When AI Agents Meet MEV: Cross-Chain Arbitrage in the Agentic Economy Wei Ye1 , Jingyan Xu2 , and Yuanhong Wu2 Department of Economics, Fordham University, New York, NY, USA [email protected] 2 Department of Computer and Information Science, Fordham University, New York, NY, USA {jxu246,ywu463}@fordham.edu
arXiv:2609.17897v1 [cs.CR] 15 Sep 2026
1
Abstract. We study cross-chain arbitrage when autonomous AI agents, rather than humans or bots, are the searchers. We model agents as both arbitrage extractors and Maximal Extractable Value targets, derive the optimal trade size for a risk-averse agent under mean-variance utility with stochastic bridge delays, and formalize multi-chain path selection as a belief-weighted online learning problem whose belief estimates converge under a Robbins–Monro schedule. Using 23,000 Uniswap V3 swap events across Ethereum, Arbitrum, and Base, we find that Ethereum–Arbitrum price gaps average 0.044% at 10-second resolution and Arbitrum–Base gaps average 0.013%, so $10,000 trades clear in 63% of L2–L2 windows via CCTP while L1–L2 routes require $50,000 or more for comparable viability. Our adaptive path-selection algorithm outperforms standard baselines by 11% on average, and moderate randomization cuts MEV exposure by over 50% with only modest profit loss. Keywords: Cross-chain arbitrage · MEV · AI agents · DeFi
1
Introduction
By early 2026, autonomous AI agents had completed over 140 million on-chain payments totaling $43 million in USDC, transacting through infrastructure such as Coinbase’s Agentic Wallets and Circle’s Nanopayments. These figures mark the emergence of an agentic economy, in which AI agents act as independent economic participants that initiate transactions and execute financial strategies without human oversight. Yet the intersection of agentic AI and Maximal Extractable Value (MEV) remains unexplored. MEV research models human or bot searchers on a single chain and ignores the behavioral signatures of autonomous agents. Work on agentic payments, in turn, emphasizes portfolio management and yield optimization but overlooks the adversarial execution environment in which every pending transaction is visible and exploitable. The features that make agents effective searchers—speed, cross-chain awareness, and continuous monitoring— also expose their algorithmic regularities to sandwich attacks and front-running.
2
W. Ye et al.
Agents therefore operate simultaneously as MEV extractors and targets, a duality that existing cross-chain MEV models obscure further by abstracting away the transaction costs that often render arbitrage infeasible. This paper bridges agentic AI and cross-chain MEV with five contributions. Agent-aware MEV framework: We model cross-chain MEV with AI agents as economic participants, treating them as both searchers and targets. Optimal arbitrage under uncertainty: We derive the optimal trade size for a risk-averse agent under mean-variance utility, accounting for stochastic bridge delays, price volatility, and transaction costs. Adaptive path selection: We formalize multi-chain path selection as a belief-weighted online learning problem and establish its convergence. Vulnerability analysis: We characterize how deterministic agent behavior amplifies susceptibility to SDA attacks and propose mitigations. Empirical evaluation: Using DeFiLlama price, gas, and bridge data, we calibrate cross-chain price distributions, backtest the adaptive algorithm against baselines, and quantify how transaction costs shrink the set of viable arbitrage opportunities. Three modeling choices are specific to the actors being software agents rather than humans or ad-hoc bots. First, the risk-aversion parameter λ in (7) is a design parameter chosen by the developer, not an estimated behavioral trait, so the comparative statics of (9) are prescriptive: they tell a designer how trade size should scale with configured risk tolerance. Second, agents follow policies that are (near-)deterministic functions of public on-chain state; Section 4 shows that this makes the searcher itself a predictable MEV target—a threat model absent from the human-trader MEV literature—and Section 4.3 quantifies the resulting protection–profitability tradeoff, which only arises for algorithmic actors that can commit to randomization. Third, continuous multi-chain operation motivates online belief updating rather than one-shot optimization. The searcher-side tools are deliberately standard; the contribution is the closed loop between searcher optimization and target-side exposure.
2
Related Work
MEV measurement and mitigation. Daian et al. [3] formalized MEV. Qin et al. [17] quantify on-chain arbitrage, liquidation, and sandwich extraction. Wahrstätter et al. [18] and Heimbach et al. [4] document builder concentration under proposer-builder separation. Heimbach and Wattenhofer [6] construct a sandwich-resistant ordering rule with linear latency overhead; Mancino and Rezzoli [10] show that 2,932 sandwich attacks occurred over two months even on private routing. Cross-chain arbitrage and MEV. Obadia et al. [13] formalize crossdomain MEV. Öz et al. [14] introduce the inventory-based vs. bridge-based (SIA/SDA) distinction; their follow-up [15] measures 242,535 cross-chain arbitrages worth $868.64M across nine chains, with SIA settling in 9 s versus 242 s for SDA. Li et al. [7] identify cross-chain sandwich attacks extracting $5.27M in two months. Heimbach et al. [5] analyze non-atomic execution risk; Milionis
AI Agents and Cross-Chain MEV
3
et al. [12] bound arbitrage profits in AMMs with fees; Li et al. [9] characterize MEV under greedy sequencing. Autonomous agents on blockchain. Alqithami [1] surveys 3,000+ agentblockchain integrations and identifies four architectural patterns. Xu [19] proposes a layered economy for autonomous agents. Li et al. [8] extend the x402 payment standard with atomic service channels. Marino and Juels [11] catalog attack vectors when agents hold on-chain wallets. This work. Existing cross-chain MEV models assume human or bot searchers and abstract away transaction costs; existing agentic-blockchain work treats the execution environment as benign. We close both gaps: we model autonomous agents as risk-averse cross-chain searchers with explicit gas and bridge costs, prove convergence of an online path-selection rule, and characterize agents’ dual exposure as MEV targets.
3
Cross-Chain Arbitrage Model
3.1
System Model and Problem Setup
Consider a set of N blockchains B = {B1 , B2 , . . . , BN }, each hosting one or more DEXs. An autonomous AI agent α monitors token prices across all chains and seeks to extract profit through cross-chain arbitrage. For a given token pair (A, B), let pi (t) denote the price of token A in terms of token B on blockchain Bi at time t. Throughout, we fix a single token pair (A, B) and suppress it from A/B the notation; pi (t) thus abbreviates pi (t). The agent α is characterized by the following: A wallet state wi (t) representing the agent’s token holdings on each chain Bi ; A risk aversion parameter λ > 0 governing the agent’s tolerance for price uncertainty; A belief vector ρ̂(t) = (ρ̂ij (t)) representing the agent’s estimated success probability for each cross-chain path (i, j). When the agent executes arbitrage between blockchains Bi and Bj , it exchanges x units of token B for token A on chain Bi , then sells token A on chain Bj after bridging. This operation incurs two types of costs: Gas fees for on-chain swaps, denoted cgas (t); Bridging fees for cross-chain asset transfer, denoted cbridge (t + τij ), where τij is the delay for bridging from Bi to Bj . The total transaction cost is: c(t) = cgas (t) + cbridge (t + τij ).
(1)
The agent’s single-period profit from arbitraging x units of token B from chain Bi to chain Bj is: πij (x, t) =
x · E[pj (t + τij )] − x − c(t), pi (t)
(2)
where x/pi (t) is the quantity of token A obtained on chain Bi , and E[pj (t + τij )] is the expected price of token A on chain Bj at the time the bridged assets arrive.
4
W. Ye et al.
In a multi-period setting, the agent’s decision at each time t is whether to execute arbitrage or wait. The value function satisfies: max πij (x, t) + δ E[Vt+τij ] , (i,j)∈P Vt (st ) = max (3) δ E[V (s )] t+1 t+1 where P ⊆ {(i, j) | i ̸= j} is the set of valid cross-chain paths, δ ∈ (0, 1) is the discount factor, and st encodes the market state. 3.2
Optimal Trade Size under Uncertainty
The agent cannot observe pj (t + τij ) at the time of execution due to the bridging delay. Assume the future price follows: pj (t + τij ) ∼ N (µj , σj2 ),
(4)
where µj and σj2 are the mean and variance of the destination chain price, which the agent estimates from historical data. Substituting into (2), the expected profit is: E[π] =
x · µj − x − c(t), pi (t)
(5)
and the variance of profit is: Var(π) =
x pi (t)
2
· σj2 .
(6)
A risk-averse agent maximizes mean-variance utility: U (x) = E[π] −
λ xµj λ x2 σj2 · Var(π) = − x − c(t) − · . 2 pi (t) 2 pi (t)2
(7)
Taking the first-order condition: λσj2 x µj ∂U = −1− = 0. ∂x pi (t) pi (t)2
(8)
Solving for x yields the optimal trade size: pi (t) µj − pi (t) x = . λσj2 ∗
(9)
The optimal trade size x∗ is increasing in the expected price gap (µj − pi (t)) and decreasing in both the risk aversion λ and the price volatility σj2 . In the limiting case λ → 0, x∗ → ∞, reflecting that a risk-neutral agent would trade without bound as long as µj > pi (t). For AI agents, λ can be interpreted as a configurable parameter that governs how aggressively the agent trades.
AI Agents and Cross-Chain MEV
5
Arbitrage Threshold Condition. Arbitrage is profitable only if πij (x, t) > 0. Rearranging (2) yields a necessary condition: c(t) E[pj (t + τij )] > pi (t) 1 + . (10) x This condition reveals a fundamental frictions–arbitrage tradeoff. Higher transaction costs c(t) or smaller trade sizes x require a larger price gap to justify arbitrage. For AI agents operating with limited wallet balances, this threshold may exclude many opportunities that are viable for well-capitalized searchers. Conversely, agents that can aggregate capital across chains or batch transactions can lower the effective c(t)/x ratio. 3.3
Adaptive Path Selection
In a multi-chain environment, the agent must choose which path (i, j) to use at each time step. This is an online decision problem: the agent does not know in advance which paths are reliable, and must learn from experience while continuing to exploit its current knowledge. Belief Update Mechanism. The agent maintains a belief ρ̂ij (t) ∈ [0, 1] for each path (i, j), representing the estimated probability that arbitrage on that path will succeed (i.e., yield positive profit). Let η ∈ (0, 1) be the learning rate. After each attempt, beliefs are updated as follows. If the arbitrage succeeds (positive profit): ρ̂ij (t + 1) = ρ̂ij (t) + η 1 − ρ̂ij (t) . (11) If the arbitrage fails (negative profit or execution failure): ρ̂ij (t + 1) = ρ̂ij (t) − η ρ̂ij (t) = (1 − η)ρ̂ij (t).
(12)
The agent selects the path that maximizes belief-weighted expected profit: (i∗ , j ∗ )t = arg max {ρ̂ij (t) · πij (x∗ , t) + δ · E[Vt+1 (st+1 )]} .
(13)
(i,j)∈P
In practice, the continuation value E[Vt+1 ] is difficult to compute exactly. A myopic approximation drops the continuation term: (i∗ , j ∗ )t = arg max {ρ̂ij (t) · πij (x∗ , t)} .
(14)
(i,j)∈P
Algorithm 1 summarizes the complete adaptive path selection procedure. The algorithm uses an ϵ-greedy exploration strategy: with probability ϵ the agent selects a random path to gather information about underexplored routes, and otherwise exploits its current beliefs. This balances exploration and exploitation, connecting to the classical multi-armed bandit framework [2].
6
W. Ye et al.
Algorithm 1: Adaptive Cross-Chain Path Selection Input: Chains B, paths P, learning rate η, risk aversion λ, exploration rate ϵ, horizon T Output: Cumulative profit Π Initialize ρ̂ij ← 0.5 for all (i, j) ∈ P; Π ← 0; for t = 1, . . . , T do Observe {pi (t)}, {cij (t)}; compute x∗ij , πij via (9), (2); if rand() < ϵ then Select (i∗ , j ∗ ) uniformly at random from P; else (i∗ , j ∗ ) ← arg max(i,j) ρ̂ij (t) · πij (x∗ij , t); end Execute on (i∗ , j ∗ ) with size x∗i∗ j ∗ ; observe π real ; if π real > 0 then ρ̂i∗ j ∗ ← ρ̂i∗ j ∗ + η(1 − ρ̂i∗ j ∗ ); else ρ̂i∗ j ∗ ← (1 − η)ρ̂i∗ j ∗ ; Π ← Π + π real ; end return Π;
Proposition 1. Under the belief update rules (11)–(12), if the true success probability ρij of path (i, j) is stationary, and the path is selected infinitely often, then ρ̂ij (t) → ρij as t → ∞. Proof. Let Yt ∈ {0, 1} be the outcome indicator at time t (1 for success, 0 for failure), with E[Yt ] = ρij . The update rule can be written as: ρ̂ij (t + 1) = (1 − η)ρ̂ij (t) + ηYt .
(15)
This is an exponential moving average with smoothing parameter η. Taking expectations in steady state, E[ρ̂ij ] = (1−η)E[ρ̂ij ]+ηρij , which gives E[ρ̂ij ] = ρij . η ρij (1 − ρij ), which decreases as The variance of the estimator is Var(ρ̂ij ) = 2−η P η →P 0. Thus, with a decaying learning rate schedule ηt → 0 satisfying ηt = ∞ and ηt2 < ∞, the estimator converges almost surely to ρij by the Robbins– Monro theorem. ⊓ ⊔
4
Agent Vulnerability to MEV Attacks
We now examine the agent as a target rather than a searcher of MEV. 4.1
Agent Predictability and Exploitation
Traditional MEV targets are human traders whose behavior contains noise from emotional decisions, variable timing, and inconsistent trade sizes. AI agents, by contrast, follow deterministic or near-deterministic policies. An agent that checks prices every ∆t seconds, trades whenever the price gap exceeds a threshold θ,
AI Agents and Cross-Chain MEV
7
and uses a fixed trade size x∗ from (9) generates a transaction pattern that is observable and learnable by an adversary. Let Ht = {(tk , xk , ik , jk )}tk=1 denote the history of the agent’s transactions up to time t, where each entry records the timestamp, trade size, source chain, and destination chain. An MEV attacker observing Ht can attempt to predict the agent’s next transaction (tt+1 , xt+1 , it+1 , jt+1 ). Define the attacker’s prediction accuracy as: h i A(t) = Pr t̂t+1 ≈ tt+1 , ît+1 = it+1 , (16) where t̂t+1 and ît+1 are the attacker’s predictions. For a fully deterministic agent, A(t) → 1 as t grows, since the attacker can learn the agent’s policy exactly from observed history. Sandwich Attack on Cross-Chain Agents. Suppose the agent submits a swap of size xα on a DEX, exchanging token B for token A at initial price p0 . An attacker who predicts this transaction sandwiches it: a front-run buy of xa units of token A pushes the price to p1 = p0 + ∆pfront , the agent’s swap then executes at the inflated p1 , and a back-run sell of xa units at p2 = p1 + ∆pagent closes the position. The attacker’s profit is: πsand = xa (p2 − p0 ) − cgas − b,
(17)
where b is the bribe or priority fee paid to secure the desired transaction ordering. The agent’s loss from being sandwiched is the difference between the price it would have received without the attack and the actual execution price: Lα = xα · ∆pfront /p0 .
(18)
For agents executing cross-chain arbitrage, this loss directly reduces the arbitrage profit πij from (2), potentially turning a profitable opportunity into a net loss. Cross-Chain Predictive Front-Running. In a cross-chain setting, an additional attack vector arises. When an agent initiates a bridge transfer on chain Bi , this transaction is visible on-chain before the assets arrive on chain Bj . An attacker monitoring chain Bi can detect the bridge transaction, infer the agent’s intended trade on chain Bj , and pre-position on chain Bj before the bridged assets arrive. Let τij be the bridge delay. The attacker’s information advantage window is exactly τij : the attacker knows the agent’s intent on chain Bj a full τij seconds before the agent can act. The attacker’s expected profit from predictive frontrunning is: πpred = xa · E[∆p | bridge detected] − cpos , (19) where cpos is the cost of pre-positioning on chain Bj .
8
W. Ye et al.
This attack is more severe for bridge-based arbitrage ([15] report averages of 242 seconds of latency) than for inventory-based arbitrage (averaging 9 seconds), as longer delays give the attacker more time to act. 4.2
Mitigation Strategies
We propose three strategies that an AI agent can employ to reduce its MEV exposure. Transaction Timing Randomization. Instead of executing at fixed intervals ∆t, the agent adds random noise to its execution timing: texec = tplanned + ξ,
ξ ∼ Uniform(−δt , δt ),
(20)
where δt controls the noise magnitude. This reduces the attacker’s ability to predict when the agent will transact. However, large δt may cause the agent to miss time-sensitive arbitrage windows, creating a tradeoff between protection and profitability. Trade Size Perturbation. The agent perturbs its trade size around the optimal x∗ : xexec = x∗ + ζ, ζ ∼ N (0, σx2 ), (21) subject to xexec > 0. Since the attacker’s sandwich profit in (17) depends on correctly anticipating the agent’s trade size to calibrate xa , perturbation reduces the attacker’s expected gain. The agent’s utility loss from deviating from x∗ is bounded by: λσj2 U (x∗ ) − E[U (x∗ + ζ)] = · σ2 , (22) 2pi (t)2 x which follows from the quadratic form of the utility function (7). The agent can choose σx2 to balance protection against utility loss. MEV-Aware Bridge Selection. The agent can incorporate MEV risk into its path selection by modifying the decision rule in (14). Define mij (t) as the estimated MEV exposure on path (i, j), based on historical sandwich frequency or the bridge’s information leakage properties. The MEV-aware path selection rule becomes: (i∗ , j ∗ )t = arg max {ρ̂ij (t) · πij (x∗ , t) − mij (t)} .
(23)
(i,j)∈P
This rule penalizes paths with high MEV exposure. An agent using this rule may choose a path with a slightly lower expected profit but significantly lower attack risk. In practice, mij (t) can be estimated from on-chain data by counting sandwich events on each DEX or measuring the frequency of front-running on specific bridge protocols.
AI Agents and Cross-Chain MEV
4.3
9
Protection-Profitability Tradeoff
The three mitigation strategies above share a common structure: each introduces noise or constraints that reduce the agent’s predictability at the cost of some expected profit. We can formalize this tradeoff. Let ϕ ∈ [0, 1] represent the agent’s overall protection level, where ϕ = 0 is a fully deterministic agent and ϕ = 1 is a maximally randomized agent. The agent’s effective utility is: Ueff (ϕ) = (1 − ϕ) · U (x∗ ) + ϕ · U (x∗ ) − Lnoise (ϕ) + ϕ · S(ϕ), (24) where Lnoise (ϕ) is the utility loss from randomization and S(ϕ) is the savings from avoided MEV attacks, which increases with ϕ. The optimal protection level ϕ∗ balances these two forces. In competitive MEV environments where multiple attackers monitor agent behavior, the marginal benefit of protection S ′ (ϕ) is high, favoring aggressive randomization. In low-competition environments, the agent may prefer minimal protection to maximize raw arbitrage profit.
5
Empirical Evaluation
We evaluate our models using two complementary data sources: (i) six months of aggregate market data from DeFiLlama for parameter calibration, and (ii) 23,000 tick-level Uniswap V3 swap events across Ethereum, Arbitrum, and Base spanning five trading days for direct observation of cross-chain price gaps. We first describe the data and calibration, then characterize real cross-chain price gaps, and finally present three simulation experiments: arbitrage threshold analysis, adaptive path selection, and agent predictability. 5.1
Data and Calibration
We collect four datasets from DeFiLlama covering the period September 2025 to March 2026 (six months): Daily OHLCV prices for WETH/USDC, WBTC/USDC, ARB/USDC, and OP/USDC; Daily gas fees for Ethereum, Arbitrum, Base, and Optimism; Daily bridge volume for Across, Stargate, and Hop Protocol; Daily DEX volume for 30 chains. In addition, we collect 23,000 individual Uniswap V3 swap events for the WETH/USDC pair across three chains: Ethereum (3,000 swaps across the 0.01%, 0.05%, and 0.30% fee-tier pools on March 23, 2026), Arbitrum (10,000 swaps across 0.01% and 0.05% pools), and Base (10,000 swaps across 0.01% and 0.05% pools). The L2 data spans five days across two periods (February 22–25 and March 23, 2026), with timestamps at second-level resolution. This dataset enables direct observation of cross-chain price gaps at the granularity relevant to arbitrage execution and allows us to verify consistency across multiple trading days. A key empirical challenge is that cross-chain price discrepancies at the daily level are negligible, as arbitrage bots close gaps within milliseconds. Following [15], we adopt a calibrated simulation approach: we extract distributional
10
W. Ye et al. Table 1. Calibrated parameters from DeFiLlama data. Panel A: Token Volatility Token p̄ σ̂
Panel B: Chain Fees (USD/day) Chain Mean Median
WETH/USDC 3,019 WBTC/USDC 90,039 ARB/USDC 0.22 OP/USDC 0.32
Ethereum 668,354 Base 201,367 Arbitrum 45,049 Optimism 4,844
0.0374 0.0263 0.0542 0.0581
438,810 136,604 23,123 2,334
Panel C: Bridge Volume (USD) Panel D: DEX Volume (USD) Across: 47,491,067 Ethereum: 2,235,832,499 Stargate: 36,518,438 Base: 1,121,527,914 Hop: 4,023 Arbitrum: 581,000,984 Optimism: 34,905,833
parameters from real data and use them to generate realistic arbitrage scenarios. We estimate daily price volatility using the Parkinson estimator [16], which uses intraday high–low range: " 2 # 1 H 2 σ̂ = · E ln , (25) 4 ln 2 L where H and L are the daily high and low prices. Table 1 reports the calibrated parameters. Two observations from Table 1 are worth noting. First, L2 native tokens (ARB, OP) exhibit nearly twice the daily volatility of major assets (WETH, WBTC), implying larger intraday price gaps and more frequent arbitrage windows. Second, gas fees differ by over two orders of magnitude across chains: Ethereum averages $668K/day in total fees while Optimism averages only $4.8K, directly affecting the threshold condition in (10). For the simulation experiments, we model instantaneous cross-chain price gaps using a log-normal distribution: ∆p ∼ LogNormal(ln(0.03), 1.2),
(26)
with a median gap of 0.03% of price, calibrated from the Uniswap V3 swap data (Section 5.2). This right-skewed specification captures the empirical pattern where the median Ethereum–Arbitrum gap is 0.031% but the 90th percentile reaches 0.086% and extreme values exceed 0.4%. 5.2
Empirical Cross-Chain Price Gaps
Before turning to simulation experiments, we use the Uniswap V3 swap data to directly characterize cross-chain price gaps. We aggregate swap-level execution prices into 10-second bins per chain, compute the mean execution price per bin,
AI Agents and Cross-Chain MEV
11
and measure the absolute percentage difference between chains for bins where both chains have at least one swap. This yields 112 simultaneous observations for the Ethereum–Arbitrum pair (limited to the 28-minute overlap window on March 23) and 954 for Arbitrum–Base (spanning five days of trading). Table 2 reports the cross-chain gap statistics. The Ethereum–Arbitrum pair exhibits a mean gap of 0.044% (median 0.031%), with the 90th percentile at 0.086% and extreme values reaching 0.479%. These gaps are economically significant: at a $50,000 trade size with realistic costs ($5.25 including Ethereum gas and bridge fees), 80% of 10-second windows present a profitable arbitrage opportunity. For the Arbitrum–Base pair, the five-day dataset reveals a mean gap of 0.013% (median 0.010%), consistent across all five observed days (daily means range from 0.010% to 0.015%). Despite these smaller gaps, the dramatically lower L2 execution costs ($0.70–$1.20 per trade) mean that at $10,000 trade size via CCTP, 63% of windows are viable. Table 2. Cross-chain price gap statistics (%, WETH/USDC). Pair
N
Med. Mean P90 Max
Cross-chain ETH–ARB ARB–Base
112 954
.031 .010
.044 .086 .013 .027
.479 .077
Intra-chain (different fee tier) ETH .01%–.05% 267 .040 ARB .01%–.05% 400 .030
.049 .088 .027 .041
.564 .089
Figure 1 visualizes the results. Panel (a) shows execution prices across all observation periods, covering a $1,850–$2,150 price range across five trading days. Panel (b) compares the gap distributions via box plots: the ETH–ARB pair (L1–L2, N = 112) exhibits wider gaps with heavier tails than ARB–Base (L2– L2, N = 954). Panel (c) shows the cumulative distribution function, highlighting that the median ETH–ARB gap (0.031%) is roughly three times the ARB–Base median (0.010%). Panel (d) quantifies arbitrage viability as a function of trade size under realistic cost assumptions: for ETH–ARB at $5.25 total cost, trades below $5K are rarely viable, whereas ARB–Base via CCTP at $0.70 reaches 63% viability at $10K. Two findings from this analysis are noteworthy. First, the Ethereum–Arbitrum cross-chain gap (mean 0.044%) is comparable in magnitude to the intra-chain gap between different fee tiers on Ethereum (mean 0.049%), suggesting that cross-chain price dispersion is driven more by execution timing and information latency than by fundamental market segmentation. Second, the L2–L2 gap (Arbitrum–Base, mean 0.013%) is roughly one-third of the L1–L2 gap, consistent with the shorter bridge delays between L2 chains reported by [15]. Importantly, the ARB–Base gap is stable across all five observed trading days (daily means: 0.010%, 0.013%, 0.013%, 0.014%, 0.015%), spanning a period in which ETH
12
W. Ye et al.
Fig. 1. Cross-chain price gaps from Uniswap V3 swap events. (a) Execution prices across chains. (b) Gap distribution by chain pair. (c) Cumulative distribution of gaps. (d) Fraction of viable arbitrage windows by trade size and cost scenario.
prices ranged from $1,850 to $2,150. This consistency across market conditions strengthens the case that cross-chain price gaps are a structural feature of multichain DEX liquidity rather than a transient artifact. These observations validate the model’s prediction in (10) that cross-chain arbitrage viability is determined by the gap-to-cost ratio rather than the absolute gap size.
5.3
Experiment 1: Arbitrage Threshold Analysis
This experiment evaluates the threshold condition from (10) under realistic cost parameters. We generate 50,000 price gap samples from the calibrated log-normal distribution and compute the fraction of gaps that exceed the cost threshold c(t)/x for each chain and trade size. Figure 2 presents the results. Panel (a) shows that on Ethereum, trade sizes below $25,000 yield almost no viable opportunities due to high gas costs, while on Optimism and Base, even $1,000 trades produce viable arbitrage in 30–40% of simulated gaps. Panel (b) compares the log-normal gap distribution (median 0.03%, calibrated from swap data) against a naive normal assumption, showing that the log-normal model produces a heavier right tail. Panel (c) reports a sensitivity analysis: we vary the assumed median gap from 0.01% to 0.5%, marking the empirically observed median (0.03%), and find that the qualitative ranking across chains is stable. L2 chains remain viable at 10–100× smaller trade sizes than Ethereum regardless of the gap assumption.
AI Agents and Cross-Chain MEV
13
Fig. 2. Arbitrage threshold analysis. (a) Fraction of viable opportunities by trade size and chain. (b) Log-normal vs. normal gap distribution. (c) Sensitivity to median gap assumption at $10K trade size. Table 3. Strategy performance (100 runs, 180 days). Strategy Random Greedy ϵ-Greedy Adaptive (ours)
Mean Profit Std
95% CI
−135 345 [−764, 566] 2,367 697 [944, 3,604] 2,242 586 [1,094, 3,458] 2,627 560 [1,738, 3,706]
This result has a direct implication for agent design: agents with limited capital should prioritize L2 chains where the cost-to-trade-size ratio is favorable, consistent with the path selection framework in Section 3. 5.4
Experiment 2: Adaptive Path Selection
We simulate 180 days of cross-chain arbitrage across four chains (12 directed paths) and compare four strategies: Random: selects a path uniformly at random each day; Greedy: selects the path with the highest estimated net profit based on current price gaps and costs; ϵ-Greedy: tracks empirical mean reward per path, exploits the best with probability 1 − ϵ and explores randomly with probability ϵ = 0.1; Adaptive (ours): the belief-weighted algorithm from Algorithm 1 with η = 0.1 and ϵ = 0.1. Daily returns are computed using real volatility data from the WETH/USDC OHLCV series and calibrated per-chain gas costs. Each path has a latent success probability drawn from a structured distribution where lower-cost paths tend to have higher success rates, reflecting the empirical finding that L2 paths are more reliable [15]. To ensure robustness, we run 100 independent trials, each with a different draw of latent success probabilities. Table 3 reports the results. The Adaptive strategy achieves the highest mean profit ($2,627), outperforming Greedy in 57 of 100 runs and ϵ-Greedy in 69 of 100 runs. Notably, the Random strategy loses money on average (−$135), confirming that naive path selection is insufficient when cross-chain gaps are small
14
W. Ye et al.
Fig. 3. Adaptive path selection. (a) Cumulative profit by strategy (100 runs, shaded region = IQR). (b) Sensitivity to learning rate η (error bars = 1 std).
relative to costs. The Adaptive strategy’s advantage is most pronounced when latent path success probabilities are heterogeneous, as the belief-update mechanism allows the agent to identify and concentrate on high-quality paths. When success probabilities are similar across paths, all informed strategies perform comparably, explaining why Adaptive does not dominate in every run. Figure 3(a) shows cumulative profit curves with interquartile ranges. The Adaptive strategy not only achieves higher terminal profit but also exhibits lower variance, reflecting the stabilizing effect of belief-weighted decisions. Figure 3(b) reports the sensitivity of the Adaptive strategy to the learning rate η. Performance is stable across η ∈ [0.05, 0.3], with degradation at extreme values: η = 0.01 learns too slowly, while η = 0.5 overreacts to individual outcomes. 5.5
Experiment 3: Agent Predictability and Protection
This experiment evaluates the vulnerability analysis from Section 4. We simulate an agent executing periodic trades with a base strategy (trade every ∼10 periods, size ∼$10,000), and vary the protection level ϕ ∈ {0, 0.2, 0.4, 0.6, 0.8, 1.0} by adding increasing noise to timing, trade size, and path selection. An attacker observes the agent’s last 20 trades and predicts the next trade’s timing and path using median-based and majority-vote heuristics. We run 30 independent trials for each ϕ level. Table 4 reports the attacker’s prediction accuracy. At ϕ = 0 (fully deterministic agent), the attacker achieves 100% joint prediction accuracy. Introducing moderate randomization (ϕ = 0.4) reduces joint accuracy to 54.2%, and at ϕ = 0.8 it drops to 16.0%. Path prediction is harder to disrupt than timing prediction, as the agent’s preferred paths are more stable than its execution timing. Figure 4(a) visualizes the smooth degradation of attacker accuracy across all three metrics. Figure 4(b) presents the protection-profitability tradeoff predicted by (24): as ϕ increases, MEV protection improves (red line) but arbitrage profit
AI Agents and Cross-Chain MEV
15
Table 4. Attacker prediction accuracy vs. protection level. ϕ 0.0 0.2 0.4 0.6 0.8 1.0
Joint (%)
Timing (%)
Path (%)
100.0 88.0 54.2 29.3 16.0 7.6
100.0 96.1 64.0 42.9 31.6 25.6
100.0 91.6 83.5 68.3 52.5 31.4
Fig. 4. Agent predictability. (a) Attacker accuracy vs. protection level (30 runs, error bars = 1 std). (b) Protection-profitability tradeoff: profit (left axis) and MEV protection (right axis) as functions of ϕ.
decreases (green line). The curves cross near ϕ ≈ 0.4–0.6, suggesting that moderate randomization offers the best balance between protection and profitability for a risk-averse agent.
6
Conclusion
This paper formalizes the intersection of autonomous AI agents and cross-chain MEV, treating agents as both arbitrage searchers and MEV targets. We validate the framework using 23,000 tick-level Uniswap V3 swap events across Ethereum, Arbitrum, and Base over five trading days, supplemented by simulations calibrated to DeFiLlama market data. Three findings stand out. Transaction costs dominate cross-chain arbitrage viability: Ethereum–Arbitrum price gaps average 0.044% at 10-second resolution while Arbitrum–Base gaps average 0.013% (σ = 0.002%), so once gas costs are netted, $10,000 trades clear in 63% of L2–L2 windows via CCTP, whereas Ethereum–Arbitrum routes require $50,000 or more for comparable viability. The adaptive path selection algorithm outperforms standard baselines by 11% on average—most strongly when path quality is heterogeneous—and is robust to learning rates η ∈ [0.05, 0.3]. Moderate randomization (ϕ ≈ 0.4–0.6) cuts MEV
16
W. Ye et al.
exposure by over 50% with only a modest profit loss, indicating that designers should calibrate unpredictability to the competitive intensity of the environment rather than maximize it. Future work includes scaling L1–L2 data collection to weeks for formal distributional estimation, and extending the framework to multi-agent strategic settings with AMM-specific price impact [1,11].
References 1. Alqithami, S.: Autonomous agents on blockchains: Standards, execution models, and trust boundaries. arXiv preprint arXiv:2601.04583 (2026) 2. Auer, P., Cesa-Bianchi, N., Fischer, P.: Finite-time analysis of the multiarmed bandit problem. Machine learning 47(2), 235–256 (2002) 3. Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach, L., Juels, A.: Flash boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability. In: 2020 IEEE symposium on security and privacy (SP). pp. 910–927. IEEE (2020) 4. Heimbach, L., Kiffer, L., Ferreira Torres, C., Wattenhofer, R.: Ethereum’s proposerbuilder separation: Promises and realities. In: Proceedings of the 2023 ACM on Internet Measurement Conference. pp. 406–420 (2023) 5. Heimbach, L., Pahari, V., Schertenleib, E.: Non-atomic arbitrage in decentralized finance. In: 2024 IEEE Symposium on Security and Privacy (SP). pp. 3866–3884. IEEE (2024) 6. Heimbach, L., Wattenhofer, R.: Eliminating sandwich attacks with the help of game theory. In: Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security. pp. 153–167 (2022) 7. Li, C., Sun, Z., Yuu, J.X., Wang, X.: The walls have ears: Unveiling cross-chain sandwich attacks in defi. arXiv preprint arXiv:2511.15245 (2025) 8. Li, Y., Wang, L., Wang, K., Yang, Z., Wang, K., Guan, Z., Gao, J.: A402: Bridging web 3.0 payments and web 2.0 services with atomic service channels. arXiv preprint arXiv:2603.01179 (2026) 9. Li, Y., Zhang, M., Li, J., Chen, E., Chen, X., Deng, X.: Mev makes everyone happy under greedy sequencing rule. In: Proceedings of the 2023 Workshop on Decentralized Finance and Security. pp. 9–15 (2023) 10. Mancino, D., Rezzoli, D.: Sandwiched and silent: Behavioral adaptation and private channel exploitation in ethereum mev. arXiv preprint arXiv:2512.17602 (2025) 11. Marino, B., Juels, A.: Giving ai agents access to cryptocurrency and smart contracts creates new vectors of ai harm. arXiv preprint arXiv:2507.08249 (2025) 12. Milionis, J., Moallemi, C.C., Roughgarden, T.: Automated market making and arbitrage profits in the presence of fees. In: International Conference on Financial Cryptography and Data Security. pp. 159–171. Springer (2024) 13. Obadia, A., Salles, A., Sankar, L., Chitra, T., Chellani, V., Daian, P.: Unity is strength: A formalization of cross-domain maximal extractable value. arXiv preprint arXiv:2112.01472 (2021) 14. Öz, B., Ferreira Torres, C., Gebele, J., Rezabek, F., Mazorra, B., Matthes, F.: Pandora’s box: Cross-chain arbitrages in the realm of blockchain interoperability. arXiv e-prints pp. arXiv–2501 (2025)
AI Agents and Cross-Chain MEV
17
15. Öz, B., Torres, C.F., Schlegel, C., Mazorra, B., Gebele, J., Rezabek, F., Matthes, F.: Cross-chain arbitrage: The next frontier of mev in decentralized finance. Proceedings of the ACM on Measurement and Analysis of Computing Systems 9(3), 1–33 (2025) 16. Parkinson, M.: The extreme value method for estimating the variance of the rate of return. Journal of business pp. 61–65 (1980) 17. Qin, K., Zhou, L., Gervais, A.: Quantifying blockchain extractable value: How dark is the forest? In: 2022 IEEE Symposium on Security and Privacy (SP). pp. 198–214. IEEE (2022) 18. Wahrstätter, A., Zhou, L., Qin, K., Svetinovic, D., Gervais, A.: Time to bribe: Measuring block construction market. Cryptology ePrint Archive (2023) 19. Xu, M.: The agent economy: A blockchain-based foundation for autonomous ai agents. arXiv preprint arXiv:2602.14219 (2026)