Solana validators accused of selling early trade access for $4,000 a month
Solana validators accused of selling a view of pending trades
An investigation by Andrei Vacariu of Corvus Labs claims that Solana validators are accepting payments to leak early access to trades they receive for block production. According to the findings, validators are allegedly taking payments starting at 10 SOL (about $1,000) a month to give quantitative traders a real-time feed of transactions before they are executed.
Vacariu traced payouts through a blockchain vault and says the trail leads to a service called Blockspace, sold by Everstake for $4,000 a month. Everstake runs one of Solana's larger validators, with about 7.4 million SOL delegated to it, and is led by former Grayscale founding general manager David Kinitsky.
Key numbers in the allegations
- Everstake's private data feed of pending trades reportedly costs $4,000 a month.
- Validators are allegedly offered payments starting at 10 SOL (about $1,000) a month to share early access to trades.
- Everstake is described as an association of 39 validators with more than 50 million SOL staked in total.
- Vacariu says Blockspace's revenue-sharing wallet has disbursed payments to Prostaking, RockawayX, Staking Facilities, and Stake.org.
- Staking Facilities is alleged to have taken more than 950 SOL in such payments since July, while Prostaking allegedly collected over 200 SOL.
How the accused scheme works
Blockspace's service exists because Solana has no public mempool, unlike other blockchains where anyone can see a queue of pending transactions for free. Most Solana transactions travel straight to the validator scheduled to build the next block without waiting in any shared queue.
The original idea behind this design was that only the scheduled validator would see a trade before it executed, which should reduce maximal extractable value (MEV) — the profit that can be made by reordering, inserting, or skipping transactions inside a block. Instead, the investigation claims, MEV chances have concentrated among customers able to pay thousands of dollars for direct access to validators with over 15,000 SOL staked.
Customers allegedly run software that mirrors incoming traffic to Everstake servers before a block exists, then rush through new transactions just before or right after ordinary users' orders. Vacariu says this lets sophisticated traders front-run and sandwich-attack common orders on DeFi (decentralized finance) exchanges — profiting by placing trades around a user's pending order and pricing it worse.
What Everstake says
Everstake has publicly responded, claiming it uses filtering mechanisms specifically designed to prevent this type of activity and that it does not encourage front-running or sandwiching. The company also said other major players in the Solana ecosystem run MEV infrastructure through different architectures, and that its traffic priority is an institutional stake-weighted quality-of-service tier that it repackages through Blockspace.
Vacariu separately claimed that Everstake salespeople are soliciting more validator operators to join the arrangement with offers of over 10 SOL a month. This claim, like the payments themselves, is part of his investigation rather than something Everstake has confirmed.
What is confirmed and what is not
Confirmed: Solana has no public mempool, and transactions are typically sent directly to the validator scheduled to produce the next block. Everstake sells a private pending-trade data feed called Blockspace for $4,000 a month, and its documentation describes how Solana transactions reach validators. Everstake has publicly stated it uses filtering to prevent front-running and sandwiching, and that it does not encourage such activity.
Reported but not independently confirmed: the allegation that validators accept 10 SOL a month or more to leak early trade access, the claim that Everstake salespeople recruit other validators, and the claim that Blockspace payments were disbursed to Prostaking, RockawayX, Staking Facilities, and Stake.org. The dollar amounts tied to specific recipients also come from Vacariu's analysis of wallet activity rather than from admissions by those firms.
Unconfirmed: that the mirrored traffic feed is actually being used to front-run or sandwich specific trades. No source supplied for this article provides evidence of completed front-running tied to the feed; the claim rests on Vacariu's allegations and Everstake's denial.
Why it matters for ordinary Solana users
Vacariu argues the practical effect is that regular users cannot protect themselves. “Every trader on Solana hits these slots, can't tell which leaders mirror their traffic, and can't opt out,” he wrote, referring to the validators chosen to produce blocks.
The broader issue is that a design meant to limit MEV may have moved it behind a paywall instead of removing it. If validators are paid to share a view of pending trades, the advantage shifts to whoever can afford the subscription, while ordinary users have no way to detect which validator is handling their order or to avoid it.
What happens next
The supplied material does not describe any official investigation, lawsuit, or regulatory response tied to these allegations, and sets no timeline for any further action. Everstake's statement that it uses filtering mechanisms to prevent front-running and sandwiching is the only committed position recorded in the sources.