Sniper Bot Watcher: Protecting Market-Making Capital from Front-Running Exploits

Market making requires a balance between providing liquidity and protecting capital. The ADAMANT mm bot enables token issuers and exchanges to create dynamic liquidity and trading volume in a controlled, automated way. As markets evolve, however, so do adversaries.

Issue #93 introduced a key defensive upgrade: the Sniper Bot Watcher. This addresses a structural vulnerability that affects nearly all automated market-making strategies — exploitation by ultra-fast external bots.

The weakness of automated market making

Market-making bots often generate volume and maintain spreads by placing orders on both sides of the book. One common mechanism is internal matching: the bot places a maker order inside the spread, then shortly after places a corresponding taker order to fill it, creating legitimate trading activity while preserving inventory balance.

The problem lies in the unavoidable delay between these two steps. Even if extremely small, it exists, and in modern electronic markets milliseconds are enough. External high-speed bots monitor order books in real time and react instantly when new liquidity appears. As soon as the market-making bot publishes its maker order, these bots intercept it before the internal matching order arrives.

Two main exploit patterns emerge. In the first, a third party immediately takes the Buy order, leaving the following Sell order unfilled or partially filled, and the bot loses USDT. In the second, a third party places a higher Buy just above the bot’s order, so the bot’s Sell matches the third party instead, and the bot loses TOKEN. The result is not occasional losses but structural exploitation.

Why traditional defenses are insufficient

It might seem possible to eliminate the delay or adjust execution timing. In practice this is impossible. Exchange APIs have latency, network communication takes time, and even the fastest infrastructure cannot guarantee atomic order placement and execution across external systems. Increasing delays makes exploitation easier; reducing them helps but never eliminates the gap entirely. Randomizing execution timing introduces unpredictability, but sniper bots are adaptive and analyze patterns over time.

What is needed is not faster execution but intelligent detection and response.

Introducing the Sniper Bot Watcher

The Sniper Bot Watcher is a detection and mitigation layer integrated into the ADAMANT mm bot. Its role is not to prevent trading but to monitor behavioral patterns and identify when external bots are exploiting the system. When suspicious activity is detected, the bot can react defensively by adjusting execution behavior, pausing trading strategies, modifying order placement logic, or activating defensive modes designed to reduce exposure.

The following code shows sniper bot activity detection:

} else if (order1Status === 'filled' && order2Status === 'filled') {
  log.info('Trader: Both maker and taker executeInSpread t-orders are self-filled.');

  order.update({
    coin1AmountFilled: coin1Amount,
    coin2AmountFilled: coin2Amount,
    isExecuted: true,
  });
} else if (order1Status === 'filled' && ['new', 'part_filled'].includes(order2Status)) {
  // Scenario1: After maker order is placed in spread, a third party bot quickly takes it, and the taker order remains unfilled or partially filled
  sniperBotActivity(1, order2Details, coin1Amount);

  await addFillsDbRecord(order2Details, order, false); // Maker order is partially or fully filled by a sniper bot

  order.update({
    coin1AmountFilled: order2Details.amountExecuted, // Self-filled amount, excluding sniper bot fills
    coin2AmountFilled: order2Details.volumeExecuted,
    isExecuted: false, // Not fully executed
  });
}

When the intervention count exceeds a threshold, the bot enters Safe mode:

/**
 * Records a sniper-bot intervention for a given scenario.
 * Triggers safe mode when the total interventions reach the threshold.
 * @param {number} scenario Scenario index: 1 or 2
 * @param {OrderInfoResult} orderDetails Exchange order details (e.g., order2Details), for logging only
 * @param {number} coin1Amount Order amount in base coin, for logging only
 * @returns {void}
 */
function sniperBotActivity(scenario, orderDetails, coin1Amount) {
  sbwActivityCounters[scenario]++;

  const fillPercent = (orderDetails.amountExecuted / coin1Amount * 100).toFixed(2);
  log.warn(`Trader: While the maker t-order is filled, the taker is ${orderDetails.status} (${fillPercent}% self-filled). This may be Scenario ${scenario} of third-party bot intervention; incrementing the counters to ${sbwActivityTotalString()} (Safe mode threshold: ${sbwEnabled ? safeModeThreshold : 'Disabled'}).`);

  if (sbwEnabled && sbwActivityTotal() >= safeModeThreshold) {
    sniperBotSafeMode();
    resetSniperBotCounters();
  }
}

Why this matters for token projects

Market making is essential for token ecosystems, but if capital is systematically drained by sniper bots, projects face hidden costs. Liquidity becomes expensive, budgets deplete faster, and market-making effectiveness declines. By introducing the Sniper Bot Watcher, the ADAMANT mm bot helps ensure that market-making resources serve their intended purpose — building markets, not feeding exploiters.