Maximal Extractable Value: Arbitrage, Liquidations, Sandwiches, and Network Effects

Key Takeaways

• What it is: Value captured by controlling which transactions enter a block and in what order, beyond the protocol's block reward and user fees.
• How it is built: Classified after the fact, not read from the chain. A pipeline replays produced blocks, matches transactions against known strategy patterns, and sums the profit of whatever it matched.
• Core expression: Published MEV = the sum, over transactions a classifier assigned to a known strategy, of value received less value spent less gas, priced at a chosen reference.
• Best use: Comparing composition and direction within one chain under one unchanged classifier version.
• Main limitation: Unrecognised strategies, reverted attempts, split-address execution, and off-chain builder payments all score as exactly zero, and every one of those errors pushes the figure the same way.
• Practical rule: Read every MEV number as a floor. A decline in the series is a claim about the classifier's coverage before it is a claim about behaviour.

Who This Guide Is For

This guide is for readers who have seen an MEV chart used as evidence that extraction is rising, falling, or worse on one chain than another, and who want to know what the underlying figure is actually counting. It is about the measurement, not about how to operate a searcher.

Educational content. Not individualized financial advice.

What Does Maximal Extractable Value Measure?

A published MEV series measures the subset of ordering-derived profit that one classifier recognised inside blocks that were actually produced. Most misreadings start in the gap between the three distinct quantities people call "MEV".

Qin, Zhou and Gervais: Quantifying Blockchain Extractable Value established the vocabulary and is explicit that its own totals are bounded by the strategies it enumerated. For why ordering has value at all, see Ethereum.org: Maximal Extractable Value.

Plain-language definition

MEV is what someone earns by deciding the sequence of other people's transactions. The published number is not that amount. It is the part a piece of software was able to recognise.

Technical definition

For a set of blocks, a classifier partitions transactions into strategy classes and computes, for each assigned transaction, the net balance delta of the initiating account across every asset touched, converted to a common unit and reduced by gas. Unassigned transactions contribute nothing. The output is therefore a function of two things: the ledger, and the strategy list the classifier happened to implement.

How Is Maximal Extractable Value Constructed?

MEV is constructed by pattern matching over decoded swap, transfer, and liquidation activity, so the central engineering problem is classification, not aggregation. Each strategy class has its own detection rule and its own reliability.

Atomic arbitrage: the reliable case

A closed loop that begins and ends in the same asset inside a single transaction can be scored without any assumption about intent. If the sending account started with a token and ended with more of that token having touched two or more venues, the profit is unambiguous and self-contained. This is the highest-precision category and the one on which providers most often agree.

Liquidations: bounded by coverage, not by inference

Lending protocols emit an explicit liquidation event naming the borrower, the repaid debt, and the seized collateral, so detection is a decoding exercise. The limitation is which protocols the pipeline has decoded: a liquidation on an undecoded market is not a hard case, it is simply absent. Coverage grows over time, quietly adding to historical totals when a provider backfills.

Sandwiches: where the classification problem actually bites

No on-chain marker distinguishes a sandwich from three ordinary trades, so a detector has to construct one. The usual construction requires all of the following at once:

• Three or more trades on the same pool inside the same block.
• Ordering of buy, then a third-party trade in the same direction, then sell.
• The outer two trades sent by the same address, or by addresses a clustering heuristic has linked.
• The outer pair roughly offsetting in size, so the position is opened and closed.

Every clause in that rule is a place where a real attack escapes and a place where an innocent pattern gets caught. Two unrelated market makers trading around a third party's swap satisfy the structure with no coordination at all. Conversely, an attacker defeats the rule by sending the two legs from separately funded addresses (breaking the identity test), splitting them across adjacent blocks (breaking the same-block clause), or executing against two pools holding the same pair (breaking the same-pool clause). In each case the entire profit drops out of the published total.

Why trace data changes the answer

A pipeline built only on event logs sees what contracts chose to emit. Profit arriving through an internal call, a raw value transfer, or a builder payment embedded in the coinbase transaction is invisible without execution traces, so two providers using identical strategy definitions can differ purely on data access. See also on-chain data quality methodology.

Formula and Measurement Logic

Measured MEV over an interval = the sum, across transactions the classifier assigned to a strategy, of (value received less value spent less gas paid), converted at a chosen reference price.

The arithmetic inside the sum is trivial. Everything difficult sits in the membership test that decides which transactions are inside it, and in the last column below.

Read that column top to bottom. With one exception, every choice available biases the result downward and none biases it upward. A quantity whose error terms all share a sign is a bound. Differencing two such bounds to claim extraction rose or fell compounds the problem rather than cancelling it.

How Should Maximal Extractable Value Be Interpreted?

Read the level as a floor and the composition as the signal. Within one chain, under one unchanged classifier version, the split between arbitrage, liquidation, and sandwich activity is far more robust than the total, because classification reliability differs so sharply between the three.

Why a falling line is usually a coverage statement

Separating the roles of block builder and block proposer changed where extraction is negotiated: searchers submit bundles to builders, and builders assemble blocks and bid for the right to have a proposer publish them. Two consequences follow for measurement. A transaction routed to a builder through a private endpoint never appears in the public mempool, so any detector comparing the pending set against the final block loses sight of it entirely. And when a searcher pays a builder by prior arrangement rather than an on-chain transfer, that payment leg is not on the ledger at all.

Neither change reduces extraction. Both reduce the published figure. This is the specific reason the sentence "MEV fell" so often means "extraction moved somewhere the classifier cannot see".

What a rising line can mean

• More extraction actually occurred.
• The classifier gained a strategy, and that strategy's history was backfilled.
• A newly decoded protocol brought its liquidations into scope.
• Unit extraction was flat but the assets being extracted became more valuable in the reporting currency.

Only the first is a behavioural claim, and distinguishing it from the others requires the provider's changelog, not the chart.

The categories are not morally equivalent

Arbitrage that realigns a stale pool price, and a liquidation that closes an undercollateralised position before it becomes bad debt, are both services the system depends on. A sandwich provides neither: it moves value from a user to a searcher and leaves the pool where it found it. A total adding all three together cannot support a network-health claim in either direction.

Step-by-Step Workflow

1. Get the list of included strategy classes explicitly, rather than inferring it from a chart legend.
2. Establish whether the figure is gross extraction or searcher profit net of builder payment. These differ by a multiple, not a margin.
3. Establish whether detection runs on produced blocks or on mempool-versus-block comparison, because only the second is blinded by private order flow.
4. Confirm whether the pipeline has execution traces or relies on event logs alone.
5. Ask how the outer legs of a sandwich are linked: same address only, or a funding or clustering heuristic.
6. Pull the same interval from a second provider and reconcile category by category rather than at the total.
7. Inspect several classified transactions and confirm the label is defensible on the raw trace.
8. Compute classified profit as a share of proposer payments, as an independent coverage check.
9. Record the classifier version and pull date, because a later rerun of the same blocks can return a different number.
10. State the conclusion as a floor, and name the categories that drove it.

Worked Hypothetical Scenario

This example is hypothetical and the arithmetic is constructed to be checkable. It uses a constant-product pool with no liquidity provider fee, so that the price mechanics are visible without a second moving part. Reserves start at 5,000,000 USDC and 5,000,000 TOKEN, giving a starting price of 1.0000 and an invariant of 25,000,000,000,000.

A user submits a swap of 200,000 USDC for TOKEN. A searcher places a 300,000 USDC buy in front of it and a sell of the same position behind it.

Against an untouched pool the same user swap would have returned 192,307.69 TOKEN at an effective price of 1.0400. Sandwiched, it returned 171,526.59 at an effective price of 1.1660. The shortfall is 20,781.11 TOKEN.

Now decompose what the searcher actually kept. Assume the two transactions cost 60 USDC in gas and that the searcher bid 80 percent of the bundle profit to the builder to secure its position.

One event, six defensible numbers, spanning 4,416 to 22,380 USDC. Nothing here is a data error. Each figure answers a different question, and none of them is wrong until it is labelled simply "MEV" and compared against a figure built from a different line.

Then remove one assumption. Suppose the searcher had sent the buy from one address and the sell from a second address funded through a separate path. The pool mechanics, the user shortfall, and the searcher profit are all identical. A classifier that requires the outer legs to share a sender records nothing at all, and this block contributes zero to the published series.

What Can Make the Interpretation Wrong?

• Treating the number as complete. It is the recognised part of a larger quantity, and the unrecognised part is not estimated anywhere.
• Comparing gross extraction to searcher net. The worked example above shows these differing by roughly five times on the same trade. Two charts built on different sides of the builder payment will never reconcile.
• Reading a decline as improvement. Migration of order flow to private channels lowers the measured figure while leaving behaviour unchanged.
• Assuming attacker profit equals user loss. They are computed from different baselines, one realised and one counterfactual, and the pool absorbs part of the difference.
• Ignoring classifier version drift. Rerunning last year's blocks under this year's classifier produces a different history. A trend measured across a version change is partly measuring the version change.
• False positives in sandwich detection. Ordinary market making around a third party's trade can satisfy the structural test with no coordination.
• Reverted bundles. Failed attempts consumed real resources and reflect real competitive intensity, but contribute nothing to a profit-based series.
• Currency conversion. Profit taken in a volatile asset and reported in dollars moves with that asset, so a rising line can be a price chart wearing a different label.

Cross-Network and Provider Comparison

Cross-chain MEV comparison is weaker than most other on-chain comparisons because what is being detected depends on how each chain orders transactions, and that varies far more than ledger models do.

A chain with an open public mempool and a competitive builder market exposes both the pending set and the payment between builder and proposer, the most measurable configuration that exists. A rollup running a single sequencer may have no public mempool at all: users submit directly to the sequencer, ordering is decided privately, and an outside observer sees only the finished sequence. Extraction still occurs, and the searcher may simply be the sequencer, but the evidence a classifier depends on is absent. A near-zero figure on such a chain is a statement about visibility.

Ordering policy matters as much as visibility. Where fee-priority auctions decide sequence, competition surfaces as observable bids. Where sequence is first-come-first-served, it surfaces as latency spending, which is entirely off-chain and leaves no trace.

Provider disagreement within one chain is usually a different strategy list, a different position on the builder payment, or a difference in trace coverage. These are diagnostic, not defects.

Advanced Analytical Methods

Bounding the invisible with proposer payments

Builder-to-proposer payments are directly observable and reflect what a builder would pay for a slot given all the order flow it held, including flow no classifier has decoded. Classified profit as a share of total proposer payments is therefore a coverage ratio, and a ratio falling while the classified total is flat is evidence that extraction is drifting outside the classifier's reach.

Reclassification backtests

Rerun a fixed historical window under the current classifier and compare against what that window reported at the time. The difference is the classifier's own contribution to the trend, isolated from behaviour. Providers without a published version history are asking for their trend to be taken on trust.

Address-linking sensitivity

Recompute sandwich totals under a strict same-address rule and again under a funding-graph rule that links addresses sharing a funder. The gap measures how much the total depends on a heuristic rather than on the ledger.

Victim-side measurement

Skip attribution entirely: for each large swap, compute the counterfactual output against the pool state at the start of the block and record the shortfall. That produces an execution-quality series requiring no claim about who caused it, sidestepping the weakest link in attacker-side classification.

Cross-domain and multi-block extraction

Strategies spanning two chains, or holding a position across consecutive blocks, break the single-transaction and single-block assumptions nearly all classifiers rest on. They are largely unmeasured, and their absence should be stated rather than assumed away.

Practical Checklist

• I know which strategy classes this series includes and which it omits.
• I know whether the figure is gross extraction or profit net of the builder payment.
• I checked whether the classifier version changed inside my comparison window.
• I recorded the provider, version, and pull date beside the number, and stated the result as a lower bound.

Conclusion

MEV is separated from the phenomenon it names by a piece of judgement rather than an arithmetic choice, and every simplification in that judgement omits rather than adds. That does not make the series useless. It makes the useful claims narrower: composition within a chain, direction under a fixed classifier version, and coverage measured against proposer payments. Claims about totals, cross-chain ranking, or extraction having declined require evidence the chart does not contain.

Frequently Asked Questions

References

These sources should be reviewed during editorial verification. They support data structures and methods, not the hypothetical conclusion. Provider formulas, chain rules, and APIs can change. Confirm current documentation before publication.

• Ethereum.org: Maximal Extractable Value: Why transaction ordering has value, and the searcher, builder, and proposer roles this page depends on.
• Qin, Zhou and Gervais: Quantifying Blockchain Extractable Value: The academic treatment of extractable value measurement and its stated coverage limits.
• Ethereum.org: Transactions: Transaction fields, receipts, and revert status, which determine what a failed bundle leaves behind.
• Ethereum.org: Gas and Fees: Priority fees and the gas costs subtracted in the profit calculation.
• Dune: Curated Data Overview: Normalized DEX trade tables of the kind sandwich and arbitrage classifiers are built on.
• Dune: Address Labels: Address labelling and entity tagging, the mechanism behind linking two legs of one strategy to one actor.