dexploits

Dexploits refer to exploits targeting decentralized exchanges (DEXs) and related DeFi protocols, aiming to manipulate trades, siphon funds, or disrupt operations. They arise from the programmable nature of smart contracts, liquidity pools, price oracles, and governance mechanisms that underlie many DEXs. Dexploits can result from code bugs, design flaws, or vulnerabilities in external data feeds, and they often exploit composability and transparency of on-chain systems.

Common categories include front-running and sandwich attacks, where an attacker observes a pending trade and inserts their own trades before and after to extract profit; flash loan attacks that use uncollateralized loans to manipulate prices or exploit timing within a single transaction; and oracle manipulation, where an attacker influences the price feed used by the protocol to liquidate positions or profit from trades. Additional concerns involve vulnerabilities in smart contracts such as reentrancy or logic errors, and governance exploits that abuse token-weighted voting or timelocks to push harmful changes.

Notable incidents include the bZx flash loan attacks in 2020, which leveraged flash loans to manipulate price feeds and margin positions. Attack patterns have driven the development of mitigations, including more robust price oracles (e.g., multi-source or time-weighted feeds), improved transaction sequencing defenses, rate limits on loans, and formal security audits.

Dexploits highlight ongoing security challenges in DeFi: while DEX architectures enable permissionless liquidity and trading, they are susceptible to systemic risk if price feeds, contract logic, or governance are not carefully secured.