# Sandwich attacks, explained: how bots eat your swap and how floors stop them

> Canonical: https://blazephoenix.xyz/learn/sandwich-attack-explained
> License: CC BY 4.0 (attribution + link) · © 2026 BlazePhoenix
> Updated: 2026-07-19

A sandwich bot buys right before your swap and sells right after, pocketing your slippage tolerance — the defense is a tight minOut plus floors the CONTRACT enforces per leg, not the frontend.

Your pending swap is public the moment it enters the mempool. A sandwich bot sees it, pays to be ordered right BEFORE you (buying the token you want, pushing its price up), lets your swap execute at the worse price, then sells right AFTER you — pocketing, almost mechanically, whatever slippage you tolerated. It is the dominant form of MEV (maximal extractable value) against retail, and it is constant.

The bot's profit is bounded by your slippage setting: tolerate 5% and you have posted a 5% bounty. That is why "auto" or double-digit slippage on a liquid pair is an invitation, and why the single best user habit is a TIGHT minOut you actually mean.

## What real protection looks like

Frontend-computed protection has a hole: if the site is compromised, your "minimum" can be set to dust. The structural fix is a floor the CONTRACT derives for itself at execution: BlazePhoenix's Router recomputes the minimum on-chain (the Iron Law Φ — hard-clamped so it can never fall below 75% of plan) and honours your minOut only when it is TIGHTER. And because a route-level floor can be gamed by sacrificing one leg, every individual leg must also deliver ≥75% of plan or the whole transaction reverts — a sandwich must now beat every leg at once.

Your part stays simple: half-a-percent slippage on deep pairs, private RPCs if you trade size, and venues where the floor lives in bytecode, not in a web page.

**Verify it yourself:** cast call 0x2a779f9Be49aac57495A8B6467Cc325a8a47Eb9f "LEG_FLOOR_BPS()(uint256)" --rpc-url https://mainnet.base.org → 7500: the per-leg floor is a public constant

Related: https://blazephoenix.xyz/learn/what-is-slippage · https://blazephoenix.xyz/learn/iron-floor · https://blazephoenix.xyz/learn/invariant-driven-ai