Price impact and sandwiches
Every trade moves the price it trades at, and someone else can try to profit from that. This page explains price impact, what a sandwich is, what protects you on GIWA and in GAMA's order books, and the one risk that remains for large orders in thin markets.
Price impact
Price impact is how far your own trade moves the price. A buy pushes the price up as it fills, so the last part of a large buy costs more than the first. The smaller the market, the bigger the move: a launch early on its curve or a pool with little liquidity moves much more than a deep pool.
- Before a swap, the app shows Price impact, including fees.
- A DCA order tells you how much each buy moves the price: "Each buy moves the price about X%."
- Your slippage sets the minimum you receive. If the price moves past it before your trade is included, the trade fails instead of filling at a worse price.
By default the app sets slippage for you: 3% on a curve and 0.5% in a pool, a little more when the trade itself moves the price a lot. It warns you when you set more than 5%: "High slippage can make your trade fill at a much worse price." See Slippage and price impact.
What a sandwich is
A sandwich is a trade wrapped around yours: someone buys just before your buy, so you pay a higher price, then sells just after it at the price your buy pushed up. Their profit is your loss.
On chains with a public waiting room for transactions, attackers watch for pending swaps and wrap trades around them. GIWA has no public mempool: transactions go straight to GIWA's sequencer, which puts them in order, higher priority fees first. Other users cannot see your swap before it is included, so they cannot aim a trade at it.
That does not freeze the price for you. Other trades can still land between your quote and your transaction, and anyone can trade right after yours. Your slippage limit is what bounds how much worse your price can be.
Market orders: what protects them
A DCA order buys on a schedule that anyone can read, so GAMA's order books add their own protections. A security review of the earlier order books showed that, without them, a market order could be sandwiched for more than half of one buy. The current release fills orders this way:
- Only keepers and you. Only GAMA's keepers and the order's owner can fill an order. A stranger cannot choose the moment of your fill.
- A random moment. The keeper fills each interval's buy at a random moment within it.
- A price that one block cannot move. Every curve and canonical pool keeps a three-minute price average, updated only by the first trade of each block. A fill is refused while the price is more than 3% from that average, the price band, and waits until it settles.
- A floor. Each fill is priced at whichever of the current price and the average is worse for you, then your slippage is applied.
- A cap on your own impact. A single fill may move the price by at most about 1%. A larger buy is split into sub-fills within its interval.
- One price per batch. Orders with the same route are filled together in one trade at one price, a batch.
Even a stolen keeper key cannot take more from one fill than the price band, your slippage and the 1% impact allowance. See How orders fill.
The reviewed attack, refused
In the live test on 3 October, a new wallet bought 0.055 test ETH of a fresh launch on its thin curve, moving the price 3.6% while a DCA order was waiting. The wallet's own attempt to fill the order was refused because it is not a keeper. A keeper fill at the pushed price was refused because it was outside the band. The real keeper waited until the price was back within 3% of its average and filled the order 69 seconds later.
What they do not stop
Trading ahead of a large, visible order. Your order's size and interval are public. A large DCA order in a thin market keeps pushing the price up with each buy, even when every fill stays inside the band and the impact cap. Anyone who bought before, and holds while your order buys, can sell afterwards at the higher price.
In the same test, the wallet kept its tokens while the order bought, then sold them about three and a half minutes later for 0.05609 test ETH: a profit of 0.00109, about 2%. The profit came from the order's own buying, not from a manipulated fill. GAMA treats this as the ordinary market impact of a large order in a thin market: orders stay public and are not changed for it.
Other limits:
- Pools without a price average. A route through an ordinary pool has no price average to check. The app then asks you for your own price limit: "Set a price limit: this route goes through a pool without GAMA’s price average."
- Trends pause fills. When the price moves more than 3% from its average and stays there, fills wait. A buy whose interval ends without a fill is skipped and not retried later.
- Older versions. On an older version of GAMA, anyone can fill a market order at a moment they choose. The app warns about such orders and offers to cancel them.
How to protect yourself
- Check Price impact, including fees before every swap. If it is high, trade a smaller amount.
- Keep slippage low, and be wary of anything above 5%.
- Size DCA buys to the market. On a thin curve, use more, smaller buys or a longer interval, so that each buy moves the price little.
- Read the slippage a DCA order shows before you place it: "Each buy fills at the market price, with up to X% slippage." On a route through a pool, Auto grows with each buy's own price impact, so a large buy in a thin pool can allow far more than 5%.
- Set a Price limit on a DCA order if you do not want to buy above a certain price.
- Remember that a large order is visible to everyone while it runs.