Did I get sandwiched or is this normal slippage?

Check the block. If a buy from an unfamiliar address sits immediately before yours and a sell from the same address immediately after, that is a sandwich.

Does lower slippage stop it?

It caps the damage rather than preventing the attempt. A tight setting means the attack cannot push you far before your transaction reverts.

Are small trades safe?

Mostly. Extracting value costs the attacker fees, so trades under roughly 1 SOL usually are not worth the effort.

Sandwich attacks explained, and what they cost you

You bought at what looked like 0.0000042 and filled at 0.0000051. Nothing crashed, no bug, and the difference went to somebody who saw your transaction before it settled.

That's a sandwich. Understanding the shape of it takes about 4 minutes and changes how you set slippage forever.

The mechanic

Three transactions, one block, in this order.

An attacker sees your pending buy. They insert their own buy immediately before yours, which pushes the price up. Yours executes at the higher price. Then they sell straight back into the price your trade just created.

Their profit is the gap between where the price sat and where you filled, and your loss is that same number to the lamport. Nothing got hacked and no rule was broken here, because transaction ordering inside a block is simply a resource that people are free to compete for.

Why your slippage setting is the whole story

The attack only works if your transaction accepts the worse price.

Slippage is the maximum move you'll tolerate before the trade reverts. Set it at 30% and you've told the network you'll accept a fill up to 30% worse than quoted, which is precisely the room an attacker needs to work in. Set it at 3% and the same attack pushes you 3% before your transaction fails outright.

So who decides how much gets taken? Not the attacker. Your setting does. What is slippage covers the practical numbers, and this is the single reason it matters more than people assume.

Solana specifics

Two things make it different from Ethereum.

There's no public mempool in the same sense, so attackers work through validator connections and staked RPC relationships rather than by watching a shared queue. Harder, and it still happens.

Blocks are also fast, around 400 milliseconds, which compresses the whole thing into a window you'd never notice. You see one fill. The three-transaction structure only appears if you go looking at the block.

Checking whether it happened

Open your transaction in Solscan and look at what shared the block.

What you see	What it means
Unknown buy before, same address selling after	Sandwiched
Just your trade, price moved anyway	Ordinary curve movement
Several buys around yours, no matching sells	Busy coin, not an attack

That middle row catches most people. On a bonding curve, a 4 SOL buy genuinely moves the price by itself, and no attacker is required for that. Why early buys move the price covers the arithmetic, and how to read a Solana transaction covers finding the surrounding activity.

What reduces exposure

Four things, in order of how much they help:

Tighter slippage. Try 3 to 5% on a liquid pool, higher only when the trade genuinely needs it
Smaller orders. Splitting 10 SOL into 4 pieces makes each one less worth attacking
Avoiding obvious moments. Large buys during a visible spike are the most attractive targets there are
A wallet with MEV protection. Some route transactions in ways that reduce exposure, though nothing eliminates it

Failed transactions are the cost of the first one. A reverted trade costs you around 0.00001 SOL in fees. A sandwiched trade at 30% slippage costs a hundred times that or worse.

Does it affect your coin as a creator?

Indirectly, and less than you'd think.

Sandwiches hit individual traders, not the token. What reaches you is the second-order effect: somebody who gets badly filled on your coin quietly decides it's unpleasant to trade and never comes back, and that happens far more often on thin liquidity where the same attack extracts several times as much.

One more argument for depth, then. A pool with real liquidity makes a worse target than a thin one, because the attacker's own buy has to move the price much further to extract the same value. Bonding curve vs AMM covers why depth behaves differently after graduation.

Your slippage setting decides it

A sandwich takes exactly as much as your slippage setting permits. Set it tight, split large orders, and check the block before concluding you were attacked, since ordinary curve movement looks identical from the outside and is far more common.