Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Understanding the Security Risks of Decentralized Exchanges by Uncovering Unfair Trades in the Wild

Jiaqi Chen, Yibo Wang, Yuxuan Zhou, Wanning Ding, Yuzhe Tang, XiaoFeng Wang, Kai Li

TL;DR

This work addresses security risks in decentralized exchanges by exposing fairness violations and extractable value (EV) in AMMs. It presents a large-scale, end-to-end transaction-analysis pipeline that analyzes $60$ million transactions across six DEXes on Ethereum and BSC, uncovering $671400$ unfair trades and about $55000$ token-theft incidents with losses above $3.88$ million USD. The study identifies novel EV patterns tied to non-standard token behaviors (e.g., rebases and token interest) and adaptive attacker strategies, and it demonstrates the feasibility of notifying developers and proposing concrete countermeasures. The authors propose secure AMM pool redesigns (e.g., ETHRelay-based verification) and off-chain mitigations, along with open-source patches, to harden deployed services against the discovered risks, offering a practical path toward more robust DeFi protocols.

Abstract

DEX, or decentralized exchange, is a prominent class of decentralized finance (DeFi) applications on blockchains, attracting a total locked value worth tens of billions of USD today. This paper presents the first large-scale empirical study that uncovers unfair trades on popular DEX services on Ethereum and Binance Smart Chain (BSC). By joining and analyzing 60 million transactions, we find 671,400 unfair trades on all six measured DEXes, including Uniswap, Balancer, and Curve. Out of these unfair trades, we attribute 55,000 instances, with high confidence, to token thefts that cause a value loss of more than 3.88 million USD. Furthermore, the measurement study uncovers previously unknown causes of extractable value and real-world adaptive strategies to these causes. Finally, we propose countermeasures to redesign secure DEX protocols and to harden deployed services against the discovered security risks.

Understanding the Security Risks of Decentralized Exchanges by Uncovering Unfair Trades in the Wild

TL;DR

This work addresses security risks in decentralized exchanges by exposing fairness violations and extractable value (EV) in AMMs. It presents a large-scale, end-to-end transaction-analysis pipeline that analyzes million transactions across six DEXes on Ethereum and BSC, uncovering unfair trades and about token-theft incidents with losses above million USD. The study identifies novel EV patterns tied to non-standard token behaviors (e.g., rebases and token interest) and adaptive attacker strategies, and it demonstrates the feasibility of notifying developers and proposing concrete countermeasures. The authors propose secure AMM pool redesigns (e.g., ETHRelay-based verification) and off-chain mitigations, along with open-source patches, to harden deployed services against the discovered risks, offering a practical path toward more robust DeFi protocols.

Abstract

DEX, or decentralized exchange, is a prominent class of decentralized finance (DeFi) applications on blockchains, attracting a total locked value worth tens of billions of USD today. This paper presents the first large-scale empirical study that uncovers unfair trades on popular DEX services on Ethereum and Binance Smart Chain (BSC). By joining and analyzing 60 million transactions, we find 671,400 unfair trades on all six measured DEXes, including Uniswap, Balancer, and Curve. Out of these unfair trades, we attribute 55,000 instances, with high confidence, to token thefts that cause a value loss of more than 3.88 million USD. Furthermore, the measurement study uncovers previously unknown causes of extractable value and real-world adaptive strategies to these causes. Finally, we propose countermeasures to redesign secure DEX protocols and to harden deployed services against the discovered security risks.
Paper Structure (35 sections, 6 equations, 11 figures, 13 tables)

This paper contains 35 sections, 6 equations, 11 figures, 13 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Background
  4. Uncovering Unfair Trades
  5. Patterns of Violations
  6. Token Supply Rebase (Pattern $P_1$)
  7. Interest-bearing Tokens ($P_2$)
  8. External Transfer for Deposit ($P_3$)
  9. Buggy Router Contracts ($P_4$)
  10. Detecting Token Thefts
  11. The Detection Problem
  12. The Detection Method
  13. Results
  14. Case Studies
  15. Block Gaps
  16. ...and 20 more sections

Figures (11)

  • Figure 1: Transaction-analysis workflow to discover unfair trades (described in § \ref{['sec:detectviolatingswap']}) and to attribute them into thefts (§ \ref{['sec:attack']}) and lost tokens (§ \ref{['sec:losttokens']}).
  • Figure 2: Fair trades and violation cases.
  • Figure 3: Matchmaking deposits and withdrawals: Matched cases are in green boxes, and mismatches are rendered in red, including standalone withdrawal (I), standalone deposits (II), and deposits of lower value (IV). In the figure, tf/tff refer to functions transfer/transferFrom.
  • Figure 4: Patterns of profitable deposits: $R$ is the router smart contract (part of the pool), $T_0$/$T_1$ are the two tokens in the target liquidity pool. Both $P_1$ and $P_2$ are non-standard mechanisms that update token balance. $W$/$D$ refer to withdrawal/deposit (directly via calling transfer).
  • Figure 5: Rational attack strategies (A1/A2/A3).
  • ...and 6 more figures