> ## Documentation Index > Fetch the complete documentation index at: https://docs.blockline.sh/llms.txt > Use this file to discover all available pages before exploring further. # Scan Wallet for Sandwich Attacks > Scan a wallet's recent DEX trades for sandwich attacks. Uses a hybrid ClickHouse/RPC approach: fetches transaction history via RPC, enriches with ClickHouse timing data, and detects sandwich patterns. Submits an async job — poll `/mev/job-status/:jobId` for results. Max 4 days, max ±10 slots. Results cached for 10 minutes. ## OpenAPI ````yaml /api-reference/openapi.json post /mev/check-wallet openapi: 3.0.3 info: title: Blockline MEV Analytics API description: >- Professional MEV analytics API for Solana. Analyze transaction context, detect front-running, identify sandwich attacks, and gain competitive intelligence on Solana MEV activity. version: 1.0.0 contact: name: Blockline Support url: https://blockline.soltop.sh servers: - url: https://api.soltop.sh description: Production API security: - ApiKeyAuth: [] tags: - name: Trade Analysis description: Analyze MEV activity and transaction context - name: Transactions description: Transaction details and metadata - name: Wallets description: Wallet transaction history - name: Data Management description: Backfill and data operations - name: MEV Analysis description: >- Sandwich attack detection: scan wallets, check transactions, and profile attackers (async job queue) - name: Write Locks description: Account write lock contention and hot account analysis paths: /mev/check-wallet: post: tags: - MEV Analysis summary: Scan Wallet for Sandwich Attacks description: >- Scan a wallet's recent DEX trades for sandwich attacks. Uses a hybrid ClickHouse/RPC approach: fetches transaction history via RPC, enriches with ClickHouse timing data, and detects sandwich patterns. Submits an async job — poll `/mev/job-status/:jobId` for results. Max 4 days, max ±10 slots. Results cached for 10 minutes. operationId: checkWallet requestBody: required: true content: application/json: schema: type: object required: - wallet_address properties: wallet_address: type: string description: Wallet address to scan (base58) example: 8ENw3qJSzWGUV31BW5u2YEmsyp9XKjH1FxuwLhhwwMe2 time_range_days: type: integer description: Number of days to analyze default: 1 minimum: 1 maximum: 4 example: 1 slot_window: type: integer description: >- Slot window (±) for detecting attackers. 0 = intra-slot only. default: 4 minimum: 0 maximum: 10 example: 4 responses: '200': description: Job submitted or cached result returned content: application/json: schema: oneOf: - type: object description: Job queued properties: success: type: boolean example: true jobId: type: string example: mev-wallet-check-abc123-1773926565328 status: type: string example: queued message: type: string example: >- Analysis started. Poll /mev/job-status/:jobId for updates. - type: object description: Cached result properties: success: type: boolean example: true data: type: object properties: wallet_address: type: string time_range_days: type: integer slot_window: type: integer trades: type: array items: type: object properties: signature: type: string description: Victim transaction signature slot: type: integer blockTime: type: integer description: Unix timestamp success: type: boolean pools: type: array items: type: object properties: pool_address: type: string pool_label: type: string dex_name: type: string incidents: type: array items: $ref: '#/components/schemas/SandwichIncident' sandwich_detected: type: boolean summary: type: object properties: total_transactions: type: integer description: Total wallet txs in time range total_dex_trades: type: integer description: Number of DEX trades found total_sandwich_attacks: type: integer description: Number of sandwiched trades '400': description: Invalid request content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Invalid request details: wallet_address is required '401': $ref: 02ca5649-c9d9-4a5e-8f26-a133d5c61cc5 '403': $ref: 80776eac-c595-4f19-9646-9d6dc9a6cf2c '429': $ref: cfbde83c-0b04-46b0-b46a-c3a713982079 security: - SupabaseJWT: [] components: schemas: SandwichIncident: type: object properties: attacker_signature: type: string description: Attacker's transaction signature attacker_signer: type: string description: Attacker's wallet address slot: type: integer description: Slot of the attacker's transaction poh_tick: type: string description: PoH tick position (BigInt as string) poh_tick_offset: type: string description: PoH tick distance from victim (negative = before) interaction_type: type: string enum: - sandwich_frontrun - sandwich_backrun description: Type of sandwich leg (only sandwich incidents are returned) pool_address: type: string description: DEX pool where the interaction occurred pool_label: type: string description: Human-readable pool label success: type: boolean description: Whether the attacker's transaction executed successfully Error: type: object properties: error: type: string description: Error message details: oneOf: - type: string - type: array items: type: string description: Detailed error information timestamp: type: string format: date-time description: When the error occurred securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API Key description: >- API Key authentication. Format: `sk_live_xxx` (production) or `sk_test_xxx` (testing). Obtain your API key from the [Blockline Dashboard](https://blockline.soltop.sh/dashboard/api-keys). SupabaseJWT: type: http scheme: bearer bearerFormat: JWT description: >- Supabase JWT authentication. Used for MEV Analysis and Write Locks endpoints. Requires an active subscription (trial, active, or grace_period status). ````