Three-transaction structure of a sandwich
A sandwich attack unfolds in three steps: the attacker places a transaction in the block before the victim's (frontrun), then the victim's transaction executes at a worse price due to the frontrun, then the attacker closes their position behind the victim (backrun), capturing the profit. For a large swap, the frontrun increases the price the victim pays, and the backrun sells at the inflated price the victim created. The attacker extracts value directly from the victim's slippage.
Why sandwiches work and who profits
Sandwiches are possible because block builders and validators control transaction order. A builder observing a large pending swap sees an arbitrage opportunity: buy before the swap moves the price, let the swap execute at worse terms, then sell after. The profit comes from the victim's slippage, not from any underlying information edge. The attacker needs only to see the transaction and reorder it, making sandwich attacks ubiquitous in public mempools. Users protect themselves through private pools and encrypted mempools.