Relay: API exposed pending routes; ~5,600 users sandwiched
12–26 Sep 2026 (heavier late window): Relay, a cross-chain routing protocol, said an API exposed pending route and status details before execution. MEV searchers used that foresight to sandwich about 5,600 users. 88.
Relay plans automatic reimbursement of about $312k to affected wallets (no claim form) and paid Outputlayer a $50k bounty for the report. Pre-trade privacy and execution integrity failed; this was not a classic bridge TVL drain.
Research snapshot from TokenPost and related public notes.
369 take
If a router or intent API shows the pending path before it lands, searchers can tax users without breaking the bridge itself.
Pulse lesson for any swap / intent / cross-chain UI: treat pending-route endpoints as sensitive; assume public foresight equals worse fills until proven otherwise.
Sources