PaperlayerView exact revision on arXiv

Source-linked AI summary

How Much Must a Private Mempool Hide? Exact Leakage Thresholds for Sandwich Attacks

Tingyi Lin, Jiazhuo Li, Ruoran Lai

arXiv:2609.31379v2cs.GTcs.CRq-fin.TR

TL;DR

Coarse leakage about a hidden swap raises the question of when a sandwich attack can still be profitable. The paper characterizes robust attacks under interval leakage and models traders bidding for the execution right. It finds that the lower endpoint governs robust feasibility and that equilibrium auction competition can transfer the expected net rent to the auctioneer.

  • Problem

    The paper asks when coarse public information about a hidden victim-order size is sufficient to support profitable predatory behavior in a constant-product AMM.

    Source: §1 · p. 1

  • Method

    The paper characterizes robustly admissible front-runs under interval leakage and models execution rights as a first-price auction among symmetric traders.

    Source: §1 · p. 2, §3.3 · p. 5

  • Results

    The interval’s lower endpoint determines robust admissibility and the exact profitability threshold, while every pure-strategy equilibrium with at least two symmetric traders transfers expected net rent to the auctioneer.

    Source: §1 · pp. 2–3

  • Takeaways & Limitations

    With positive execution cost, a signal revealing no positive lower bound supports no guaranteed-profit sandwich, although post-trade arbitrage can survive perfect pre-trade hiding.

    Source: §1 · p. 3

    The robust feasibility analysis assumes a single victim; multiple victims make feasibility depend on their individual slippage guards and preceding orders.

    Source: §6.3 · p. 10

Abstract

from arXiv · show

Private and encrypted mempools hide pending transactions to stop sandwich attacks and other forms of maximal extractable value (MEV), but what they hide is rarely everything: a transaction's pair, direction, and a coarse range for its size can still leak. How much leakage makes sandwiching pay? We answer exactly for a fee-free constant-product automated market maker, the pricing rule behind Uniswap v2. Traders observe an interval containing the victim's size and bid in a first-price auction for the right to sandwich it, and the winning front-run must keep the victim's trade executable at every size in the interval. The answer turns on the smallest size consistent with the leak. It alone determines the feasible front-runs, the largest feasible front-run is optimal for pointwise, expected, and worst-case profit alike, and the guaranteed profit has a closed form. When execution is costly, a privacy layer that wants to rule out sandwiches profitable at every consistent size may therefore reveal anything about the size except a lower bound above an explicit threshold; the upper end of the range is irrelevant. With two or more symmetric traders, every pure-strategy perfect Bayesian equilibrium of the auction hands the entire expected net rent to the auctioneer. If the direction is hidden too, no non-contingent first leg front-runs both possible directions, while post-trade arbitrage can survive even perfect pre-trade hiding.

1 Introduction

The paper asks when coarse leakage about a hidden swap is enough to support profitable sandwiching, and answers for a constant-product AMM with an interval signal and an execution-rights auction. Its central results make the leaked lower bound decisive for robust attacks and show how execution costs and auction competition shape their profitability.

1 Introduction

  • The largest robustly admissible front-run maximizes pointwise, expected, and worst-case profit.The attacker must choose a front-run that keeps the victim’s trade executable throughout the leaked interval.Source: §1 · p. 2
  • With execution cost c, a robust bundle has positive net payoff at every consistent size exactly when the leaked lower bound exceeds an explicit threshold.The threshold depends on X, τ, and c; to first order, λc ≈ c/τ.Source: §1 · p. 2, Figure 1 · p. 2
  • With two or more symmetric risk-neutral traders, every pure-strategy perfect Bayesian equilibrium awards a profitable execution slot at its expected net rent to the auctioneer.If the expected net rent is negative, no equilibrium places a sandwich.Source: §1 · p. 3
  • The leaked interval’s lower endpoint alone determines robust admissibility, the optimal robust attack, and the exact profitability threshold.The upper endpoint is irrelevant because the smallest consistent victim size is hardest to sandwich.Source: §1 · pp. 2–3
  • If direction is hidden until after the first leg, no non-null non-contingent first leg front-runs both directions; post-trade arbitrage may nevertheless survive.The closed forms rely on the fee-free constant-product invariant and are not claimed for other pricing rules.Source: §1 · p. 3

2 Related Work

Related work studies sandwiching under public order flow, market design for strategic trading, and privacy or sequencing systems. This paper’s contribution is an exact test of when interval leakage is sufficient for robust sandwiching and how the execution right is priced.

2 Related Work

  • Prior sandwich analyses largely assume full or nearly full observability; under interval leakage, the leaked lower endpoint is the analogue of the minimum profitable victim input [30].The paper places its result alongside public-order-flow analyses [31] and the sandwich game of Heimbach and Wattenhofer [16].Source: §2 · p. 3
  • Market-design work addresses strategic trading, transaction fairness, sequencing, and block-space pricing, while this paper shows that its execution-rights auctioneer collects the entire expected net rent.The related auction literature also studies how information structures shape bidding and revenue.Source: §2 · p. 3
  • Private-mempool systems motivate the analysis, which abstracts from implementation details and represents pre-trade privacy solely through a leakage map.The cited systems include threshold-decryption and threshold-cryptography approaches, encrypted-mempool ordering, and economic evaluation of private mempools [26].Source: §2 · pp. 3–4

3 Preliminaries and Model

The model combines a constant-product AMM and a hidden victim size with interval leakage and an auction for a robustly admissible execution slot. It imposes a trade-execution guarantee, then evaluates eligible bids using posterior expected utility.

3.1 Constant-Product AMM and Sandwich Bundles

  • The AMM holds reserves with invariant XY = k; a victim buys Y with X and requires at least (1−τ) of the honest output, which constrains an admissible front-run.The setup studies one victim order; the opposite trading direction is symmetric under token exchange.Source: §3.1 · p. 4

3.2 Leakage Signals

  • A leakage signal reveals an interval containing the hidden size, either [ℓs, us] with ℓs > 0 or (0, us]; robust front-runs must preserve execution for every size in that interval.The signal is public before bidding, while the exact victim size remains hidden.Source: §3.2 · p. 5

3.3 Execution-Rights Auction

  • Symmetric risk-neutral traders bid for one slot to place a front-run and unwind, choosing only robustly admissible front-runs and paying their own winning bid.A non-null sandwich also incurs fixed execution cost c; winning utility is trading profit minus bid and cost.Source: §3.3 · p. 5
  • Robust admissibility defines the action set, while traders rank eligible bundles by posterior expected profit rather than a max-min objective.Equilibrium is pure-strategy perfect Bayesian equilibrium; the robust guarantee is distribution-free, whereas relaxing it to a failure-probability bound uses a lower posterior quantile.Source: §3.3 · p. 5

4 Main Results

The results characterize which front-runs remain executable across a leaked size interval, which one maximizes profit, and when the resulting sandwich is worthwhile. They also distinguish guaranteed sandwiching from equilibrium attacks and post-trade arbitrage.

4 Main Results

  • The largest robustly admissible front-run uniquely maximizes pointwise, expected, and worst-case profit.The theorem also gives an exact worst-case gross profit and an optimal posterior expected gross profit.Source: §4 · p. 6
  • With positive execution cost, an interval revealing no positive lower bound supports no sandwich profitable at every consistent size.Under perfect hiding, an equilibrium sandwich may nevertheless occur when the posterior makes the continuation value positive.Source: §4 · p. 6
  • When the posterior continuation value is positive, every pure-strategy equilibrium awards the slot and transfers the entire expected net rent to the auctioneer.If that value is negative, every pure-strategy equilibrium has no on-path sandwich.Source: §4 · pp. 6–7
  • With positive execution cost, the lowest bin from revealing leading size bits never supports a sandwich profitable at every consistent size.The zero-bit case recovers the perfect-hiding result.Source: §4 · p. 7
  • Even when perfect hiding rules out an on-path sandwich under the stated cost condition, post-trade arbitrage can yield positive gross profit up to q^2/(X + q).The arbitrage uses an external market trading token Y at the pool’s initial price X/Y.Source: §4 · p. 7

5 Proof Overview

The proof reduces robust feasibility to the smallest size consistent with the signal, then uses profit monotonicity to identify the best admissible front-run. The auction result follows from competition over that shared continuation value.

5 Proof Overview

  • Victim output after a front-run, relative to honest output, rises with victim size, so robust feasibility is determined by the smallest consistent size.This lower-tail condition yields the robust-admissibility result.Source: §5 · p. 7
  • Because sandwich profit rises with both front-run size and victim size, the largest admissible front-run maximizes pointwise, expected, and worst-case profit.The worst-case value occurs at the lower endpoint, where the slippage boundary binds.Source: §5 · p. 7
  • At least two symmetric traders compete in a Bertrand-like auction over the same continuation value, pinning positive rent to the auctioneer and eliminating attacks when value is negative.At zero continuation value, an attack earns zero surplus.Source: §5 · p. 7

6 Extensions, Boundary Cases, and Conservative Variants

The extensions show how the lower-endpoint threshold changes under relaxed feasibility and hidden metadata, and where the constant-product results may not extend. The upper endpoint remains irrelevant to the robust threshold, while posterior information, fees, and pool structure qualify other conclusions.

6 Extensions, Boundary Cases, and Conservative Variants

  • The robust threshold depends on the lower bound, reserve, slippage tolerance, and execution cost—not the interval’s upper endpoint.Even complete size hiding leaves a positive lower bound if the relevant order sizes are known to be bounded away from zero.Source: §6 · p. 8

6.1 Relaxing Robustness

  • Allowing a positive failure probability weakly enlarges the feasible set, replacing the interval minimum with a lower posterior quantile.At ε = 0, the robust case is recovered with q0 = ℓ; with occasional failures or q-dependent expected costs, the full posterior can matter.Source: §6.1 · p. 8

6.2 Hidden Metadata Beyond Size

  • If direction is hidden until after the first leg is chosen, no non-null first leg front-runs both possible directions.This rules out the studied non-contingent robust sandwich, not post-trade arbitrage.Source: §6.2 · p. 8
  • When slippage tolerance is hidden within a set, robust admissibility and the optimal robust size reduce to its lower bound.The optimal size is amax(ℓs, τs), where τs is the set’s lower endpoint.Source: §6.2 · p. 9

6.3 Dimensionless Form and Conservative Variants

  • With fees withheld from reserves, gross sandwich profit is weakly smaller than in the fee-free benchmark, so the fee-free threshold is conservative.A positive fee cannot make universal robust sandwiching possible when it is impossible at zero fees.Source: §6.3 · p. 9
  • The exact threshold may not persist for multiple victims, cross-venue interactions, or tick-crossing v3 trades; broader CFMMs and richer allocation mechanisms remain open.Within one v3 tick range, fee-free results apply with virtual reserves if the front-run, victim trade, and unwind all stay in that range.Source: §6.3 · p. 10
  • The threshold is scale-free; to first order, λc/X is approximately c/(τX), and halving τ roughly doubles the lower bound that can leak.For X = 10^6, τ = 0.02, and c = 100, the example gives λc ≈ 4,976.Source: §6.3 · pp. 9–10

7 Open Problems

The paper leaves open extensions involving richer victim flows, pool designs, auction mechanisms, and information release. Each changes an element of the setting used for the exact theorems.

7 Open Problems

  • Multiple victims would add interacting slippage guards and downstream flow to feasibility and unwind profit.Opposite-direction orders, unknown interleavings, and cross-venue routing add further state variables.Source: §7 · p. 10
  • Whether the paper’s monotonicity arguments extend beyond constant-product pools remains open.Constant-product pools admit clean cancellations.Source: §7 · p. 10
  • Exact results for multi-stage or asymmetric allocation mechanisms remain an open extension of the single-slot, symmetric-trader model.Source: §7 · p. 10
  • Endogenous or strategically timed leakage would turn the exogenous leakage map into an information-design problem.Source: §7 · p. 10

A.1 Structural lemmas

The structural-lemma proof examines how the relevant expression varies with victim size and represents another quantity through numerator and denominator terms. The supplied passages give only fragments of those calculations.

A.1 Structural lemmas

  • For fixed a, the proof differentiates the second factor of the expression for r(a,q).Source: §A.1 · p. 13
  • The displayed derivative of the second factor is positive for a > 0.Source: §A.1 · p. 13
  • The proof also introduces N(a,q) = aq(2X + a + q) and D(a,q) = (X + a)^2 + aq.Source: §A.1 · p. 13

A.2 Main results

The main results characterize robustly admissible front-runs and show how their largest feasible size determines profit and the cost threshold. The proofs reduce interval-wide feasibility and profitability to the smallest consistent victim size.

A.2 Main results

  • The robustly admissible front-runs form [0, amax(ℓ, τ)].The interval endpoint is determined by the lower victim-size bound and slippage tolerance.Source: §A.2 · pp. 13–14
  • The largest admissible front-run uniquely maximizes pointwise, expected, and worst-case profit.The worst-case profit occurs at the smallest victim size in the interval.Source: §A.2 · p. 14
  • A robustly admissible bundle has positive net payoff for every hidden type exactly when its guaranteed gross profit exceeds cost.The proof solves this condition through a quadratic in the lower endpoint; positive ℓ yields positive net payoff exactly when ℓ > λc.Source: §A.2 · p. 14
  • With a positive execution cost, no bundle guarantees positive net payoff on an interval (0, Q].Source: §A.2 · p. 15

A.3 Execution auction equilibrium

The auction outcome depends on the posterior net value of the best admissible front-run, Rs = V − c. With at least two traders, positive value is bid away to the auctioneer, while negative value rules out an on-path sandwich.

A.3 Execution auction equilibrium

  • The best admissible front-run a⋆ maximizes posterior expected gross profit V, so the auction’s net value is Rs = V − c.Every robustly admissible front-run has expected profit at most V, with equality only at a⋆.Source: §A.3 · p. 15
  • When Rs < 0, no equilibrium has an on-path sandwich because winning yields less than submitting null.At Rs = 0, all-null bidding is an equilibrium, and any equilibrium winner pays zero and earns zero.Source: §A.3 · p. 15
  • When Rs > 0, every equilibrium uses the largest-value front-run a⋆ and charges a payment of Rs, leaving the winner and losing traders with zero utility.A winner paying less can be outbid profitably; a front-run below a⋆ can also be profitably displaced.Source: §A.3 · p. 15

A.4 Bit-prefix leakage and post-trade arbitrage

For bit-prefix leakage, universal robust profitability depends on whether the interval’s lower endpoint exceeds the cost threshold. Complete hiding can rule out an on-path sandwich for positive execution cost, while post-trade arbitrage can still be profitable.

A.4 Bit-prefix leakage and post-trade arbitrage

  • For bins j ≥ 1, universal robust profitability holds exactly when ℓj > λc; the lowest bin, with no positive lower bound, supports none for c > 0.The lowest bin is I0 = (0, Q/2^d]; for d = 0, the signal is complete hiding.Source: §A.4 · p. 15
  • Under complete hiding, the expected continuation value is below execution cost, so there is no on-path sandwich.The bound is E[π(a, q) | s⊥] ≤ π(a0, Q) < c.Source: §A.4 · p. 15
  • After the victim trade, arbitrage profit is positive exactly when η < Yq(2X + q)/(X(X + q)), and is largest at η = Yq/(X + q).The trader buys η units of Y externally at price X/Y and sells them to the pool.Source: §A.4 · p. 15

B Deferred Proofs for Extensions

This section presents deferred theoretical proofs on how leakage thresholds, cost uncertainty, fees, and hidden trade direction affect sandwich results, rather than an empirical evaluation. It also discloses AI-tool use to check and revise derivations and proofs.

B Deferred Proofs for Extensions

  • The failure probability is at most ε exactly when the front-run is admissible for every size from qε to u, equivalently when a ≤ amax(qε, τ).The proof uses monotonicity of admissibility in victim size and continuity and strict increase of Fµ.Source: B Deferred Proofs for Extensions · p. 16
  • A non-null first leg that buys Y with X does not front-run a victim selling Y for X; the sell-first case is symmetric under token exchange.The proof compares the victim’s output after the leg with its honest output.Source: B Deferred Proofs for Extensions · p. 16
  • Robustness over a fee interval is determined by its smallest fee τs; when τs = 0, the only robustly admissible front-run is a = 0.For positive τs the stated formulas follow from Theorems 4.1 and 4.2.Source: B Deferred Proofs for Extensions · p. 16
  • The fee expansion substitutes c = bcX and λc = bλX into (14), then uses a first-order Taylor expansion around bc = 0.With fees withheld, swaps act on reserves as fee-free swaps of their effective inputs, so the fee-free conditions apply after replacing each input δ with αδ.Source: B Deferred Proofs for Extensions · p. 16
  • With a fee, any robust sandwich profitable above cost at every size in an interval implies a universally profitable robust sandwich without the fee.The proof rescales the front-run by the fee-adjusted input factor α and uses the fee-free admissibility and profit bounds.Source: B Deferred Proofs for Extensions · p. 16

NeurIPS Paper Checklist

  • The checklist describes the paper as a theoretical analysis with no experiments, statistical estimates, or experimental error bars.It also says the paper discusses its modeling scope and limitations, and frames societal implications as technical security and market-design implications rather than a deployed system.Source: NeurIPS Paper Checklist · pp. 17, 18, 20, 21
  • The authors report using AI tools to check manuscript derivations and proofs and suggest improvements to them.The checklist marks LLM usage as “Yes.”Source: NeurIPS Paper Checklist · p. 23
Loading 2609.31379v2…