Resolver

A sandwich attack is one of the few exploits where the victim can see it coming and still cannot act. The attacker's first transaction is already in the public mempool, the victim's swap is sitting next to it, and by the time a block is built the outcome is decided.

The defence has to happen in the gap between broadcast and inclusion, which is measured in seconds, and it has to decide correctly without a human.

The detection engine, the private relay integration, and the exchange and token contracts the whole thing is demonstrated against, deployed to a public test network.

An operator console showing the five zones a transaction passes through, from mempool to settlement, animated from real events as they happen rather than from a script.

A replay view over any past window, live latency charts, aggregate statistics, and a full transaction history linking out to a block explorer, so every claim the interface makes can be checked against the chain.

A sliding window over the mempool, watching for the shape of the attack rather than for any single transaction: a high gas buy, a victim swap on the same pair, a low gas sell behind it.

When the pattern fires, the victim transaction is not in the public mempool at all. It is held, and then submitted as a bundle through a private relay, which means the attacker's transactions can no longer be ordered around it.

Everything the engine sees is streamed to the interface over WebSockets, and every event is written to a local store so a session can be replayed afterwards at varying speed.

Lead developer. The detection engine, the relay integration, the contracts, the console, and the replay and statistics layers.

Detection has to be fast enough to matter and accurate enough to be trusted. A false positive routes an innocent trade down a slower path; a false negative is the attack succeeding. The window is tuned against real traffic rather than against a fixture.

Subscribing to a mempool at all requires a persistent socket connection rather than polling, and that connection has to survive the reconnects that a public node will impose on it.