Router & Multicall Traffic: Read Swap Events, Exclude MEV
tactic
Core idea
Most DeFi activity routes through aggregator routers (1inch, 0x, CoW, Uniswap Universal Router), and a single router tx can wrap multiple swaps across several DEXes. Reading the encoded router calldata directly is rarely useful; instead read the emitted Swap events in order, which give the actual token movement cleanly.
Components
- A single tx to a router can bundle multiple swaps: the encoded router action is complex, so parse the Swap event stream rather than the raw input calldata.
- Read Swap events in order to reconstruct the true token movement through the route.
- MEV exclusion: when swaps are sandwiched by MEV bots, two extra Swap events bracket the victim’s trade; identify and exclude them from attribution of the victim’s funds.
When to use
When a traced transaction hits an aggregator router or contains multicall-style bundled swaps, and when a victim’s trade may have been sandwiched.
Example
A victim swap through Uniswap Universal Router shows three Swap events; the first and third belong to a sandbot bracketing the trade and are excluded, leaving the middle Swap as the victim’s actual token movement.
Related
EVM Event Logs & Decoding Calldata, Reading an EVM Transaction, Filter-by-Size + Scrape + LLM Summarise