9 Maximal Extractable Value
We additionally show that high fees paid for priority transaction ordering pose a systemic risk to consensus-layer security.
Daian et al., Flash Boys 2.0 (2020)
9.1 Learning objectives
By the end of this chapter the reader should be able to:
- define MEV precisely as the value of transaction inclusion and ordering, and locate it in the pipeline from mempool to block;
- classify the three canonical strategies (arbitrage, liquidation, sandwich) by whether they close or manufacture inefficiency;
- formulate the sandwich attack as a constrained optimisation on the constant-product curve from Chapter 8 and compute the optimal front-run;
- explain how fee-driven reordering threatens consensus stability, following the analysis of Daian et al. (2020);
- describe proposer-builder separation as an auction that redistributes rather than abolishes MEV;
- audit a claim of ‘MEV protection’ by quantifying the residual extractable value it leaves unaddressed;
- transfer the ordering-tax lesson to any allocation queue, recognising that ordering power together with advance visibility constitutes a tax whether the venue is a mempool or a waiting list.
9.2 Orientation
We begin not with a blockchain but with a waiting list. Whenever a scarce health resource is allocated by a queue, whether a transplant waiting list, a vaccine appointment slot during a shortage, or the procurement of a scarce therapeutic, the party who controls the order of that queue, or who can merely see the pending requests before they settle, holds something of value. The value is the ability to place a favoured request ahead of others, or to act on the knowledge of what is coming before it arrives. History gives us little reason to expect such value to go unextracted. Wherever ordering power and advance visibility coincide, they function as a tax on the participants whose requests are reordered, and the tax is collected whether or not anyone troubles to name it.
Maximal extractable value (MEV) is the cryptocurrency instance of this general phenomenon. Its setting is the automated market maker of Chapter 8 (a venue that prices each trade by a fixed formula against a pool of reserves rather than by matching buyers to sellers), which priced a swap by a deterministic curve: given the reserves, the output of any trade is a known function of its size. That determinism was presented as a virtue, and for a lone trader it is. Here we study its adversarial consequence. If the price a user receives is a known function of the pool state, and if the pool state can be altered by inserting a transaction immediately before the user’s, then the profit an adversary can extract by choosing what to insert, and in what order, is itself a deterministic function of the user’s trade and the pool depth. It is not a matter of luck or of rare exploitation but an optimisation problem with a closed-form-adjacent solution, solved thousands of times per day.
MEV carries one property that its public-health analogues lack, and that property is what makes it worth our close study: on a public chain the extraction is measurable to the dollar. A waiting list manipulated for advantage leaves, at best, a statistical residue open to dispute, whereas a sandwich attack (an adversary bracketing a victim’s trade with its own transactions in order to worsen the victim’s price) leaves an auditable trail of transactions from which the extracted value can be computed exactly. We shall exploit that measurability to make the general lesson precise, and then carry the lesson back to the settings in which it cannot be measured but nonetheless applies.
The reader arrives equipped for the technical work. Choosing an inclusion set and an order to maximise a payoff is a scheduling problem. The attacker’s profit as a function of front-run size (the size of the trade the attacker inserts ahead of the victim) is a smooth objective on a compact set, to be maximised by the same reasoning used for any one-dimensional optimum. The market that sells the right to order transactions is an auction, analysable with the tools of auction theory. The work of the chapter is to make these translations and, in doing so, to remove the mystique MEV is usually granted and to exhibit it as market microstructure (the study of how the mechanics of trading and order handling determine prices).
The stakes are not only pecuniary. Ordering that is economically valuable and visible before settlement is an information-integrity failure, and the same structure recurs wherever a queue of sensitive operations is exposed before it is committed. The book’s running case study, a multi-institution clinical-trial data-integrity ledger, furnishes the health-data instance we shall develop once the mechanism is precise: several hospitals maintain a shared, append-only record of enrolment, randomisation, and outcome events with no single trusted custodian, and a regulator audits it after the fact. We refer to it hereafter as the trial ledger. A ledger of that kind places a queue of pending allocations in view, and a queue of pending allocations is precisely the surface this chapter teaches one to recognise.
The plan of the chapter is as follows. We first make the notion of extractable value precise and classify the three canonical strategies by whether they close or manufacture an inefficiency. We then treat the sandwich quantitatively, correcting a common misdescription of its profit function, and follow Daian et al. (2020), the study published as ‘Flash Boys 2.0’, in tracing how competition for MEV destabilises the consensus layer beneath it. Proposer-builder separation is examined as an auction that redistributes rather than abolishes the tax. Lastly we return to the trial ledger and to allocation-order integrity in health systems generally, where the mechanism recurs but the remedy is regulatory rather than market-based.
Before proceeding we fix the vocabulary on which the argument depends, so that the reader need not carry these terms as mysteries.
Several terms recur throughout the chapter. We define them here and use them consistently thereafter.
- Maximal (miner) extractable value (MEV). The value a block producer can capture through its power to decide which pending transactions enter a block and in what order, over and above the ordinary transaction fees and block reward. The term arose as ‘miner extractable value’ under proof-of-work and was reread as ‘maximal’ under proof-of-stake.
- The mempool. The public holding area of pending transactions. In an open network a proposed transaction broadcasts to every node and waits there, visible to all, until some producer includes it in a block.
- Transaction ordering. The producer’s right to choose both which transactions to include and the sequence in which they execute. Because a trade’s price depends on the pool state it meets, the sequence is economically consequential, and it is ordering, not mere inclusion, that MEV monetises.
- Front-running and back-running. Placing one’s own transaction immediately before a target transaction (front-running) or immediately after it (back-running) in order to profit from the price movement the target causes.
- The sandwich attack. The pairing of a front-run and a back-run around a victim’s trade, so that the victim executes at a price the front-run has deliberately worsened while the attacker unwinds its position immediately after.
- Arbitrage. A trade that profits by equalising a price that differs between two venues, or between a pool and an external reference, thereby restoring a single price.
- Liquidation. The forced closing of a collateralised loan whose collateral has fallen below a required threshold, for which the lending protocol pays the closing party a discount.
9.3 The statistician’s contribution
Three judgements in this chapter are the analyst’s to make, and no tool makes them automatically.
Quantify extractable value as an optimisation on a known curve. MEV is frequently reported as an aggregate dollar figure of unclear provenance. The disciplined statement is a function: given the victim trade, the pool reserves, and the fee, the extractable value is the maximum of an explicit profit function over the attacker’s decision variable. Writing that function down converts folklore into a computation we can check, and, as this chapter shows, checking it sometimes contradicts the folklore.
Recognise MEV as a structural tax, not a bug. A sandwich is not a protocol defect to be patched. It is the equilibrium consequence of two design choices: a public queue of pending trades and a block producer free to order them. The extractable value is therefore a levy on users that scales with their trade size and their tolerance for slippage, the gap between the price a trade is quoted and the price it in fact receives. Naming it a tax, and estimating its rate, is more useful than naming it an attack.
Audit ‘MEV protection’ claims. A protocol or wallet that advertises protection is making an empirical claim: that the residual extractable value under its mechanism is small. That claim is testable. The statistician’s contribution is to compute the residual, not to accept the adjective.
9.4 What MEV is
A block producer assembles the next block from a pool of pending transactions. In an open network that pool, the mempool, is public: proposed transactions broadcast to every node and wait, visible, until some producer includes them. The producer is not obliged to include transactions in the order they arrived, nor to include any particular transaction at all. Within the block it builds, the producer chooses the inclusion set and the order.
That freedom has value. Under the fee market of Buterin et al. (2019) (the 2021 reform that split each transaction’s fee into a base fee and a priority tip) a transaction carries a priority fee, a tip paid directly to the producer, so the naive value of ordering is the sum of tips the producer can collect. Maximal extractable value is the larger quantity that includes the profit the producer can capture by inserting its own transactions and by ordering the block’s contents to its advantage. The term originated as ‘miner extractable value’ in proof-of-work, where the miner producing a block was the ordering authority; under proof-of-stake (Chapter 10) the proposer, the validator whose turn it is to produce the block, plays that role, and the initialism was retained by reading it as ‘maximal’.
Two roles populate the supply chain. A searcher is an agent who scans the mempool for profitable ordering opportunities and submits transactions, or bundles of transactions, designed to capture them. A block producer, or an intermediary the producer delegates to, decides which of these bundles enters the block. A searcher who is not the producer must pay the producer for favourable placement, through a priority fee or an explicit bribe. The value extracted is thus split between searcher and producer by a market we examine under proposer-builder separation below.
9.5 Three canonical strategies
MEV strategies are not uniform in their welfare effect. It is worth separating those that correct a mispricing from those that manufacture one. Before treating each in turn, we set the three side by side. Table 9.1 distinguishes them by who bears the cost, whether the strategy performs a function the system needs, what drives its magnitude, and the health-queue situation each most resembles.
| Strategy | Who bears the cost | Socially useful | Magnitude driver | Health-queue analogue |
|---|---|---|---|---|
| Arbitrage | Liquidity providers | Yes, realigns the pool to the market price | Size of the mispricing | Reordering a queue back to the stated policy |
| Liquidation | The undercollateralised borrower | Yes, removes bad debt | Collateral shortfall and the liquidation discount | Enforcing a triage threshold once it is crossed |
| Sandwich | The targeted victim trader | No, manufactures then unwinds a mispricing | Victim slippage tolerance times trade size | Advancing a favoured patient ahead in the queue |
9.5.1 Arbitrage
When the same asset trades at different prices on two venues, or when a pool’s price diverges from an external reference, a trade that equalises them earns the difference. On a constant-product pool with reserves \(R_x, R_y\) (a market maker whose reserves multiply to a constant \(R_x R_y = k\) that every trade preserves) and no fee, the marginal price of \(X\) is \(R_y/R_x\). If an external market prices \(X\) at \(p\), the pool is mispriced whenever \(R_y/R_x \neq p\), and the trade that restores \(R_y/R_x = p\) has a closed form. Selling \(\Delta x^\star = \sqrt{R_x R_y / p} - R_x\) units of \(X\) into the pool (valid when the pool over-prices \(X\)) brings its marginal price exactly to \(p\).
Rx <- 1e6; Ry <- 1.1e6 # pool prices X at 1.10
p_ext <- 1.00 # external price of X
dx_star <- sqrt(Rx * Ry / p_ext) - Rx
after <- swap_x_for_y(dx_star, Rx, Ry)
arb_profit <- after$dy - dx_star * p_ext
c(trade = dx_star,
pool_price_after = after$Ry / after$Rx,
profit_Y = arb_profit)
#> trade pool_price_after profit_Y
#> 48808.848 1.000 2382.304The trade drives the pool price to exactly the external price and books a profit equal to the mispricing it removed. Arbitrage of this kind is the benign end of MEV: it is a deterministic optimisation, it is competed for, and its social effect is to keep pool prices aligned with the wider market. It taxes liquidity providers (the participants who fund the pool and stand as counterparty to the correcting trade) but it does not target any individual user’s transaction.
‘MEV is good for users because arbitrage keeps prices efficient.’ Name the tier. That arbitrage closes price gaps is a protocol-level fact about the curve, verified by the computation above. That MEV as a whole benefits users is an economic claim, and it is false as stated: the same ordering power that enables benign arbitrage enables the sandwich, which is a direct transfer from a user to an adversary. The efficiency of arbitrage does not net against the extraction of sandwiching; they are different trades with different victims. Conflating the benign case with the whole category is exactly the tier-slippage this book trains the reader to catch.
9.5.2 Liquidations
Lending protocols hold collateralised loans that become eligible for liquidation when the collateral value falls below a threshold. The protocol offers a liquidator a discount for closing an undercollateralised position. Because eligibility is a deterministic function of an on-chain price and the loan state, the moment a position crosses the threshold is observable, and searchers compete to be the transaction that liquidates it. Like arbitrage, liquidation performs a function the system needs (removing bad debt) while extracting value from the ordering right to perform it. The competition is again a race for position in the block.
9.5.3 The sandwich
The sandwich is the extractive case. It targets a specific pending swap and profits by degrading the price that swap receives. The attacker places one transaction before the victim and one after, so the victim executes ‘sandwiched’ between them. Unlike arbitrage, it corrects no mispricing: it creates a temporary one, forces the victim to trade into it, and then undoes it. The remainder of the chapter treats the sandwich quantitatively, because it is the strategy for which the statistician’s framing is most clarifying and the popular account most often wrong.
We picture the mechanism before we quantify it. Figure 9.1 shows the attacker occupying the slots immediately before and after the victim inside one block, the arrangement that lets a front-run inflate the price the victim then pays.
PAL <- c('#2a78d6', '#1baf7a', '#eda100', '#008300',
'#4a3aa7', '#e34948', '#e87ba4', '#eb6834')
book_theme <- ggplot2::theme_minimal(base_size = 11) +
ggplot2::theme(
panel.grid.minor = ggplot2::element_blank(),
panel.grid.major = ggplot2::element_line(
linewidth = 0.25, colour = 'grey88'),
axis.title = ggplot2::element_text(size = 10),
legend.position = 'bottom')
ink <- '#33356b'; hit <- '#e34948'; ctx <- '#9a9a92'
ggplot() +
annotate('rect', xmin = 0.2, xmax = 2.7, ymin = 2.9, ymax = 4.6,
fill = 'grey95', colour = ctx, linewidth = 0.5,
linetype = 2) +
annotate('text', x = 1.45, y = 4.35, label = 'Public mempool',
colour = ctx, size = 3.3, fontface = 'bold') +
annotate('text', x = 1.45, y = 3.65,
label = 'victim swap\npending, visible', colour = ctx,
size = 3) +
annotate('segment', x = 2.75, xend = 3.25, y = 3.75, yend = 3.75,
colour = ink, arrow = arrow(length = unit(0.16, 'cm'))) +
annotate('rect', xmin = 3.3, xmax = 9.6, ymin = 2.6, ymax = 4.9,
fill = NA, colour = ink, linewidth = 0.6) +
annotate('text', x = 6.45, y = 4.65,
label = 'Block (ordering fixed by producer)', colour = ink,
size = 3.2, fontface = 'bold') +
annotate('rect', xmin = 3.55, xmax = 5.4, ymin = 3.1, ymax = 4.3,
fill = PAL[1], colour = ink, linewidth = 0.5) +
annotate('rect', xmin = 5.55, xmax = 7.4, ymin = 3.1, ymax = 4.3,
fill = hit, colour = ink, linewidth = 0.5) +
annotate('rect', xmin = 7.55, xmax = 9.4, ymin = 3.1, ymax = 4.3,
fill = PAL[1], colour = ink, linewidth = 0.5) +
annotate('text', x = 4.47, y = 3.7,
label = '1 front-run\nbuy (attacker)', colour = 'white',
size = 2.9) +
annotate('text', x = 6.47, y = 3.7,
label = '2 victim buy\nat worse price', colour = 'white',
size = 2.9) +
annotate('text', x = 8.47, y = 3.7,
label = '3 back-run\nsell (attacker)', colour = 'white',
size = 2.9) +
annotate('segment', x = 3.55, xend = 9.4, y = 2.35, yend = 2.35,
colour = ctx, linewidth = 0.3) +
annotate('text', x = 4.47, y = 2.05, label = 'price rises\np0 -> p1',
colour = ink, size = 2.7) +
annotate('text', x = 6.47, y = 2.05,
label = 'executes at\ninflated p1', colour = hit,
size = 2.7) +
annotate('text', x = 8.47, y = 2.05, label = 'price falls\np1 -> ~p0',
colour = ink, size = 2.7) +
coord_cartesian(xlim = c(0, 9.8), ylim = c(1.6, 5)) +
theme_void()
9.6 The sandwich as an optimisation
Fix a pool with reserves \(R_x, R_y\) and a victim who will swap \(v\) units of \(X\) for \(Y\). The attacker front-runs with a buy of size \(a\), the victim then buys at the worsened price, and the attacker sells back the \(Y\) it acquired. Every leg is a constant-product swap, so the attacker’s profit is an explicit function of the single decision variable \(a\). We reuse the swap primitives from above and grid-search the objective. The pool fee is set to zero here so the mechanism is visible without the fee’s confounding; we restore a binding cost in a moment.
sandwich_profit <- function(a, v, Rx, Ry) {
s1 <- swap_x_for_y(a, Rx, Ry) # attacker front-run buy
s2 <- swap_x_for_y(v, s1$Rx, s1$Ry) # victim buy at worse price
s3 <- swap_y_for_x(s1$dy, s2$Rx, s2$Ry) # attacker sells its Y back
s3$dx - a
}
Rx <- 1e6; Ry <- 1e6; v <- 5e4
a_grid <- seq(1, 2e5, length.out = 400)
profit <- sapply(a_grid, sandwich_profit, v = v, Rx = Rx, Ry = Ry)
a_star <- a_grid[which.max(profit)]
c(optimal_a = a_star, max_profit = max(profit))
#> optimal_a max_profit
#> 200000.00 15517.24
The reported optimum lies at the right edge of the grid, and Figure 9.2 shows why: with a zero fee the profit is monotonically increasing in \(a\). The grid search did not find an interior peak because there is none to find. This is worth dwelling on, because a widely repeated description of the sandwich asserts that profit is concave in the front-run size with an interior optimum, and here the computation contradicts the description. If we push the front-run far beyond the grid, the reason becomes clear.
c(front_run_1e9 = sandwich_profit(1e9, v, Rx, Ry),
victim_input = v)
#> front_run_1e9 victim_input
#> 49999.95 50000.00With no fee, the attacker’s round-trip is costless, so a larger front-run is always weakly better, and the profit rises toward a ceiling equal to the victim’s entire input \(v\). Intuitively, the attacker can extract at most the value the victim loses to slippage, and in the limit of an enormous front-run the victim receives almost nothing while the attacker captures very nearly the full \(v\). There is no too-large front-run to punish when the round-trip is free, hence no interior optimum. The concavity story is not wrong in spirit, but it requires a cost that the zero-fee model omits. Two costs supply it: the pool’s trading fee, charged on every leg including the attacker’s own round-trip, and, more sharply, the victim’s slippage limit, which removes the victim entirely if the front-run is too aggressive. We develop the second, which is both the dominant real-world bound and the quantity a ‘protection’ claim is really about, in the worked example.
9.7 Flash Boys 2.0: reordering and consensus instability
The foregoing establishes that extractable value is a deterministic function of public state. The consequence, drawn out by Daian et al. (2020) in the paper that named the phenomenon for a general audience, is that competition to capture it destabilises the layer beneath it. Their argument has two parts, and both are quantitative.
First, front-running competition becomes an auction conducted in the fee. When several searchers detect the same opportunity, each wants its transaction ordered first, and under a fee-priority regime the producer orders by fee. The searchers therefore bid each other up in a ‘priority gas auction’, raising fees until they approach the value of the opportunity itself. This is an ascending auction whose proceeds accrue to the producer, and it explains a puzzling empirical signature: sudden fee spikes uncorrelated with ordinary user demand, driven by two bots outbidding one another over a single arbitrage. The fee market of Buterin et al. (2019) reshaped the mechanics, replacing a first-price free-for-all with a base-fee-plus-tip structure, but the tip is still an ordering auction and the competitive dynamic survives.
Second, and more seriously, the extractable value in past blocks can exceed the reward for producing a new block. When it does, a rational producer’s best move is not to extend the chain but to re-mine a recent block and capture the MEV inside it for itself, a ‘time-bandit’ reorganisation that rewrites confirmed history for profit rather than for a double-spend. This couples the application layer to consensus in a way the security analysis of Chapter 6 did not contemplate: the cost of rewriting history is offset by the MEV reward for doing so, lowering the effective security of finality. Daian et al. (2020) frame this as a systemic risk, and the framing is apt. MEV is not only a tax on users; above a threshold it is a bribe to abandon consensus.
The disciplined reading keeps the two claims in their tiers. That reordering is profitable and fee-competition is an auction are protocol-level facts, verifiable from the mechanism. That time-bandit reorgs occur at scale is an empirical claim whose magnitude depends on the ratio of extractable value to block reward, and it is that ratio, not the mere possibility, that determines whether the risk is realised.
9.8 Proposer-builder separation and the MEV supply chain
If ordering is a valuable and contestable right, the natural institutional response is to organise a market for it, and that is what proposer-builder separation (PBS) does. PBS decomposes the producer into two roles. A builder assembles a full, ordered block, including whatever MEV bundles it has sourced, and attaches a bid: the payment it will make to the proposer if its block is chosen. A proposer, the validator whose turn it is to add a block, does not build; it selects the highest-bidding block and signs it. Between them sit relays, trusted intermediaries that hold builders’ blocks and reveal them to the proposer only after the proposer has committed to the bid, preventing the proposer from stealing the block’s contents.
We can lay the supply chain out as a diagram. Figure 9.3 traces a bundle from searcher through builder and relay to proposer, marks the sealed-bid auction that settles the ordering right, and shows private order flow as the bypass that never touches the public mempool.
node_rect <- function(xmin, xmax, label, fill = 'grey96') {
list(
annotate('rect', xmin = xmin, xmax = xmax, ymin = 3.0, ymax = 4.0,
fill = fill, colour = ink, linewidth = 0.5),
annotate('text', x = (xmin + xmax) / 2, y = 3.5, label = label,
colour = ink, size = 3.1, fontface = 'bold'))
}
flow_arr <- function(x, xend) {
annotate('segment', x = x, xend = xend, y = 3.5, yend = 3.5,
colour = ink, linewidth = 0.5,
arrow = arrow(length = unit(0.16, 'cm')))
}
ggplot() +
node_rect(0.3, 2.0, 'Searcher') +
node_rect(2.7, 4.4, 'Builder') +
node_rect(5.1, 6.8, 'Relay') +
node_rect(7.5, 9.2, 'Proposer') +
flow_arr(2.02, 2.68) + flow_arr(4.42, 5.08) +
flow_arr(6.82, 7.48) +
annotate('text', x = 2.35, y = 3.75, label = 'bundle', colour = ink,
size = 2.6) +
annotate('segment', x = 3.55, xend = 8.35, y = 4.55, yend = 4.55,
colour = PAL[3], linewidth = 0.4) +
annotate('text', x = 5.95, y = 4.85,
label = 'sealed-bid auction: highest bid wins the slot',
colour = PAL[3], size = 2.8, fontface = 'bold') +
annotate('segment', x = 3.55, xend = 3.55, y = 4.0, yend = 4.5,
colour = PAL[3], linewidth = 0.3, linetype = 3) +
annotate('segment', x = 8.35, xend = 8.35, y = 4.0, yend = 4.5,
colour = PAL[3], linewidth = 0.3, linetype = 3) +
annotate('rect', xmin = 0.3, xmax = 2.0, ymin = 1.1, ymax = 2.0,
fill = 'grey96', colour = PAL[2], linewidth = 0.5) +
annotate('text', x = 1.15, y = 1.55, label = 'User', colour = PAL[2],
size = 3.1, fontface = 'bold') +
annotate('curve', x = 2.02, xend = 3.55, y = 1.55, yend = 2.98,
colour = PAL[2], linewidth = 0.5, curvature = -0.3,
arrow = arrow(length = unit(0.16, 'cm'))) +
annotate('text', x = 3.35, y = 1.75,
label = 'private order flow\n(bypasses mempool)',
colour = PAL[2], size = 2.7, hjust = 0) +
coord_cartesian(xlim = c(0, 9.5), ylim = c(0.9, 5.1)) +
theme_void()
The economic content is an auction, and the statistician should read it as one. Builders compete in what is effectively a first-price sealed-bid auction for the right to have their block proposed. In equilibrium a builder bids up to the MEV it can extract, less its margin, so the auction transfers most of the extractable value from the builder to the proposer. This is a redistribution, not an elimination. The user whose trade is sandwiched is no better off; the sandwich still occurs, and its proceeds now flow up the chain to the proposer via the builder’s bid. PBS improves decentralisation (a small validator can capture MEV revenue without running a sophisticated searching operation) and it mitigates the consensus-instability worry by making MEV a smooth ongoing revenue stream rather than a lumpy incentive to reorg. What it does not do is reduce the tax.
A further wrinkle is private order flow. If users send transactions directly to a builder through a private channel rather than to the public mempool, those transactions are never exposed to searchers, and the sandwich opportunity never forms. Private order flow is thus a genuine protection, but it purchases integrity by reintroducing a trusted intermediary, the builder who sees the order first. The property the public mempool sacrificed, integrity of ordering without a custodian, is recovered only by appointing a custodian.
The posture PBS adopts, to constrain and channel ordering power rather than to remove it, is familiar from the governance of allocation queues in health systems. We do not eliminate ordering power on a transplant waiting list or in the appointment queue for a scarce vaccine; we constrain it with published allocation rules and we audit it after the fact. The parallel should be drawn with care, however, for it ends at a substantive point. MEV is redistributed by a market, the sealed-bid auction transferring the tax from builder to proposer, whereas the integrity of a health-allocation queue is secured by regulation and audit, not by selling the ordering right to the highest bidder. Auctioning the right to order a transplant list would be a scandal rather than a mechanism. What transfers between the two settings is diagnostic, the recognition of an ordering-and-visibility surface, and not the market remedy.
‘PBS solves MEV.’ Name the tier. That PBS moves MEV revenue from builders to proposers and smooths the reorg incentive is an economic claim that holds under its stated auction assumptions, and it is largely true. That PBS solves MEV is a narrative, and it fails on the definition: the extractable value is a function of the public pending trade and the pool depth, and PBS changes neither. It reassigns who collects the tax, not whether the user pays it. A mechanism that redistributes a levy is not a mechanism that abolishes it, and marketing that elides the difference is selling the narrative in the cadence of the fact.
9.9 Ordering integrity beyond crypto
Strip away the tokens and the sandwich is an instance of a general failure: a system in which the order of operations is economically valuable and is visible before it is committed. Wherever both conditions hold, whoever controls or observes the queue can profit by reordering it, and the participants whose operations are reordered bear the cost. The public mempool is the crypto-specific form of the vulnerability, but the structure is not crypto-specific.
To illustrate, consider the trial ledger in a concrete shortage scenario. Suppose four hospitals share the ledger during a trial of a scarce therapeutic, and that each day a fixed number of enrolment-and-randomisation entries are appended, say twenty slots against forty eligible patients. If the pending entries are visible before they are committed, a coordinator at one site who can see that the next randomisation will assign the active arm, and who can advance a preferred patient into that position, extracts value in the precise sense of this chapter: the value of controlling the order of a queue whose order is outcome-relevant. No tokens change hands, yet the integrity of the allocation is compromised exactly as a swap’s execution price is compromised by a front-run. Here the analogy both illuminates and reaches its limit. It illuminates because the diagnosis is identical, namely order-dependent value together with pre-settlement visibility. It reaches its limit because the extractable quantity is not a dollar figure but a bias in arm assignment, unmeasurable to the precision the on-chain case affords, and because the remedy is not an auction that reassigns the tax but a regulatory prohibition on exposing the queue at all. The vaccine cold-chain provenance system, the book’s secondary example, admits the same reading whenever the sequence of pending custody transfers is visible before it is recorded.
We can tabulate the venues this chapter has touched. Table 9.2 compares who holds the ordering right, how visible the pending queue is before it settles, and what mechanism constrains the power in each.
| Venue | Who orders | Visibility before settlement | Constraint mechanism |
|---|---|---|---|
| Public mempool | Block producer or builder | Full and public | Market: PBS sealed-bid auction |
| Private order flow | The builder that receives it | Hidden from searchers, seen by the builder | Trust in the intermediary, plus PBS |
| Transplant list | Allocation policy and the procurement organisation | Restricted, not publicly pending | Regulation and after-the-fact audit |
| Vaccine scheduler | The scheduling administrator | Restricted, not publicly pending | Regulation and after-the-fact audit |
Consider a workflow in which sensitive operations queue before they settle: pending laboratory orders visible to a party who also trades on the implied diagnosis, a formulary system in which the sequence of pending procurement requests leaks demand before contracts are set, or the trial ledger’s enrolment pipeline in which the order of pending allocations is observable to someone with an interest in the arm assignment. Each is a front-running surface in the exact sense of this chapter: order-dependent value plus pre-settlement visibility. The lesson transfers cleanly. Making a queue of sensitive operations public before commitment is an information-integrity hazard, and the analyst should treat ‘the pending list is visible’ as a finding, not a convenience.
The lesson also cuts against naive on-chain designs for health data. A public ledger for clinical operations would expose precisely the pre-settlement queue that must stay confidential, importing the mempool’s vulnerability into a setting where the leaked information is a diagnosis rather than a trade. The remedies that work on-chain, private order flow and commit-reveal schemes, amount to reintroducing a trusted intermediary or delaying visibility, which a conventional access-controlled database provides directly and more simply. As Chapter 1 argued, when a custodian is available and acceptable, the custodial design is usually the correct one, and ordering integrity is a case where the public ledger is often the wrong tool.
9.10 Worked example: auditing MEV protection
The dominant real-world bound on a sandwich is the victim’s slippage limit. A well-formed swap specifies a minimum acceptable output: the transaction reverts if the received amount falls below \((1-s)\) times what a trade against the undisturbed pool would return, for a tolerance \(s\) the user sets (a wallet default of one percent is common). This changes the attacker’s problem from an unbounded optimisation into a constrained one. Front-run too little and value is left unextracted; front-run enough to push the victim below its minimum and the victim’s transaction reverts, leaving no victim to sandwich and only the attacker’s own round-trip. The profit function now rises and then falls, and the interior optimum the zero-fee model lacked appears, located by the slippage limit rather than by a fee.
slip <- 0.01
fair_out <- swap_x_for_y(v, Rx, Ry)$dy
min_out <- (1 - slip) * fair_out
victim_reverts <- function(a) {
after <- swap_x_for_y(a, Rx, Ry)
swap_x_for_y(v, after$Rx, after$Ry)$dy < min_out
}
bounded_profit <- function(a) {
if (victim_reverts(a)) 0 else sandwich_profit(a, v, Rx, Ry)
}
b_grid <- seq(1, 3e4, length.out = 500)
b_profit <- vapply(b_grid, bounded_profit, numeric(1))
b_star <- b_grid[which.max(b_profit)]
c(front_run = b_star,
extracted = max(b_profit),
tax_fraction = max(b_profit) / v)
#> front_run extracted tax_fraction
#> 5.111050e+03 5.197297e+02 1.039459e-02
The extracted value is close to one percent of the victim’s trade, which is to say close to the slippage the victim authorised. This is the auditable statement the chapter has been building toward: under a sandwich, the tax a user pays is approximately its own slippage tolerance times its trade size. A wallet advertising ‘MEV protection’ through a tighter default slippage is making a quantitatively correct claim, and the analyst can state its size rather than accept its adjective. A protection that halves the tolerance halves the worst-case extraction.
We can display the identity directly. Figure 9.5 plots the extraction tax against the tolerance the victim authorised, and the curve sits almost on the dashed identity line across the usual range of wallet defaults.
a_search <- seq(1, 3e4, length.out = 500)
tax_frac <- function(s) {
floor_out <- (1 - s) * swap_x_for_y(v, Rx, Ry)$dy
prof <- vapply(a_search, function(a) {
after <- swap_x_for_y(a, Rx, Ry)
got <- swap_x_for_y(v, after$Rx, after$Ry)$dy
if (got < floor_out) 0 else sandwich_profit(a, v, Rx, Ry)
}, numeric(1))
max(prof) / v
}
tol_grid <- seq(0.0025, 0.03, length.out = 24)
tax_df <- tibble(tol = tol_grid,
tax = vapply(tol_grid, tax_frac, numeric(1)))
ggplot(tax_df, aes(tol * 100, tax * 100)) +
geom_abline(slope = 1, intercept = 0, linetype = 2,
colour = '#9a9a92') +
geom_line(colour = PAL[1], linewidth = 0.7) +
annotate('text', x = 2.55, y = 2.05,
label = 'identity: tax = tolerance', colour = '#9a9a92',
size = 3, angle = 32) +
labs(x = 'victim slippage tolerance (percent)',
y = 'extraction tax (percent of trade)') +
book_theme
How much does the tax depend on how deep the pool is? The popular intuition holds that deeper liquidity protects users, so it is worth checking against the slippage-bounded model.
extract_max <- function(depth) {
fair <- swap_x_for_y(v, depth, depth)$dy
floor_out <- (1 - slip) * fair
prof <- vapply(b_grid, function(a) {
after <- swap_x_for_y(a, depth, depth)
got <- swap_x_for_y(v, after$Rx, after$Ry)$dy
if (got < floor_out) 0 else sandwich_profit(a, v, depth, depth)
}, numeric(1))
max(prof)
}
tibble(depth = c(2.5e5, 5e5, 1e6, 2e6, 4e6)) |>
mutate(max_extract = vapply(depth, extract_max, numeric(1)))
#> # A tibble: 5 × 2
#> depth max_extract
#> <dbl> <dbl>
#> 1 250000 577.
#> 2 500000 539.
#> 3 1000000 520.
#> 4 2000000 510.
#> 5 4000000 506.The extraction is nearly flat across a sixteen-fold range of pool depth. This is the correction the model supplies to the intuition: once the slippage limit binds, it, and not the pool depth, sets the extractable value. Deeper liquidity lets the victim trade with less price impact for a given tolerance, but the attacker is still permitted to consume the whole tolerance, so the tax tracks the slippage allowance almost independently of depth. The protection lever the user actually controls is the slippage setting, not the pool it trades against, and a protection claim should be audited on that basis. (All pool figures here are SYNTHETIC, constructed to expose the mechanism rather than to match any deployed pool.)
9.11 Collaborating with an LLM
An assistant is useful for surveying the MEV landscape and drafting extraction models, and hazardous wherever a plausible narrative can pass for a computed fact. Three exchanges recur.
Prompt. ‘Write R to compute the optimal front-run for a sandwich attack on a constant-product pool and show that profit is concave in the front-run size.’
Watch for. The assistant will very likely produce code and prose asserting an interior optimum, because that claim is repeated throughout the secondary literature it was trained on. As this chapter showed, the claim is false for the zero-fee model, where profit is monotone.
Verification. Run the grid over a range wide enough to reveal the shape, as in Figure 9.2, and inspect whether the argmax is interior or on the boundary. Add the cost that actually bounds the problem (a fee or a slippage limit) before believing any concavity claim, and confirm the optimum moves to the interior only once that cost is present.
Prompt. ‘Summarise how proposer-builder separation protects users from MEV.’
Watch for. Conflation of redistribution with elimination, the tier-slippage demoted in the sceptic’s reflex above. The assistant may describe PBS as reducing MEV when it only reassigns who collects it.
Verification. Ask specifically whether the extractable value, defined as a function of the pending trade and the pool depth, changes under PBS. It does not, and forcing the definition into the answer exposes the redistribution.
Prompt. ‘Estimate the annual MEV extracted on a given chain.’
Watch for. A confident aggregate with no stated method. MEV totals circulate as round numbers whose measurement (which strategies, which pools, gross or net of costs) is rarely specified.
Verification. Demand the estimand and the method before the number. Treat any figure without a defined extraction model and a data source as a tier-four narrative, not a tier-two measurement.
9.12 Conclusion
In conclusion, three points are to be emphasized. First, MEV is not a mysterious exploit but an optimisation on a known curve: given the victim trade, the pool reserves, and the fee, the extractable value is the maximum of an explicit profit function, and writing that function down converts folklore into a computation, one that here contradicted the received account of the sandwich’s profit shape by showing it monotone at zero fee and interior-optimal only once a per-leg cost or a slippage bound binds. Second, the extractable value is a structural tax rather than a bug, levied by the conjunction of a public pending queue and a producer free to order it; the institutional responses we examined, proposer-builder separation and private order flow, redistribute or relocate the tax but do not abolish it, so that a protection claim should be audited by computing the residual it leaves rather than by accepting its adjective. Third, the structure is not confined to cryptocurrency: wherever a scarce resource is allocated by a queue whose order is valuable and whose contents are visible before they settle, from the trial ledger to a transplant waiting list, ordering power and advance visibility together constitute a tax. The cryptocurrency case is distinguished chiefly by its measurability, and it is that measurability we have used to make precise a lesson that elsewhere must be enforced by governance rather than computed to the dollar.
9.13 Exercises
Marginal price and the no-arbitrage condition. For a zero-fee constant-product pool with reserves \(R_x, R_y\), derive the marginal price of \(X\) in \(Y\) as the limit of the average price of an infinitesimal trade, and show it equals \(R_y/R_x\). Then verify that the arbitrage trade \(\Delta x^\star = \sqrt{R_x R_y / p} - R_x\) restores the marginal price to an external price \(p\), and state the condition on \(p\) under which the trade is a sale of \(X\) rather than a purchase.
The extraction ceiling. Prove that the zero-fee sandwich profit
sandwich_profit(a, v, Rx, Ry)is monotonically increasing in \(a\) and bounded above by \(v\). Confirm numerically that the bound is approached as \(a\) grows, and explain why introducing a per-leg fee turns the monotone function into a concave one with an interior maximum.Fee-bounded optimum. Modify the swap primitives to charge a fee, so that an input \(\Delta x\) contributes \(\gamma \Delta x\) to the product with \(\gamma = 0.997\) while the full \(\Delta x\) is added to the reserve. Grid-search the resulting sandwich profit and locate the interior optimum. Compare its position and the extracted value to the slippage-bounded optimum of the worked example, and comment on which constraint binds first for a realistic pool.
Slippage as a control variable. Using the
bounded_profitconstruction, compute the maximum extractable value as a function of the victim’s slippage tolerance \(s\) over a grid from \(0.001\) to \(0.05\). Plot extraction against \(s\) and characterise the relationship. What does the result imply for a wallet choosing a default tolerance, and what does the user trade away by tightening it?Priority-gas auction. Model two searchers competing for a single opportunity worth \(\Pi\) as an ascending auction in the priority fee. Argue that in equilibrium the winning fee approaches \(\Pi\), so that the producer captures nearly all of \(\Pi\) and the searchers earn nearly zero. State the assumptions your argument requires, and discuss how sealed-bid proposer-builder separation changes the split between searcher, builder, and proposer.
The reorg threshold. Let a block carry ordinary reward \(\rho\) and let a recent block contain extractable value \(M\). Write the condition under which a rational producer prefers to re-mine the recent block rather than extend the chain, ignoring for simplicity the probability of losing the reorg race. Relate the threshold to the security analysis of Chapter 6, and explain why a rising ratio \(M/\rho\) erodes the effective cost of rewriting history.
9.14 Further reading
Daian et al. (2020) is the primary source for this chapter and should be read first. It introduced the vocabulary of the field (front-running, priority gas auctions, and the coupling of extractable value to consensus stability) and its argument that MEV threatens the layer beneath it remains the reference framing. Read it for the mechanism, and hold its empirical magnitudes to the tier-two standard the book applies to all measured claims.
Adams et al. (2020), the Uniswap v2 protocol specification, sets out the constant-product pool on which every computation in this chapter runs, including the fee accounting that Exercise 3 asks the reader to implement. It is the ground truth for the curve, and reading it removes any ambiguity about how a swap alters the reserves, which is the whole basis of the extraction model.
Buterin et al. (2019) defines the fee market whose priority tip is the ordering auction of this chapter. Understand the base-fee-and-tip split to see why fee-driven reordering survived the reform, and to reason about where MEV revenue accrues under proposer-builder separation.
Narayanan et al. (2016) remains the reference text for the underlying mechanics of transaction propagation and block assembly, and its treatment of the mempool and of miner incentives is the foundation on which the MEV supply chain is built. Read its consensus chapters alongside Chapter 6 to place the time-bandit argument in context.