{"id":"https://openalex.org/W7214212801","doi":"https://doi.org/10.48550/arxiv.2609.28115","title":"No Place to Hide: An Analysis on Protected Order Flow Sandwich Attacks","display_name":"No Place to Hide: An Analysis on Protected Order Flow Sandwich Attacks","publication_year":2026,"publication_date":"2026-09-23","ids":{"openalex":"https://openalex.org/W7214212801","doi":"https://doi.org/10.48550/arxiv.2609.28115"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2609.28115","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.28115","pdf_url":"https://arxiv.org/pdf/2609.28115","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2609.28115","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5074821339","display_name":"Lioba Heimbach","orcid":"https://orcid.org/0000-0002-8258-1712","observed_orcids":["https://orcid.org/0000-0002-8258-1712"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Heimbach, Lioba","raw_affiliation_strings":["Category Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Category Labs","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120048473","display_name":"Ozan Solmaz","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Solmaz, Ozan","raw_affiliation_strings":["ETH Zurich"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ETH Zurich","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101909808","display_name":"Burak \u00d6z","orcid":"https://orcid.org/0009-0003-7508-7112","observed_orcids":["https://orcid.org/0009-0003-7508-7112"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"\u00d6z, Burak","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5067908322","display_name":"Christof Ferreira Torres","orcid":"https://orcid.org/0000-0001-6992-703X","observed_orcids":["https://orcid.org/0000-0001-6992-703X"]},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I141596103","display_name":"University of Lisbon","ror":"https://ror.org/01c27hj86","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103"]},{"id":"https://openalex.org/I4387152517","display_name":"Instituto Superior T\u00e9cnico","ror":"https://ror.org/03db2by73","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103","https://openalex.org/I4387152517"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Torres, Christof Ferreira","raw_affiliation_strings":["INESC-ID & Instituto Superior T\u00e9cnico (IST) , University of Lisbon"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INESC-ID & Instituto Superior T\u00e9cnico (IST) , University of Lisbon","institution_ids":["https://openalex.org/I121345201","https://openalex.org/I141596103","https://openalex.org/I4387152517"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10270","display_name":"Blockchain Technology Applications and Security","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10270","display_name":"Blockchain Technology Applications and Security","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10772","display_name":"Distributed systems and fault tolerance","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sandwich-attacks","display_name":"sandwich attacks","score":0.9810000061988831},{"id":"https://openalex.org/keywords/front-running","display_name":"front-running","score":0.9710000157356262},{"id":"https://openalex.org/keywords/ethereum","display_name":"Ethereum","score":0.5519999861717224},{"id":"https://openalex.org/keywords/solana","display_name":"Solana","score":1.0},{"id":"https://openalex.org/keywords/tron","display_name":"TRON","score":0.9959999918937683},{"id":"https://openalex.org/keywords/bases","display_name":"bases","score":0.9049999713897705},{"id":"https://openalex.org/keywords/arbitrum","display_name":"Arbitrum","score":0.9959999918937683},{"id":"https://openalex.org/keywords/monads","display_name":"monads","score":0.5450000166893005},{"id":"https://openalex.org/keywords/transaction-exposure","display_name":"transaction exposure","score":0.43799999356269836},{"id":"https://openalex.org/keywords/bot-detection","display_name":"bot detection","score":0.5799999833106995}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7103999853134155},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.592199981212616},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.5806999802589417},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.572700023651123},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.4156000018119812},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.4052000045776367},{"id":"https://openalex.org/C163239763","wikidata":"https://www.wikidata.org/wiki/Q5153637","display_name":"Common value auction","level":2,"score":0.3894999921321869},{"id":"https://openalex.org/C75949130","wikidata":"https://www.wikidata.org/wiki/Q848010","display_name":"Database transaction","level":2,"score":0.3707999885082245},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.35920000076293945},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.31150001287460327},{"id":"https://openalex.org/C2985179714","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Work flow","level":2,"score":0.3028999865055084},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.26460000872612},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.250900000333786},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.2506999969482422}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2609.28115","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.28115","pdf_url":"https://arxiv.org/pdf/2609.28115","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2609.28115","doi":"https://doi.org/10.48550/arxiv.2609.28115","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2609.28115","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2609.28115","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.28115","pdf_url":"https://arxiv.org/pdf/2609.28115","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7214212801.pdf","grobid_xml":"https://content.openalex.org/works/W7214212801.grobid-xml"},"referenced_works_count":25,"referenced_works":["https://openalex.org/W2911456131","https://openalex.org/W2984747683","https://openalex.org/W3016124762","https://openalex.org/W3042738715","https://openalex.org/W3143489046","https://openalex.org/W3167092767","https://openalex.org/W3212176792","https://openalex.org/W4220884837","https://openalex.org/W4221162551","https://openalex.org/W4226265426","https://openalex.org/W4281638018","https://openalex.org/W4287203512","https://openalex.org/W4387880972","https://openalex.org/W4404515186","https://openalex.org/W4414586968","https://openalex.org/W4414742630","https://openalex.org/W4415249941","https://openalex.org/W4416927422","https://openalex.org/W7106303124","https://openalex.org/W7109997224","https://openalex.org/W7125942716","https://openalex.org/W7148583123","https://openalex.org/W7163399478","https://openalex.org/W7163598374","https://openalex.org/W7171501066"],"related_works":["https://openalex.org/W4313025221","https://openalex.org/W3129190210","https://openalex.org/W4399178829","https://openalex.org/W4409262486","https://openalex.org/W7125942716","https://openalex.org/W4401719787","https://openalex.org/W4281393872","https://openalex.org/W7125597218","https://openalex.org/W7058423807","https://openalex.org/W7111623614"],"abstract_inverted_index":{"Front-running":[0],"has":[1],"long":[2],"plagued":[3],"Ethereum's":[4],"public":[5],"mempool,":[6],"earning":[7],"it":[8],"the":[9,50,72,239],"nickname":[10],"of":[11,52,78,176],"a":[12,149,173],"\"dark":[13],"forest\",":[14],"where":[15],"predators":[16],"lurk":[17],"for":[18,241],"profitable":[19],"transactions.":[20],"In":[21,67],"response,":[22],"Ethereum":[23,152],"and":[24,33,58,93,105,108,134,186,193,208,217],"other":[25],"blockchain":[26],"ecosystems":[27],"increasingly":[28],"rely":[29],"on":[30,110,126,129,132,136,189,196,206,221],"private":[31],"RPCs":[32],"native":[34],"protections":[35,229],"to":[36,44,113,141,202],"shield":[37],"transactions":[38,139,216],"from":[39,116,144],"adversaries,":[40],"which":[41],"we":[42,70],"refer":[43],"as":[45],"protected":[46,82,143],"order":[47,83],"flow.":[48],"Yet":[49],"effectiveness":[51],"these":[53,158],"mechanisms":[54],"in":[55],"preventing":[56],"front-running,":[57],"what":[59],"trust":[60],"assumptions":[61],"they":[62],"entail,":[63],"remain":[64],"poorly":[65],"understood.":[66],"this":[68],"work,":[69],"conduct":[71],"first":[73],"longitudinal,":[74],"three-year":[75],"measurement":[76],"study":[77],"sandwich":[79,124,246],"attacks":[80,125,159],"against":[81,138,245],"flow":[84],"across":[85,106],"six":[86],"blockchains:":[87],"Ethereum,":[88,133,197],"Solana,":[89,127,168,190],"Tron,":[90,130,207],"Base,":[91],"Arbitrum,":[92],"Monad.":[94],"We":[95,120],"introduce":[96],"detection":[97],"heuristics":[98],"that":[99,200,213,226],"capture":[100],"wide":[101],"attacks,":[102],"both":[103,209],"within":[104],"blocks,":[107],"filter":[109],"bot":[111],"behavior":[112,220],"distinguish":[114],"sandwiches":[115],"legitimate":[117],"trading":[118],"activity.":[119],"identify":[121],"28.0":[122],"million":[123],"38,567":[128],"30,607":[131],"1,889":[135],"Base":[137],"intended":[140],"be":[142],"front-running.":[145],"Reorged":[146],"blocks":[147,195],"expose":[148],"further":[150],"2,875":[151],"victims.":[153],"Unlike":[154],"conventional":[155],"public-mempool":[156],"sandwiches,":[157],"rarely":[160],"occur":[161],"tightly":[162],"around":[163],"their":[164],"victims":[165],"and,":[166],"outside":[167],"are":[169],"carried":[170],"out":[171],"by":[172],"small":[174],"number":[175],"entities.":[177],"Our":[178],"analysis":[179],"uncovers":[180],"exposures":[181],"at":[182],"every":[183],"layer:":[184],"validator-":[185],"application-level":[187],"exposure":[188],"order-flow":[191],"auctions":[192],"reorged":[194],"first-come-first-served":[198],"ordering":[199],"fails":[201],"prevent":[203],"latency-based":[204],"front-running":[205,228],"an":[210],"RPC":[211],"bug":[212],"exposes":[214],"pending":[215],"predictable":[218],"victim":[219],"Base.":[222],"These":[223],"findings":[224],"show":[225],"existing":[227],"can":[230],"provide":[231],"substantially":[232],"weaker":[233],"guarantees":[234],"than":[235],"users":[236],"expect,":[237],"highlighting":[238],"need":[240],"stronger":[242],"end-to-end":[243],"defenses":[244],"attacks.":[247]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-09-25T00:00:00"}