Fighting Sandwich Attacks With an Auction: CoW Protocol’s MEV Reversal

1. The market saw a transaction; the bot saw an option

When a trader clicks swap on a decentralized exchange, they assume their trade is finished. On a public blockchain, however, an ordinary transaction is broadcast to the mempool before execution. Automated searchers constantly monitor this queue, analyzing slippage tolerances and token amounts. A bot can buy ahead of the trader, let the trader's volume elevate the price, and sell immediately afterward. The trader requested an exchange; the transaction queue handed an arbitrageur a short-lived option on their trade.^[7]

That pattern is widely known as a sandwich attack. Its extraction mechanism depends on transaction ordering: one transaction executes before the victim to push up the price, and a second transaction follows behind to capture the profit. The automated market maker simply executes its formula, but the user receives the worst acceptable price within their slippage tolerance. Custody is not stolen, but the open queue allows intermediaries to harvest the slippage gap.^[7]

GPv2 addressed that structural flaw rather than offering a marginally better route through the same vulnerable queue. As presented at EthCC in July 2021, orders were grouped off-chain into batches and submitted to a competition among independent solvers. Trades within the same batch received uniform clearing prices regardless of internal ordering, while remaining unmatched volume could still tap into Ethereum's external automated market maker liquidity.^[2]

This distinction forms the essential boundary of the protocol. CoW Protocol does not eliminate all extractable value, nor does it guarantee that every order matches peer-to-peer. Instead, it shifts who constructs execution, avoids broadcasting each intent as an ordinary direct swap, and enforces identical prices for identical directed pairs in a batch. MEV resistance is a bounded economic mechanism, not an absolute guarantee.^[7][2]

2. Gnosis replaced the queue with a five-minute room

The underlying architecture began before the protocol adopted its cow branding. Gnosis launched its first trading protocol on April 15, 2020, following two years of research into improved on-chain trading mechanisms. Every five minutes, the protocol gathered open orders into a batch auction, invited settlement proposals, and executed ring trades that maximized trader welfare under uniform clearing prices. Its initial focus was facilitating liquidity for long-tail prediction market tokens.^[1]

Ring trades expanded the traditional barter model across multi-token cycles. Alice might want to exchange Apples for Bananas, Dan wants Carrots for Apples, and Carlos wants Bananas for Carrots. Even without a direct pair match between two traders, a multi-party cycle satisfies all three participants simultaneously. In token trading, this shared settlement allows liquidity to circulate directly across multiple orders without routing every trade through intermediate base pairs.^[1]

A centralized operator is replaced by open, incentivized competition, in which anyone can submit order settlement solutions.^[1]

— Gnosis, Announcing Gnosis Protocol

That five-minute cadence was a proof of concept rather than the final consumer trading experience. GPv2 launched in April 2021, with CowSwap debuting as its flagship decentralized application. The updated architecture retained off-chain batching, uniform pricing, and open solver competition while tapping external decentralized liquidity when internal matches were insufficient. The cow abbreviation emerged as a memorable name for its core optimization.^[2]

3. A wish list for machines called solvers

A trade on CoW Protocol is structured as an intent: a cryptographically signed message defining acceptable execution boundaries. The user specifies tokens, amounts, limit price, expiration, and recipient, leaving the execution path open. Once a batch closes, independent bonded solvers analyze the pooled intents alongside on-chain liquidity conditions. Each competing algorithm formulates feasible mathematical routes to settle the maximum possible trade volume.^[5][8]

This structure transforms trade routing into an open solver optimization contest. A solver can match opposing orders directly peer-to-peer, group overlapping trades into aggregate transactions, or construct multi-asset ring trades. When an order only partially coincides with opposing demand, the solver matches the overlapping balance internally and routes the remainder through decentralized automated market makers. Direct coincidence of wants serves as an optimization opportunity rather than a prerequisite.^[6]

CoW (Coincidence of Wants): An economic phenomenon where two parties - each holding the asset that the other needs - exchange assets directly in an equivalent barter.^[6]

— CoW Protocol Documentation

Open solver competition requires strict contractual safeguards. Solvers must post financial bonds and operate under protocol rules that reward the solution generating the greatest economic surplus for the batch. Mathematical specifications treat each intent as an immutable acceptance set, measuring execution surplus relative to the signed limit price. Solvers search for optimal routes, but cannot alter the explicit boundaries the user authorized.^[5][4]

4. Why the cow blocks the sandwich

The protocol's primary defensive layer is delegated execution. Because traders sign off-chain intents rather than broadcasting individual swap transactions directly to Ethereum, their orders are not exposed to public-mempool MEV in the same way as ordinary on-chain swaps. Bonded solvers assume the responsibility and gas risk of submitting settlement bundles. The signed intent is therefore not the same standalone, route-ready transaction that a searcher ordinarily targets in Ethereum's public queue.^[7]

The second defensive layer is the uniform directed clearing price. All orders trading the same token pair in the same direction within a given batch auction receive the exact same price. Because reordering trades within the batch cannot alter that uniform price, sandwich bots lose the ordering leverage needed to extract arbitrage profits. When orders match directly through a coincidence of wants, trades settle peer-to-peer without touching AMM reserve pools.^[7][6]

The final security layer executes on-chain within the GPv2Settlement smart contract. Before executing any trade settlement, the contract verifies the user's signature, checks expiration deadlines, confirms the order was not previously filled, and ensures execution prices meet or exceed signed limit requirements. While solvers interact with external decentralized liquidity sources, protocol rules prevent these interactions from accessing user funds, while solver bonds protect the settlement contract from potential interaction risks.^[8]

These combined safeguards illustrate the pragmatic design trade-off within CoW Protocol. The architecture delegates complex transaction routing and multi-source execution to specialized solvers, but tightly bounds their behavior through cryptographic signatures, economic bonding, and smart contract verification. Users outsource route construction without giving up custody or allowing intermediate settlement agents to worsen their signed limit price boundaries.^[5][8]

5. The auction learned to judge its own winners

In January 2022, governance proposal GIP-13 asked Gnosis DAO to spin out the development team, formalize the name CoW Protocol, and deploy CoW DAO alongside the COW governance token. The proposal would place key protocol parameters, including scoring metrics and slashing mechanisms, under token-holder governance. The batch-auction mechanism was being presented as independent, community-governed public infrastructure for Ethereum.^[3]

As the protocol matured, researchers examined a subtle auction problem: a batch auction can maximize aggregate social welfare while still producing an unfair outcome for an individual trader. In an August 2024 research paper, economists Andrea Canidio and Felix Henneke formalized this structural tension. Batch auctions can deliver greater aggregate surplus than independent trade-by-trade auctions, yet certain batched bids may leave one participant worse off than the individual-bid benchmark.^[9]

The protocol filters out "unfair" batched bids, which are those delivering less to an order than some available "non-batched" bids.^[4]

— CoW Protocol Documentation

The fair combinatorial auction addresses this dilemma by asking solvers for both individual and batched bids. The protocol constructs an individual counterfactual benchmark and filters a batched bid when an order falls below it. The paper also makes the cost explicit: fairness can reduce total value returned to traders, and its equilibrium guarantee depends on the counterfactual mechanism. The achievement is a transparent trade-off, not mathematical perfection.^[9][4]