The Simulation Spoofing Attack: How Malicious Pools Are Weaponizing Trust in DeFi Quotes

In the ashes of Terra, we learned that liquidity can be weaponized. But a new attack uncovered by Enso goes deeper: it weaponizes the very simulation that traders and aggregators trust to find the best price. Over the past months, two distinct pools—one on Curve (Ethereum) and another on Uniswap v4 (Polygon)—have executed a novel form of fraud. They return fake, inflated quotes during simulation, then revert or execute at worse prices when the real transaction lands. The result: $30,000 in wasted gas and $34,600 siphoned from users who believed they were getting the best deal. This is not your typical MEV. This is an attack on an implicit assumption that underpins the entire DeFi routing layer. The anatomy of this attack is deceptively simple. When you swap tokens on a decentralized exchange, your wallet or aggregator simulates the trade across dozens of pools to find the optimal route. The simulation runs locally or on a node, estimating output amounts and gas cost. It does not modify state—it’s a read-only preview. The attacker exploits this by deploying a pool that returns an artificially attractive price during simulation. For example, the Curve pool on Ethereum would show a significantly higher output than honest pools, luring the simulation to choose it. But when the actual transaction is sent and executed, the pool either reverts (wasting gas) or executes at a much worse price, netting the attacker the spread. On Polygon, the Uniswap v4 hook used a conditional revert: the trade would succeed only if certain conditions were not met—conditions that the attacker controlled. In 99.1% of attempts, the trade failed, burning user gas. The attacker’s profit came from the rare successful trades where the price was manipulated in their favor. From my years auditing smart contracts, I’ve seen exploits that drain millions, but this one is particularly insidious because it exploits a fundamental trust: that simulation equals execution. The industry has optimized for speed—aggregators race to find the best quote in milliseconds, and wallets pride themselves on accurate gas estimates. But nobody thought to verify that the quote actually materializes. Enso’s analysis reveals that the malicious Curve pool processed 129,000 transactions before being detected. The attacker deployed multiple similar contracts, indicating a systematic campaign. The detection challenge is acute because pools can switch between honest and malicious behavior on a per-transaction basis, making static analysis nearly useless. This is not a one-off; it’s a blueprint. The contrarian truth is that this attack, while small in absolute losses, exposes a systemic vulnerability. The DeFi routing layer—composed of aggregators, wallets, and simulation engines—has become a blind spot. Every new protocol that allows custom logic (hooks, custom curves, dynamic fees) becomes a potential vector. Uniswap v4’s flexibility, celebrated for enabling innovation, also lowers the bar for deploying malicious behavior. The attacker didn’t need a complex exploit; they just needed to write a hook that lies during simulation. The industry’s euphoria around modular liquidity is masking the fact that every module can be a trap. As one security engineer told me, “We built a highway, but forgot to add guardrails.” Enso’s Shield is a direct response—a runtime verification layer that checks whether the executed output matches the simulated promise. But adoption is not yet widespread, and the arms race has just begun. In the ashes of Terra, we learned that liquidity can be illusory. Now we must learn that simulation can be deceptive. The takeaway is clear: the next phase of DeFi security will not be about preventing reentrancy or oracle manipulation alone. It will be about ensuring that every quote is not just an estimate but a binding commitment. The tools exist—execution verification, fraud proofs, and cross-chain validation. The question is whether the market will demand them before the next cascade of failures. Watch for more pools on other L2s, more hooks on Uniswap v4, and more aggregators scrambling to update their simulation engines. The ashes of Terra are still warm.