Published on Sat Aug 22 2026 00:00:00 GMT+0000 (Coordinated Universal Time) by Jacob Cavazos

Maximal Extractable Value, or MEV, is the value that can be extracted from block production by reordering, including, or excluding transactions. In practice, this means someone is making money off your transaction before it gets confirmed. Sometimes you pay for it without knowing.

The most common form of MEV that affects ordinary users is the sandwich attack — see our guide on what MEV is and how to protect against it for the full picture. You submit a swap on a DEX. A bot sees your pending transaction in the mempool, places a buy order ahead of yours to push the price up, lets your transaction execute at the worse price, then sells immediately after. The bot pockets the difference. You paid for it.

This article is about detecting that. Not preventing it, not building MEV-resistant systems, but detecting it after the fact and monitoring for it in real time — for a forensic methodology on auditing DEX settlements, see Auditing DEX Settlements. The tools and methods described here are all public. Anyone can use them.

What MEV Looks Like On-Chain

Before you can detect MEV, you need to know what it looks like in transaction data. MEV extraction leaves traces on-chain. The patterns are identifiable if you know what to look for.

Sandwich attacks. A sandwich attack produces three transactions in the same block, targeting the same liquidity pool. The first transaction is the bot’s buy. The second is your swap. The third is the bot’s sell. All three interact with the same pool contract. The bot’s buy and sell are from the same address or a related address. The price impact of the bot’s buy moves the pool state such that your swap executes at a worse rate than you would have gotten without the bot’s intervention.

Arbitrage. A bot buys an asset on one DEX and sells it on another (or in a different pool on the same DEX) within the same block, capturing the price difference. This does not directly harm other users but does extract value from the block. Arbitrage transactions are typically standalone and involve flash loans.

Liquidations. A bot calls a lending protocol’s liquidation function to repay a borrower’s debt and claim the collateral bonus. This is MEV because the liquidator profits from the ordering of transactions.

Just-in-time liquidity. A bot adds liquidity to a pool right before a large swap and removes it immediately after, capturing swap fees without bearing inventory risk. This is harder to detect because it does not involve a direct attack on a specific user, but it degrades returns for liquidity providers.

For most users, the concern is sandwich attacks. That is what this article focuses on for the audit methodology, though the tools covered detect all forms of MEV.

Manual Detection: Reading the Block

You can detect a sandwich attack manually if you know the transaction hash of your swap. The process is straightforward.

Find your transaction in a block explorer like Etherscan. Note the block number. Open the block and look at the list of transactions in that block. Find your transaction. Look at the transactions immediately before and after it that interact with the same liquidity pool.

If the transaction before yours is a swap on the same pool, and the transaction after yours is also a swap on the same pool, and both are from addresses that are not yours, you may have been sandwiched. Check the addresses of the surrounding transactions. If they are the same address, or if they are addresses that are known MEV bot addresses, the sandwich is confirmed.

Next, compare the pool state. Look at the reserves of the pool before the first bot transaction, after the bot’s buy, after your swap, and after the bot’s sell. If the bot’s buy moved the price against you, your swap executed at a worse rate, and the bot’s sell captured the difference, you have a confirmed sandwich.

This is tedious but it works. For a single transaction, it takes about ten minutes. For a history of hundreds of swaps, you need automated tools.

Flashbots mev-inspect-rs

The most well-known open-source MEV inspection tool is mev-inspect-rs, maintained by Flashbots. It is written in Rust and available on GitHub under the Flashbots organization.

mev-inspect-rs works by replaying blocks. It takes a block number, fetches all transactions in that block, simulates each transaction against the pre-block state, and classifies each transaction or group of transactions as a specific type of MEV. It detects sandwich attacks, arbitrage, liquidations, and JIT liquidity.

For sandwich detection specifically, mev-inspect-rs identifies the pattern of three transactions on the same pool and calculates the profit extracted by the bot. It outputs structured data that you can query to find out if any of your addresses were sandwiched in a given block range.

The tool requires an Ethereum node. You can run your own archive node, use a hosted archive node service like Alchemy or Infura, or use a provider that supports eth_call with historical state. The inspection is compute-intensive because it simulates every transaction in every block, so running it over a large block range takes time and resources.

To use mev-inspect-rs for auditing your own swaps, you would run it over the block range that includes your transactions, then query the output for sandwich events where the victim transaction matches your transaction hash or your address. The output includes the bot address, the profit amount, and the victim transaction hash.

This is a developer tool. It requires Rust, a working Ethereum RPC connection, and familiarity with command-line interfaces. It is not a consumer product. But it is the most thorough open-source option available.

EigenPhi

EigenPhi is a real-time MEV analytics platform that provides a web interface and an API. It monitors multiple chains including Ethereum, BNB Chain, Arbitrum, Optimism, and Polygon.

EigenPhi’s web dashboard shows MEV extraction in real time. You can see sandwich attacks, arbitrage, and liquidations as they happen, including the bot address, the profit, and the victim transactions. The dashboard is free to browse.

For auditing your own swaps, EigenPhi is useful because it maintains a historical database of MEV events. You can search for your address or transaction hash and see if it appears in any MEV event. If your swap was sandwiched, EigenPhi will show the sandwich event with the profit extracted and the bot responsible.

EigenPhi also provides an API for programmatic access. The API allows you to query MEV events by block range, by address, or by transaction hash. This is useful if you want to build automated monitoring into your trading pipeline.

The platform categorizes MEV into more granular types than most other tools, including atomic arbitrage, sandwich, liquidation, JIT, CEX-DEX arbitrage, and backrunning. This granularity is useful for understanding the full picture of value extraction around your transactions.

EigenPhi’s data is widely cited in MEV research and is considered reliable. The platform is free for basic use, with paid tiers for higher API limits and historical data access.

MEV-Boost and mev-watch

MEV-Boost is Flashbots’ block builder and relay system for Ethereum proof-of-stake. It is not a detection tool per se, but it is relevant to MEV monitoring because it changes how MEV is distributed.

Under MEV-Boost, validators connect to relays, which connect to block builders. Builders construct blocks that capture MEV and bid for inclusion. The validator selects the highest-bidding block. The MEV revenue is shared between the builder, the relay, and the validator.

For users, the relevant tool is mev-watch, maintained by Flashbots. mev-watch is a web interface that shows which relays are currently active, which builders are producing blocks, and the MEV rewards being distributed to validators. It does not detect sandwich attacks on individual transactions, but it provides visibility into the MEV supply chain.

If you want to understand whether your validator or staking pool is using MEV-Boost and which relays it connects to, mev-watch is the tool. This matters because some relays have censorship policies that exclude transactions from sanctioned addresses, and some builders are more aggressive about sandwich attacks than others.

For end users concerned about being sandwiched, mev-watch is less directly useful than EigenPhi or mev-inspect-rs. But it provides context on the broader MEV landscape.

DEX aggregators and slippage monitoring

One practical approach to MEV detection does not require specialized MEV tools at all. If you track your swap execution quality, you can infer MEV exposure from slippage.

Every DEX swap has an expected output based on the pool state at the time you submit the transaction and a minimum output you are willing to accept (your slippage tolerance). The difference between the expected output and the actual output is your realized slippage.

Some slippage is normal. Pool state changes between submission and execution. But if your realized slippage consistently exceeds what you would expect from normal pool movement, and the excess aligns with the presence of sandwich transactions in the same block, you are being extracted.

To monitor this, log the expected output at submission time for every swap. After execution, compare the actual output. Calculate the slippage percentage. Track it over time. If you see spikes that correlate with specific blocks or specific pools, investigate those blocks for sandwich patterns.

This is not a substitute for dedicated MEV detection tools, but it is a lightweight method that any developer can implement. It catches the symptom, even if it does not identify the bot.

Building a monitoring pipeline

For institutions or active traders, a real-time MEV monitoring pipeline is worth building. The components are all publicly available.

First, you need access to the Ethereum mempool. This means running your own node or subscribing to a mempool service. When you see your own pending transaction in the mempool, you can check whether other pending transactions target the same pool. If a bot transaction appears after yours but before inclusion, targeting the same pool in the opposite direction, you are about to be sandwiched.

Second, you need block monitoring. After your transaction is included, check the block for sandwich patterns around your transaction. This is the same logic as manual detection, but automated.

Third, you need alerting. If a sandwich is detected, send an alert. For institutional traders, this can trigger a review of routing strategy or a switch to MEV-protected transaction submission.

The tools for each component are public. Mempool monitoring can be done with any Ethereum node. Block analysis can use mev-inspect-rs or EigenPhi’s API. Alerting can use any standard notification system.

MEV protection vs detection

Detection tells you what happened. Protection prevents it from happening again — and real-time MEV monitoring is how you catch it before it settles. They are different problems.

The primary public MEV protection mechanism is Flashbots Protect, a private transaction pool that routes transactions directly to builders without exposing them to the public mempool. Transactions submitted through Flashbots Protect cannot be sandwiched because they are not visible to sandwich bots in the mempool.

Other protection mechanisms include CoW Swap, which uses batch auctions to eliminate MEV, and 1inch’s Fusion mode, which uses Dutch auctions for order matching. These are protocol-level solutions that change the execution model rather than hiding the transaction.

Using a DEX aggregator with MEV protection does not eliminate all MEV, but it significantly reduces sandwich exposure. If you are auditing your transaction history and finding frequent sandwiches, switching to a protected submission method is the logical next step.

Detection and protection are complementary. You detect to understand the scope of the problem. You protect to reduce it going forward. You continue detecting to verify that your protection is working.

What to do with detection results

If you find that your swaps are being sandwiched, the data tells you several things. It tells you which pools are most targeted, which times of day see the most sandwich activity, and how much value you are losing.

Use this data to adjust your execution strategy. Increase slippage tolerance only when necessary and reduce it when possible. Use MEV-protected submission for large swaps. Avoid executing large swaps during periods of high MEV bot activity. Split large swaps across multiple blocks or multiple pools to reduce the signal that attracts sandwich bots.

The amount of value lost to MEV can be significant. Studies from EigenPhi and Flashbots have shown that total MEV extraction on Ethereum regularly exceeds hundreds of millions of dollars annually. For blockchain companies building monitoring tools for government use, becoming defense-eligible is a prerequisite. A portion of that comes from sandwich attacks on ordinary users. Knowing how much of it comes from you is the first step to reducing it.

Frequently Asked Questions

How is MEV detected?

MEV is detected by analyzing blockchain transactions and block contents for patterns that indicate value extraction through transaction reordering. This includes comparing transaction ordering to submission order, identifying sandwich attack patterns around victim transactions, and measuring arbitrage profits. Detection tools process mempool data and on-chain events in real time.

What tools detect sandwich attacks?

Sandwich attack detection tools analyze mempool activity and block contents to identify the characteristic pattern of a front-run buy followed by a back-run sell around a victim swap. Open-source tools like mev-inspect and dashboards from EigenPhi and Flashbots provide visibility into sandwich attacks. These tools reconstruct attack patterns from on-chain data.

What is mempool monitoring?

Mempool monitoring is the practice of observing pending transactions before they are confirmed in a block. By watching the mempool, analysts can identify transactions being targeted by MEV bots, detect front-running attempts, and measure the time between submission and inclusion. It is a foundational technique for understanding MEV activity.

Can MEV be measured?

Yes, MEV can be measured by quantifying the value extracted through transaction reordering, sandwich attacks, and arbitrage. Tools like EigenPhi and Flashbots track total MEV volume across chains, and researchers have estimated annual MEV extraction in the hundreds of millions of dollars. Measurement helps traders understand their exposure and evaluate protection strategies.

Written by Jacob Cavazos