structure (CoW Protocol)
CoW Protocol represents a new approach by fundamentally changing the way orders are matched. Instead of submitting the transaction directly to the mempool, the user submits a transaction "intent". The protocol uses Batch Auctions, where multiple orders are gathered and settled at the same time at a unified price (Uniform Clearing Prices).
The "Coincidence of Wants" (CoW) mechanism allows for direct order matching between users with opposing needs (for example: A sells ETH to buy USDC, B sells USDC to buy ETH) without going through an on-chain liquidity pool, thereby completely eliminating the possibility attacked by bots. Actual results show that transactions via CoW Protocol typically have 9 to 21 basis points (bps) better execution prices than traditional methods.
Case Analysis: Black Thursday Event and Lessons on Sustainability
Black Thursday event (March 12, 2020) remains the most important case study of how mempool manipulation can destroy a financial system come on. When the price of ETH dropped 50% in one day, demand to liquidate assets on MakerDAO skyrocketed. However, due to the network being spammed by Hammerbots, miners' mempools were filled with transactions that had no real value.
Ethereum nodes with the default mempool configuration were forced to evict valid transactions to protect system resources. This creates a "competition gap" where only an attacker who knows how to optimize message transmission can inject commands into the block. As a result, 1,462 liquidation auctions (36.6% of the total) ended with zero bids, causing a severe asset deficit for the MakerDAO system and forcing the protocol to issue additional MKR tokens to compensate.
The subsequent class action lawsuit against the Maker Ecosystem Growth Foundation was dismissed in 2023, but it left a valuable lesson about how protocols must be designed to withstand withstand manipulation at the mempool layer.
The Future of Blockchain Design: Encrypted Mempools and eMEV
The industry is moving towards solving the problem at its root through changes at the protocol level.
Encrypted Mempools
Projects such as Shutter Network and FAIR L1 are pioneering the use of threshold encryption (threshold encryption) to keep transaction contents private in mempool. The transaction is decrypted only after its order has been finalized by the consensus mechanism. This eliminates the ability to observe assets to perform front-running or sandwich attacks, as bots cannot know which assets users are buying or selling until it is too late to intervene.
Enshrined MEV (eMEV)
Instead of trying to completely remove MEV, some researchers propose integrating the MEV auction mechanism directly into the consensus layer (Enshrined MEV). The goal is to transfer the value extracted from the hands of centralized builder entities back to the network itself (e.g., through fee burning or staker distribution), while also establishing fair ordering rules to protect end users.
However, technical analyzes indicate that "fair ordering" is a difficult goal to achieve on permissionless networks due to state synchronization and latency issues network. Current protocols such as Arbitrum or Optimism are still relying on centralized sequencers to implement FCFS policy, but this is only a temporary solution and still poses risks from manipulation by the entity operating the sequencer itself.
Legal and Regulatory Aspects of Mempool Manipulation
The legality of extracting MEV through transaction order manipulation remains a topic of intense debate in the legal world
Analysis Under U.S. Securities and Commodities Laws
Recent research articles have analyzed MEV through the lens of Rule 10b-5 (SEC) and Rule 180.1 (CFTC) on combating market manipulation. A key point is whether validators hold a position of "trust" with users. If a validator is considered a financial intermediary with an obligation to execute the best transaction for the customer, then intentionally re-arranging the transaction for personal gain could be considered fraud or a breach of fiduciary duty.
Furthermore, sandwich attacks targeting private order flows have much higher legal risks than public mempools. When a user submits a private transaction with an expectation of confidentiality, the act of a validator taking advantage of that information to front-run could constitute the crime of insider trading.
Legal risks of MEV techniques
Typical Case Studies
1. Black Monday (August 5, 2024): Builders's dominance During a day of extreme market volatility, Builder 0x3b collected 1,448 ETH (about 3.5 million USD) simply by optimizing the block arrangement containing liquidation and arbitrage orders. Block 20459000 alone brought in over 800,000 USD from a single liquidation event.
2. Bot "E6Y" on Solana: The Ultimate Sandwich Machine This entity controlled up to 42% of the total sandwich attack volume on Solana in early 2025. With a trading volume of more than 1.6 billion USD in 30 days, this bot generated a net profit of about 300,000 USD per day after paying thousands of SOL in "tips" to Jito.
3. MakerDAO Black Thursday (2020): Lessons on mempool flooding Attackers use "Hammerbots" to spam a series of junk transactions, clogging the mempool of Ethereum validators. This prevented valid auction transactions, allowing the attacker to purchase $8.32 million in liquidated assets at a bid of zero.
4. Exploiting Vyper on Curve Finance (2023): Front-run Race When the reentrancy vulnerability in the Vyper compiler was discovered, a MEV war broke out in the mempool. Although 69 million USD was lost, thanks to white-hat hackers successfully performing the front-run, about 16.7 million USD was rescued promptly before falling into the wrong hands.
5. JIT Liquidity Whale (Bot 0xa57 6CF): Instant Liquidity Monopoly A single bot captured 92% of the total profits from the Just-in-Time (JIT) strategy on Uniswap V3. This strategy requires extremely large capital (an average of 269 times the trading volume) to "jump" in to provide liquidity right before a large order and withdraw immediately afterward.
6. Oligopoly Spam on Base (2025): When bots "devour" the infrastructureThere are only two entities responsible for more than 80% of spam transactions on the Base network. These bots consume 56% of the network's total gas but only contribute 14% of fees, causing gas fees to remain artificially high for real users.
7. Jaredfromsubway.eth: Multilayer Sandwich Technique Ethereum's most famous MEV bot has upgraded its strategy to be able to "sandwich" 4 victims simultaneously in a single block. By inserting central transactions to push price slippage further, this bot maximizes the profit extracted from each block.
8. Mining Polymarket Prediction Pools (2024)MEV bots successfully extracted 2.3 million USD from Polymarket prediction pools through front-running. Attackers take advantage of changing odds in the mempool to place orders in front of users, causing direct damage to those participating in predicting political and sports events.
9. DeezNode and Validator MEV (Solana) Validator "HM5 H6" operated by DeezNode holds over 168 million USD of authorized SOL. This entity uses its node operating advantage to support the vpeNAL sandwich bot, conducting more than 1.5 million sandwich transactions in a month, reaping huge profits directly from Solana users.
10. Builder-Searcher Collusion (2024): Risk of centralizationResearch discovered collusion between block builder and searcher in more than 2,000 transactions (worth 350 ETH). Instead of a fair auction, these entities share private mempool information to eliminate competition, creating an unhealthy environment for end-user transactions.
Frequently Asked Questions (FAQ)
Here are 15 of the most common questions to help users master the concepts and solutions for protecting assets against mempool manipulation during the year 2025:
1. What is MEV and why is it important? MEV (Maximal Extractable Value) is the maximum profit that a validator or miner can obtain by changing the order, adding or removing transactions in a block. It is important because it directly affects your transaction execution price and network fees.
2. How does a Sandwich attack specifically work? MEV bot detects your large buy order, it places a buy order in advance (front-run) to push the price up, then you buy at a high price, and finally the bot sells immediately afterward (back-run) to take profit from your price slippage.
3. How to install Flashbots Protect on MetaMask wallet? Open MetaMask, go to "Add Network", select "Add a network manually" and fill in the information: Network Name (Flashbots RPC), New RPC URL (https://rpc.flashbots.net), Chain ID (1). Once saved, switch to this network when making transactions .
4. Why do gas fees spike when there is mempool manipulation? MEV bots compete fiercely by continuously paying higher gas fees (gas wars) or sending a series of junk transactions (spam) to take up block space, causing normal users to also pay high fees to be confirmed.
5. How is private RPC different from public RPC? Public RPC spreads your transaction across the network, making it visible to bots. Private RPCs (like Flashbots) send transactions directly to validators, making them "invisible" until included in the block.
6. What are the main differences in MEV between Ethereum and Solana?Ethereum uses a closed bundle auction model (MEV-Boost), while Solana does not have a traditional mempool and uses a streamed auction mechanism via Jito, which requires bots to have extremely low latency.
7. How does CoW Protocol protect users? CoW Protocol uses batch auctions and direct order matching between users (CoW matching) without going through a mempool, completely eliminating the risk of price clamping by bots.
8. What is the Black Thursday event and what are the lessons learned? In 2020, Ethereum mempool was spammed (Hammerbots) making it impossible for users to submit liquidation bids, leading to attackers buying liquidated assets at almost zero price. The lesson is that protocols need to be designed to be spam-resistant at the mempool layer.
9. What is the "Dark Forest" in mempool? This is a term referring to a public mempool where every transaction is observed by thousands of predatory bots ready to front-run any profit opportunity .
10. What is the "MEV rebate" mechanism?Some RPC services (like MEV Blocker or Flashbots MEV-Share) will auction the opportunity to back-run your trades to bots and return up to 90% of those profits to yourself .
11. Is all MEV activity harmful to the ecosystem? Not really. Arbitrage helps balance prices between DEXs, while liquidations help maintain the stability of lending protocols. However, sandwich attacks always cause direct harm to the end user.
12. What is cross-chain MEV and its risks? This is where bots exploit price differences between different chains through bridges. The biggest risk is the concentration of power in the hands of entities that operate bridges and infrastructure .
13. Is mempool manipulation illegal? In 2025, agencies like the SEC and CFTC are looking at MEV through the lens of market manipulation and insider trading, especially when validators exploit information from private order flows.
14. How will Encrypted Mempool change the future? It will keep the transaction content private until the order is finalized, making it impossible for bots to know what you intend to buy or sell to attack, promising a fairer trading environment.
15. Which wallet should you use to best protect against MEV in 2025? Wallets that support private RPC integration or hardware wallets with blind signing prevention are the best choice. However, the most important thing is still to configure a secure RPC connection point.
Mempool manipulation has become an integral but controversial component of blockchain economics. While some argue that MEV makes the market more efficient by accelerating price adjustments, the reality is that much of the value extracted is a form of unfair transfer of wealth from users to the entities operating the infrastructure.
For users, Tan Phat Digital recommends caution as key. Using tools like protective RPC (Flashbots Protect, MEV Blocker) and intent-based exchanges (CoW Swap) is no longer a choice but a necessity to stay profitable in today's DeFi environment. Settings such as low slippage and gas fee controls need to be implemented in a disciplined manner.
For developers and researchers, the top priority is decentralizing the MEV supply chain and implementing cryptographic solutions at the protocol level. Only when the “window of opportunity” for manipulation is closed or fairly regulated can blockchain truly become a trusted financial infrastructure for billions of global users. The shift from "exploiting inefficiencies" to "optimizing user benefits" will be the measure of success for blockchain networks in the next phase of development.
Share
