Ανίχνευση sandwich attacks στο Ethereum μέσω ανάλυσης on-chain δεδομένων

Abstract

This thesis focuses on the detection and analysis of sandwich attacks in the Ethereum ecosystem, with an emphasis on transactions executed through decentralized exchanges (DEXs) such as Uniswap [1]. Sandwich attacks are a malicious strategy in which an attacker inserts transactions before and after a victim’s transaction, exploiting price fluctuations for personal gain [2]. The goal of the project is to develop a detection mechanism based on real on-chain data. To achieve this, the Python programming language was utilized, and the approach was based on transaction data exported from Etherscan. The tool processes transactions via .csv files, performing filtering and chronological sorting. It then applies a sliding window algorithm to detect suspicious patterns such as BUY–BUY–SELL and SELL–SELL–BUY, which are associated with sandwich attacks. The tool identifies cases where the same address interacts with the same liquidity pool before and after a victim’s transaction, suggesting potential price manipulation. Identified attackers are logged in a structured JSON file along with the relevant transactions and timestamps. This approach ensures both flexibility and accuracy, while avoiding the technical limitations of live API usage. During testing, numerous sandwich attacks were detected, primarily in tokens with high transaction volume and activity. The SELL–SELL–BUY pattern was observed more frequently than BUY–BUY–SELL, with most attacks occurring within 0–2 seconds between steps. Furthermore, several repeated attacker addresses were identified, indicating the presence of bots executing systematic strategies. Through this analysis, the system detects patterns indicative of sandwich attacks and records the attackers in a JSON file. While it does not implement an automated reporting mechanism, the generated data can potentially support the submission of formal complaints to regulatory entities or be used for further research aimed at strengthening security in the DeFi ecosystem [3].