How to Protect a Treasury Swap From Sandwich Attacks

Protect a treasury swap from sandwich attacks by setting a firm price limit and routing the trade through an order flow that does not expose it as a predictable pending swap. A sandwich bot tries to profit by buying before your trade pushes a token’s price up, then selling after your trade executes. The result can be a worse price for the treasury.

Set the trade’s limits before you submit it

Start by writing down the trade the treasury actually needs: which wallet will trade, which token it will sell, how much, which token it will receive, and the minimum acceptable amount out. A swap’s “price impact” is the price change caused by the trade itself; a large order against a shallow liquidity pool can move the price even without an attacker.

For a treasury swapping, say, 50,000 USDC into another token, compare quotes for the full amount and smaller portions. Splitting may reduce price impact, but it can add execution time and expose the treasury to price changes between trades. When you submit through cowswap, the signed order enters a batch auction for solvers to compete over; the cowswap interface is useful here because the trade is handled as an order rather than sent as a public swap transaction waiting in the mempool.

1. Confirm the wallet and network. Use the treasury’s approved wallet on the intended network, and check the token contract addresses against a trusted source. A correct ticker can still refer to a different token.
2. Choose the exact sell amount. Check the available balance and any policy limit for the wallet. Leave enough of the network’s native token for any required wallet actions, such as approving token spending.
3. Set a minimum receive amount. Use the quote to decide the least the treasury can accept after fees and price movement. For example, if a quote offers 49,000 tokens, a 1% tolerance would set a floor near 48,510; that figure is illustrative, and the right tolerance depends on volatility and treasury policy.

Submit an order that can fail safely

A limit price is the worst exchange rate your order permits. If the market moves past that price, the order should remain unfilled or expire instead of completing at a price the treasury rejected. Tight limits can protect value but may delay or prevent execution, so avoid loosening them just to force a fill.

1. Review the order details before signing. Confirm the sell token, buy token, amount, minimum receive, expiration, and any displayed fee. A signature authorizes the order conditions; it is not the same as handing over unrestricted control of the wallet.
2. Approve token spending only when asked. Some tokens need an on-chain approval before the order can be filled. Check the spender and amount in the wallet prompt, and avoid granting unlimited approval if a smaller allowance is available and fits the treasury’s operating policy.
3. Sign and track the order. Signing submits the trade intent for matching; it does not mean the swap has already settled. In a batch auction, solvers look for matching orders—sometimes a “Coincidence of Wants,” where traders want each other’s tokens—or route the batch to available liquidity. If no valid execution meets your limit, the order may not fill.

Verify settlement before recording the trade

Once the order fills, check the wallet’s token balances and the transaction or order status before marking the treasury trade complete. Compare the actual amount received with the minimum in the signed order, and record the transaction hash, amounts, network, and time in the treasury’s normal records.

1. Handle an unfilled or expired order deliberately. Check its status before resubmitting; an old order may still be open. Cancel it if the interface offers cancellation, then get a fresh quote and reassess the minimum receive amount.
2. Reconcile approvals and balances. Confirm the tokens spent and received, and review any remaining allowance under the treasury’s policy. Keep the order record with the wallet’s transaction evidence for later review.

Batch auctions reduce the opportunity for a bot to target one visible pending swap, but no trading route guarantees a fill or removes every risk, including token and liquidity risks. For a large treasury trade, my practical tip is to test the wallet process with a small amount first, then use cowswap for the approved order with its price floor set before anyone signs.