---
title: "Detected Sandwich Attacks"
method: GET
path: "/api/v1/mev/sandwiches"
tags: ["Execution Benchmarks"]
---

# Detected Sandwich Attacks

`GET /api/v1/mev/sandwiches`

## Request

- Base URL: `https://cleartracedata.com` (the document declares no server; this is the origin it was published from)
- URL: `https://cleartracedata.com/api/v1/mev/sandwiches`
- Auth: none declared

**Public API: Returns detected sandwich-attack (MEV) events.**

Each row is a sandwiched transaction from Dune's curated `dex.sandwiched`
table: the victim's `tx_hash`, wallet, trade size, and the DEX/token pair,
plus trailing-7-day attack counts and total value sandwiched per chain.

Since the 2026-10-05 query the feed holds the LARGEST victims per chain over
the window (up to 125 per chain) rather than the most recent, and the 7-day
totals count victims of at least `victim_floor_usd` ($1,000). The unfloored
figures are returned beside them as `*_raw`. The floor exists because one
Base flow of sub-$1,000 rows took the raw Base count from 208k to 1.58M in
the week to 2026-10-05 and crowded every other chain out of a recency feed.
Useful for MEV-protection scoring and victim alerting.

## Query parameters

- `chain` string: Filter by blockchain (ethereum, base, arbitrum, optimism).
- `project` string: Filter by DEX project name (e.g., 'uniswap').
- `min_victim_volume_usd` number: Only return events where the victim trade was at least this size (USD).
- `limit` integer: Maximum number of events to return.
- `offset` integer: Pagination offset.

## Response `200`

Sandwich-attack (MEV) events with victim wallet, trade size, and 7-day chain totals.

- SandwichesResponse
  - `sandwiches` SandwichEvent[], required: Sandwich-attack events, newest first. The feed holds the largest victims per chain over the trailing 7 days (up to 125 per chain), not the most recent.
    - `tx_hash` string, required: The victim's on-chain transaction hash.
    - `block_time` string, required: Block timestamp of the victim transaction (UTC).
    - `chain` string, required: The blockchain the sandwich occurred on.
    - `project` string, required: The DEX whose pool was sandwiched.
    - `token_pair` string, required: The token pair traded by the victim.
    - `victim_wallet` string, required: The sandwiched wallet address.
    - `victim_volume_usd` number, required: USD size of the victim's trade.
    - `chain_attacks_7d` integer, nullable: Total sandwich attacks detected on this chain over the trailing 7 days.
    - `chain_sandwiched_usd_7d` number, nullable: Total USD sandwiched on this chain over the trailing 7 days.
  - `total_attacks_7d` integer, required: Cross-chain total sandwich attacks over the trailing 7 days, counting victims of at least victim_floor_usd. Read it with top_pair_share_of_attacks_pct: the FLOOR does not make this a market-wide figure, and a single pair has supplied a majority of it.
  - `total_sandwiched_usd_7d` number, required: Cross-chain total USD sandwiched over the trailing 7 days, over victims of at least victim_floor_usd.
  - `victim_floor_usd` number, nullable: The victim-size floor applied to the 7-day totals (USD). Null means the data predates the floor (query v2) and the totals are unfloored.
  - `total_attacks_7d_raw` integer, nullable: Cross-chain 7-day attack count with NO floor, for comparison with total_attacks_7d. Since 2026-09-29 one Base flow of sub-$1,000 rows dominates this figure -- and per top_pair_share_of_attacks_pct the same pair dominates the FLOORED count too, which the floor was not able to fix.
  - `total_sandwiched_usd_7d_raw` number, nullable: Cross-chain 7-day sandwiched USD with NO floor.
  - `top_pair_7d` string, nullable: The token pair contributing the most attacks to the floored count. Null on data written before query v4.
  - `top_pair_blockchain` string, nullable: The chain top_pair_7d trades on. The pair name alone is ambiguous; the concentration is one pool on one chain.
  - `top_pair_attacks_7d` integer, nullable: How many of total_attacks_7d came from that one pair.
  - `top_pair_sandwiched_usd_7d` number, nullable: How much of total_sandwiched_usd_7d came from that one pair.
  - `top_pair_share_of_attacks_pct` number, nullable: top_pair_attacks_7d as a percentage of total_attacks_7d: 51.9% when measured on 2026-10-08. Above ~50 the count describes one pair's flow more than the market's. Dune's sandwich detector is curated, not ours, and its false-positive rate is not bounded here.
  - `total` integer, required: Total number of matching events.
  - `limit` integer, required: The maximum number of events returned.
  - `offset` integer, required: The offset used for pagination.

---

[API](https://skmtc.dev/cleartracedata/apis/cleartrace-api.md) · [All operations](https://skmtc.dev/cleartracedata/apis/cleartrace-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cleartracedata/apis/cleartrace-api/revisions/2073a5a38ab5?raw)