Did you know someone might be stealing money when you hit confirm on Uniswap?
Every swap starts with a quote, which shows what you are expected to receive if the trade goes through as planned.
A 2025 paper by Daniele Maria Di Nosse, Federico Gatta, Fabrizio Lillo, and Sebastian Jaimungal analyzed the 24 most active Uniswap version 3 pools across 2023 and 2024.
They studied what happens between the moment a swap becomes visible and the moment it lands on-chain.
That short window matters because specialized bots scan pending transactions, detect large trades, and move before the transaction is confirmed.
One strategy is sandwiching. An attacker sees a large swap, buys before it, lets the user’s trade push the price even higher, then sells right after.
For you, this can mean a worse fill.
Another strategy is Just-in-Time liquidity. A searcher sees a large swap, adds liquidity in the exact price range where the trade should happen, earns the fee from that swap, then removes the liquidity right after.
The goal is to appear for one trade, earn the fee, and leave.
The paper finds that Just-in-Time liquidity accounts for more than 20% of mint operations and more than 50% of the liquidity added in the dataset.
Low-fee pools make sandwiching cheaper. Higher-fee pools make Just-in-Time liquidity more attractive because the fee earned on a large swap can be bigger.
How to prevent being attacked?
Before swapping, read your own trade the way a searcher would. Look at the pool, the size, the slippage, and the fee tier.
If the trade looks easy to exploit, adjust it before it lands on-chain. Reduce the order size, use deeper liquidity, tighten slippage, compare fee tiers, or use protected routing.
The goal is to avoid paying for the opportunity your own swap created.