Conditions:
- Three transactions inside one block.
- Consecutive - (indexes are i - 1, i, i + 1)
- Successful
- Each of these three transactions include a token swap
- Signers of these transactions are: Attacker → Target → Attacker
- Attacker is influencing the liquidity pool target uses
- It’s profitable for an attacker (if both Attacker transactions are combined)
- Many attackers bundle target transaction with their own. In this case all three transactions are part of the same JITO bundle and attacker is a JITO tipper for the bundle.
You don’t need to use exactly these conditions, as long as your query selects most of the sandwich transaction triples.
An example
https://explorer.jito.wtf/bundle/ef07916721b22593de2087102daee9931741935cb5e8320912749399cbba9964
Optimization condition
block_time >= TRY_CAST('2025-05-25 00:00:00' AS TIMESTAMP)
AND block_time < TRY_CAST('2025-05-25 08:00:00' AS TIMESTAMP)
Recommened output table schema
block_slot
tx_id_before
tx_id_target
tx_id_after
You may add attacker_profit column if your solution has this information
Relevant data is in: