Appearance
4. The Searcher
Why someone is always watching your trade — and what they get paid for it.
Cold open
Between early December 2024 and the first week of January 2025, a single anonymous program on Solana — known to on-chain analysts only as Vpe — executed 1.55 million transactions and walked away with $13.4 million in profit. According to Jito's own analysis, this one program was responsible for roughly half of all sandwich attacks on Solana during that window. It paid $4.6 million in fees to the validators who included its transactions. Its success rate was 89%. No one knows who runs it.[1] This chapter is about what people like the operator of Vpe do for a living, why the role exists, and out of whose pocket the $13.4 million came.
What this chapter answers
- What is a searcher, and why does the role exist on every chain that lets transactions queue?
- What are the three things searchers do — arbitrage, liquidations, sandwiches — and how are they economically different from each other?
- Where does the searcher's profit come from in each case, and whose pocket does it leave?
- Why is searching a real business with real costs, and why has it consolidated to a handful of firms?
The setup
Every block on every public chain is a small ordered list. Some entity — a validator, a builder, or both — has to decide which transactions go in and in which sequence. That decision is worth money, because the order in which transactions execute changes the prices they execute at. A buy that lands first moves the market against the buys behind it. A sale that lands last fills at the worst price. The actor who controls the sequence captures the difference, or sells the right to capture it to someone else.
It's known as Maximum Extractable Value, or MEV. MEV is the profit a privileged participant can earn by reordering, inserting around, or censoring transactions inside a block — money that comes out of other people's trades.[2]
The searcher is the participant who specialises in finding that money. A searcher is a firm, often a team of two to fifteen engineers, that runs software designed to do one thing: watch the public flow of pending transactions, identify configurations that can be made more profitable by inserting a trade of the searcher's own, and submit that trade — usually paying a fee to whichever entity controls the ordering of the block in question.
The TradFi reader has met this role before. A high-frequency arbitrage desk at Citadel Securities or Jane Street earns its living the same way on NASDAQ: it reads the order flow, prices the spread, and pays to be first. The mechanism is the same on-chain; the rails and the regulators might not be exactly the same.
Meet the Searcher
Job: Find and capture profit opportunities created by the order in which on-chain transactions execute.
How they earn: From the price gap (arbitrage), the protocol-paid bonus (liquidations), or the worsened execution price of a victim (sandwiches). Always settled in the same transaction or bundle that captures the opportunity.
How they spend: On gas and priority fees — paid on every attempt, win or lose. On infrastructure: colocation near the relays and block engines that route their orders, in-house simulators, dedicated RPC nodes. On engineers, who are expensive and few.
The moat: Increasingly, not the algorithm. The moat is access — to fast inclusion paths, to private mempools, to the block builders who decide whose transactions get to land at the top of a block.
TradFi analogue: An HFT arbitrage desk circa 2010. Same role, same incentives, different rails. The market structure that lets a Jane Street desk earn the bid-ask spread on the NYSE is the same market structure, mechanically generalised, that lets Vpe earn $13.4 million in a month on Solana.
One last term, defined briefly here and at length in Chapter 3: when a trader on Ethereum, Solana, or most chains submits a transaction, it does not go straight into a block. It enters a pending state — a public queue, broadly called the mempool, that other participants can read. The searcher reads it. So does every other searcher. The reason searching is a competitive business is that everyone with software and infrastructure sees the same opportunity at almost the same time. The fastest to act, with the highest bid, wins.
The worked example
Imagine a retail trader — call her Alice — on a Tuesday afternoon in February 2025. She is moving $10,000 of USDC into SOL because her firm has decided to take a position. She opens Jupiter, Solana's dominant DEX aggregator, picks the route the interface recommends, and clicks Swap. Her wallet signs. The transaction goes out.
A bit under a second later, the interface tells her the trade succeeded. She holds SOL. She closes the tab and goes to a meeting.
What Alice does not see is that her transaction did not go directly into the next block. For about three hundred milliseconds it sat in a public-facing transmission path where, among other participants, Vpe was watching. The chapter resumes Alice's trade in a moment. First, two cases that look mechanically similar to Alice's but are economically different from each other and from hers.
The mechanics, in detail
Arbitrage: closing a gap
The cleanest searcher activity is also the oldest. Two venues quote the same asset at different prices. A searcher buys it cheap on one venue, sells it dear on the other, in a single transaction. The profit is the price gap, less fees. The loser, if there is one, is whichever venue was slow to reprice — usually a liquidity pool whose pricing curve had not yet adjusted to a new market reality.
It's known as arbitrage. It is the activity that economists have generally treated as useful, because it is the mechanism by which prices in fragmented markets converge. The same case applies on-chain. When the SOL/USDC price on Raydium drifts away from the SOL/USDC price on Orca by more than the round-trip cost of arbitraging it, a bot closes the gap within one block. The bot earns the gap; the venues end up with the same price.
The numbers can be striking. In January 2024, a Solana bot known as 2Fast captured a single arbitrage opportunity worth approximately $1.9 million in one transaction by back-running a poorly priced trade in a low-liquidity pool.[3] That is not a typical day; it is a clean illustration of what searching for arbitrage means when the gap is large and the speed is faster than every other watcher.
A variation of the same role is what academic researchers have called CEX-DEX arbitrage: the searcher quotes a price on Coinbase or Binance, picks up an asset cheaply on the centralised side, and dumps it on a Uniswap pool whose curve has not yet seen the centralised price move. The most recent comprehensive measurement of the Ethereum CEX-DEX market — peer-reviewed, covering the nineteen months ending in March 2025 — put total extracted value at $233.8 million across 7.2 million transactions on $241.7 billion of routed volume. The same paper observed that the number of active firms running this strategy on Ethereum fell from 23 at the end of 2024 to 11 in the first quarter of 2025, with the top three capturing 90 percent of the volume.[4] No subsequent comprehensive measurement has been published; the academic work in 2026 has so far focused on the theoretical question of what should happen to that consolidation as Ethereum moves toward sub-second slot timing.[5]
The CEX-DEX case is the one that researchers call "the darkest corner" of MEV, because the inputs — exchange prices, searcher inventory — are not on-chain and cannot be measured by inspecting the chain alone. The on-chain footprint shows only the back-end of the trade.
The person paying for the CEX-DEX arbitrageur's profit is not a clearly named victim. It is the passive liquidity provider on the Uniswap side, who has just sold an asset for slightly less than the centralised market would have offered. The loss is real, and it accumulates, but no individual LP can identify it on any individual trade.
Liquidations: forced repayment
The second thing searchers do is keep DeFi lending protocols solvent. A user posts collateral, borrows against it, and watches the value of the collateral float. If the collateral falls below a protocol-defined threshold — what Aave-style protocols call the health factor — the position becomes liquidatable. Any third party can repay a portion of the borrow, seize the collateral, and pocket a protocol-defined bonus of typically 5 to 15 percent of the seized value.[6] The bonus is the searcher's compensation for performing the liquidation; without it, the protocol would not have a reliable mechanism for closing bad debt.
The economics here are the inverse of the sandwich case the chapter is about to come back to. The borrower would have lost the position under any healthy lending protocol — the collateral fell, the loan went underwater, the position closed. The searcher does not create the loss. The searcher arbitrages the protocol's own internal price mechanism.
On 10 March 2026, an oracle-pricing edge case on Aave V3 demonstrated this in compressed form. Aave's Correlated-Asset Price Oracle briefly priced wstETH at about 2.85 percent below the secondary market, sending a band of wstETH-collateralised positions across the liquidation threshold simultaneously. Within hours, searchers had liquidated approximately $27 million of those positions and captured the full bonus stack on each one.[7] The borrowers in question would, in most cases, have been solvent under a correct oracle price. The bonus was paid anyway, because the protocol's rule is mechanical: health factor below one, liquidator earns the bonus. The case shows the morally awkward feature of MEV-as-maintenance: even when the trigger is wrong, the extraction proceeds.
Sandwiches: the pure-extraction case
The chapter returns to Alice. Three hundred milliseconds is a long time on Solana. It is enough for Vpe — or any program like it — to see Alice's pending swap, simulate its effect on the relevant pool, and decide that the trade is worth a sandwich.
What the diagram shows: Alice's transaction was visible to the searcher before it executed. The searcher bought SOL first, paying a Jito tip large enough to win priority over the other searchers watching the same opportunity. Alice's transaction then filled at a price the searcher's own buy had just degraded. The searcher closed the position by selling immediately after.
The two new terms that name the searcher's two transactions: a frontrun is a transaction the searcher places so it executes immediately before another transaction whose contents the searcher has already seen. A backrun is a transaction the searcher places so it executes immediately after a target transaction whose effect the searcher has predicted. A sandwich attack is a frontrun and a backrun executed around the same victim, by the same searcher, in the same block.
The dollar consequences for Alice were small in percentage terms and not small in absolute terms. On a $10,000 swap of USDC for SOL on a moderately volatile pair in February 2025, an unprotected route through the public transmission path could plausibly cost the trader on the order of $50 to $150 of price degradation, depending on pool depth and the size of the winning bid.[8] Calling Alice's loss $73 is plausible. The distribution of that $73 across the participants the searcher had to pay is the part most readers find more surprising than the loss itself.
Three observations about the split. First, the largest single share — slightly more than 30 percent — went not to the searcher but to the validator whose block included the searcher's transactions, via a Jito tip. The Vpe sample for December 2024 to January 2025 paid $4.6 million in tips on $13.4 million of revenue, a 34 percent ratio.[1:1] Alice's $23 is the same ratio applied to her trade. Second, gas and base fees absorbed only a few dollars; Solana's base fee schedule is cheap by design and the searcher's two transactions together cost a small fraction of the take. Third — the part that does not show up in this single split — the searcher's $45 of gross is not net profit. It is gross before the searcher's daily share of failed attempts.
Why this is a real business
A casual reader of the previous section would conclude that searchers operate at extraordinary margins. That conclusion is wrong, and the gap between Vpe's headline numbers and a typical searcher's daily P&L is the gap between gross and net.
Two facts about that gap. The first is theoretical and was articulated by Paradigm researchers in mid-2024: in a competitive priority-fee auction, the searcher with the most extractable value to capture will, in equilibrium, pay almost all of it back to whoever controls the ordering of the block. The net the searcher keeps is the wedge between their bid and the runner-up's. The theoretical ceiling on searcher net margin under a priority-gas auction, in other words, is zero.[9] The second fact is empirical. In June 2025, Flashbots published a measurement of arbitrage on Base, an Ethereum L2: roughly 350 failed transactions were submitted for every successful one, with the per-success economics running around $0.12 of profit for $0.02 of paid fees and a great deal more in unpaid fees on failed simulation attempts. Two firms accounted for more than 80 percent of all such activity on Base; the long tail had largely been competed out.[10]
A representative P&L for the dominant Solana sandwich operator during its peak month, derived from the publicly reported numbers, looks roughly like the following:
| Item | Vpe, Dec 2024 – Jan 2025 (≈30 days) |
|---|---|
| Sandwich transactions executed | 1,550,000 |
| Success rate | 88.9% |
| Gross profit | $13,430,000 |
| Jito tips paid to validators | $4,630,000 |
| Implied gross before tips | $13,430,000 |
| Implied net before infrastructure | $8,800,000 |
| Daily run-rate net | ≈$293,000 |
The implied net is large, and Vpe is the largest known operator. The window — December 2024 to January 2025 — was also Solana's peak MEV quarter; the equivalent operator in the same chain's Q1 2026 would book substantially smaller numbers, with total Solana network revenue from priority fees and Jito tips down 68 percent year-on-year and Jito tips alone down 72 percent.[11] The same business at a typical scale — one of the eleven Ethereum CEX-DEX firms still active in Q1 2025, or one of the two dominant Base arbitrage firms — operates on much narrower absolute margins, with gas-on-losses the dominant variable cost and the relationship with one or more block builders the dominant fixed asset.
That last sentence is the chapter's most important point about searcher economics in 2026. The competitive moat is no longer raw algorithmic edge. The moat is whether a builder will give your bundle priority in its order-of-arrival queue, whether a relay will route your private flow without latency, whether a validator will accept your bid at all. Searchers do not compete only with other searchers; they compete to be the preferred counterparty of the actors who decide block content. That dynamic is the subject of Chapter 5.
How this plays out on each chain
On Solana, the surface has compressed in a single year. Total network revenue from priority fees and Jito tips fell 68 percent year-on-year in Q1 2026, with Jito tips specifically down 72 percent.[11:1] The simple validator-leader sandwich that produced Vpe's $13.4 million month a year earlier was suppressed at the protocol level on 8 April 2026, and Jupiter's MEV-Protect routing had already pulled most retail flow around it before that. As of the time of writing, no rigorous post-patch measurement of the residual sandwich surface has been published; Helius researchers have flagged multi-slot sandwich attacks as the documented vector the patch does not eliminate, but the empirical question is open.[12] The live extraction has shifted toward CEX-DEX latency arbitrage and toward exclusive-flow arrangements with validators that are not yet public. Jito tips remain the dominant signal that controls inclusion priority; what changed is who can pay them and how much.
On Hyperliquid, the surface does not exist. The chain runs an on-chain central limit order book that matches inside HyperBFT consensus with roughly seventy-millisecond finality and no public mempool. A third-party searcher has no way to observe a pending swap before it fills, because there is no pending state to observe.[13] The rents that would otherwise accrue to external searchers on a public-mempool architecture accrue instead to the validator set and to HLP, the protocol-owned liquidity vault that absorbs liquidation surplus and quotes against incoming flow. This is not a moral improvement so much as a different distribution. The extraction has been collapsed into protocol structure: where Ethereum and Solana let third parties bid for the right to extract, Hyperliquid keeps the right inside the protocol's own balance sheet.
On Ethereum and its L2s, the trend split in two directions. EigenPhi measured Ethereum sandwich extraction falling from approximately $10 million per month in late 2024 to about $2.5 million per month by October 2025 — a roughly fourfold compression while monthly DEX volume on Ethereum rose from $65 billion to over $100 billion. The migration of retail flow to solver-mediated venues like CoW and UniswapX and to protected-routing services like MEV-Share and Flashbots Protect is the proximate cause.[14] Inside that smaller L1 extraction surface, block-building concentrated: one builder, Titan, produced roughly 52 percent of all Ethereum blocks in Q1 2026.[15] The L2 surface tells a different story. The most recent academic measurement, covering Q1 2026 on Base and Arbitrum, finds spam-MEV gas consumption persistent in structure even as gas-price interventions trim its peaks. The introduction of a minimum gas price on Base in December 2025 cut spam gas by roughly a third; Arbitrum's January 2026 fee increase saw spam dip briefly and then surge above pre-change levels by mid-February 2026.[16] Flashbots' own June 2025 measurement of Base — spam bots consuming more than half of the chain's gas while paying under a tenth of the fees, with two firms responsible for over 80 percent of the spam — has not been separately re-measured, but the structural framing the 2026 paper provides is that L2 spam economics are durable in a way Ethereum L1's sandwich economics have not been.[10:1]
Who wins, who loses, why
Winners. Through Q1 2026 the picture compressed. Solana's total measurable execution revenue — what the industry calls REV, comprising priority fees, Jito tips, and the rest of the validator income stream that scales with extraction — fell to $89.9 million in the quarter, down 68 percent year-on-year and 72 percent down on Jito tips specifically.[11:2] On Ethereum, block-building flow concentrated further: one builder, Titan, produced approximately 52 percent of all Ethereum blocks in Q1 2026.[15:1] Inside both of those smaller totals, the same handful of firms continued to capture most of what remained. The cleanest comprehensive measurement of the Ethereum CEX-DEX market — covering the nineteen months ending March 2025 — put total extraction at $233.8 million on $241.7 billion of routed volume, with the active firm count falling from twenty-three to eleven during the measurement window and the top three taking 90 percent.[4:1] The Vpe program's December-2024-to-January-2025 sample remains the cleanest snapshot of a peak-quarter Solana sandwich operator: $13.4 million of gross profit, of which 34 percent — about $4.6 million — went to validators via Jito tips.[1:2] Wallet-app routers like Jupiter monetised the retail-facing layer of the same flow by selling slippage protection to traders who would otherwise have lost it. An equivalent operator in Q1 2026 earns materially less in absolute terms; the share validators, builders, and routers capture as a percentage of every flowing dollar has not declined in proportion. The volume has contracted. The structure has not.
Losers. The traders whose transactions sat exposed in the public path paid the bill. Alice's $73 on a $10,000 swap is a defensible illustrative number for an unprotected early-2025 trade; the loss to her was small in percentage terms and is, multiplied across millions of traders, the great majority of what the searcher industry consumed. Passive liquidity providers on AMM pools paid a different, less visible bill — every CEX-DEX trade routed through a Uniswap pool is a sale of inventory at a price that was, by definition, stale. Slow market makers on order-book venues paid the same bill in a different denomination. Validators without infrastructure relationships paid in the form of revenue they did not receive: the dominant Solana validators in Q1 2026 earned considerably more in MEV-derived priority fees than the median, because Jito tips concentrate on the validators best positioned to capture them, and the dispersion has widened over time.[17]
Is this bad? The clinical answer is the only useful one. Arbitrage is price discovery; the chain pays for it through validator economics, and on most measures it is welfare-improving. Liquidations are a protocol-required maintenance function whose bonus has to be paid to someone, although the wstETH oracle episode in March 2026 shows that the rule fires whether or not the trigger was correct. Sandwiches are a pure transfer with no useful function — the architectural response over 2025 and the April 2026 Solana patch are evidence that the chains themselves agree with that assessment. The dollar of slippage Alice paid in February 2025 is not lost to corruption; it is lost to a market structure that, until recently, paid more attention to throughput than to who pays for it. That structure is now changing. Where the rents went next is the rest of this book.
What changes when…
What changes when the validator who built Alice's block has an exclusive arrangement with one specific searcher — when the routing path that suppressed the public sandwich has, on the other side, created a private one that only certain firms can use? Vpe paid $4.6 million in tips over thirty days. Where that money went, and what the recipients did to earn it, is Chapter 5.
Footnotes and sources
Helius Research, Solana MEV Report (Q1 2025), https://www.helius.dev/blog/solana-mev-report. Vpe's 30-day window covered approximately 7 December 2024 to 5 January 2025. Accessed 2026-05-13. ↩︎ ↩︎ ↩︎
This is a working definition for the business reader and is deliberately not the conventional acronym expansion. For the formal background, see Daian et al., Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges (2019), https://arxiv.org/abs/1904.05234. Accessed 2026-05-13. ↩︎
The 2Fast trade is documented in EigenPhi's 2024 MEV recap, From Jared 2.0 to Searcher-Builder Integration, January 2025, https://medium.com/@eigenphi/from-jared-2-0-solana-mev-to-searcher-builder-integration-2024-what-an-impactful-year-of-crypto-9fdb567d90bb. Accessed 2026-05-13. ↩︎
Heimbach, Wang, et al., Measuring CEX-DEX Extracted Value and Searcher Profitability (presented at AFT 2025), arXiv:2507.13023, July 2025, https://arxiv.org/abs/2507.13023. Coverage window: August 2023 to March 2025. Accessed 2026-05-13. ↩︎ ↩︎
Adadurov, Barseghyan, Chtepine, Eloranta, Sebyakin, Valitov, Second Thoughts: How 1-second subslots transform CEX-DEX Arbitrage on Ethereum, arXiv:2601.00738, 2 January 2026, https://arxiv.org/abs/2601.00738. Models the impact of Ethereum's expected sub-second slot timing; finds 1-second subslots would increase arbitrage transaction count by ≈535% and trading volume by ≈203% on average, suggesting the consolidation trend in CEX-DEX would slow or reverse if subslots ship. The most recent 2026 academic work on CEX-DEX; does not update the firm-count headline of arXiv 2507.13023. Accessed 2026-05-13. ↩︎
Aave Risk Documentation, Asset risk parameters, https://docs.aave.com/risk/asset-risk/risk-parameters. The 5–15% bonus range covers governance-set parameters for major V3 collateral assets; market-specific values vary. MarginFi and Kamino, the major Solana lending protocols, run comparable ranges. Accessed 2026-05-13. ↩︎
Brett Knoblauch, DeFi Lending Platform Aave Sees a Rare $27M Liquidations After a Price Glitch, CoinDesk, 10 March 2026, https://www.coindesk.com/business/2026/03/10/defi-lending-platform-aave-sees-a-rare-usd27-million-liquidations-after-a-price-glitch. Accessed 2026-05-13. ↩︎
There is no published per-trade sandwich-loss distribution for Solana DEX swaps at the $10,000 size band that this chapter could cite directly. The $50–$150 range used here is derived from the Helius Vpe data (gross extraction divided by transaction count, scaled up to the $10K size) and from independent reporting on Solana sandwich slippage in late 2024 and early 2025, before Jupiter's MEV-Protect was made a defaulted route. The $73 figure is illustrative. ↩︎
Dan Robinson and Dave White, Priority is All You Need, Paradigm, June 2024, https://www.paradigm.xyz/2024/06/priority-is-all-you-need. Accessed 2026-05-13. ↩︎
Flashbots Research, MEV and the Limits of Scaling, 16 June 2025, https://writings.flashbots.net/mev-and-the-limits-of-scaling. The 350:1 fail ratio and the two-firm-80% concentration are measured on Base over the Nov 2024 – Feb 2025 window. Accessed 2026-05-13. ↩︎ ↩︎
Michael Nadeau / The DeFi Report, Solana Q1 2026 network REV, via PANews, 20 April 2026, https://www.panewslab.com/en/articles/019da9c6-e9d5-76c0-904a-878418fd7fbc. Q1 2026 Solana network REV $89.9M (down 68% year-on-year, lowest since Q3 2023); Jito tips down 19.7% quarter-on-quarter and 72.3% year-on-year; priority fees down 68.8% year-on-year. Accessed 2026-05-13. ↩︎ ↩︎ ↩︎
Helius Research, Constellation (April 2026), https://www.helius.dev/blog/constellation. Helius researchers flag multi-slot sandwich attacks — attacks executed across consecutive blocks rather than within a single one — as a residual extraction vector that the 8 April 2026 protocol-level mitigation does not directly address. As of mid-May 2026, no formal empirical measurement of post-patch sandwich activity has been published. Accessed 2026-05-13. ↩︎
Hyperliquid Documentation, Order book, https://hyperliquid.gitbook.io/hyperliquid-docs/hyperliquid-l1/order-book. Accessed 2026-05-13. ↩︎
EigenPhi data via Cointelegraph Research, Sandwich attacks on Ethereum have waned, December 2025, https://cointelegraph.com/research/exclusive-data-from-eigenphi-reveals-that-sandwich-attacks-on-ethereum-have-waned, and EigenPhi's own time-series chart at https://x.com/EigenPhi/status/1998090234442215671. Accessed 2026-05-13. ↩︎
Relayscan, MEV-Boost relay and builder share — Q1 2026 snapshots, https://www.relayscan.io/. Titan produced ≈52.2% of Ethereum blocks in Q1 2026; next-largest BuilderNet ≈24.6%; Quasar ≈15.1%. Relay-side, Flashbots' own relay fell below 5% of share in Q1 2026, continuing the post-OFAC migration toward Ultrasound, Titan, and bloXroute. Accessed 2026-05-13. ↩︎ ↩︎
Wang, Saraf, Heimbach, Babel, Zhang (Yale / Cornell IC3 / Category Labs), Blockspace Under Pressure: An Analysis of Spam MEV on High-Throughput Blockchains, arXiv:2604.00234, 31 March 2026, https://arxiv.org/abs/2604.00234. The direct academic follow-up to Flashbots' June 2025 "Limits of Scaling." Key Q1 2026 findings: Base's December 2025 minimum-gas-price introduction cut spam gas from ~450 Bgas/day to ~302 Bgas/day (a ~33% reduction); Arbitrum's January 2026 fee increase produced a brief dip, then spam surged above pre-change levels by mid-February 2026. The theoretical result of the paper is that spam share has a positive lower bound under linear demand growth — i.e. minimum-fee floors are not durable. Accessed 2026-05-13. ↩︎
Figment Insights, Q1 2026 Solana Validator Report, https://www.figment.io/insights/figments-q1-2026-solana-validator-report/. The Q1 2026 figure attributes MEV-derived rewards (priority fees and Jito tips combined) to ~0.36% of total Solana staking rewards, materially down from 2024 highs; the dispersion across validators has widened. Accessed 2026-05-13. ↩︎