{"id":23000,"date":"2025-04-14T11:24:27","date_gmt":"2025-04-14T08:24:27","guid":{"rendered":"https:\/\/forklog.com\/en\/defis-manipulation-problem-what-the-financial-lego-conceals\/"},"modified":"2025-04-14T11:24:27","modified_gmt":"2025-04-14T08:24:27","slug":"defis-manipulation-problem-what-the-financial-lego-conceals","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/defis-manipulation-problem-what-the-financial-lego-conceals\/","title":{"rendered":"DeFi\u2019s manipulation problem: what the \u201cfinancial LEGO\u201d conceals"},"content":{"rendered":"

The fast-evolving DeFi sector offers users undeniable advantages regardless of capital, age or country. With a smartphone and an internet connection, you can access savings, loans and other financial tools without KYC<\/span>, paperwork or intermediaries.<\/p>\n

For the unbanked, it is a way to manage their own<\/em> money without bureaucracy and other barriers; in high-inflation economies, stablecoins become<\/a> an alternative to depreciating fiat. Smart contracts power everything\u2014fast, transparent and without the \u201cwe\u2019ll call you back\u201d.<\/p>\n

Yet DeFi still resembles the Wild West\u2014light on regulation and prone to manipulation\u2014worrying institutions and watchdogs. The industry is maturing quickly, however: tools to detect and curb sharp practice are improving.<\/p>\n

DeFi\u2019s standard-bearer?<\/h2>\n

Uniswap has for years led DEX<\/span> by trading volume, only occasionally ceding<\/a> first place to Solana-based Raydium.<\/p>\n

As one of the first platforms to bring the AMM mechanism to market, Uniswap continues to remain the standard-bearer<\/a> of DeFi innovation.<\/p>\n

Even here, manipulation persists. A common tactic is the sandwich attack. Borrowed from high-frequency trading in TradFi<\/span>, it sees an attacker place a buy order just before the victim\u2019s trade and then a sell order immediately after\u2014within the same block. The price is briefly distorted; the attacker profits at the user\u2019s expense.<\/p>\n

According to Kaiko<\/a>, in March a market participant tried to swap ~220,800 USDC for USDT in the corresponding Uniswap V3 liquidity pool on Ethereum. Just before execution, the attacker sold almost 20m USDC for USDT, crashing Circle\u2019s stablecoin to 0.024 USDT amid thin liquidity and heightened pool slippage.<\/p>\n

\"1-Uniswap-v3\"
The March sandwich attack in the USDC\u2013USDT pool on Uniswap v3. Source: Kaiko.<\/figcaption><\/figure>\n

The swap cleared at a disastrous rate: the user received only about 5,300 USDT instead of the expected 220,800 USDT, losing roughly 215,500 USDT.<\/p>\n

\n\u201cThe attacker then repurchased USDC at a lower price within the same block. They still profited after paying $200,000 to the block builder for priority execution,\u201d the Kaiko researchers explained.<\/cite><\/p><\/blockquote>\n

They observed that the incident coincided with declining USDC liquidity on Uniswap V3. On the day of the attack, more funds were withdrawn from the pool than added, helping the manipulator move the price.<\/p>\n

\n\u201cThe result was significant slippage\u2014the gap between expected and actual execution price. This created market risk not only for the victim but for all traders using that pool at the time,\u201d the experts noted.<\/cite><\/p><\/blockquote>\n

\"2-usdc-usdt_mint_burn\"
Mint and burn events on 12 March in the USDC\u2013USDT pool on Uniswap v3. Source: Kaiko.
<\/figcaption><\/figure>\n

Similar\u2014sometimes more intricate\u2014attacks flare up on other non-custodial venues too, including the hyped-up Hyperliquid<\/a>.<\/p>\n

A new stress test<\/h2>\n

Hyperliquid, one of the largest platforms for decentralised perpetuals, came under a coordinated attack late last month. The incident, and the team\u2019s response, caused an uproar in the crypto community, prompting debate and doubts about decentralisation.<\/p>\n

On 26 March 2025 an unknown trader targeted the Hyperliquidity Provider Vault (HLP), opening large positions on contracts tied to the thinly traded Jelly-My-Jelly (JELLYJELLY): a short of roughly $4m and two longs totalling about $3m.<\/p>\n

JELLYJELLY\u2019s market capitalisation is a modest $11.5m, though the coin trades on both DEX and CEX<\/span>.<\/p>\n

\"3-JELLYJELLY\"
Price action and other data for JELLYJELLY. Source: CoinGecko<\/a> as of 9 April.<\/figcaption><\/figure>\n

\n\u201cIts daily liquidity, measured by 1% market depth, averaged just $72,000\u2014less than half the figure for comparable low-cap tokens like Slerf ($190,000); more than 1,000 times lower than that of Solana\u2019s native token, SOL,\u201d observed<\/a> Kaiko\u2019s researchers.<\/cite><\/p><\/blockquote>\n

\"4-JellyJelly_market_depth\"
JELLYJELLY 1% market depth. Source: Kaiko.<\/figcaption><\/figure>\n

During the attack the trader ran two coordinated manoeuvres, opening a short and a long on the token\u2019s perpetuals simultaneously:<\/p>\n

    \n
  1. Forced liquidation.<\/strong> The attacker withdrew the margin backing the short, triggering liquidation. Losses were borne by HLP.<\/li>\n
  2. Spot pump.<\/strong> In parallel, the trader aggressively bought JELLYJELLY on spot markets. Given the low liquidity, the token spiked. Because Hyperliquid\u2019s derivatives settle off a spot price sourced via an oracle, this instantly drove up perpetuals.<\/li>\n<\/ol>\n

    Within an hour the price of Jelly-My-Jelly surged by more than 500%\u2014from $0.00806 to $0.0517.<\/p>\n

    \"5-Jelly_perps_future_price\"
    Timeline of the attack on Hyperliquid\u2019s JELLYJELLY derivatives market. Source: Kaiko.<\/figcaption><\/figure>\n

    In Kaiko\u2019s view, the manipulation exposed weaknesses in Hyperliquid\u2019s liquidation mechanism.<\/p>\n

    \n\u201cAfter open interest exceeded critical thresholds, the platform blocked new positions. This prevented liquidators from closing the attacker\u2019s short in time, increasing losses and exacerbating HLP\u2019s situation,\u201d the experts explained.<\/cite><\/p><\/blockquote>\n

    They added that Binance and OKX fanned the flames\u2014these large centralised exchanges listed Jelly-My-Jelly futures the same day Bybit\u2019s trading volume in the asset hit a record $150m.<\/p>\n

    \"6-Jelly_Jelly_Volumes_on_CEXs\"
    Perpetuals trading volumes for JELLYJELLY on Binance and Bybit. Source: Kaiko.<\/figcaption><\/figure>\n

    Kaiko also noted that activity around JELLYJELLY came with violent price swings and liquidations \u201con both sides of the market\u201d:<\/p>\n

    \n\u201cIn the morning forced short closures dominated, but by evening it was long holders who were caught. The largest liquidation on 26 March was a short of about $250,000.\u201d<\/cite><\/p><\/blockquote>\n

    \"7-liquidations_on_CEXs_Jelly_Jelly_Perps_Markets\"
    Liquidations on centralised exchanges\u2019 JELLYJELLY perpetuals markets on 26 March. Source: Kaiko.<\/figcaption><\/figure>\n

    \n\u201cThese actions indicate a carefully planned attack. On-chain data show the perpetrator began test transactions on Hyperliquid at least ten days before the 26 March attack, likely to hone the strategy,\u201d the researchers concluded.<\/cite><\/p><\/blockquote>\n

    Hyperliquid later halted<\/a> trading in JELLYJELLY contracts by validator decision due to \u201csuspicious market activity\u201d. The whale managed to withdraw about $6.2m.<\/p>\n

    A watchful community<\/h3>\n

    The crypto community had already flagged peculiarities on Hyperliquid. Weeks before the attack, EmberCN analysts recorded<\/a> abnormal behaviour by several large traders\u2014possibly a stress test of the liquidation mechanism.<\/p>\n

    Experts at 10x Research noted<\/a> that Hyperliquid\u2019s high transparency opened the door to a kind of crowd-led \u201cwhale hunt\u201d using leverage\u2014to force liquidations. The trend, they argued, could materially shift the market balance.<\/p>\n

    One example came on 16 March, when a user going by CBB called<\/a> on the community to liquidate a large trader who had opened a 4,442 BTC short<\/a> with 40x leverage. After coordinated action, bitcoin rose 2.5%, and the whale had to increase the position to 6,210 BTC (~$524m) to avoid liquidation.<\/p>\n

    Analysts drew parallels with GameStop, when retail investors teamed up against hedge funds. A similar \u201cpeople\u2019s hunt\u201d could become a new crypto-trading motif, where platform transparency lets small players influence large investors\u2019 actions.<\/p>\n

    Even manipulators get burned<\/h2>\n

    A year ago a group of MEV bots profiting from backrunning<\/span> lost over $25m to a rogue validator.<\/p>\n

    According to CertiK, the attacker swapped out recipient addresses in a transaction bundle. Instead of profits, the bots \u201cforwarded\u201d Wrapped BTC (WBTC), Ethereum (WETH) and the USDC, USDT and DAI stablecoins to the attacker\u2019s wallets.<\/p>\n

    Almost immediately after the incident, Tether added one related address to its blacklist\u2014holding roughly $3m in assets.<\/p>\n

    The move drew a wave of criticism on X. Users questioned the decentralisation of the market\u2019s biggest stablecoin.<\/p>\n

    \n\u201cThey said \u2018money of the future\u2019\u2026 Got mad over a random MEV mistake\u2026 Straight to the blacklist,\u201d wrote<\/a> one user.<\/cite><\/p><\/blockquote>\n

    A representative of Cryptonary asked<\/a> how such wallets are blocked.<\/p>\n

    \n\u201cWhat does a blacklisted stablecoin address look like? Is it just added to a list or are any sanctions imposed?\u201d the post read.<\/cite><\/p><\/blockquote>\n

    \"8-USDT_banned_addresses\"
    Number of Tether-blocked addresses and total USDT held. Source: Dune<\/a>.<\/figcaption><\/figure>\n

    In September last year an \u201cunlucky\u201d MEV bot took out<\/a> a $11.7m flash loan to attempt a sandwich attack\u2014only to net $20.<\/p>\n

    The target was a user swapping $5,000 of Shuffle (SHFL) into WETH. Slippage was about 2%.<\/p>\n

    The bot executed 14 transactions across the Balancer, Aave and Uniswap protocols. After gas, the final profit was just over $20.<\/p>\n

    \n\u201cUnlucky,\u201d concluded<\/a> Arkham Intelligence researchers.<\/cite><\/p><\/blockquote>\n

    Commenters wryly noted<\/a> that in today\u2019s market even an MEV bot can\u2019t make more than $20.<\/p>\n

    How not to be duped<\/h2>\n

    The DeFi Report founder Michael Nado offered a few tips<\/a> on avoiding MEV bots when using DEXs:<\/p>\n

      \n
    1. Reduce the slippage tolerance on your transactions.<\/li>\n
    2. Don\u2019t use Uniswap. Switch to CowSwap or another aggregator that can deliver better execution and prevent MEV.<\/li>\n
    3. Use a custom RPC<\/span> that doesn\u2019t broadcast your transactions publicly.<\/li>\n<\/ol>\n

      Many projects aim to curb MEV\u2019s impact on Ethereum. The best known\u2014Flashbots<\/strong>\u2014is a research outfit building tools to mitigate the negative effects of Maximal Extractable Value and reduce network risk.<\/p>\n

      Some wallets are adding built-in protections against MEV. For example, MetaMask<\/strong> introduced<\/a> Smart Transactions, which uses a \u201cvirtual mempool\u201d to stage operations before they hit the blockchain, helping prevent front-running<\/span> and other MEV attacks.<\/p>\n

      The feature targets bot strategies and offers instant transaction simulation, allowing users to preview outcomes and reduce gas costs.<\/p>\n

      \n\u201cCurrently up to 15% of transactions revert, meaning users spend around 47,000 ETH each year on operations that accomplish nothing. That\u2019s on top of the 124,000 ETH extracted by MEV bots that read users\u2019 transactions and front-run them for profit. In total, that\u2019s over $440m in annual losses,\u201d the MetaMask team said.<\/cite><\/p><\/blockquote>\n

      The feature was developed with the Special Mechanisms Group at ConsenSys.<\/p>\n

      Smart Transactions is opt-in\u2014the user decides whether to enable it and can revert to regular transactions at any time. MetaMask does not charge for the feature.<\/p>\n

      In 2022 the 1inch Network<\/strong> team introduced RabbitHole, a tool to shield MetaMask users from sandwich attacks.<\/p>\n

      It acts as a proxy between the wallet and Ethereum validators, letting swap transactions bypass the mempool. To make it work, 1inch integrated products from Flashbots, BloXroute, Eden and Manifold.<\/p>\n

      Conclusions<\/h2>\n

      Despite adverse market conditions, DeFi keeps gaining ground, offering innovative financial instruments without intermediaries. Yet the young and still relatively small sector remains vulnerable to attacks and manipulation.<\/p>\n

      Recent incidents on Uniswap and Hyperliquid laid bare the fragility of low-liquidity tokens and weaknesses in liquidation mechanics. The analysis suggests that manipulation is often directly or indirectly amplified by large centralised exchanges, further distorting price formation and heightening trader risk.<\/p>\n

      Against this backdrop, the community needs to build more tools to bolster trading transparency and shrink avenues for manipulation. Only then can the ecosystem reach its next stage of maturity and win the confidence of both institutions and retail users.<\/p>\n","protected":false},"excerpt":{"rendered":"

      The fast-evolving DeFi sector offers users undeniable advantages regardless of capital, age or country. With a smartphone and an internet connection, you can access savings, loans and other financial tools without KYC, paperwork or intermediaries. For the unbanked, it is a way to manage their own money without bureaucracy and other barriers; in high-inflation economies, […]<\/p>\n","protected":false},"author":1,"featured_media":22999,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"","news_style_id":"","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[1144],"tags":[1442,1093,787,1231,1391],"class_list":["post-23000","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-longreads","tag-bot","tag-defi","tag-dex","tag-mev","tag-uniswap-uni"],"aioseo_notices":[],"amp_enabled":true,"views":"185","promo_type":"","layout_type":"","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/23000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=23000"}],"version-history":[{"count":0,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/23000\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/22999"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=23000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=23000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=23000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}