Inside Ethereum's Mempool Predators and the Rise of Pay-to-Play Frontrunning

Before an Ethereum transaction is finalized on-chain, it sits briefly in the mempool — a public, unsettled state where pending trades are visible to anyone watching. That visibility makes the mempool a hunting ground: automated bots continuously scan it for profitable opportunities, frontrunning trades before they can settle and repeating the process wherever it remains lucrative. Miners, infrastructure providers, and the bots themselves all benefit at the expense of the original trader.

A borrowed metaphor

The framing of this piece draws on the "dark forest" concept from Liu Cixin's science fiction novel of the same name — a theory describing how interstellar civilizations might behave under scarcity and mutual suspicion, offered as one possible explanation for the Fermi paradox. In Cixin's telling, civilizations separated by vast distances default to hostility: any contact risks escalating into mutual destruction, so the most advanced civilizations preemptively monitor and eliminate anything that reveals its position.

The parallel to Ethereum is direct. Frontrunners must maintain a real-time view of all pending mempool activity, competing to react within milliseconds — the sharper their visibility, the greater their profit. The dynamic is inherently zero-sum: a frontrunner's gain equals another participant's loss. And the piece argues this activity is shifting away from Ethereum's open, permissionless architecture toward paid infrastructure and mining arrangements that give some participants a structural edge.

Speed decides the winner

Because Ethereum's fee market is open, mining pools award finality to whoever pays the most. A common frontrunning pattern involves spotting a pending transaction, then resubmitting an equivalent one at a higher fee to jump the queue. But fees alone don't guarantee speed — transaction propagation time across the network is itself a bottleneck, meaning the real contest is about who can get their transaction seen and mined first, with high fees acting only as the entry price to that race.

bloXroute enters the picture

One company built infrastructure explicitly around this dynamic: bloXroute, which runs a high-speed relay network within Ethereum that gives paying customers privileged, faster access to mining pools — letting them route around the standard mempool and the bots patrolling it. Traffic is prioritized by payment tier, effectively creating a private fast lane for the highest bidders.

Rekt's own monitoring recorded 22,391 transactions passing through the bloXroute network over a 30-hour window. A single address accounted for 10,081 of them — more than three times the volume of the next most active participant, and close to half of all network traffic observed.

A frontrunning trade, illustrated

One representative example: a victim attempted to swap CRV for ETH on Uniswap, attaching a $4.17 transaction fee. Within milliseconds, a frontrunning bot submitted an identical trade with a $16.29 fee. The victim's transaction failed while the frontrunner's went through — the entire sequence resolving in under 30 seconds. The frontrunner's transaction and the victim's failed attempt are both on record, and similar patterns recur across multiple repeat attempts by the same victims.

The broader effect: bots typically extract profits ranging from tens to hundreds of ETH per successful frontrun, while ordinary users absorb repeated failed transactions and the associated gas costs — a direct transfer of value from less sophisticated participants to faster, better-resourced ones.

Monetizing the danger it creates

Having built dominant frontrunning infrastructure, bloXroute also began selling protection from it: for $1,250 per month, customers can route "private transactions" that skip the public mempool entirely, avoiding the exposure that enables frontrunning in the first place. The arrangement creates an odd loop — the same infrastructure that intensifies the threat also sells the fix for it. At the top tier, bots can even route trades directly to a miner, bypassing public visibility altogether, effectively functioning as a private frontrunning dark pool.

Miner collusion: not yet, but trending that way

The 2019 academic paper Flash Boys 2.0 found no evidence at the time that miners were colluding directly with frontrunners. But the growth of bloXroute's network raises the possibility of that changing: an estimated 40–50% of Ethereum miners were, at time of writing, running bloXroute nodes — fast, privately-paid infrastructure operating outside the network's open architecture.

Nakamoto consensus is designed so that miners' self-interest reinforces network security, but that same self-interest could just as easily bend toward collusion if the financial incentive is strong enough.

Escalation and possible mitigations

The dark-forest dynamic tends to be self-reinforcing: once mutual aggression becomes the norm, no participant can safely opt out, and the arms race toward faster, more automated attacks continues as long as it remains profitable.

EIP-1559, the long-discussed proposal to cap and stabilize Ethereum gas prices, could reduce the runaway fee auctions that fuel frontrunning. However, nothing prevents private networks like bloXroute's from continuing to run their own gas auctions off-chain, regardless of what the base protocol enforces. Miner resistance to EIP-1559 — driven by the fee revenue it would cut into — adds further uncertainty about whether such mitigations would hold in practice, or whether miners might informally route around them.

Editorial framing

The piece closes by characterizing bloXroute's business model as extractive: profiting first by amplifying the mempool's dangers, then charging for protection from those same dangers, in the process centralizing power that used to belong to the open network. It notes, citing A Short History of Progress, that vaguer, more exaggerated threats tend to be more useful for manufacturing consent — while acknowledging that, within Ethereum's own rules, bloXroute's approach is entirely legitimate. As the piece puts it, the system still runs on the principle that code is law.

This article was written by an anonymous contributor.