Skip to content
DeFi Reference

Order flow auctions

1. TL;DR

Section titled “1. TL;DR”

An orderflow auction (OFA) takes a user’s transaction out of the public mempool, lets searchers bid for the right to trade around it (usually only to backrun it), and pays most of the winning bid back to the user or their wallet. Flashbots’ MEV-Share and CoW’s MEV Blocker refund about 90% of the backrun value by default; Paradigm’s “MEV taxes” show that on chains with strict priority ordering an application can run its own OFA with a single line of contract logic. The cost is a new trust assumption in the OFA operator and a tendency for exclusive orderflow to entrench the largest builders.

2. Explain it simply

Section titled “2. Explain it simply”

Analogy

Section titled “Analogy”

When you sell a house, you can post the listing publicly and let every flipper in town race to lowball you, or you can hand it to an agent who runs a sealed auction among vetted buyers and passes you the highest bid minus a fee. An orderflow auction is that agent for your transaction: it hides the details from the crowd, lets bidders compete for the small profit your trade creates (the “backrun”), and returns most of that profit to you instead of letting a bot keep it.

ELI5

Section titled “ELI5”

When you make a trade on a blockchain, your trade often nudges prices and creates a tiny money-making opportunity for whoever trades right after you. Normally a bot grabs it and you get nothing. An orderflow auction is a service that keeps your trade hidden, lets bots bid for the right to be the one who trades right after you, and gives you most of what they bid. It also promises not to let anyone trade before you, which is the harmful kind of bot behaviour. The catch: you have to trust the service, and the biggest block builders tend to get all the hidden trades, which makes them even bigger.

Step-by-step walkthrough

Section titled “Step-by-step walkthrough”

Alice sells 100 ETH into a pool through Flashbots Protect with MEV-Share:

  1. Before: Alice holds 100 ETH; two pools quote ETH at 3,000 USDC (pool P, deep) and 3,000 USDC (pool Q, shallow). Alice’s swap will push P’s price to ~2,970.
  2. Submission: Alice’s wallet sends the signed swap to the MEV-Share Node instead of the public mempool. The node publishes only a hint (e.g. “a swap touched pool P”) according to her privacy setting; the full transaction stays hidden.
  3. Bidding: searchers simulate backruns against the hint. Searcher S computes that buying ETH in P at ~2,970 and selling in Q at ~3,000 yields 0.10 ETH after gas, and submits a partial bundle “[Alice’s tx, S’s arb]” with a bid.
  4. Matching: the MEV-Share Node simulates the bundle, confirms S’s transaction cannot frontrun Alice’s (it only backruns), and forwards it to builders with the condition that Alice is paid 90% of S’s payment.
  5. After: the block includes Alice’s swap then S’s arbitrage. Alice receives ~297,000 USDC plus a 0.09 ETH refund; S keeps 0.01 ETH minus gas; the builder and proposer share whatever S paid for inclusion. No transaction executed before Alice’s, so no sandwich was possible.

Common misconceptions

Section titled “Common misconceptions”
  • Myth: OFAs refund users the MEV they “lose”. Reality: they refund the backrun (arbitrage created by the trade). Sandwich losses are prevented, not refunded; loss-versus-rebalancing borne by liquidity providers is untouched.
  • Myth: A private RPC is trustless. Reality: the OFA node and its builders see the full transaction; MistX’s 2021 design already noted traders “are still trusting Flashbots miners not to sandwich a bundle”, and the same holds today for MEV-Share nodes and builders.
  • Myth: OFAs are an Ethereum-only phenomenon. Reality: Solana’s MEV-protect modes, Jito’s DontFront rule, DFlow’s declarative swaps, and rebate-paying RPC endpoints are OFAs in all but name.
  • Myth: MEV taxes need an auction server. Reality: on a chain with competitive priority ordering, a contract that charges a fee proportional to the transaction’s priority fee turns the block producer’s own sorting into the auction.
  • Myth: More private orderflow is unambiguously good. Reality: exclusive orderflow is the main driver of builder concentration on Ethereum, which is what inclusion lists and ePBS are trying to counter.

If you only remember one thing

Section titled “If you only remember one thing”

An OFA converts the backrun your transaction creates into a refund, at the price of trusting the auctioneer and feeding the largest builders.

3. How it works

Section titled “3. How it works”

Where the value comes from

Section titled “Where the value comes from”

A user’s swap of size δ\delta on a constant-product pool moves its price from pp to p′<pp' < p (for a sell). The gap between p′p' and the price on other venues p∗p^{*} is an arbitrage worth roughly

πbackrun≈12 L (p∗−p′)2p∗\pi_{\text{backrun}} \approx \tfrac{1}{2}\,L\,\frac{(p^{*} - p')^{2}}{p^{*}}

for a pool with liquidity LL (a second-order quantity: small trades create negligible backrun value, large trades create a lot). Without an OFA, a searcher captures πbackrun\pi_{\text{backrun}} by inserting a transaction right after the user’s; with a public transaction the searcher can also frontrun, turning the same setup into a sandwich (see /mev/mev-taxonomy/).

The OFA mechanism

Section titled “The OFA mechanism”

Flashbots’ MEV-Share defines the general shape. Users send transactions to a MEV-Share Node, which “selectively shares information about the user’s transaction according to their privacy preferences”. Searchers submit partial bundles referencing the hidden transaction; the node simulates them and forwards successful ones to builders “along with a condition that the user must be paid back [a] specified percentage (by default 90%) of the MEV their transactions create”. Only backruns are accepted. MEV Blocker (CoW, Agnostic Relay, Beaver Build) uses the same rule: the searcher keeps up to 10% and 90% is rebated. If searchers are competitive, the winning bid b→πbackrun−cb \to \pi_{\text{backrun}} - c (their execution cost), so the user receives 0.9 (πbackrun−c)0.9\,(\pi_{\text{backrun}} - c).

Three properties matter: frontrun protection (no bundle may place a transaction before the user’s), failed-trade privacy (losing bundles are never seen), and neutrality (MEV-Share “does not enshrine a single block builder”; Flashbots moved its own building and refunds to the TEE-based BuilderNet in December 2024).

The 2021 precursor: bundles as protection

Section titled “The 2021 precursor: bundles as protection”

MistX (analysed by Paradigm in June 2021) was the first consumer product to submit trades exclusively as Flashbots bundles. A bundle is “executed atomically” and “mined at the top of a block”, so a miner “can’t frontrun the trade”; the trader pays the miner via a contract call that only executes if the trade succeeds, giving gasless, revert-free trades. Cost: the example trade paid 0.0099 ETH to Sparkpool (0.27%, about $25) and used 205k gas versus 160–180k on Uniswap directly, and bundles compete with arbitrage and liquidations for top-of-block space.

MEV taxes: an OFA without a server

Section titled “MEV taxes: an OFA without a server”

Robinson and White (“Priority Is All You Need”, 2024) observe that under competitive priority ordering (sort by priority fee, no censoring, peeking, or delay) the priority fee of a transaction reveals the MEV it captures: a searcher chasing 100 ETH of MEV bids up to 100 ETH in priority fees. An application can therefore charge

tax=a⋅priorityFeePerGas\text{tax} = a \cdot \text{priorityFeePerGas}

and capture a fraction aa+g\dfrac{a}{a + g} of the MEV, where gg is gas used (the proposer’s share); a tax of 99× the priority fee captures 99%. Applications: intent fills whose price improves with priority (replacing UniswapX Dutch auctions), an AMM whose first trade per block must raise xy\sqrt{xy} by a⋅a\cdotpriority (auctioning top-of-block arbitrage to LPs), and wallets that sell the exclusive right to backrun the user. Two taxed apps in one transaction split MEV as taxi=aia1+a2 MEV\text{tax}_i = \dfrac{a_i}{a_1 + a_2}\,\text{MEV}. This only works where sequencers follow priority ordering (OP Stack chains) and “would likely not work at all on Ethereum L1”.

The 2020 original: auctioning the ordering right itself

Section titled “The 2020 original: auctioning the ordering right itself”

Floersch’s MEV Auction (MEVA, January 2020) proposed selling the right to order an NN-block window to a single “sequencer” while block producers keep control of inclusion, with proceeds funding public goods; McMenamin’s SoK later identified sequencers and OFAs as the protocols with “the greatest potential to mitigate MEV”. pmcgoohan’s rebuttal (2021) argued that auctioning ordering enshrines “the right of the richest to extract money from the poorest”.

4. Worked numeric example

Section titled “4. Worked numeric example”

Same scenario as §2. Pool P is a constant-product pool with 10,000 ETH and 30,000,000 USDC (k=3×1011k = 3\times10^{11}); pool Q is small and always quotes near 3,000.

Alice’s swap. Selling 100 ETH into P: x′=10,100x' = 10{,}100, y′=3×1011/10,100=29,702,970y' = 3\times10^{11}/10{,}100 = 29{,}702{,}970; Alice receives 297,030297{,}030 USDC (average 2,970.3); P’s marginal price becomes y′/x′=2,940.9y'/x' = 2{,}940.9.

Backrun value. A searcher buys ETH in P until its price returns to ~3,000 and sells in Q. Buying Δ\Delta ETH so that (y′+u)/(x′−Δ)=3,000(y' + u)/(x' - \Delta) = 3{,}000 with uu USDC spent gives Δ≈49.6\Delta \approx 49.6 ETH for u≈147,270u \approx 147{,}270 USDC (average 2,969), resold in Q at 3,000 for 148,800 USDC. Gross arbitrage ≈ 1,530 USDC ≈ 0.51 ETH; net of ~0.03 ETH gas, π≈0.48\pi \approx 0.48 ETH.

Public mempool (no OFA). A searcher would sandwich instead, earning both the sandwich spread (capped by Alice’s slippage tolerance) and the backrun.

MEV-Share. Bidding competes bb up to ≈0.48 ETH. Refund to Alice =0.9×0.48=0.43= 0.9 \times 0.48 = 0.43 ETH; searcher keeps 0.05 ETH; Alice’s effective price improves from 2,970.3 to ≈2,983.3 USDC/ETH.

MEV tax (on an OP Stack chain). Alice’s wallet intent charges the filler a tax of 99×99\times the priority fee. The winning searcher sets total payment ≈0.48 ETH: priority fee 0.0048 ETH to the sequencer, tax 0.475 ETH to Alice (99%). Same order of magnitude as MEV-Share but without any off-chain node; the difference is who is trusted (the sequencer’s ordering rule rather than the OFA operator).

5. Where it’s used

Section titled “5. Where it’s used”

Ethereum

Section titled “Ethereum”
  • Flashbots Protect + MEV-Share — default 90% refund of backrun value; 2.1 million unique accounts, $43 billion of DEX volume protected, 313 ETH of MEV refunds cumulatively, and private mempools carrying more than half of all Ethereum gas (as of 2025, Flashbots “2 Million Protect Users”). docs.flashbots.net
  • MEV Blocker (CoW DAO, Agnostic Relay, Beaver Build) — same 90/10 split; roughly 5% of Ethereum transactions (as of 2025, CoW docs, secondary).
  • CoW Protocol batch auctions — solvers compete on price improvement; see /exchange/batch-auctions/.
  • UniswapX / 1inch Fusion — intent Dutch auctions that are OFAs run by the router; see /exchange/rfq-and-intents/.
  • MEV taxes on OP Stack L2s — Unichain’s TEE builder enforces priority ordering per flashblock so apps can levy MEV taxes (Unichain whitepaper, 2024-10). See /exchange/v4-hooks-and-am-amm/.

Solana

Section titled “Solana”
  • Jito bundles with DontFront — a transaction that references an account prefixed jitodontfront must be at index 0 of any bundle, so it can be backrun but not frontrun; used by Jupiter and Telegram bots’ “MEV protect” modes, which route exclusively to Jito block engines (Helius, as of 2025-01). solana.com guide
  • MEV-protected RPC endpoints with rebates — “Searchers bid for the right to backrun your transaction and bid an associated rebate, which gets paid back to the user” (Helius, as of 2024-03); trust in the endpoint operator is explicit.
  • DFlow conditional liquidity and declarative swaps (December 2024) — tighter spreads for flow classified as non-toxic, executed as Jito bundles with a quote guaranteed at signature.
  • BAM plugins (2025) — application-controlled execution lets an app define its own ordering (e.g. cancel-before-take) and monetize it, an on-validator OFA; see /mev/solana-mev/.

6. Risks, attacks, and incidents

Section titled “6. Risks, attacks, and incidents”
  • Exclusive orderflow and builder concentration. jgm’s 2022 prediction that searchers route to the builder with the best pool has borne out: top CEX-DEX searchers integrated with top builders (Wintermute–rsync, SCP–beaverbuild, as of 2023-10) and three builders produced ≈90% of blocks (as of 2025-07). OFAs routing to one builder amplify this; multi-builder forwarding and BuilderNet are responses.
  • The April 2023 unbundling. The $20M relay exploit specifically targeted sandwich bots’ bundles: because bundles are the primitive OFAs are built on, a leak of bundle contents to a proposer exposes every user in the OFA to the very attack it prevents (Flashbots post-mortem, 2023-04; see /mev/pbs-and-epbs/).
  • Solana private mempools sold as a “service”. After Jito suspended its public mempool in March 2024, DeezNode circulated a “DeezMempool” proposal to validators promising profit shares; its validator accumulated 811,604.73 SOL ($168.5M) of delegated stake and its sandwich program made 65,880 SOL ($13.43M) in 30 days (as of 2025-01, Helius). The Solana Foundation removed over 30 operators from its delegation program in June 2024 (The Block, secondary). This is an OFA run against users rather than for them.
  • Pay-for-stake auctions subsidized by sandwiching. Marinade’s Stake Auction Marketplace showed winning bids of 13.73% APY (top ten 18.27%) versus ~9.4% from zero-commission validators; Helius infers the gap is funded by sandwich revenue (as of 2024-12).
  • MEV taxes need honest sequencers. A sequencer that peeks, censors, or reorders can evade the tax entirely, which is why Robinson and White restrict the claim to chains with enforceable priority ordering and why Unichain moved building into a TEE (2025-05).

7. Open problems

Section titled “7. Open problems”
  • Who should the OFA pay? Flashbots frames users as the creators of MEV; the 2026 “Origins of MEV” attribution work asks whether the creator of an arbitrage is the swapper, the LP, or the price-moving venue, which changes what a fair refund is.
  • Neutral vs exclusive. McMenamin’s SoK ranks OFAs and sequencers as the most promising mitigations “but also as protocols with some of the biggest technical barriers”; an OFA’s need for reliable inclusion favors big builders.
  • Enforcing priority ordering trustlessly. Robinson and White call this “an open problem”; TEEs (Unichain, BuilderNet, BAM) are the current answer, with hardware trust as the cost (see /mev/encrypted-mempools/).
  • Auction design under latency. Paradigm’s timing-advantage model shows a late bidder in a UniswapX-style fill earns a positive expected profit without seeing rivals’ bids (as of 2025-05).

8. Ethereum vs Solana

Section titled “8. Ethereum vs Solana”
AspectEthereumSolana
Canonical OFAMEV-Share (Flashbots Protect), MEV BlockerJito bundles + DontFront; app “MEV protect” modes
Default user refund90% of backrun bidusually none; protection rather than rebate (some RPCs pay rebates)
What is auctionedthe right to backrun a hidden transactionposition in an atomic bundle around a user transaction
Trust assumptionOFA node + builders see the transactionJito block engine sees it; validators must not run private mempools
Application-level variantMEV taxes on priority-ordered L2s; Uniswap v4 hooksBAM plugins (application-controlled execution)
Main failure modeexclusive orderflow → builder concentrationprivate validator mempools → sandwiching, stake bribery

Ethereum’s OFAs grew out of Flashbots bundles and are now the main reason most user transactions never touch the public mempool; their economics are explicit (90% refunds) and their side effect is builder concentration. Solana’s OFAs are implicit: because there is no mempool, “protection” means routing to the one auctioneer (Jito) whose rules forbid frontrunning, while the threat is validators who quietly operate their own mempool. Both chains are converging on TEE-attested sequencing (BuilderNet, Unichain, BAM) as the way to make the auctioneer’s promises verifiable.

9. Reference doc

Section titled “9. Reference doc”

The reference

Section titled “The reference”

MEV Auction: Auctioning transaction ordering rights as a solution to Miner Extractable Value — Karl Floersch (with Vitalik Buterin, Phil Daian, Barry Whitehat, Ben Jones), 2020-01-15. https://ethresear.ch/t/mev-auction-auctioning-transaction-ordering-rights-as-a-solution-to-miner-extractable-value/6788

Summary of the reference

Section titled “Summary of the reference”

The post starts from the observation that block producers’ power to reorder, insert, and delay transactions is worth more than fees, citing Flash Boys 2.0. It contrasts frequent batch auctions, which neutralize micro-timing in a single market by sorting orders by price, with a general-purpose chain where no fixed “correct” order exists. The proposal: “we simply auction off the right to reorder transactions within an N-block window to the highest bidder”, creating a MEV Auction (MEVA) whose winner, the sequencer, may reorder and insert but may not delay any transaction more than N blocks. This “managed centralization” removes the benefit of clever ordering for ordinary block proposers, so “dumb” proposers remain viable and proposal stays decentralized.

“MEV Auction on top of Gas Price Auction” notes that in the existing priority-gas-auction world the real winners are miners, because bots bid up gas; a MEVA layered on top redirects that surplus to the community. “Implementing the Auction” separates block producers (transaction inclusion, censorship resistance) from sequencers (ordering), with a MEVA smart contract run by producers electing the sequencer and replacing it on timeout. Sequencers can also give instant cryptoeconomic inclusion guarantees by signing orderings on receipt, with fraud proofs slashing equivocation, foreshadowing preconfirmations. “Implementation on Layer 2” argues the mechanism fits Optimistic Rollup and similar systems, repurposing L1 miners as block producers.

“Considerations” lists collusion among bidders (mitigated by open-source sequencer software lowering entry barriers), long-term incentive alignment (a daily first-price auction is attackable; require a slashable deposit or a health-correlated asset), and the “parasitic L2 problem” of diverting L1 revenue. The “Path Forward” frames the design as a way to reinvest MEV in public goods.

Key quotes

Section titled “Key quotes”

“we simply auction off the right to reorder transactions within an N-block window to the highest bidder.” (§Introduction)

“This creates a form of ‘managed centralization’: a single sophisticated party wins the auction and can capture all of the MEV. We call this party a ‘sequencer.’” (§Introduction)

“Counter-intuitively, the real winner of these auctions is Ethereum miners, as bots which outbid each other raise the gas price.” (§MEV Auction on top of Gas Price Auction)

“Block producers which determine transaction inclusion, and sequencers which determine transaction ordering.” (§Implementing the Auction)

How to read the original

Section titled “How to read the original”

Background: Flash Boys 2.0’s PGA and MEV definitions, and what an optimistic rollup batch is. Read the introduction and “Implementing the Auction”; the L2 section is short and the “Considerations” are the interesting critique. The hardest idea is the inclusion/ordering split: block producers guarantee a transaction lands within N blocks (censorship resistance) while the sequencer chooses order within that window (value capture), and why that split preserves decentralization at the proposal layer.

What changed since

Section titled “What changed since”
  • 2021-03: pmcgoohan’s “MEV Auctions Will Kill Ethereum” argued auctions entrench extraction from ordinary users.
  • 2021: Flashbots’ bundle auction implemented a per-block version of “selling ordering” to searchers rather than a single sequencer.
  • 2023-02/2023-06: Flashbots announced and shipped MEV-Share, the user-refunding OFA.
  • 2023-08: McMenamin’s SoK classified sequencers and OFAs as the most promising cross-domain mitigations.
  • 2024-06: “Priority Is All You Need” showed apps can tax priority ordering directly on OP Stack chains.
  • 2025: Unichain (TEE builder) and Jito’s BAM (TEE sequencing with plugins) put verifiable ordering rules into production.

Secondary references

Section titled “Secondary references”
  1. “MEV-Share: Introduction” (Flashbots docs) — read if you want the current user-facing OFA mechanism.
  2. “Priority Is All You Need” (Robinson & White, 2024) — read if you build applications and want to capture your own MEV.
  3. “How mistX uses Flashbots bundles” (Paradigm, 2021) — read if you want the earliest consumer OFA and its cost accounting.
  4. “SoK: Cross-Domain MEV” (McMenamin, 2023) — read if you want OFAs placed among other mitigations.
  5. “MEV Auctions Will Kill Ethereum” (pmcgoohan, 2021) — read if you want the strongest critique.

The reference

Section titled “The reference”

MEV-Share: Introduction — Flashbots documentation, n/d (protocol announced 2023-02; MEV-Share Node renamed June 2023). https://docs.flashbots.net/flashbots-mev-share/introduction

Summary of the reference

Section titled “Summary of the reference”

The page defines MEV-Share as “an open-source protocol for users, wallets, and applications to internalize the MEV that their transactions create (‘orderflow auction’)”. Users share selected data about their transactions with searchers, who bid to include them in bundles, and users choose how the bid is split among themselves, validators, or others. It is described as credibly neutral, permissionless for searchers, and non-enshrining of any single builder, aiming “to reduce the centralizing impact of exclusive orderflow on Ethereum”. “Why MEV-Share?” asserts the redistribution target: MEV “back to the party that creates it in the first place: users”. “How does MEV-Share work?” describes the MEV-Share Node, hint sharing per privacy preference, partial bundles from searchers, node-side simulation, forwarding to builders with a payment condition (default 90% to the user), and the restriction that only backruns are accepted. “How do I use MEV-Share?” points to Flashbots Protect RPC and the private-transaction API; “How do I search on MEV-Share?” points to the searcher guide.

Key quotes

Section titled “Key quotes”

“MEV-Share is an open-source protocol for users, wallets, and applications to internalize the MEV that their transactions create (‘orderflow auction’).” (§What is MEV-Share?)

“the user must be paid back specified percentage (by default 90%) of the MEV their transactions create.” (§How does MEV-Share work?)

“At the moment, MEV-Share Nodes only accept backruns.” (§How does MEV-Share work?)

How to read the original

Section titled “How to read the original”

No background beyond bundles and the builder market. Read it in five minutes, then the searcher “Getting Started” guide for the hint schema. The subtle point is that privacy is configurable per transaction: more hints mean more searcher competition and higher refunds, but more information leakage.

What changed since

Section titled “What changed since”
  • 2024-12: Flashbots migrated builders, orderflow, and refunds to BuilderNet (TEE-based, multi-operator).
  • 2025: Flashbots reported 2.1M Protect accounts, $43B protected volume, and 313 ETH of refunds, with private mempools over half of Ethereum gas (as of 2025).

Secondary references

Section titled “Secondary references”
  1. “2 Million Protect Users” (Flashbots, 2025) — read if you want adoption numbers.
  2. “MEV Blocker” (CoW docs) — read if you want the competing implementation and its 90/10 rule.
  3. “Solana MEV Report” (Helius, 2025) — read if you want the Solana analogues and their failure modes.

10. Sources

Section titled “10. Sources”