THE QUANTUM INTELLIGENCER

A paper posted to the arXiv offers an exact answer to a question private transaction pools have until now addressed by concealment rather than arithmetic: how much leakage still makes a sandwich attack pay. Examining a fee-free constant-product automated market maker of the Uniswap v2 kind, the authors find that when a trader observes an interval containing the victim's transaction size, the smallest size consistent with the leak determines every feasible front-run; the upper end of the interval is immaterial. Where execution is costly, a privacy layer that wishes to rule out profitable sandwiches at every consistent size may therefore reveal anything about a transaction's size except a lower bound above an explicit threshold. With two or more symmetric traders in the auction, every pure-strategy equilibrium hands the entire expected net rent to the auctioneer. Hiding the direction, however, does not complete the defence: no non-contingent first leg can front-run both possible directions, while post-trade arbitrage can survive even perfect pre-trade hiding. The vocabulary of the contest should be set down before the arithmetic is read. A mempool is the body of transactions that have been broadcast to a blockchain network and await confirmation. A private or encrypted mempool hides those pending transactions from public view, the better to defeat the attacks that depend on seeing them arrive. Privacy is a matter of degree; the pair of assets a transaction touches, the direction in which it moves, and a coarse range for its size may still escape concealment. That escape is the leakage of the title, and the quantity the paper measures. MEV, maximal extractable value, is the name for profit that arises from the order in which transactions are arranged rather than from the merits of any one trade. Its familiar expression is the sandwich attack. An attacker who sees a victim's transaction approaching places a purchase immediately before it and a sale immediately after it; the victim's trade moves the price, and the attacker collects the difference on the way up and back. The first leg is the front-run, the second is post-trade arbitrage, and the combination is the sandwich. The market in which the contest is staged is a constant-product automated market maker of the Uniswap v2 kind, considered without fees. Such a market maker holds two assets and fixes the product of their quantities; every trade that enlarges one quantity must diminish the other, so every trade moves the price by an amount that can be calculated in advance. It is that calculability which makes the attack a matter of arithmetic and not of luck. Between the parties stands an auction. In the paper's model, traders bid in a first-price auction for the right to sandwich the victim. The highest bidder wins and pays what it bid. The right comes with a condition: the winning front-run must keep the victim's trade executable for every transaction size consistent with what has leaked, not merely for the size the attacker happens to guess. An equilibrium is a pattern of bidding from which no single trader can improve by changing its own bid. The paper's results are stated for pure-strategy equilibria, the patterns in which each trader chooses one definite bid rather than a mixture of possibilities. Rent, in the economist's usage, is a return that no effort produces; the auctioneer collects the rent of the sandwich by selling the privilege to inflict it. Such is the institutional setting: a privacy layer makes a public rule about what it will reveal, and the rule has a price. The paper states the price exactly. —Elias Hartwell Dispatch from The Prepared E0