MEV
Suspicious-pattern detector feed. Sandwich attacks, oracle sandwiches, liquidation cascades, wash trading — the patterns Stellar exhibits, with the same canonical-VWAP context surrounding each event.
What we look for
Pattern catalogue — confidence-scored, false-positive-tolerant
Sandwich
Front-run + back-run around a victim swap. Detector groups (front, victim, back) when they share (ledger, op_index neighbors) and the front+back account match.
e.g. Bot detects a large XLM→USDC swap in mempool, drops a smaller XLM→USDC swap before it (raising price), and an opposite-direction swap immediately after.
Oracle-update sandwich
Specific to Blend lending. A liquidation immediately after a Reflector update, where the same account that placed the liquidate also called update_price() — meaning the oracle update was profitable for them.
e.g. Account writes a Reflector price update that crosses a Blend liquidation threshold, then in the same ledger fires the liquidate() call against an undercollateralised position.
Liquidation cascade
A liquidation that triggers another liquidation within a short window — usually because the first liquidation's auction sold collateral at a discount, depressing the on-chain oracle price for downstream pools.
e.g. Pool A liquidates a large XLM-collateralised position, dumping XLM into Soroswap. Reflector reads the depressed XLM price; pool B's positions cross liquidation threshold and get liquidated next ledger.
Wash trading
Self-trading or coordinated trading to inflate observation count for a thin asset. Detector flags rapid back-and-forth trades on the same pair that net to ~zero volume.
e.g. Two accounts swap the same pair back and forth across many ledgers, generating trade count without moving real value.
Why this matters for pricing
MEV trades show up as ordinary swaps on the wire. Without detection, a sandwich pair would inflate observation count on the same pair the victim contributed to, and an oracle- update sandwich would skew the oracle reading the liquidation price was set against.
Detected events get a per-trade flag in mev_events (migration 0021). The aggregator can then optionally exclude flagged trades from VWAP — the policy lever lives at the aggregator, not the decoder, so we keep the raw observation and let downstream methodology decide.
Coming next
Auto-flagged event feed, per-kind tally, event drill-down with tx-hash deep links plumb in once the /v1/mev endpoint ships (Phase 5). The schema is in place; the detector worker (Phase 3) lands as the aggregator data flow stabilises. For the underlying methodology see the research index.