Pseudo transaction sandwiching/front-running now occurring on Cowswap, the “front-running protected” DEX.

Please note, this is a transcription of someone else's Twitter post, not my original content. It is a transcription because as a Reddit user I myself always find native content more convenient to read and more privacy friendly.

OP: @AgentChud (Twitter) – Original post

Ok have been out of town all weekend… but just got back. Still working on programmatic demonstration.

I do feel comfortable saying stop using Cowswap.

It saddens me to say this, because i've been a loyal user / have suggested it for a long time.

Cowswap users are being taken to the cleaners. "Don't get sandwiched"….

Ok, how about a pseudo sandwich?
Here's how it works.

In a traditional sandwich, some mev dbag like jaredfromsubway sees your order in the mempool, buys a coin before you, then sells the coin after you… all in the same block. It's free money for the mev bot with little to no risk.

In a cowswap pseudo sandwich, mev bots are monitoring cowswap auction data, front running users before the auctions are completed… then selling after the auction is completed.

It's not as great as a traditional sandwich bc it's a multiblock operation / bots do carry inventory risk… but when you know the future (what people are about to buy), it's pretty solid edge.

How is this possible? Well, the live auctions are available via a public api. At the following endpoint, ANYONE can see user intents before solvers win competitions / execute orders.

https://api.cow.fi/mainnet/api/v1/auction

I noticed this when i was trying to use cowswap to buy kekec and some dbag kept buying before me the second i signed my cowswap order… then selling shortly after my order went through… or sometimes, even causing my order to fail bc his order pushed my order outside slippage tolerances.

But if my intention was to buy fucking kekec… i'm going to resubmit my order right? Well yeah that's what i did multiple times, and sure enough, this guy was ready to sell his front ran kekec the second my order actually executed.

Here's his address… he's made over 200k usd in the past 2 months exploiting cowswap users in this fashion… and you'd better believe if he's doing it… and is this successful… others are too.

I tried to inform the cowswap team about this behavior because i've absolutely loved using the product over the past years… but the guy i spoke with was condescending and didn't seem to think this was an issue / shit on me because i hadn't put together a comprehensive report yet… but brother in christ, if the pending auction data is public… you know damn well that people are taking advantage of this.

https://etherscan.io/address/0x9f9401c76e054d1c9fe3b94a7356361ff32b1ea1#tokentxns

Because of this design flaw, there is literally no advantage to using cowswap.

Moving forward, i suggest using flashbots rpc + llamaswap @DefiLlama @0xngmi exclusively, at least until this can be addressed / rectified.

Stay safe cousins. There's crime afoot.

I'm interested to hear people's opinions on this. Personally, I will probably keep using Cowswap for smaller transactions as Cowswap still has a higher upfront cost for someone to front-run them, though I do wonder if swapping to other front-running protection services like MetaMask's built in one might be a better option going forwards.