Skip to content
Last updated: February 06, 2026

SCWE-142: Extractable Value from Predictable Transaction Ordering

Stable Version v1.0

This content is in the version-(v1.0) and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).

Send Feedback

Relationships

Description

Contracts that create predictable, orderable state changes expose value to block builders and searchers (MEV). Sandwich attacks, backrunning, and liquidation front-running are examples. When a user's transaction has a predictable effect (e.g., large swap moving price), an attacker can place transactions before and after to extract value. SCWE-037 covers front-running; this weakness addresses the broader MEV surface—design choices that make extraction easy.

Remediation

  • Use private mempools or commit-reveal schemes for sensitive transactions.
  • Implement slippage protection (SCWE-090) and deadline parameters (SCWE-141).
  • Consider batch auctions, fair ordering, or MEV-aware design (e.g., CoW Protocol) where applicable.

Examples

Vulnerable

pragma solidity ^0.8.0;

contract SimpleSwap {
    function swap(uint256 amountIn, uint256 minOut) external {
        // Predictable: searcher sees large amountIn, sandwiches with buy-before and sell-after
        uint256 out = getAmountOut(amountIn);
        require(out >= minOut, "Slippage");
        transferOut(msg.sender, out);
    }
}

Fixed

function swap(uint256 amountIn, uint256 minOut, uint256 deadline) external {
    require(block.timestamp <= deadline, "Expired");
    uint256 out = getAmountOut(amountIn);
    require(out >= minOut, "Slippage");
    transferOut(msg.sender, out);
}
Fix: User-supplied deadline and minOut limit MEV extraction. Use DEX aggregators or private order flow for additional protection.