The Big Extraction: A Forensic Leaderboard for Uniswap V3 MEV Activity
Tools
• MEV • UNISWAP • DEX • CEX • BLOCKCHAIN • FORENSICS •
Decentralised exchanges (DEX) do not have a compliance desk, and they do not file suspicious activity reports. What they do have is a public ledger, and that ledger records every trade in enough detail to reconstruct who extracted value from whom, and when. The MEV leaderboard engine presented here is an attempt to impose some analytical structure on that record for the ETH/USDC pool on Uniswap V3.
What the System Measures
Our monitoring system ingests on-chain swap events from Uniswap and asks a straightforward set of questions, resolved per wallet address over rolling daily and weekly windows:
Which Ethereum addresses extracts the most net value after gas costs? The primary ranking metric is net_usdc_after_gas — gross USDC flows minus transaction fees — which is the closest approximation to realised profit available from public data alone.
How consistently did a wallet perform? Win rate measures the fraction of blocks in which a wallet’s mark-to-market equity improved. A wallet with a high win rate and high profit factor is operating a disciplined strategy. A wallet with high total extraction but erratic win rates is likely taking directional risk or running a noisier execution model.
Is the wallet informed by centralised exchange price action? Three CEX-relative metrics answer this. mean_cex_bps_at_trade measures whether trades coincide with directional momentum on Kraken. informed_trade_pct measures what fraction of trades were directionally aligned with that momentum. cex_slippage_bps measures whether the wallet paid more or less than the simultaneous CEX mid-price. Together, these columns separate wallets that are responding to CEX signals — likely arbitrageurs — from wallets trading without that signal, who are often providing the other side of that arbitrage.
Where in the transaction bundle does the wallet appear? Average log index is a structural indicator. Wallets that consistently appear as the first or second event in a transaction tend to be operating with bundle placement capability, which is the mechanism behind front-running and sandwich attacks.
What is MEV?
Maximal Extractable Value, commonly abbreviated MEV, refers to profit that can be obtained by controlling the ordering of transactions within a block. In a conventional financial market, trade sequencing is managed by exchange infrastructure and subject to regulatory requirements around fair access. On a public blockchain, sequencing is performed by validators who can, within limits, reorder, insert, or exclude transactions to their benefit or the benefit of paying third parties.
The practical result is that certain actors — searchers, in the common terminology — monitor the mempool for pending transactions and either prepend their own transactions to exploit price movements those trades will cause, or wrap victim transactions between two of their own to profit from the price impact. These strategies are not new. Front-running has been documented in equity and commodity markets for decades. The blockchain environment reproduces the same incentive structure with lower barriers to entry and no regulatory oversight.
Uniswap’s constant-product market maker formula makes the price impact of each trade mathematically predictable from public data, which makes the pool a particularly legible target. Every pending swap announces, in effect, the price movement it will cause and the profit available to anyone who can trade ahead of it.
Why Uniswap Functions as a Testing Environment
From a financial intelligence perspective, a high-liquidity AMM pool like ETH/USDC on Uniswap V3 functions as a persistent, permissionless laboratory for extraction strategies. The combination of transparent pending transactions, deterministic pricing, and open block-builder markets means that any approach that works here is likely portable to other venues. Strategies observed on-chain tend to appear first in their crudest form — simple front-runs with a fixed gas premium — and become more sophisticated over time as competition increases.
The adversarial dynamic is also worth noting. Liquidity providers lose money on every trade that an informed arbitrageur executes against them. The leaderboard surfaces this asymmetry: wallets with high informed_trade_pct and positive cex_slippage_bps are systematically extracting from LPs. Wallets with negative slippage and low informed trade percentages are closer to noise traders and are likely losing money to the arbitrageurs they interact with. The pool does not distinguish between these participants; the ledger does.
Forensic Utility
The immediate outputs — two ranked CSVs, one daily and one weekly — are usable as a starting point for further investigation. Wallet addresses that appear consistently at the top of the net extraction ranking across multiple windows warrant examination of their deployment patterns, associated smart contracts, and funding sources. Addresses with persistently low average log index values and high informed trade percentages are strong candidates for entities with privileged block-builder relationships.
The separation of wallets below a minimum trade threshold into a low-activity file is a deliberate analytical decision. Wallets with fewer than twenty trades in a window produce metrics with wide confidence intervals. Including them in a ranked list would obscure genuine signal with noise, and treating them separately allows for a different investigative lens — a single high-extraction trade from a wallet with no other history is itself a meaningful data point, but it belongs in a different analytical category than a systematic operator running hundreds of trades per week.
The CEX alignment layer is the most analytically substantive component. Without it, on-chain data alone cannot separate informed flow from directional speculation. The comparison against Kraken’s tick history provides an external reference point that is independent of the on-chain data, which makes the resulting metrics more robust to manipulation of on-chain signals.
Limitations
The engine makes several assumptions that bound its conclusions. It assumes zero starting inventory for all wallets, which understates the equity position of wallets with pre-existing ETH holdings. It captures activity in one pool only; wallets operating cross-pool or cross-chain strategies will appear to have lower extraction than they actually achieve. Gas costs are denominated in ETH and converted at execution price, which introduces measurement noise during volatile periods. And the CEX comparison uses Kraken as a single reference venue, which may not reflect the best available price at trade time for all market conditions.
These are known constraints, not flaws in the approach. The leaderboard is a forensic lens on a single data source. Its value is in ranking relative activity and flagging structural patterns, not in producing balance-sheet-accurate profit figures.
The public nature of blockchain data makes this kind of analysis possible. The same transparency that makes decentralised markets legible to researchers also makes them legible to extractors. The leaderboard does not resolve that tension. It quantifies it.
Open-Source On-chain Forensics
The system is a part of our open-source on-chain forensics work, being released here. The data that is processed by the MEV Leaderboard system comes from ETH/USDC pool on Uniswap V3. We previously published a snapshot of our forensics data here, while a sample of raw input data, collected with our collector.py module from eth-wallet-forensics, is available here.
For technical support, feature requests, or enterprise customization options, please contact: kibervarnost@proton.me
clanek057En