When you submit a transaction, it sits in the public mempool before it is mined, visible to everyone. Bots watch that mempool and reorder, insert, or sandwich transactions to extract value. This is MEV, and if you write a contract without thinking about it, you are leaving money on the table for bots to take, and sometimes leaking it from your users. Here is how front-running works and how to design around it.
The mempool is public, and that is the whole problem
Your pending transaction is not secret. Between submission and inclusion, anyone can see exactly what you are about to do: the function, the parameters, the amounts. Bots run sophisticated strategies on this visibility. The three you most need to understand:
Front-running: a bot sees your profitable transaction and submits the same one with a higher gas price so it executes first and takes the profit.
Sandwiching: a bot places one transaction right before yours and one right after, profiting from the price impact your transaction creates.
