Solscan’s Role in Solana MEV Research: Understanding Sandwich Attacks and Frontrunning

A trader places a transaction on the Solana blockchain, intending to swap tokens at a favorable rate. Before that transaction confirms, two others appear in the sequence: one placing a large order in the same direction, then the trader’s transaction, followed by another sale that exits the position. The trader pays more than expected. This is a sandwich attack, a form of maximal extractable value (MEV) extraction that has become a routine risk on the network. Understanding when and how it occurs requires access to detailed transaction data, precise timing information, and the ability to reconstruct the sequence of events that led to the loss.

Solscan provides the tools to perform that reconstruction. As the leading blockchain explorer for Solana, it offers real-time transaction tracking, wallet monitoring, token analytics, and developer access to blockchain data that makes MEV patterns visible. A researcher or trader examining a bad execution price can pull the transaction history, check the exact sequence of operations within a block, compare gas fees and confirmation times, and identify whether a sandwich attack, frontrunning, or legitimate market movement was responsible. The visibility that Solscan enables has become essential for anyone seeking to understand Solana’s transaction landscape and the forces that shape execution outcomes.

How sandwich attacks work on Solana and why transaction order matters

Sandwich attacks exploit the time window between when a transaction is submitted and when it is finalized on the blockchain. A bot observing the mempool or validator activity can identify a large upcoming trade, place its own transaction ahead of it (frontrunning), execute the trade in a way that moves the market, and then place a third transaction that exits the position after the original trade goes through at a worse price. On Solana, which uses a single leader-validator model during each slot, the mempool is technically private to that validator rather than public. However, transactions broadcast to the network are visible to validators and sophisticated observers, and the tight slot duration creates pressure for rapid decision-making.

The mechanics depend on transaction ordering within a block. Solana’s slots last approximately 400 milliseconds, and a validator can choose the order of transactions within that slot subject to certain constraints. A sandwich attack succeeds when the three transactions—the bot’s initial trade, the victim’s transaction, and the bot’s exit—all execute in that sequence within the same block or consecutive blocks. The profit comes from the price movement caused by the first large transaction combined with the unfavorable execution the victim receives. The victim’s transaction is mechanically valid; it just executes at a worse effective price than anticipated.

Using solscan, a researcher can observe this pattern directly. By searching a wallet address or transaction signature, one can retrieve the exact sequence of instructions, the amounts involved, the token pair traded, the fee paid, and the timestamp to the microsecond. Comparing the quoted price at the time of submission against the actual execution price reveals the slippage. Examining transactions in the same block from the same bot wallet can show repeated patterns, establishing that the sandwich was deliberate rather than coincidental.

The difference between a legitimate MEV extraction and a sandwich attack often comes down to intent and sequence. A validator prioritizing transactions by fee is not sandwiching; it is simply choosing the highest-paying work first. A bot that places three coordinated transactions with the victim’s transaction sandwiched in between is more clearly engaging in extraction. The blockchain data alone cannot prove intent, but the pattern of gains and losses, the timing correlation, and the repeated sequence across multiple incidents can establish a strong inference.

Frontrunning versus MEV: Understanding the distinction through blockchain data

Frontrunning and MEV extraction are related but distinct. Frontrunning typically means placing a transaction ahead of an observed or anticipated transaction to capture the benefit of that move. MEV is the broader category of value that can be extracted from transaction ordering, timing, and inclusion, including frontrunning, sandwiching, and liquidation detection. A transaction on Solana may experience MEV without experiencing classical frontrunning if, for instance, a liquidation bot detects an undercollateralized position and executes a liquidation in the same slot. The liquidation benefits the bot, but the victim’s transaction was not intentionally placed ahead; rather, the bot reacted to on-chain data it observed.

The Solana blockchain data structure makes these distinctions testable. Each transaction records its signer, the program it invokes, the accounts it modifies, the amount of compute budget requested, and the actual fees paid. A researcher examining transactions through Solscan can filter for specific token pairs, program IDs, or wallet addresses and reconstruct the flow of value. If a bot repeatedly profits from transactions it places immediately before large trades, the pattern indicates intentional frontrunning. If the bot’s activities follow predictable liquidation mechanics tied to price oracles or collateral ratios, the behavior is mechanistic rather than adversarial.

This distinction matters for protocol design and risk assessment. A trader or liquidity provider can adjust their strategies to minimize exposure to frontrunning—using private mempools, aggregating orders, or changing order timing—but liquidations driven by protocol logic are harder to avoid without changing leverage or collateral composition. Solscan’s advanced search capabilities allow researchers to identify which category of MEV is most prevalent on which programs, which validator sets, or which token pairs. That data has fed into protocol improvements such as PBS (Proposer-Builder Separation) discussions and validator selection strategies.

A practical example: a large arbitrage transaction between two DEXs will likely be frontrun or arbitraged by bots if the price difference is significant enough. Examining the transaction history through Solscan, a researcher can see the initial arbitrage opportunity, the bot’s transaction preceding or following it, and the final prices. The data shows whether the original trader captured the arbitrage or whether a bot extracted it first. Understanding this pattern helps traders decide whether to use public broadcasting or private relay services for future transactions.

Using Solscan’s advanced search and filtering for MEV pattern detection

Solscan provides several tools specifically useful for MEV research. The transaction search allows filtering by signature, account, program, and time range. A researcher studying a particular bot or validator can retrieve all transactions associated with a specific wallet address, review the accounts they interact with, and construct a behavioral profile. The advanced search can isolate transactions for a specific token pair, narrowing the dataset to relevant activity and filtering out unrelated transactions that would obscure patterns.

The block explorer view shows the order of transactions within each slot, the compute units consumed, and the fee paid per unit. This ordering information is central to understanding MEV. A transaction that pays a higher fee per compute unit but appears later in a block suggests that something other than fee-priority ordering is at work, or that the transactions were reordered by the validator for other reasons. The epoch monitoring and validator information further contextualize the data: different validators may have different ordering strategies or may prioritize different MEV extraction services.

Token and NFT analytics in Solscan reveal market activity and trading volume on specific assets. A researcher studying MEV on a particular token can examine its trading volume, identify the dominant DEXs, and check whether MEV appears more severe on low-liquidity assets or during volatile periods. This analysis informs which assets or trading patterns are most vulnerable and which may benefit from protective measures.

The developer tools and API access provided by Solscan enable programmatic research at scale. Rather than manually inspecting transactions through the web interface, a developer can write scripts to retrieve transaction data for thousands of blocks, filter for suspected sandwich attacks or frontrunning patterns, and generate statistics about the prevalence and profitability of MEV extraction. This capability has supported academic research into Solana’s MEV landscape and informed protocol discussions about how to mitigate extractive behavior.

Real-world case studies: Identifying MEV in actual Solana transactions

Consider a scenario involving a liquidity provision transaction on a major DEX. A wallet provides liquidity to a SOL-USDC pool at a particular price. Before the transaction finalizes, a bot places a large buy order on the same pair, moving the price upward. The victim’s liquidity is now provided at a worse effective price. The bot then exits its position at a profit. By examining this sequence through Solscan, the structure becomes clear: the bot’s address, the exact amounts, the order of operations, and the total profit can all be quantified.

Another case involves liquidation cascades. A price feed updates, triggering a liquidation of an undercollateralized position. Multiple liquidation bots compete to execute the liquidation, creating a series of rapid transactions in the same block or adjacent slots. The user whose position was liquidated suffers a loss, but the liquidation is mechanically necessary for protocol solvency. Solscan shows the original position data, the price feed update, the competing liquidations, and the order in which they settled. A researcher can then analyze whether the liquidation price was fair or whether bots extracted additional value through ordering manipulation.

A third example involves token swaps on multiple DEXs. An arbitrageur identifies a price discrepancy between two DEXs and places a swap transaction to profit from it. But before the transaction executes, another bot places its own swap to capture the same arbitrage. The arbitrageur’s transaction then executes at a worse price, or may fail due to slippage. Solscan reveals not only the orders these transactions took, but also the intermediate balances of the affected liquidity pools and the prices at each step.

These cases illustrate why Solscan has become indispensable to MEV research. The blockchain data is immutable and precise. Every transaction carries a timestamp, a fee, a sequence number, and account deltas. Researchers can reconstruct the state of the network at any point, simulate what should have happened under different ordering, and quantify the value extracted. This empirical foundation supports arguments for protocol changes, informs trader behavior, and documents the true cost of MEV on the Solana ecosystem.

Developer tools and API access for MEV research and monitoring

Solscan offers an API that allows developers to query transaction data programmatically, retrieve token information, access NFT trading history, and monitor real-time activity on the Solana blockchain. For MEV researchers, this API transforms manual analysis into automated research pipelines. A developer can set up monitors that alert when a specific wallet address places large transactions, track the profitability of suspected MEV bots, or measure the slippage experienced by a particular DEX across thousands of swaps.

Smart contract verification on Solscan allows researchers to understand the logic of the programs involved in transactions. A DEX program’s on-chain code, if verified, shows exactly how it calculates prices and executes swaps. This makes it possible to trace the precise mathematical basis for an unfavorable execution price and distinguish between slippage caused by MEV and slippage caused by normal price movement or impermanent loss. For protocols that implement anti-MEV measures, the verified code shows whether those protections are present and how they function.

The read-only nature of Solscan—it provides no private key access and requires no login for basic searches—lowers the barrier to research. A trader who suspects they were sandwiched can immediately investigate without downloading specialized tools or running a full node. A researcher studying MEV prevalence across a large dataset can retrieve data in bulk without custody or permission concerns. This accessibility has made Solscan the de facto starting point for MEV investigations on Solana.

Integration with other tools and services further extends the platform’s research value. Traders and analysts often combine Solscan data with on-chain analytics platforms, simulation tools, and market data to build comprehensive MEV detection systems. The standardized, accessible format of Solscan’s blockchain data makes it compatible with custom analysis pipelines and supports the broader ecosystem of MEV research and mitigation tools.

Defensive strategies informed by Solscan data: How traders reduce sandwich attack exposure

Understanding MEV patterns through Solscan enables traders to adopt defensive measures. The first is time-weighting: spreading trades across multiple blocks or time intervals to reduce the probability that a bot can profitably sandwich a single transaction. If a large trade is split into smaller orders over several minutes, the potential profit from sandwiching any single order may fall below the cost of execution, making the attack uneconomical.

The second strategy is private relay or dark pools. Rather than broadcasting transactions to the public mempool, traders can send transactions directly to a validator or through a service that aggregates orders privately. This reduces visibility to MEV bots and lowers sandwich attack risk, though it introduces custody or trust considerations with the relay service. Solscan cannot help detect MEV from private relays, but understanding the cost-benefit trade-off requires knowing the baseline risk from public broadcasting, which Solscan reveals.

The third is order type selection. Some DEXs offer features such as limit orders, which only execute if the price is within an acceptable range, or batch auctions, which bundle multiple trades and execute them simultaneously at a cleared price. These reduce the risk of execution at an adversarial price by changing the execution model. A trader analyzing Solscan data can see how often their chosen DEX experiences MEV-driven slippage and decide whether alternative order types or venues justify any additional costs or latency.

The fourth strategy is MEV-aware validator selection. Some validators and block builders publicly commit to ordering transactions fairly or refusing sandwich attacks. By preferentially submitting transactions to these builders, traders can reduce extraction risk. Solscan provides the historical data to assess which validators and builders have actually honored such commitments, comparing their transaction ordering against the broader network baseline.

The role of MEV research in Solana protocol evolution and governance

Solana’s core developers and governance community use MEV research informed by Solscan and similar tools to inform protocol changes. The data showing the frequency and profitability of sandwich attacks has motivated discussions around PBS (Proposer-Builder Separation), validator incentive structures, and transaction ordering rules. If Solscan data showed that MEV extraction was negligible or that validators were already ordering fairly, the urgency of such changes would be lower.

Because Solscan provides transparent, accessible blockchain data, it enables community-driven accountability. Researchers can publish findings showing which validators are most exposed to MEV extraction accusations, which programs are most vulnerable, and which time periods experience the most extraction. These findings can then drive voting on governance proposals, discussions in community forums, and reputational pressure on validators to improve their practices.

The platform also supports the development of MEV-resistant or MEV-aware protocols. A new DEX design that claims to reduce slippage can be tested against historical Solscan data to validate the claim. A validator set claiming to offer fair ordering can be audited by analyzing their actual transaction sequences through Solscan. This empirical verification is more credible than marketing claims and supports evidence-based protocol design.

Long-term, the combination of Solscan’s data access and ongoing research may inform systemic changes to how Solana handles transaction ordering. Whether through threshold encryption, commit-reveal schemes, encrypted mempools, or other mechanisms, the goal would be to reduce the information asymmetry that currently allows MEV extraction. Solscan itself may evolve to support such changes or to help users and researchers understand their effects once implemented.

Limitations and considerations when analyzing MEV through public blockchain data

While Solscan provides powerful visibility into Solana transactions, it has important limitations. The data is public and therefore cannot reveal transactions sent through private relays or encrypted mempools. If a significant portion of Solana traffic moves to private channels, Solscan’s view of MEV becomes incomplete. Researchers studying the true prevalence of sandwich attacks must account for this blind spot.

Correlation is not causation. Observing that a bot’s transaction precedes a large trade does not prove intent to sandwich. The two could be independent decisions that happened to occur in the same slot. A rigorous MEV analysis requires statistical evidence across many incidents, not inference from single transactions. Solscan provides the raw data but not automatic interpretation; responsible research involves careful methodology and skepticism of apparent patterns.

The view of intention is fundamentally limited. The blockchain records actions but not reasoning. A validator reordering transactions might be optimizing for MEV, might be prioritizing by fee, might be following a fair-ordering protocol, or might be responding to latency and network conditions. Solscan shows what happened, but determining why requires additional context, validator policies, and inference that goes beyond the data itself.

Finally, the speed of MEV innovation can outpace visibility tools. As new MEV extraction strategies emerge, they may not immediately appear in straightforward transaction sequences that Solscan’s interface makes obvious. Specialized analytics, academic research, and collaboration with validator operators may be needed to detect truly novel attacks. Solscan remains the foundation for investigation, but it is not a complete automated detection system.