Sandwich Attacks on XRPL — and how TxnReserve stops them
A plain-English breakdown of how sandwich bots extract value from AMM traders, why XRPL is exposed once large AMM flows arrive, and how David Schwartz’s TxnReserve proposal closes the gap.
What is a sandwich attack?
A sandwich attack is a form of MEV (Maximal Extractable Value) where a bot wraps your trade between two of its own: a front-run buy executed just before you, and a back-run sell executed just after. The bot pushes the pool price against you, forces you to receive fewer tokens, and then immediately sells into the recovered price for a risk-free profit — paid entirely by you in the form of extra slippage.
The constant-product math
Most AMMs (including XRPL’s) follow x × y = k. For a pool with reserves x and y, swapping dx of asset A returns:
dy = (y · dx) / (x + dx)
The bigger dx is relative to x, the worse your price. A sandwich bot exploits this curvature: their front-run buy increases x before your trade lands, so your effective price is much worse than the quoted one.
Why XRPL is exposed
XRPL settles in ~3-5 second ledgers, and transactions inside a ledger are ordered by fee. A bot that watches the pending pool can submit a front-run with a slightly higher fee, see your transaction land second, and then submit a back-run in the next ledger. The honest trader has no way to guarantee priority — only to outbid, which still leaks value.
The TxnReserve proposal
David Schwartz (@JoelKatz) has proposed TxnReserve: a mechanism that lets a transaction pay at least 2× the normal fee to reserve a slot in a specific future ledger. Reserved transactions execute first in that ledger, ahead of any fee-bidding attacker. The attacker can no longer guarantee their front-run lands before you — so the sandwich strategy stops being profitable.
“Pay a premium fee, get a reserved execution slot. Front-running requires being able to insert a transaction before yours; reservations remove that ability.”
Trade-offs
- You pay roughly 2× the base fee — cents on XRPL.
- In return, your slippage stays at the honest AMM curve baseline.
- On any trade large enough to attract a bot, the slippage savings dwarf the extra fee — often by orders of magnitude.
See it in action
Open the live calculator, set a trade size, and toggle TxnReserve protection on and off to watch the slippage gauge and ledger queue react in real time.
Try the simulator