> ## Documentation Index > Fetch the complete documentation index at: https://docs.allium.so/llms.txt > Use this file to discover all available pages before exploring further. # MEV Labels One row per address that Allium's MEV heuristics have labeled, carrying both the label and the evidence behind it so a label can be audited rather than taken on trust. Labels accumulate and are not retired: an address that qualified once stays labeled, and `confidence` reflects the activity seen when it was first labeled. Check `evidence_status`, `evidence_last_seen` and the `*_30d` columns before treating a label as describing current behavior. All `*_volume_usd` columns are gross traded or bracketing volume, not profit. ### Table Columns | Column Name | Description | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | chain | Slug identifying the blockchain this record belongs to. | | address | The labeled address. | | label | MEV label assigned to the address (e.g. `sandwich_bot`, `flashloan_arbitrage`). | | entity | Named entity the address is attributed to, when one is known. | | confidence | Confidence score for the label, between 0 and 1. Carried through from the detector at the time the address was first labeled and not recomputed since, so it reflects the activity seen then rather than today. Use `evidence_status` and the `*_30d` columns to judge whether the behavior is ongoing. | | detected\_behaviors | Array of the distinct MEV behaviors detected for this address. | | signal\_count | Number of distinct MEV behaviors in `detected_behaviors`. | | label\_reason | Human-readable explanation of why the address was labeled, summarizing the supporting evidence. | | detection\_rules | Array of the detection rules that fired for this address. | | evidence\_status | How current the supporting evidence is. `meets_threshold_now`: the address still qualifies on recent activity. `historical_evidence_only`: MEV activity exists in the address's history but not in the recent window, so the label is real but the behavior may have stopped. `no_evidence_found`: labeled upstream with no supporting activity found on this chain; treat as a data-quality signal. Labels accumulate and are not retired, so read this column before relying on a label. | | sandwich\_bundle\_count | Number of distinct sandwich attacks attributed to the address, approximated by distinct block and pool pairs. The more intuitive "how many attacks" figure. | | sandwich\_leg\_tx\_count | Number of distinct sandwich-leg transactions. Front-run and back-run legs count as separate transactions, so this runs higher than `sandwich_bundle_count`. | | sandwich\_active\_days | Number of distinct days on which the address executed a sandwich trade. | | sandwich\_pool\_count | Number of distinct liquidity pools the address sandwiched. | | sandwich\_projects | Array of the DEX projects on which the address executed sandwich trades. | | sandwich\_volume\_usd | Gross USD volume of the address's sandwich trades over its full history. This is traded volume, not profit. | | sandwich\_leg\_tx\_count\_30d | Distinct sandwich-leg transactions in the trailing 30-day window. Use with `sandwich_volume_usd_30d` to judge whether the address is still active. | | sandwich\_volume\_usd\_30d | Gross USD sandwich volume in the trailing 30-day window. Traded volume, not profit. | | sandwich\_first\_seen | Timestamp (UTC) of the address's earliest observed sandwich trade. | | sandwich\_last\_seen | Timestamp (UTC) of the address's most recent observed sandwich trade. | | flashloan\_arb\_tx\_count | Number of distinct flashloan arbitrage transactions attributed to the address over its full history. | | flashloan\_arb\_leg\_count | Total number of individual trade legs across the address's flashloan arbitrage transactions. | | flashloan\_active\_days | Number of distinct days on which the address executed a flashloan arbitrage. | | flashloan\_volume\_usd | Gross USD volume of the address's flashloan arbitrage transactions over its full history. Traded volume, not profit. | | flashloan\_arb\_tx\_count\_30d | Distinct flashloan arbitrage transactions in the trailing 30-day window. | | flashloan\_volume\_usd\_30d | Gross USD flashloan arbitrage volume in the trailing 30-day window. Traded volume, not profit. | | flashloan\_first\_seen | Timestamp (UTC) of the address's earliest observed flashloan arbitrage. | | flashloan\_last\_seen | Timestamp (UTC) of the address's most recent observed flashloan arbitrage. | | total\_evidence\_tx\_count | Combined count of sandwich-leg and flashloan arbitrage transactions supporting the label. | | total\_evidence\_volume\_usd | Combined gross USD volume across all MEV activity supporting the label. Traded volume, not profit. | | evidence\_first\_seen | Timestamp (UTC) of the earliest MEV activity observed for this address, across all behaviors. | | evidence\_last\_seen | Timestamp (UTC) of the most recent MEV activity observed for this address, across all behaviors. The best single indicator of whether the address is still operating. | | evidence\_window\_days | Length in days of the trailing window used to compute the `*_30d` evidence columns and `evidence_status`. | | source\_type | Type of source that produced the label (e.g. heuristic, manual). | | source\_system | System that produced the label. | | attribution\_date | Date on which the label was attributed to the address. | | \_created\_at | Timestamp of when the entry was created in the database. | | \_updated\_at | Timestamp of when the entry was last updated in the database. |