DeFi’s Newest Threat: How Malicious Liquidity Pools Are Trick-Quoting Ethereum and Polygon Users
DeFi infrastructure firm Enso has identified a new class of malicious liquidity pools called “toxic pools. ” Unlike traditional exploits that steal funds directly, these pools manipulate transaction. . .
DeFi infrastructure firm Enso has identified a new class of malicious liquidity pools called “toxic pools. ” Unlike traditional exploits that steal funds directly, these pools manipulate transaction simulations. Key TakeawaysEnso’s July 16 report exposed “toxic pools” that fake quotes, causing tens of thousands of dollars in losses on a Curve pool. The exploit threatens DeFi front-ends, with one malicious Uniswap v4 hook causing a 99. 1% failure rate. Enso updated its Enso Shield product to detect fake quotes across 2 different blockchain environments. A ‘Jekyll and Hyde’ TacticA newly uncovered class of maliciousdecentralized finance(DeFi)liquidity poolsis targeting the core infrastructure thatcryptocurrencytraders rely on to find the best prices, according to new research published July 16 byDeFiinfrastructure firm Enso. The company is calling the deceptive setups “toxic pools. ” Unlike typicalcryptocurrencyhacks that drain funds directly fromsmart contracts, these pools are engineered to systematically trick transaction simulations. They return attractive, highly competitive price quotes when acryptowallet ordecentralized exchange(DEX) aggregator runs a simulation, but they alter their behavior the moment the transaction is actually executed on theblockchain. The result is a subtle, systemic drain: traders receive significantly worse execution prices than they were quoted, or their transactions fail, burning network fees in the process. “Our investigation leads us to believe this is not simply another isolatedsmart contractexploit,” said Milos Costantini, co-founder and chief product officer at Enso. “The industry has spent years optimizing price discovery. Our findings suggest the next challenge is verifying execution integrity. ”According to Enso’sreport, toxic pools exploit the off-chain “dry-run” simulations that wallets use to preview trades. The malicious contracts detect when they are running in a read-only simulation environment and return an artificially optimized price. Once the transaction is actually broadcast on-chain, the pool alters its mathematical logic to execute the trade at a degraded rate. To remain hidden from security systems, these pools alternate between honest and malicious states, rendering static code scanners and historical reputation filters ineffective. This bait-and-switch design degrades the user experience and drains user funds through failed transactions. In one case study, a manipulated Curve pool triggered more than 37,000 reverted trades, forcing users to burn nearly $30,000 ingasfees. Attackers are also exploiting next-generation, modular exchange architectures. On Polygon, a malicious “hook” — asmart contractplugin used in platforms like Uniswap v4 — lured routing systems with fake rates before triggering a 99. 1% transaction failure rate. Findings From On-Chain Forensic AnalysisThe research, which spanned roughly two months of on-chain forensic analysis, combined historical archive-nodedata, transaction trace analysis andsmart contractinspections. Enso engineers, with support from contacts at majorDeFiprotocols Curve Finance and Oku, identified active toxic pools operating across both the Ethereum and Polygonblockchains. In one documented case study on Ethereum, a manipulated Curve pool processed more than 129,000 swaps. While the pool appeared to be the optimal route, it delivered worse execution than quoted, leading to approximately $225,000 in overstated quotes. Furthermore, Enso’s team identified multipleblockchainoraclecontracts deployed by the same operator to support additional pools, indicating the tactic is likely more widespread than the two documented cases and could represent an emerging template for on-chain extraction. The findings present a direct challenge to the user-facing layer of theDeFiecosystem. Popular wallets, consumer-facing interfaces and aggregators depend heavily on automated simulations to guarantee the “best path” for a user’s trade. Enso’s report highlights that if routing infrastructure cannot distinguish between a legitimate quote and a manipulated one, front-ends will continue to steer users toward these traps. This creates potential legal and financial liability risks for wallet providers and interface operators who promise “best execution” but routinely deliver toxic routes. In response to the threat, Enso announced it has updated its execution-protection product, Enso Shield, to include dedicated toxic-pool detection. The security tool is designed to bypass standard simulation methods by analyzing live on-chain context, monitoring quote history and using transaction traces to spot execution discrepancies. Rather than blaming individualdecentralized exchanges, Enso has called on the widercryptocurrencyindustry to conduct further research into the manipulation of transaction simulations. “If transaction simulations can be manipulated while real execution tells a different story,” Costantini said, “we need better ways to verify what users actually receive. ”