Skip to main content

Make Manipulation Unprofitable

The Manipulator's Ledger​

For any trading venue there is only one core question: can manipulation make money? As long as pump-and-dump has positive net returns, attacks will happen. The goal of defense is to make that net return persistently negative — the cost a manipulator pays to distort the price must always exceed what they can extract.

Most protocols defend with "after-the-fact patches": risk rules, trading limits, emergency pauses. Catswap builds defense into the structure of every layer; from entry to exit, a manipulator pays us at every step.

Layered Defense (Concepts)​

  1. Wicks never enter the accounting price — the prices used for valuation and liquidation are EMA benchmarks of in-pool trades; a momentary wick cannot get into the accounting price (real case: in a pulse move of +53% within roughly 30 seconds, the accounting price followed only a small part of it). The "fake price" a manipulator pumps up cannot be used to extract protocol funds.

  2. Paying for deviation — when trading deviates significantly from the price benchmark, the trade itself pays progressively higher fees proportional to the deviation. Pumping pays, dumping pays: every leg of the full manipulation loop (enter — pump — exit) taxes the pool, which means paying the LPs.

  3. Aggregate exposure caps — the derivatives exposure a single pool can accumulate has a total bound, determined by the pool's own depth. The thinner the pool, the smaller the extractable total — attack revenue is naturally tied to pool size: thin pools are not worth attacking, deep pools cannot be moved.

  4. Reserve guards — under extreme conditions, outflows from the pool are structurally limited, eliminating the tail risk of a single trade emptying one side of the reserves.

Defense Is Revenue, Not Cost​

What these layers share: where does the manipulator's money go? Into the pool, as LP revenue. Defense is not an operating expense but part of the protocol's economy — the more someone tries to manipulate, the more honest LPs benefit. This is the fundamental difference from designs where "defense = cost."

Industry Reference​

The lessons of oracle manipulation repeat across the industry: pump a thin pool → the oracle reads the price → a lending protocol is drained (Moonwell/MAMO, Mango Markets, and similar cases). Their shared structural flaw is that the pricing source and the liquidity source are separated — an attacker only needs to break the weaker link. Pool-as-market plus layered defense closes that path: prices are born in the pool, fees are collected in the pool, exposure is capped by pool depth — there is no external weak link to go around.