blockchain security auditors

Abstract: Many decentralized exchanges use automated market makers (AMMs) to trade assets against liquidity pools. Modern AMMs allow third-party contracts, called Hooks, to customize this process. However, Hooks can impose additional deductions that fee breakdowns based on standard pool parameters do not itemize. We present, to the best of our knowledge, the first large-scale empirical study of the production Hook ecosystem, focusing on these undisclosed settlement charges. Our study covers 7,873 Hook deployments, 50,011 pools, and 296M pool events on Uniswap v4 and PancakeSwap Infinity across Ethereum and BNB Smart Chain (BSC) through August 1, 2026. We develop a bytecode analysis that reconstructs how Hooks change traders' payments and receipts, separating charges from exchanged assets and standard fees. We then reconstruct historical settlements to measure charging frequency and economic burden. We find that direct settlement adjustment is the dominant Hook capability, supported by 71.37% of registered Hooks. Charging capability is widespread and often exercised: 24.30% of Hooks can impose undisclosed deductions, and these deductions occur in 59.23% of accounted swaps involving such Hooks. These charges generate millions of dollars in revenue, with $3.97M recorded across Hooks with available token prices. These findings reveal a gap between standard fee displays and actual trading costs, motivating explicit disclosure of Hook deductions alongside standard fees.

Abstract: Blockchains enable decentralized applications through smart contracts---interactive programs executed through consensus. However, the inherently asynchronous nature of blockchain transaction ordering introduces a class of vulnerabilities known as frontrunning attacks, which have caused millions of dollars in losses in major blockchains, such as Ethereum. Frontrunning attacks arise because users interact with smart contracts through transactions, which are added to the blockchain by designated nodes called miners. Miners can exploit their ability to reorder, delay, or insert transactions to gain an advantage over honest users, effectively frontrunning them. Yet, to date, the field lacks a rigorous definition of what it even means for a contract to resist such attacks. Worse, we show that existing dynamic detection approaches are fundamentally inadequate: in a large-scale study comprising 287 smart contract audits, 55% of the 393 reported vulnerabilities identified by leading smart contract auditors fall outside the scope of state-of-the-art detection criteria. To address this gap, we propose the first formal definition of frontrunning vulnerability for smart contracts. Our definition captures a key insight: resistance to frontrunning is not an intrinsic property of a contract alone, but depends critically on how honest users interact with it. Grounded in this observation, we develop a sound algorithm for synthesizing secure interaction conditions, alongside a prototype implementation that we apply to audited real-world contracts---revealing previously undiscovered vulnerabilities in two Ethereum contracts.