Over 129,000 transactions on a single Curve pool were processed under a false premise. The pool returned favorable quotes during simulation, then systematically reverted or executed at worse rates on-chain. The cost to the attacker? Approximately $34,600 in profit. The cost to users? Over $225,000 in inflated quotes and roughly $30,000 in wasted gas from failed transactions.
This is not a flash loan attack. It is not a sandwich exploit. It is a quiet, methodical fraud built into the very architecture of how DeFi routes trades: the trust in simulation.
Context: The Optimization Assumption
Every time you click "Swap" on a wallet like Rabby or MetaMask, the interface simulates the transaction locally or on a node. It fetches quotes from multiple liquidity pools via aggregator APIs or direct on-chain calls, selects the best price, and sends the transaction. The implicit assumption is that what the simulation returns is what the execution will deliver. For years, this held true. The market priced in the risk of slippage, frontrunning, and sandwich attacks, but not the risk that the pool itself would lie about its quotes.
In May and June 2024, Enso, a security firm specializing in on-chain detection, identified a novel attack vector they call "Simulation Spoofing." The attacker deploys a liquidity pool—on Curve (Ethereum) or Uniswap v4 (Polygon)—that behaves honestly during simulation checks but either reverts or executes at a manipulated price when the actual transaction lands. The hook mechanism in Uniswap v4 made this trivial: a custom hook can inspect the calling context and decide to revert if it detects a real transaction. On Curve, the attacker deployed a pool with a custom implementation that returned a favorable price during quote calls but used a different logic during swap.
Core: Systematic Teardown
Let me dissect the two case studies documented by Enso. I do not follow the wave; I measure its depth. And the depth here is alarming.
Case 1: Curve on Ethereum
A pool deployed as a Curve stable swap pool handled over 129,000 transactions. The pool's get_dy function—used to estimate the output amount—was overridden to return a price 10-20% above the actual execution. The exchange function then used the true pool reserves, causing the user to receive less than simulated. The attacker did not control the pool's underlying tokens; they merely exploited the disconnect between quote and execution. Over the pool's lifetime, the cumulative difference between simulated and actual output amounted to ~$225,000. However, due to the high revert rate (many users canceled after seeing the simulation result but before sending the transaction, or the attacker's gas strategy), the realized profit was only $34,600. The rest was eaten by gas fees on reverts—approximately $30,000 in total.
What I find particularly insidious is the pattern: the pool did not always return false quotes. It alternated between honest and dishonest behavior, likely based on a condition such as block number or caller address. This means a single snapshot audit would miss it. Continuous monitoring was required. The code does not lie, but the contract can—through conditional logic.
Case 2: Uniswap v4 on Polygon
Here, the attacker used Uniswap v4's hook system. The beforeSwap hook checked if the transaction was a simulation by analyzing the gas limit or the caller (e.g., simulating wallets often use a static gas limit). If the hook detected a simulation, it returned a favorable quote. During actual execution, it reverted with a custom error, causing the transaction to fail but still consume gas. On this pool, 99.1% of swaps failed. The attacker collected swap fees from the 0.9% that succeeded (likely from users who manually increased gas or used direct contract calls). The gas wastage alone is a form of griefing, but the attacker's net profit came from the few successful swaps that also overcharged via the same quote discrepancy.
Beauty is the mask; geometry is the bone. The elegant hook architecture of Uniswap v4 is an aesthetic achievement, but it provides a geometric platform for deception. The attacker did not need to break any fundamental protocol rule—they simply used the flexibility as intended.
Common Technical Thread
Both attacks rely on a fundamental flaw in the DeFi routing stack: simulation is performed off-chain or in a context that the pool can distinguish from a real transaction. The attacker exploits this by making the pool's behavior context-dependent. This is not a bug in the EVM or in the AMM design—it is a protocol-level assumption that trusting simulation is equivalent to trusting execution.
From my years auditing smart contracts during DeFi Summer, I saw similar patterns in oracle manipulation where the price feed would update differently based on time or caller. The principle is identical: any state that is observable during simulation but not verifiable on-chain is a vector for manipulation.
Contrarian Angle: What the Bulls Got Right
Now, to balance the analysis, I must acknowledge what the market's optimists would say. First, the scale is small: $34,600 in realized profit is negligible compared to the billions flowing through these pools. Second, the attack is detectable—Enso built a detection tool called Enso Shield, and Curve has already disabled the malicious pool. Third, the attack does not exploit any core DeFi protocol vulnerability; it exploits a user experience optimization. The bulls would argue that this is a temporary gap that will be closed by better simulation verification (e.g., requiring the user to sign a hash of the simulation result, or using a trusted execution environment).
They are partially correct. The attack surface is narrow: it only works when users rely on third-party aggregators or wallets that do not verify the execution. Sophisticated users using direct contract calls are immune. The industry will adapt, and the expected value of the attack will drop as detection improves.
But silence is the loudest indicator of risk. The fact that this attack went undetected for months across 129,000 transactions on a Curve pool—a protocol considered battle-tested—signals that the industry's security mindset is still reactive. We wait for an exploit, then patch. We do not proactively audit the assumptions in our routing stack.
Takeaway: The Accountability Call
The future of DeFi depends on closing the gap between simulation and execution. Every wallet and aggregator should implement a post-execution verification: compare the actual output with the simulated quote and flag discrepancies. This is not technically difficult; it is a 10-line check. The lack of adoption reveals a perverse incentive: wallets prioritize speed and UX over security, and users prioritize convenience over verification.
Beneath the yield lies the rot. The crypto industry continues to build on trust assumptions that were valid in 2020 but are being chipped away by increasingly creative attackers. The question for developers and users is not whether this attack will be replicated—it already has been. The question is whether you will wait for the next 129,000 transactions to tell you what Enso already proved.
I do not follow the wave; I measure its depth. The depth revealed here is shallow for now—$34,600 is a puddle. But the technique is scalable, and the incentives are aligned for attackers to go deeper. Hype is noise; structure is signal. The signal is clear: verify execution, or prepare for a steady bleed.