If you are bridging through a transaction that swaps tokens, check its minimum output and how it is submitted before signing. A tight, realistic slippage limit caps how much worse the swap can execute; private transaction routing can hide it from public-mempool bots, but neither option guarantees a fill or protection on every chain.
When can a bridge deposit be sandwiched?
A sandwich attack targets a visible swap, not the act of moving tokens between chains by itself. A bot sees a pending swap in the public mempool, trades ahead of it to move the price, lets the swap execute at a worse rate, then trades back; Ethereum.org describes this ordering as a way to extract value from a user’s trade.
That distinction matters when comparing bridge routes. A deposit that transfers a token as-is may have no swap slippage setting to adjust, while a route that converts tokens as part of the deposit can expose a price-sensitive swap. When comparing a route such as the acrossbridge service, check whether the deposit transaction includes a source-chain swap, because that determines whether swap protections apply.
Find the swap’s minimum output, often shown as “minimum received,” and identify which chain executes it. A destination-chain relayer fulfilling a transfer is a different mechanism from a bot ordering trades around a source-chain swap; protections on one chain do not automatically protect activity on another.
How much does a slippage limit protect?
The minimum output sets a floor: if the swap would deliver less, the transaction reverts instead of completing at that price. For example, if a quote is 1,000 tokens and the minimum is 995, the 0.5% allowance limits the permitted shortfall against that quote, though it does not stop a bot from trying to move the price.
The common mistake is raising slippage just to make a transaction go through. A wider allowance gives an attacker more room to worsen the execution before the swap hits its floor; an overly tight limit, however, can cause a revert when the market moves normally. Choose a limit that reflects the token pair’s liquidity and volatility, and compare the displayed minimum output with the quote before signing.
Slippage limits are useful when you want an on-chain execution bound and can tolerate a failed transaction if the market moves too far. They do not hide the trade, and a revert may still cost gas depending on the chain and transaction path. Check the wallet’s failure-fee terms rather than assuming every failed bridge or swap is free.
When should you use private routing?
Private routing submits a transaction to a private transaction channel instead of broadcasting it to the public mempool, reducing the chance that a public-mempool bot sees and sandwiches it. Flashbots documents private routing for Ethereum transactions, but availability and behavior depend on the wallet, chain, and route you use.
Private submission trades public visibility for reliance on the provider and its delivery path; it cannot promise inclusion, the best price, or protection if the transaction is later exposed to other parties. Check that the wallet is using the private route for the chain where the swap executes, and avoid approving a public fallback without noticing it.
For a small, liquid swap, a sensible minimum output may be enough; for a large trade or a thinly traded token, compare private routing and consider splitting the swap if the route allows it. Before signing, read the minimum output, confirm the swap’s chain, and check how the transaction will be submitted.
Top comments (0)