How to Check if Your Transaction Was Sandwich Attacked
The quickest way to check if your transaction suffered a sandwich attack is to examine the "Transaction Actions" section of your transaction on a block explorer (such as Etherscan). The defining characteristic of a sandwich attack is that your transaction is "sandwiched" between two other transactions in the same block.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Prerequisites
Before you begin, make sure you have:
The transaction hash (TxHash) of the transaction in question.
Access to a block explorer, like Etherscan (for Ethereum mainnet) or the explorer of the corresponding blockchain.
How to Inspect via a Block Explorer
Step 1: Locate Your Transaction
Open a block explorer (e.g., Etherscan) and search for your transaction hash.
Enter the transaction details page.
Find the "Transaction Actions" area on the page. This section shows a clear list of what your transaction did, such as "Swap XX Token A for YY Token B".
Completion Criteria: You have successfully located your transaction and can see a complete "Transaction Actions" summary.
Step 2: Examine the Transactions Before and After in "Transaction Actions"
This is the most critical checkpoint. Look at the list of Transaction Actions:
Before your transaction, did someone perform a trade of the same token pair but in the opposite direction, usually with a large volume?
After your transaction, did someone immediately perform a reverse operation (for example, if you bought, someone sold right after your buy)?
A common misconception: Not every trade that looks like a "sandwich" is an attack. Some may be JIT (Just-In-Time) liquidity. JIT and sandwich attacks share the same structure—frontrun + backrun—but their purposes differ: a sandwich attack harms you by manipulating the price, while JIT liquidity injects a large amount of liquidity to reduce your slippage, which is beneficial for you.
Advanced Check: Analyze the Trading Pair Address
If you want further confirmation, check whether the three transactions point to the same liquidity pool (trading pair) address.
On your transaction details page, find the smart contract address of the DEX (e.g., Uniswap) used in your trade.
Examine the preceding and following transactions to see if they also interacted with the same address.
If all three transactions operated in the same liquidity pool, it is very likely a sandwich attack.
Completion Criteria: You have identified the actions of the related transactions and judged whether they negatively impacted your trade.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Confirming You Were Sandwich Attacked
If all of the following conditions are met, you can be nearly certain that you experienced a sandwich attack:
Transaction order: Your trade is positioned exactly between a large frontrunning transaction and a following reverse transaction (backrun).
Counterparties: Both the frontrun and backrun originate from the same attacker address and interact with the same DEX liquidity pool you used.
Outcome: The amount of tokens you actually received is significantly lower than the price quote you saw when placing the order. The profit earned by the attacker is precisely the price difference you lost.
