Curriculum·G104 MEV Analysis·about 30 min
Reading a sandwich
By the end of this lesson you can
- →Identify the three transactions of a sandwich and their positions around the victim
- →Explain how a prolific sandwich bot extracted tens of millions by front-running and back-running trades
- →Compute the extracted value from the attacker's buy price, sell price, and the victim's slippage
- →Detect a sandwich in a block from the pattern of same-pair trades wrapped around one victim
Graduate · enrolled learners
This lesson opens with The jaredfromsubway.eth sandwich bot, 2023.
- What happened
- Through 2023 a single Ethereum address, jaredfromsubway.eth, ran one of the most prolific sandwich operations on record: on one day in April 2023 it spent over 1.1 million dollars on gas, nearly 1.7 percent of all Ethereum fees and the second-largest spender on the network, and by May EigenPhi estimated it had taken about 40 million dollars in revenue in three months, 34 million after 6 million of fees, from sandwich attacks and arbitrage, across 238,000 attacks on more than 106,000 victims. Each attack is the same readable shape in a single block: the bot sees a victim's pending swap that will move a token's price, places its own buy of that token immediately before the victim (front-run), lets the victim's trade push the price up, and places its own sell immediately after (back-run), pocketing the difference the victim's own trade created. The victim receives worse execution, their slippage, and the bot keeps it. None of this is hidden; the three transactions sit in order in the block, on the same token pair, from the same bot address around the same victim, and reading that pattern is reading a sandwich.
- The decision point
- A sandwich is the most common and most legible MEV extraction, and learning to read one teaches the whole method of MEV analysis. The pattern is fixed: three transactions in a single block, a bot buy, a victim trade, a bot sell, all on the same token pair, with the bot's transactions bracketing the victim's. Once you see the shape you can measure it: the bot's profit is what it sold for minus what it bought for, and that profit is exactly the extra cost the victim paid in slippage, so a sandwich is a direct transfer from the trader to the ordering-privileged bot. jaredfromsubway.eth is the case at industrial scale, one address, the same three-transaction shape repeated relentlessly, tens of millions extracted, every instance sitting openly in the block for anyone who reads order rather than membership.
- Recorded loss
- $40,000,000
What you will be able to answer
- →What are the three transactions of a sandwich?
- →How did jaredfromsubway.eth extract tens of millions?
- →Where does sandwich profit come from?
- →How do you detect and measure a sandwich?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.theblock.co/post/230218/jaredfromsubway-mev-bot
- https://www.theblock.co/post/227110
- https://eigenphi.io/
- https://ethereum.org/developers/docs/mev/
Confidence high·Volatility high·Reviewed 2026-09-15·Owner unassigned
Contested
The tens of millions are gross revenue, not profit, and the estimates disagree. EigenPhi gave about 40 million dollars of revenue and 34 million after fees by May 2023; in the same Block article a pseudonymous MEV operator, Yannick, put the actual proceeds at 3.5 to 4.5 million dollars and said EigenPhi typically overestimates MEV revenue.
The Block (19 April 2023) reported, from Etherscan data, that the bot had spent over 1.1 million dollars on network fees in the previous 24 hours, nearly 1.7 percent of all gas fees, making it the second-largest spender on gas fees over that day, with about 700,000 dollars of profit for the day.
Not every jaredfromsubway.eth attack was the clean three-transaction shape: Yannick told The Block the bot often sandwiched several tokens in a single transaction and added arbitrage at the end of its bundles, and EigenPhi's revenue figure covers arbitrage as well as sandwiches.
Sandwich detection has edge cases (multi-hop routes, several victims per block); the three-transaction shape described is the core pattern, and real detection tools handle the variations.