Anatomy of the Dark Forest: Sandwich Extraction Bounds and Fee-Market Coupling in Ethereum's Transaction Supply Chain
Ethereum's public mempool exposes every pending transaction to adversaries who can reorder, insert, or censor transactions for profit — a phenomenon known as Maximal Extractable Value (MEV), and the reason practitioners describe the mempool as a "dark forest." While a substantial measurement literature quantifies how much value has been extracted, comparatively little work derives closed-form conditions governing when extraction is profitable at all. This paper contributes an analytical treatment of the canonical sandwich attack against constant-product automated market makers (AMMs). We derive and numerically verify two results. First, we establish a fee-determined break-even law: a victim trade of size v against a pool of depth X is profitably sandwichable if and only if v/X > φ, where φ is the pool's fee rate, independent of the victim's slippage tolerance. Simulation across four orders of magnitude of fee tiers (0.01%–1%) matches this prediction to within 1.6% relative error. Second, we show that above break-even the victim's slippage constraint is always binding: the optimal front-run saturates the tolerance budget exactly, making attacker profit essentially linear in the tolerance parameter σ — a 5% tolerance yields 49.7× the profit of a 0.1% tolerance at fixed trade size. We further model the coupling between extraction and EIP-1559 fee dynamics, showing that a 5× demand shock produces a 6.4× base-fee excursion that decays to within 10% of baseline in 16 blocks. Together these results reframe slippage tolerance from a user-convenience setting into the primary control variable governing extractable value, and yield concrete, quantitative defense guidance. Note: This is an analytical and simulation study. All quantitative results are derived from the stated model under the stated parameters and are not empirical measurements of on-chain activity.
Authors
- Peter Ong
Publication Details
- Journal
- Zenodo (CERN European Organization for Nuclear Research)
- Published
- 2026-07-30
- DOI
- https://doi.org/10.5281/zenodo.21698144
- Primary Topic
- Information and Cyber Security
- Type
- preprint