Over 2026-09-08 to 2026-09-20 on Ethereum mainnet we reproduced 3,434 sandwich victim fills to the wei, out of 5,231 sandwiches. The losses cluster on wallet dropdown defaults:
1,806 of 3,434 victims —
52.6% — lost one of six round numbers. A sandwich cannot take more than the victim's own
minAmountOut allows: the attacker pushes price until that binds and stops. The
loss is not what the attacker could extract, it is what the trader authorised — which makes
the slippage setting the lever, and the dropdown the attack surface.