Hassan Maishera
Web3 infrastructure provider Enso has published new research uncovering a previously undocumented category of malicious decentralized finance (DeFi) liquidity pools that it calls "toxic pools."
In a press release shared with Cryptowisser, the company said these pools are designed to deceive wallets, decentralized exchange (DEX) aggregators, and other routing systems by presenting attractive prices during transaction simulations while delivering significantly worse execution after trades are finalized on-chain.
The findings suggest the issue could represent a broader threat to DeFi infrastructure rather than isolated smart contract exploits.
How Toxic Pools Manipulate Trade Execution
Most DeFi wallets and aggregators simulate transactions before submitting them to the blockchain to determine the most efficient trading route.
Enso's research found that toxic pools exploit this process by returning favorable pricing during simulations but changing their behavior once transactions are actually mined.
As a result, users may receive materially worse execution than initially quoted, even though routing systems continue identifying the malicious pool as the optimal trading destination.
Unlike traditional forms of maximal extractable value (MEV) or slippage, toxic pools specifically target the transaction simulation process itself, undermining the reliability of quoted execution prices.
The research is based on approximately two months of on-chain forensic analysis conducted by Enso's engineering team.
The investigation combined:
-
Archive-node RPC data analysis
-
Transaction trace analysis
-
Smart contract inspections
-
Independent validation with support from industry contacts at Curve and Oku
During the investigation, researchers identified two active toxic pools operating on separate DeFi protocols while employing similar manipulation techniques, suggesting the attack methodology can be replicated across multiple blockchain environments.
Real-World Cases on Ethereum and Polygon
Enso revealed that it documented two separate examples of toxic pools operating on Ethereum and Polygon.
Manipulated Curve Pool
One malicious Curve liquidity pool processed more than 129,000 successful swaps while consistently delivering worse execution than users were quoted during simulations.
According to the research, the pool resulted in more than $225,000 in overstated quotes, over 37,000 reverted transactions, and nearly $30,000 in gas fees lost on failed swaps
Malicious Uniswap v4 Hook
Researchers also identified a malicious Uniswap v4 hook that repeatedly attracted transaction routing systems before intentionally causing transactions to fail.
The attack generated a 99.1% transaction failure rate, illustrating how malicious liquidity providers can exploit automated routing mechanisms.
Researchers found that one Ethereum-based toxic pool did not behave maliciously continuously.
Instead, it alternated between normal and manipulated behavior over time, making periodic audits and one-time transaction simulations ineffective at identifying the threat.
The investigation also uncovered multiple oracle contracts deployed by the same operator to support additional liquidity pools, suggesting similar attack patterns could exist elsewhere across DeFi ecosystems.
Execution Integrity Emerging as New Security Challenge
Enso argues the research highlights a growing challenge for decentralized trading infrastructure.
According to Milos Costantini, Enso's Co-Founder and Chief Product Officer, the industry has spent years improving price discovery, but ensuring execution integrity may become the next major security priority.
If simulated transaction quotes can be manipulated while executed trades produce different outcomes, users may have little visibility into whether they actually receive the prices displayed before confirming a transaction.
Alongside publishing its findings, Enso announced enhancements to Enso Shield, its transaction protection platform.
The upgraded system introduces dedicated toxic pool detection and execution verification capabilities.
Rather than relying solely on traditional transaction simulations, Enso Shield continuously:
-
Monitors live on-chain conditions
-
Tracks quote consistency over time
-
Verifies executed transactions using detailed blockchain traces
-
Detects discrepancies between simulated and actual execution results
The company believes these additional safeguards can help identify malicious liquidity pools that conventional routing systems may overlook.
Enso emphasized that the issue extends beyond any single protocol or decentralized exchange.
Instead of attributing responsibility to individual DeFi projects, the company is encouraging wallets, DEX aggregators, infrastructure providers, and blockchain researchers to independently investigate similar execution manipulation techniques across the broader DeFi ecosystem.
As transaction simulations become increasingly central to decentralized trading, ensuring that quoted prices accurately reflect executed trades may become one of the industry's most pressing infrastructure challenges.
The full research report, including the complete methodology, on-chain evidence, transaction traces, and technical analysis by Milos Costantini, Co-Founder and CPO at Enso, and Brendon Karelis, Lead Engineer, is available here: https://hackmd.io/@milonite7/rJne_iQQfe
Enso is the fastest way to build and launch onchain. Trusted by over 100 projects and having enabled more than $15 billion to be settled onchain, Enso simplifies what used to be a slow and complex process. Developers no longer need to manually integrate protocols, understand smart contracts, or invest significant resources before testing new products.
Through blockchain shortcuts and a shared execution engine, Enso handles the complexity of onchain interactions, allowing developers and institutions to focus on building products rather than infrastructure.
