Disambiguate consecutive sandwiches

[henridf]

We ran into one situation with odd in/out sandwich amounts.

The second sandwich is incorrect. That same attacker was busy doing other sandwiches on DVG trades in that block and neighboring blocks, and our detection thought that the closes of the preceding sandwich was an open for the user swap above tx, and the open of the following sandwich was a close for your tx.

• open https://etherscan.io/tx/0x792e7e2280293e941b9f428fc9598fd50e080cf34b7aacca9b7377b3d6cf3877
• user https://etherscan.io/tx/0xa1ad2e15150875f276f8fa37a74eccb386cae4a8e1c9874deedbb2564d43ed7a
• close https://etherscan.io/tx/0xf019fde2c81212452df72f41f435e702dacc6ed49d4763bdd98257bc84f11cc1

This is a bit tricky to fix short of detecting all sandwiches on all users. In the near term, maybe disqualify sandwiches where the input of the close is bigger than the output of the open ? (5.41 vs 4.18).

[henridf]

Another similar example seems to be

on wallet 0x5d4377C603d5B677d797Cb025e777e9b6B106EF0

• https://etherscan.io/tx/0x1d0afc197f0287bf890eb90df4c5e17288148f8dc9517fc6a24ff7d1efef94f4
• https://etherscan.io/tx/0xcf270f6cc0eb8f1b81f961c7a9e3204a6fbd6fd36aea52c7d5c83f90f6bfe3eb
• https://etherscan.io/tx/0x55bb1a6e604319c422416507a76ae2f563798c2b788025a7c7d701e3c2a4abf1

[henridf]

And another:

0xebdb626c95a25f4e304336b1adcad0521a1bdca1

this one appears to be arbs. As @Fiddlekins noted:

I've taken a look at the open and close transactions and both seem to be individual arb attempts (the close actually costing more in gas than it profited) On etherscan it's clearer that any interim tokens are just steps along the way, and checking the state tab confirms that the net result is just shuffling some ETH around