Smart-contract security & auditing

front-running

Front-running is observing someone's pending transaction in the public mempool and rushing your own transaction ahead of it to profit from what they are about to do. Because most blockchains broadcast unconfirmed transactions to a public waiting room before they are mined, anyone can see a profitable action coming, copy it, and pay a higher fee so the block producer places their copy first. The victim's own transaction then executes against worse conditions, or fails entirely.

The lever is transaction ordering. On Ethereum, the proposer orders the transactions in a block, and the simplest ordering heuristic is by priority fee. A front-running bot watches the mempool, spots a transaction that will move a price or claim a reward, and submits a near-identical one with a higher tip. Generalized front-running takes three shapes: displacement (run your action instead of theirs), insertion (the sandwich, trading both before and after the victim), and suppression (delaying or censoring a transaction). All are forms of maximal extractable value.

Because the public mempool is the root cause, defenses try to hide intent or remove the ordering advantage. Commit-reveal schemes split an action into a hidden commitment and a later reveal, so there is nothing to front-run at commit time. Private transaction relays such as Flashbots route transactions straight to builders, bypassing the public mempool. Slippage limits and deadlines cap how much value a swap can leak. Batch auctions clear many orders at one uniform price so ordering within the batch does not matter. None fully eliminates the problem; they shrink the attacker's edge.

Front-running is the public-mempool tax: anything profitable and visible can be copied and reordered ahead of you. Encrypted mempools and commit-reveal shrink it but do not erase it, because the block producer still ultimately chooses the order.

Also called
front-run搶跑