Solana gets new tools to slash validators that engage in sandwich attack

2025/06/25 03:21

Solana-based Marinade Finance has unveiled new tools to combat validators that take advantage of traders.

Bad actors among Solana validators have long posed a challenge, but native protocols are stepping up efforts to address the issue. On Tuesday, June 24, Marinade Finance rolled out a suite of tools designed to detect and block validators engaging in sandwich attacks against users.

Sandwich attacks occur when validators strategically place a transaction both before and after a user’s trade. Because validators can control transaction sequencing, they exploit this advantage to extract profit — at the trader’s expense.

Marinade identified such behavior in SOL delegated through its Stake Auction Marketplace. In response, the team developed more effective blacklisting mechanisms and added slashing tools that penalize malicious validators by cutting their rewards.

Solana’s Anatoly Yakovenko praises the move

To further mitigate risks, Marinade introduced Marinade Select, a curated list of trusted validators that other stakers can follow. The move has already gained notable support, including from Solana co-founder Anatoly Yakovenko, particularly in the context of liquid staking.

Yakovenko emphasized that liquid staking protocols like Marinade, Jito, and Lido should provide feedback on validator performance. This feedback loop, he argued, can help insulate the broader ecosystem from bad actors.

Solana Foundation has been actively trying to overhaul its validator ecosystem for a while. In April, the Foundation announced that it would start cutting small validators from its delegation program. Namely, the organization gives some of its SOL tokens to validators to boost their earnings.

Still, challenges for Solana’s validator ecosystem remain. Due to high fixed costs associated with running a node, many validators struggle to break even. This is why some of them resort to operations such as sandwich attacks.

Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact [email protected] for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.
Share Insights

You May Also Like

Massive Software Supply-Chain Hack Targeting Crypto Ends with Pennies Stolen

Massive Software Supply-Chain Hack Targeting Crypto Ends with Pennies Stolen

The post Massive Software Supply-Chain Hack Targeting Crypto Ends with Pennies Stolen appeared on BitcoinEthereumNews.com. One web developer’s compromised npm account triggered a large-scale supply chain attack, but the hacker only got a few cents in crypto, analysts say. An unknown hacker pulled off what may be the largest software supply-chain attack ever, but still made less than the price of many memecoins. On Monday, Sept. 8, a hacker broke into the account of a well-known JavaScript developer known as “qix” and pushed malicious updates to dozens of widely used software tools for building websites and apps, which together are downloaded more than two billion times each week. After gaining access, the hacker added malicious code to all of the developer’s packages, which wasn’t a virus in the traditional sense but was still designed to steal cryptocurrency from users’ crypto wallets in browsers. The attack immediately caused chaos as developer updates are usually automatically trusted, so when new versions come in, many projects and apps accept them without checking, letting the hacker’s code spread fast. Snir Levi, founder and CEO of compliance and threat management platform Nominis, told The Defiant that the modern software supply chain is “incredibly interconnected,” as a single compromised npm account can cascade across thousands of projects and businesses in minutes, because code reuse is the “backbone of the entire ecosystem.” Npm is a registry for JavaScript software packages. “The stakes aren’t just technical – a malicious package in a critical dependency can impact millions of users, move billions of dollars, and undermine trust in the integrity of the industry. This incident highlights that security isn’t just about protecting infrastructure; it’s about protecting every link in a vast, invisible web of trust,” Levi explained. The malicious code, mainly targeting Ethereum and Solana transactions, was created to swap destination addresses to the hacker’s wallet, the Security Alliance wrote in a post-attack blog…
Share
BitcoinEthereumNews2025/09/11 01:27
Share