Remeasuring the Arbitrage and Sandwich Attacks of Maximal Extractable Value in Ethereum

• Existing heuristic methods miss advanced MEV forms and may label unprofitable transactions as MEV because they compare token amounts without confirming realized profit.Source: §1 · p. 2
• The study compiles transactions and blocks through August 2023, spanning periods before and after The Merge and the introduction of PBS.Source: §1 · p. 2
• A token-exchange-rate profitability algorithm supports separate algorithms for identifying naive and advanced arbitrages and sandwich attacks.Source: §1 · p. 2
• 16.4% more arbitrages and 1.2% more sandwich attacks are detected than state-of-the-art methods, with at most 2.4% false positive/negative rates.Source: §1 · p. 3
• 9.4 million in-the-wild MEV activities are identified in the collected dataset.Source: §1 · p. 3
• Emerging meme tokens are prominent MEV targets, while private architectures shift searchers away from the mempool and make lower-profit opportunities viable.Source: §1 · p. 3
• Back-running is increasingly important in frequency and revenue, although MEV-Share and MEV-Blocker adoption remains incomplete and Builder exploitation obtained 620K USD.Source: §1 · p. 3

2.1 Ethereum

• Ethereum transactions encode account and smart-contract interactions, while PBS separates block construction by builders from block proposal by proposers.Source: §2.1 · pp. 3–4

2.2 Decentralized Finance & Tokens

• DeFi applications support financial operations, with DEX swaps exchanging tokens and potentially creating price slippage when liquidity is inadequate.Source: §2.2 · p. 4

2.3 Maximal Extractable Value Extraction

• MEV is value extracted beyond block rewards and gas fees by selecting, adjusting, or reordering transactions; participating accounts are MEV searchers.Source: §2.3 · p. 4

Front-running & Back-running.

• Front-running places an MEV transaction before a target, whereas back-running places it after the target to capitalize on execution-induced market changes.Source: Front-running & Back-running · p. 4

Common Types of MEV

• Arbitrage exploits price differences across DEXes, while sandwich attacks combine front- and back-running to profit from victim-trade price slippage.Source: Common Types of MEV · p. 5

MEV Forms

• MEV evolves from mempool-based early activity and priority gas auctions, through Flashbots private pools, to PBS-stage architectures involving builders, relays, and proposers.Source: MEV Forms · pp. 5–6

• Geth data collection parsed over 2 billion transactions, 3 billion emitted events, and 5.5 billion traces from blocks 0 through 18,000,000.Source: §3 · p. 6
• Blocknative and Flashbots sources yielded 36 million private transactions, while Relay APIs supplied more than 2 million PBS blocks.Source: §3 · p. 6
• The study uses Blocknative, Flashbots, and Relay APIs alongside Ethereum data, and states that all collected data are publicly available.Source: §3 · p. 6
• PBS blocks cannot be distinguished by block construction time because normal blocks continued to appear after The Merge.Source: §3 · p. 6

4.1 Limitations of Existing Methods & Case Studies

• Heuristic detectors can miss profitable arbitrages with nonchronological swaps or slightly mismatched intermediate amounts, and complex sandwiches with multiple attack transactions.These cases violate conventional rules while still producing attacker profits.Source: §4.1 · p. 8

4.2 Profitability Identification

• The profitability algorithm tests whether token losses can be covered by gains after aggregating trader balance changes and converting tokens through the best available swap path.It removes irrelevant addresses, evaluates token-change pairs, and accepts transactions only when all losses are covered.Source: §4.2 · pp. 9–10

4.3 Identifying Arbitrage & Sandwich Attack

• The arbitrage detector builds a token-flow graph from recognized swap events, requires a cycle, checks profitability, and distinguishes front-running from back-running by replaying the transaction.The method does not require swaps to appear in sequential order.Source: Identifying Arbitrages · pp. 10–11, §4.2 · p. 10

Identifying Arbitrages.

• The paper names sandwiches with multiple victims between two attacks multi-layered burger attacks, and sandwiches with multiple attack transactions conjoined sandwich attacks.These terms capture extensions beyond the typical one-victim, two-attack pattern.Source: Identifying Sandwich Attacks · p. 11

Identifying Sandwich Attacks.

• The sandwich detector identifies chronological attack-victim patterns with shared addresses and opposite swap directions, combines overlapping attacks, and retains profitable combinations.This supports multi-transaction attack structures rather than restricting detection to a single attack pair.Source: Identifying Sandwich Attacks · pp. 11–12, Identifying Arbitrages · p. 11

Research Questions

• The study separately asks what characterizes emerging back-running arbitrages after Ethereum’s transaction-architecture changes.This is RQ3.Source: §5 · p. 12

Dataset Comparison

• For comparison, the authors use the open Weintraub dataset for arbitrages and the ZeroMEV dataset for sandwich attacks because prior studies lack comparable public data.They do not use Z. Li et al.’s results as a baseline because its dataset is unavailable.Source: §5 · p. 12

Experimental Setting

• The experimental design spans all DEXes listed on DefiLlama, covers 44 swap patterns, and uses a Ganache-based replay environment for transaction-position analysis.The replay environment supports the private-architecture and back-running questions.Source: §5 · p. 12

6.1 Identified MEV Activities

• Approximately 9.4 million MEV activities comprise 6,331,851 arbitrages and 3,016,971 sandwich attacks, including 13.1% multi-layered burger and 1.1% conjoined sandwich attacks.Conjoined sandwich attacks have nearly five times the median profit of other sandwich types because multiple transactions can create larger price deviations; their median victim counts are 2 and 4, respectively, for the two advanced types.Source: §6.1 · p. 13, Table 2 · p. 13
• The findings indicate that complicated MEV activities are fewer but more profitable, while emerging tokens increasingly become targets alongside heavily used DEXes and tokens.The paper attributes emerging-token opportunities to frequent price fluctuations and possible price slippage.Source: §6.1 · p. 14, §6.3 · p. 16

Arbitrages Comparison.

• Existing arbitrage methods miss transactions because of limited swap patterns and strict token-amount or chronological rules, with roughly 15% mislabeled as negatives by Weintraub.Among transactions exclusively detected by the proposed method, limited swap patterns account for 81.6%, strict token comparison for 11.0%, and strict chronology for 3.8%.Source: Table 3 · p. 13, Arbitrages Comparison · p. 14
• The method excludes final-token-loss transactions and does not count profits transferred through collusion, making its arbitrage identification conservative.These choices explain 27.3% of transactions missed by the method and leave 91,980 potentially profitable transactions outside its detections.Source: Arbitrages Comparison · p. 14

6.2 Comparison with Existing Methods

• Compared with existing methods, the proposed detector achieves arbitrage FPR/FNR of 0.6%/2.4% and sandwich FPR/FNR of approximately 0%/2.4%.The method identifies 3,910,444 arbitrages versus Weintraub’s 3,358,371 and 1,265,929 sandwich attacks versus ZeroMEV’s 1,251,072 within the compared ranges.Source: Sandwich Attack Comparison · pp. 14–15, Arbitrages Comparison · p. 14

6.3 DEX & Token Composition

• Uniswap V2 emits 53.0% of MEV-related swap events across 81.0% of involved DEX addresses, while wrapped tokens participate in 97.0% of MEV transactions.USD stablecoins account for 22.9%; after April 16, 2023, meme tokens surpassed stablecoins, associated with trading hype, price fluctuations, and low liquidity causing slippage.Source: Figure 4 · p. 15, §6.3 · p. 16

7.1 Volume of MEV Activities

• Private transaction pools became dominant after their emergence, with mempool activity falling from 37.1% of MEV activities in Stage II to 4.7% in Stage III.Stage I contained 2,488,789 MEV activities, followed by a sharp decline in mempool activity after private architecture appeared.Source: §7.1 · p. 17

7.2 Financial Metrics of MEV Activities

• Stage III reversed the revenue ranking, with private MEV activities exceeding mempool activities in median revenue as searchers pursued high-revenue opportunities privately.In both stages, mempool activities nevertheless achieved eight times higher profit than private activities, which the authors associate with private transaction fees.Source: §7.2 · p. 18
• Profit margins favored mempool activity, reaching 47.1% versus 6.7% in Stage II and 66.6% versus 1.9% in Stage III for private activity.The authors attribute the widening gap to private bidding fees and conclude that profit gains became more concentrated among block proposers.Source: §7.2 · p. 18

7.3 Adopted MEV Strategies

• Mempool front-running had a median success rate below 40%, encouraging searchers to use private transactions that exclude reverted transactions from blocks.The analysis replayed 20,496,511 transactions from 107 contracts and identified 779,055 successful mempool, 1,104,891 successful private, and 675,065 failed mempool front-running arbitrages.Source: §7.3 · p. 19
• 67.7% of successful private front-running arbitrages had negative expected profit in the mempool, compared with 10.5% of successful mempool arbitrages.This supports private architecture as a way to preserve smaller-yield opportunities that would otherwise incur losses from failed mempool transaction fees.Source: §7.3 · pp. 19–20

8.1 Overall Results

• Back-running comprised 1,212,672 arbitrages versus 2,712,357 front-running arbitrages in Stages II and III and became the main form of arbitrage in Stage III.The authors associate this rise with private ordering services and competition that causes high-revenue opportunities to be captured immediately within the same block.Source: §8.1 · pp. 20–21
• 79.7% of back-running cases had no intermediate transaction, while 41.8% targeted Uniswap-related transactions and 58.9% of those involved the Uniswap V2 Router.These findings indicate that public trading contracts generated many of the targeted back-running opportunities.Source: §8.1 · p. 21

8.2 Back-running Application#1: MEV-Share & MEV-Blocker

• MEV-Share and MEV-Blocker protected only 441.76 ETH of 4,122.24 ETH in extracted revenue, or 10.7%.MEV-Blocker returned a larger revenue share to users than MEV-Share, while MEV searchers received the largest share in MEV-Share.Source: §8.2 · p. 22

8.3 Back-running Application#2: Builder MEV Extraction

• The authors conclude that builder reordering in private pools can quietly extract MEV, conflicting with the intended PBS reward structure and motivating stronger PBS regulation.This conclusion is explicitly framed as a consequence of builder-controlled transaction ordering in Stage III.Source: §8.3 · pp. 22–23
• The study heuristically identified three builder-searcher groups whose median profit margins were 80.6%, 46.1%, and 44.7%, respectively.The authors interpret these high margins relative to ordinary private activity as evidence consistent with collusion and estimate nearly 620K USD in hidden back-running activity.Source: §8.3 · pp. 22–23

9 Limitations

• Private-transaction data collection relies on previous detection methods, which may introduce false positives.The authors identify this as a limitation despite compiling their largest dataset of arbitrage and sandwich-attack transactions.Source: §9 · p. 23
• Manual inspection can evaluate most detected arbitrages and sandwich attacks, but the lack of ground truth prevents precise evaluation.The benchmark requires profitable token-balance changes and the structural patterns of cyclic arbitrage or before-and-after sandwich transactions.Source: §9 · p. 23

MEV identification

• Earlier MEV-identification studies relied on heuristic methods and often covered only a few popular DEXes, limiting transaction-type coverage.The paper describes its approach as expanding DEX coverage and refining rules to identify more transaction subtypes.Source: §10 · p. 23

Private transaction architecture

• Related private-transaction studies examined pre-PBS relationships or post-PBS builder behavior, whereas this work focuses on private architecture’s effects on searcher profits and strategies.The comparison includes studies of builder submission timing and block-construction profits [51].Source: §10 · p. 24

MEV applications

• MEV applications include DEX redesigns, transaction-order changes, MEV-Share, and MEV-Blocker, but the paper reports that the latter services remain insufficiently adopted for fair profit distribution.The paper distinguishes trader-protection mechanisms from back-running services that redistribute MEV proceeds.Source: §10 · p. 24

• At most 2.4% false positive/negative rate, outperforming state-of-the-art methods in identifying MEV activities.The algorithms were evaluated on the paper’s largest-ever collected dataset.Source: §11 · p. 24
• Emerging meme tokens, alongside established DeFi projects, are widely targeted by MEV activities.Source: §11 · p. 24
• Private transaction architecture reduces MEV searchers’ profits but enables capture of lower-profit opportunities.Source: §11 · p. 24
• Back-running began replacing front-running in arbitrage, although some back-running applications remain incompletely adopted and may be exploited maliciously by builders.Source: §11 · p. 24