MEV & Private Mempool Architecture: Flashbots, Searchers & Order Flow Defense

1. MEV Taxonomy & The Public Mempool Landscape

Maximal Extractable Value (MEV) represents the maximum value that block proposers, validators, and automated searchers can extract from blockchain users by including, excluding, or reordering transactions within a block. In the public Ethereum peer-to-peer mempool, unconfirmed transactions broadcast in plaintext are constantly inspected by automated arbitrage and searcher bots.

Predatory MEV strategies—most notably Sandwich Attacks—monitor Decentralized Exchange (DEX) swaps with loose slippage tolerance. A searcher bot immediately frontruns the user with a buy transaction (driving up asset price) and backruns the user with a sell transaction (extracting profit while inflicting maximum slippage on the victim).

Benign MEV strategies, such as multi-pool arbitrage and liquidation auctions on lending protocols (Aave, MakerDAO), stabilize on-chain market equilibrium but create intense Priority Gas Auction (PGA) spam when executed over public mempools.

// Python: Calculating Optimal Sandwich Attack Profit Constraints
def calculate_sandwich_profit(pool_reserves_x, pool_reserves_y, victim_amount_in, max_slippage):
    k = pool_reserves_x * pool_reserves_y
    user_min_out = (victim_amount_in * pool_reserves_y / (pool_reserves_x + victim_amount_in)) * (1.0 - max_slippage)
    
    # Calculate maximum frontrun amount that pushes user execution exactly to min_out
    frontrun_in = ((pool_reserves_x * victim_amount_in * pool_reserves_y / user_min_out) ** 0.5) - pool_reserves_x
    return max(0.0, frontrun_in)

2. Proposer-Builder Separation (PBS) & MEV-Boost Relays

To prevent validator centralization and eliminate on-chain mempool spam, the Ethereum ecosystem implemented Proposer-Builder Separation (PBS) via MEV-Boost. In this architecture, specialized entities called Block Builders compile full candidate blocks maximizing fee revenue, which are submitted to independent Relays.

Consensus validators (Proposers) connect to MEV-Boost relays to receive blinded block headers containing the highest validator bid. The validator signs the header before receiving the block body, guaranteeing that validators cannot steal searcher MEV bundles or frontrun transactions before block publication.

// Go: MEV-Boost Relay Bid Header Verification
package main

import (
    "context"
    "fmt"
    "github.com/flashbots/go-boost-utils/types"
)

type RelayClient struct {
    Endpoint string
}

func (c *RelayClient) GetHeader(ctx context.Context, slot uint64, parentHash types.Hash) (*types.SignedBuilderBid, error) {
    // Query builder bid with highest execution payload value
    bid := &types.SignedBuilderBid{
        Message: &types.BuilderBid{
            Value: types.IntToU256(1850000000000000000), // 1.85 ETH
        },
    }
    fmt.Printf("[MEV-BOOST] Validated payload value: %s wei
", bid.Message.Value.String())
    return bid, nil
}

3. Private RPC Routing & Atomic Searcher Bundles

Private RPC endpoints (such as Flashbots Protect, Eden Network, and MEVBlocker) allow decentralized applications and individual users to route transactions directly to trusted block builders, bypassing the public p2p mempool entirely.

For DeFi searchers, the eth_sendBundle JSON-RPC API provides atomic execution guarantees: a bundle containing multiple transactions (e.g. target swap + backrun liquidation) will either execute in the exact specified sequence within the target block or not be included at all, completely eliminating wasted gas fees on failed arbitrage transactions.

# JSON-RPC: Submitting Flashbots Searcher Bundle
curl -X POST https://relay.flashbots.net \n  -H "Content-Type: application/json" \n  -H "X-Flashbots-Signature: 0x1234..." \n  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "eth_sendBundle",
    "params": [{
      "txs": ["0x02f87...", "0x02f88..."],
      "blockNumber": "0x1245A00",
      "minTimestamp": 1792400000,
      "maxTimestamp": 1792400060
    }]
  }'

4. Order Flow Auctions (OFAs) & Decentralized Block Building

The frontier of cryptoeconomic security centers on Order Flow Auctions (OFAs) and decentralized block building architectures (such as SUAVE - Single Unifying Application for Value Expression). In an OFA, value extracted from transactions is automatically rebated back to the originating user rather than captured entirely by validators.

SUAVE acts as an independent execution chain and cryptographic mempool, executing confidential smart contracts inside Trusted Execution Environments (TEEs) to decentralize block construction across multi-chain ecosystems.

// Python: Computing User MEV Rebate Distribution
def compute_mev_rebate(extracted_value_eth, searcher_margin=0.10, builder_fee=0.05):
    retained_profit = extracted_value_eth * searcher_margin
    infrastructure_cost = extracted_value_eth * builder_fee
    user_refund = extracted_value_eth - (retained_profit + infrastructure_cost)
    
    return {
        "user_refund_eth": user_refund,
        "searcher_profit_eth": retained_profit,
        "builder_fee_eth": infrastructure_cost
    }

Written by Zyekh Abdul Qadir Jailani

Digital Forensics & Incident Response (DFIR) Specialist & Security Researcher specializing in Linux kernel hardening, threat hunting, and system security research.

LinkedIn • GitHub • Discord • Security Policy • PGP Key