SoK: Decentralized Exchanges (DEX) with Automated Market Maker (AMM) Protocols

What the paper argues

By 2021, AMM-based decentralized exchanges — Uniswap, Curve, Balancer, and a growing field of variants — were routing tens of billions of dollars without an order book: instead of matching a buyer and a seller, each protocol prices assets algorithmically against a shared pool, using a conservation function that only lets the price move along a predefined curve. Every protocol had its own whitepaper, its own notation, and its own claims about slippage and risk, with no common framework to check them against each other.

The paper is the first systematization of knowledge (SoK) for this space. It does four things: builds one state-space framework that every AMM design can be expressed in; uses that framework to derive and compare the conservation function, slippage, and divergence-loss formulas of the major protocols side by side; places AMM-based DEX within the broader taxonomy of DeFi (lending, stablecoins, NFTs, and prediction markets all borrow AMM machinery); and builds a taxonomy of the security and privacy attacks AMMs are exposed to, layered by where in the stack they occur.

A shared state-space framework

The functioning of any AMM-based system reduces to a small set of mechanisms. The state of a liquidity pool is a tuple

\chi = (\{r_k\}_{k=1,\dots,n},\, \{p_k\}_{k=1,\dots,n},\, C,\, \Omega)

where $r_k$ is the reserve quantity of token $k$ , $p_k$ its current spot price, $C$ the conservation function's invariant, and $\Omega$ the protocol's fixed hyperparameters (fees, pool weights, and so on). User actions — providing liquidity, withdrawing it, or swapping — are state transitions

\chi \xrightarrow[f]{a} \chi'

with two rules that hold across every AMM design considered: the price of assets in a pool stays constant for pure liquidity provision and withdrawal, and the invariant stays constant for pure swaps. Every protocol-specific whitepaper turns out to be a particular choice of conservation function

C = C(\{r_k\})

inside this one framework — which is what makes a direct, apples-to- apples comparison possible in the first place.

Comparing the major protocols

The paper derives the conservation function, spot exchange rate, slippage, and divergence loss of the four most representative AMMs by market share and mechanism at the time — Uniswap (V2 and V3), Balancer, Curve, and DODO — with the full formulas worked out in an appendix so the derivations are checkable rather than asserted. Uniswap's constant-product invariant is the simplest case,

C = r_1 \cdot r_2

Balancer generalizes it to a weighted geometric mean across two or more assets,

C = \prod_k r_k^{w_k}

and Curve interpolates between constant-sum and constant-product to keep same-peg assets trading close to a 1:1 rate while still absorbing imbalance. DODO breaks the pattern entirely: instead of deriving price purely from reserves, it borrows an external market price and uses arbitrage to pull the pool back to that price — trading the "proactive market maker" complexity for the ability to largely eliminate divergence loss at equilibrium.

Protocol	Invariant shape	Distinguishing move
Uniswap V2	constant product	the baseline every other design is read against
Uniswap V3	constant product, concentrated	LPs choose a price range instead of the full curve
Balancer	weighted geometric mean	more than two assets, arbitrary weights
Curve	constant-sum ↔ constant-product blend	low slippage for pegged assets
DODO	external-price-anchored	arbitrage restores equilibrium, cutting divergence loss

The two implicit costs every AMM imposes

Two costs are native to trading against a curve instead of an order book, and the paper gives both a precise, protocol-independent definition. Slippage is the gap between the pre-trade spot rate ${}_iE_o$ and the realized rate of an actual trade,

S(x_i, \{r_k\}; C) = \frac{x_i/x_o}{{}_iE_o} - 1

— it approaches zero for infinitesimally small trades and grows with trade size relative to pool depth, which is also what makes sandwich attacks profitable (below). Divergence loss — the paper deliberately avoids the more common but misleading term "impermanent loss" — is what a liquidity provider gives up by holding assets inside a pool instead of outside it, once prices move:

L(\rho, \{r_k\}; C) = \frac{V'(\rho, \{r_k\}; C)}{V_{\text{held}}(\rho; \{r_k\}, C)} - 1

For Uniswap's constant-product pools this reduces to a clean closed form in the price ratio $\rho$ ,

L(\rho) = \frac{\sqrt{1+\rho}}{1+\frac{\rho}{2}} - 1

and the paper works out the equivalent expression for every other protocol in the comparison, showing that low slippage and low divergence loss trade off against each other — an AMM that's cheap for traders is, structurally, more expensive for the LPs funding it.

A taxonomy of what goes wrong

The second half of the paper is a security and privacy taxonomy, organized by which layer of the stack an attack targets:

Infrastructure layer — block-timestamp and transaction-sequence manipulation by miners/validators, plus generic threats like DDoS and the 51% attack that indirectly degrade a DEX's service.
Middleware layer — smart-contract vulnerabilities, reentrancy chief among them (the pattern behind both the 2016 DAO hack and a 2020 Uniswap-adjacent exploit).
Application layer — attacks specific to how AMMs price assets: oracle manipulation via flash loans, rug pulls, front-running, back-running, the sandwich attack that combines both, and vampire attacks that drain a protocol's liquidity by out-incentivizing it (SushiSwap's $830M migration from Uniswap in 2020 is the canonical example).

Alongside the attack surface, the paper covers the privacy implications of trading on a fully transparent ledger — transaction inspection, identity tracing, and behavioral-model inference — and the confidentiality techniques (zero-knowledge proofs, MPC, encrypted mempools) proposed to mitigate them, while noting the real tension between privacy and the market-supervision that regulators expect.

Where this connects to what's on this site

The framework here — reserves, a conservation function, spot price derived from its slope, slippage and divergence loss as the two implicit costs — is exactly the model behind the ERC-20 CFMM DEX write-up on this site: a constant-product $xy=k$ pool built to let outcome tokens from the LMSR prediction markets trade on a secondary venue. The survey is the theory; that project is one small, concrete instance of it.

References

Jiahua Xu, Krzysztof Paruch, Simon Cousaert, Yebo Feng — SoK: Decentralized Exchanges (DEX) with Automated Market Maker (AMM) Protocols, ACM Computing Surveys 55(11), 2023.
Open-access preprint — arXiv:2103.12732.
Related write-up — ERC-20 CFMM DEX.