Sandwich attacks have become a measurable execution risk in the Solana memecoin market. These attacks exploit the order in which blockchain transactions are processed, allowing specialized bots to trade immediately before and after another trader's swap. The victim receives a less favourable execution price, while the attacker attempts to capture the resulting price difference. A recent on-chain investigation identified approximately 6.85 million sandwich attacks on Solana over an eleven-month period, highlighting why traders need to understand MEV, slippage tolerance and transaction execution rather than focusing exclusively on token price movements.

What is a sandwich attack in Solana trading?

A sandwich attack is a form of Maximal Extractable Value, commonly abbreviated as MEV. It occurs when an attacker exploits transaction ordering to extract economic value from another participant's trade.

In a conventional example, the attacker identifies a pending token purchase and places a buy transaction immediately before it. This first transaction increases the token's price within the relevant decentralized exchange liquidity pool.

The victim's transaction then executes at the higher effective price. Finally, the attacker sells the previously purchased tokens, attempting to capture the price difference created by the victim's trade.

The sequence consists of three economically connected operations: the attacker's initial buy, the victim's swap and the attacker's closing sell.

The term sandwich attack describes the victim's transaction being positioned between the attacker's two trades.

This mechanism is particularly relevant in automated market maker environments, where token prices respond mechanically to changes in the assets available within liquidity pools.

The attacker does not need to access the victim's private keys or directly withdraw funds from their wallet. Instead, the attack affects the economic terms of a transaction that the victim has already authorized.

Why Solana memecoins are attractive targets

Solana's high-speed infrastructure makes it possible to execute token transactions rapidly and at relatively low network cost. This has supported an ecosystem of active decentralized exchanges, launchpads and automated trading applications.

Memecoins add another characteristic: intense short-term speculation.

New tokens frequently experience rapid changes in demand and available liquidity. Some markets are relatively shallow, meaning that even moderate purchases can have a significant effect on their effective swap prices.

For a sandwich attacker, the potential opportunity arises when a victim's transaction is large enough to influence the pool price and permits sufficient execution slippage.

The attacker must also consider transaction costs, the cost of entering and leaving the position, competition from other bots and the possibility of unfavourable market movement.

Not every memecoin transaction is profitable to attack. However, markets combining significant price impact with permissive execution settings can create conditions attractive to specialized MEV strategies.

That is why evaluating transaction execution is especially important when trading newly launched or highly volatile tokens.

What recent Solana sandwich-attack research reveals

An investigation published by Bitquery in October 2026 analysed Solana swaps over the period from October 30, 2025, through October 7, 2026.

The researchers identified approximately 6.85 million sandwich attacks involving 2,545 attacking wallets and around 2.15 million distinct wallets whose trades were affected.

According to the investigation, the identified attackers extracted approximately $29.7 million before accounting for transaction fees and other execution costs.

The findings also demonstrated a strong concentration around memecoin trading. Approximately 96% of the identified attacks involved tokens traded through Pump.fun-related markets, including launch curves and PumpSwap.

One particularly relevant result concerned slippage tolerance. In the analysed Pump.fun sample, swaps allowing 20% to 50% slippage were sandwiched approximately fourteen times as often as swaps permitting less than 3%.

These findings should be interpreted within the study's methodology and observation period. They describe patterns identified in historical on-chain data, not a guarantee about the risk attached to every future swap.

Nevertheless, the broader conclusion is important: transaction-ordering risk is not merely theoretical. It can have a measurable financial impact across a large population of trades.

How MEV attacks are possible without a public Solana mempool

One common misconception is that sandwich attacks require a public mempool where every pending transaction is visible to everyone before confirmation.

Solana does not operate with the same shared public mempool model associated with some other blockchain environments.

Transactions are forwarded toward validators responsible for producing upcoming blocks. This architecture reduces certain opportunities to observe and exploit pending transactions.

However, specialized infrastructure can still provide participants with information about transaction flow. Searchers may operate optimized systems, maintain direct connections with validators or interact with specialized block-building services.

These execution paths create opportunities for transaction-ordering strategies even without a traditional public mempool.

The relevant risk is therefore not determined solely by whether a public pending-transaction list exists.

It depends on who can observe transaction flow, how ordering decisions are made and whether a profitable sequence can be executed around another participant's trade.

This is an important distinction because it explains why rapid block production does not eliminate all forms of MEV.

The difference between arbitrage and harmful MEV

Not every form of MEV has the same economic effect.

Arbitrage transactions can help correct price differences between decentralized exchanges. When one venue offers a token at a different price from another, an arbitrage strategy may trade across those markets until the discrepancy narrows.

This activity can contribute to more consistent pricing across liquidity venues.

Sandwich attacks are different because they deliberately exploit another trader's execution.

The attacker seeks to improve their own outcome by placing transactions around a victim's swap and making that swap execute at a less favourable effective price.

Both activities may involve automated strategies and transaction-ordering considerations, but their effects on other market participants are fundamentally different.

For analytical platforms, this means that identifying automated trading activity is not sufficient to determine whether a particular strategy is harmful.

The sequence of transactions and their economic consequences must also be examined.

Why slippage tolerance affects sandwich-attack exposure

Slippage tolerance specifies how much deterioration from a quoted swap result the trader is prepared to accept before execution becomes unacceptable.

This setting is intended to address the reality that decentralized markets can change between receiving a quote and completing a transaction.

A restrictive tolerance reduces the range of acceptable outcomes. If market conditions move too far against the quoted result, the swap may fail rather than execute outside the permitted range.

A wider tolerance provides more flexibility during volatile conditions, but it also gives a potential attacker more room to influence the execution price while remaining within the limits authorized by the trader.

That creates a trade-off.

Setting slippage too tightly can lead to failed transactions, particularly in fast-moving or illiquid markets. Setting it too widely can expose the position to unnecessarily poor execution.

There is no single slippage percentage that guarantees safety for every Solana memecoin.

The appropriate setting depends on market depth, transaction size, price volatility and the execution route.

What matters is understanding that slippage tolerance is not simply a technical parameter designed to improve transaction success. It is also part of the trade's economic risk.

Price impact, slippage and sandwich attacks are not the same thing

These three concepts are related but should not be confused.

Price impact describes how the trade itself affects the effective price available within the market. A large purchase relative to pool liquidity can produce significant price impact even when no attacker is involved.

Slippage describes a difference between the quoted or expected execution outcome and the final result under changing market conditions.

A sandwich attack is a specific adversarial trading strategy designed to exploit transaction ordering and worsen another trader's execution.

A poor swap result does not automatically prove that a sandwich attack occurred.

The market may have moved naturally. Another participant may have traded independently. The pool may have been shallow before the transaction was submitted.

To identify an actual attack, investigators need evidence connecting the relevant trades, wallets, execution order and economic outcomes.

This distinction is essential for accurate on-chain analysis.

Why some sandwich attacks can span multiple slots

A simplified explanation often shows the attacker's buy, the victim's trade and the attacker's sell occurring consecutively within one Solana slot.

That pattern is useful for understanding the mechanism, but it does not describe every real-world attack.

More sophisticated transaction-ordering strategies can span multiple slots. The initial purchase, victim transaction and closing sale may occur across separate blocks or validation periods.

This makes identifying sandwich activity more difficult.

A detector examining only transactions within one slot can overlook wider patterns. A detector relying solely on nearby buy and sell transactions may also classify unrelated activity incorrectly.

More reliable analysis considers transaction sequences across time, wallet relationships, pool changes and the economic outcomes of the suspected attack.

The objective is not simply to detect three transactions close together.

It is to establish whether an economically connected strategy extracted value from another participant's execution.

How Jito bundles fit into Solana MEV

Jito provides infrastructure for transaction submission and ordering within the Solana ecosystem.

One of its features is the ability to submit bundles of transactions for sequential, atomic execution. Under the relevant rules, the entire bundle is executed as a unit or fails together.

This capability has legitimate applications, including arbitrage and transactions that require coordinated execution.

However, carefully controlled ordering can also be relevant to MEV extraction.

A sandwich strategy may attempt to arrange the attacker's initial trade, the victim transaction and the closing trade in an economically advantageous sequence.

This does not mean every Jito bundle is malicious or that every sandwich attack is executed through a bundle.

The technology itself is a transaction-execution mechanism. The economic purpose of the transactions determines how it should be interpreted.

What is Jito DontFront protection?

Jito DontFront is a mitigation mechanism intended to limit a specific category of transaction-ordering attacks.

When configured correctly through the supported Jito block-engine path, it applies ordering restrictions that prevent another transaction from being positioned ahead of the protected transaction within the relevant bundle.

This can reduce exposure to certain forms of front-running and sandwich activity.

However, the protection has important limitations.

DontFront operates within the Jito block-engine context. It does not automatically control transaction ordering through every possible submission route.

It also cannot guarantee protection from all attack patterns, including strategies operating across different slots or through other execution paths.

For this reason, MEV protection should be understood as a layer of risk reduction rather than a universal guarantee.

Using a protected execution route does not remove the need to consider slippage, price impact, liquidity or the size of the proposed trade.

Can tighter slippage prevent sandwich attacks?

Tighter slippage limits can make certain attacks less profitable because they restrict how much the victim's execution price can deteriorate before the transaction becomes unacceptable.

This is one of the most practical controls available when evaluating swap execution.

However, tighter limits do not provide complete protection.

A transaction may still be vulnerable within the remaining permitted range. The market may also move naturally, and the swap may fail if conditions change beyond the chosen tolerance.

The correct objective is therefore not to search for one magical percentage.

It is to understand the relationship between the permitted execution range, the actual market liquidity and the risks of the specific trading environment.

A trader should also consider whether their position size is appropriate for the liquidity available in the token's market.

A relatively small transaction in a deep pool can behave differently from the same transaction in a thin memecoin market.

How can traders identify a suspected sandwich attack?

A useful starting point is comparing the execution result with the expected swap outcome.

If a transaction repeatedly executes near its maximum permitted slippage, this may justify further investigation, but it is not sufficient evidence by itself.

The next step is examining the on-chain activity surrounding the trade.

Investigators can look for a related purchase before the victim's transaction and a corresponding sale afterwards. They can analyse whether those trades interacted with the same liquidity pool and whether the suspected attacker ended with an economic gain.

Wallet relationships, token balance changes and transaction timing provide additional context.

Because some attacks span multiple slots, reviewing only the immediately adjacent transactions may not reveal the complete pattern.

The key is to distinguish deliberate ordering-based extraction from ordinary market volatility.

An analytical system should ideally avoid declaring that a trade was attacked without sufficient evidence.

Does MEV protection stop every attack?

No.

MEV protection encompasses several possible approaches, including slippage controls, transaction-routing choices and ordering restrictions implemented by specialized infrastructure.

Different mechanisms address different parts of the problem.

A tool that restricts ordering within a particular block engine does not necessarily prevent attacks executed through other routes.

A slippage limit can restrict permitted execution deterioration, but it cannot create missing liquidity or guarantee that the transaction will complete.

Reducing exposure therefore requires understanding several aspects of execution together.

The presence of a protection label in a trading interface should never be interpreted as proof that all MEV risk has disappeared.

Why execution awareness matters for Solana trading bots

Trading bots simplify the process of buying and selling tokens, especially in markets where prices and liquidity change quickly.

Their primary value often comes from automation, consistent execution rules and the ability to act without continuous manual monitoring.

But automated execution still takes place within a blockchain market.

A bot cannot automatically eliminate transaction-ordering risks merely by executing quickly. The result also depends on the available liquidity, the execution route, the trading parameters and the conditions under which the transaction is processed.

This is where XSolanaBot fits into the broader discussion.

XSolanaBot provides tools for buying and selling Solana tokens and configuring automatic Take Profit and Stop Loss conditions. It also offers a periodically refreshed list of newly launched memecoins.

These functions can support a more structured trading workflow, but they should not be confused with a guarantee against MEV extraction.

Traders still benefit from understanding how swaps work and what can influence the final amount received.

The goal is to combine the convenience of automation with realistic expectations about market execution.

Can a sandwich bot steal assets directly from your wallet?

A conventional sandwich attack does not require the attacker to control the victim's wallet or obtain its private keys.

Instead, the attacker attempts to profit from a swap the trader has already authorized.

The harm occurs through execution quality: the victim receives an economically worse result than would have been available without the attacker's price-moving transactions.

This distinction matters because sandwich attacks are not the same as wallet-draining malware, malicious token approvals or private-key compromise.

Different threats require different security controls.

Secure wallet custody protects against some categories of compromise, but it does not automatically protect a trader from unfavourable decentralized exchange execution.

Final thoughts: the hidden cost of a Solana memecoin trade

Sandwich attacks demonstrate that successful transaction execution and good transaction execution are not always the same thing.

A swap can complete successfully while producing a worse economic result because another participant exploited its ordering.

Recent on-chain research shows that this risk exists at significant scale within the Solana memecoin ecosystem, particularly in markets where trading conditions permit aggressive price movement.

For traders, the practical response is to understand the mechanics of their swaps.

Liquidity, slippage tolerance, price impact, transaction routing and available protective mechanisms all influence execution quality.

Automated trading can improve consistency, but it does not eliminate the underlying risks of decentralized markets.

A token chart tells you where the market has been.

A transaction record shows what happened when an order was executed.

And understanding the difference is essential to more informed Solana memecoin trading.