{"id":"aedaa113-a9a3-4017-a892-0cd7f48e5597","arxiv_id":"2505.19006","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A new quantitative 'MEV interference' metric measures how much a smart contract's dependencies amplify economic losses from attacks, with theorems and DeFi case studies.","lead":"The paper introduces a mathematical measure of how much an attacker can amplify financial damage to a new smart contract by manipulating the contracts it relies on. The measure turns a yes/no security question into a number between 0 and 1, and the authors test it on lending and exchange attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Example 6's lending-pool computation implicitly assumes Cmin<1; for standard collateralization Cmin>1 the displayed MEV values go negative and I exceeds 1, contradicting Lemma 1(iii).","rationale":"The reader's verdict is CONDITIONAL, and the reader did flag an 'unstated Cmin range assumption' in Example 6, but chose reentrancy/partial-order as the weakest assumption. I agree that the reentrancy exclusion is a scope limitation, yet the Cmin issue is more concrete and directly testable: it produces values of I outside the proved bound [0,1] for realistic collateralization thresholds, and it arises in the paper's central motivating application. The core Definition 1 and the structural theorems seem internally coherent within the stated acyclic, well-formed model, so I do not recommend moving to REJECT solely on this basis. However, the example bug means the paper's claim that the notion can be applied to assess under-collateralized loan attacks is not currently supported as written. A conditional acceptance requiring correction/clarification of Example 6 (and the equality-versus-upper-bound issue in Example 5) remains the appropriate verdict.","tokens_in":25050,"tokens_out":22908,"duration_ms":147237,"concrete_test":"Recompute Example 6 with Cmin=1.5, n=10, r=10 using the paper's own equations: verify that restricted MEV should be 0 rather than n(1/Cmin−1), and evaluate the displayed I formula to see whether I lies in [0,1]. Repeat with Cmin=0.8 and compare the formula against I=1−MEV_{LP}/MEV computed directly from Equations (2)–(3). If I>1 or restricted MEV<0 for Cmin>1, the use case is invalid for standard collateralization parameters.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central application in Example 6 (AMM/Lending Pool) computes restricted MEV as n(1/Cmin−1). Since MEV is a maximum loss by Equation (3), it must be nonnegative; for any Cmin>1 this expression is negative, so the true restricted MEV is 0 because the adversary can simply abstain from borrowing. The unrestricted MEV formula t+x−n is likewise only valid when the attack actually reduces LP wealth. The displayed closed form for I then violates Lemma 1(iii): with Cmin=1.5, n=10, r=10 (so 4n≥r), the formula yields I≈1.25>1. The derivation silently assumes Cmin<1, i.e., a protocol that already permits borrowing more than deposited collateral; under that parameter regime the described 'under-collateralized loan attack' is not enabled by oracle manipulation, so the use case does not demonstrate what it claims. This is an internal inconsistency within a claimed application of Definition 1, not merely a typo: it shows the example computations are unreliable for the standard lending-protocol parameter range.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces MEV interference, I(S⇝∆) = 1 − MEV_{†∆}(S|∆,†∆) / MEV(S|∆,†∆) (with value 0 when the denominator is 0), as a quantitative, state-dependent measure of how much an adversary can amplify the economic loss of a set of contracts ∆ by manipulating their context S. The paper proves fundamental properties: I is always between 0 and 1 (Lemma 1), it is monotone under widening the context (Theorem 1), it is independent of non-adversarial user wallets (Theorem 2), and it is preserved when the context is extended with sender-agnostic, token-independent contracts (Theorem 3). It then applies the notion to archetypal compositions: Airdrop/Exchange, FeeManager/Airdrop, AMM/Bet, and AMM/LendingPool, with the last intended to quantify under-collateralized loan attacks enabled by oracle manipulation.","tokens_in":25224,"tokens_out":16334,"duration_ms":140724,"significance":"If the formal results are correct, the paper offers a clean, parameter-free quantitative refinement of the qualitative MEV non-interference notion of [6], with plausible applications to DeFi risk assessment. The definition is transparent, state-dependent, and does not rely on fitted parameters or circular reasoning. The theorems are supported by proofs in Appendix A, although those proofs depend on the well-formedness assumption of Section 2. The significance of the applications is not yet established, because several of the worked examples contain arithmetic or modeling errors that change the claimed conclusions.","major_comments":[{"comment":"The restricted MEV in Example 2 is computed as the amount transferred to the adversary rather than the loss of ∆. In a withdrawal of x=n from AirdropFee, the contract transfers n−fee to the caller and fee to the FeeManager owner, so the wealth of ∆ decreases by n regardless of the fee. By Eq. (3), MEV_{†∆}(S|∆,†∆)=n, hence I(S⇝∆)=0, contradicting the displayed I≤r/100. This is a misapplication of Definition 1 in the paper's own illustrative example.","section":"Section 4, Example 2 (Listing 1.2)"},{"comment":"The MEV formulas count the gross ETH output of the swap instead of the net wealth loss of Exchange. When M swaps x:T and receives x·r:ETH, Exchange gains x:T and loses x·r:ETH, so by Eq. (1) its loss is x(r−1), not x·r. Draining the Airdrop gives an unrestricted loss bounded by min((n_M+n_A)(r−1), n_E), not min((n_M+n_A)r, n_E), so the displayed piecewise expression for I is incorrect.","section":"Section 5, Example 4 (Airdrop/Exchange)"},{"comment":"The restricted MEV displayed as an equality, (2br0/(rr1)−b−1) for r0/(rr1)≥1/2, conflicts with the stated exact real-arithmetic assumption in Section 5 and with Appendix B, which derives the expression as an inequality after applying flooring. Under exact arithmetic the term should be 2br0/(rr1)−b, and the subsequent I formula should be a genuine equality rather than the bound derived in the appendix. The main text must either consistently use exact arithmetic or explicitly present the formulas as upper bounds.","section":"Section 5, Example 5 (AMM/Bet)"},{"comment":"The restricted MEV n(1/Cmin−1) is negative whenever Cmin>1, contradicting the nonnegativity of MEV (Eq. (3), Lemma A.1(5)) and causing the displayed I to exceed 1 (e.g., Cmin=1.5, n=10, r=10), which contradicts Lemma 1(iii). For standard collateralization Cmin>1 the true restricted MEV is 0 because the adversary can simply abstain from borrowing, while the unrestricted attack can still be profitable. The formulas are valid only in the unstated regime Cmin<1, and in that regime the described borrowing is available even without oracle manipulation. Moreover, the derivation maximizes t(x), the borrowed amount, rather than the actual loss t(x)+x−n; the derivative of the loss contains an extra +1 term, so x=(4n−r)/5 does not maximize the loss. The example needs to be reworked with explicit parameter ranges and max(0,·) truncation.","section":"Section 5, Example 6 (AMM/Lending Pool)"},{"comment":"The well-formedness assumption that the call relation ≺ is a partial order and the resulting exclusion of reentrancy are load-bearing: Lemma A.3 and Theorem 3 rely on there being no internal calls across the Γ/Γbar boundary. The footnote claims that reentrancy can always be removed by programming patterns, but gives no proof or reference, and for arbitrary existing compositions this is not evident. The paper should either relax the assumption or state this restriction prominently as a limitation in Section 6.","section":"Section 2 / Appendix A (Lemma A.3, Theorem 3)"}],"minor_comments":[{"comment":"The word 'minumum' should be 'minimum'.","section":"Section 4, after Lemma 1"},{"comment":"The closing sentence claims that the Bet/Exchange composition has zero MEV interference, but this is not derived anywhere in the example and needs a one-line justification or a reference.","section":"Section 5, Example 5"},{"comment":"In the second derivative computation, the term '-4(r+x^3)' appears to be a typo for '-4(r+x)^3'.","section":"Appendix B, Example 6"},{"comment":"The phrase 'analysequalitative' should be 'analyse qualitative'.","section":"Section 6"}],"recommendation":"major_revision","confidential_remarks":"The examples are the main demonstration of the framework, and the errors in Examples 2, 4, 5, and 6 are extensive enough that a careful rewrite of the applied sections is needed. The formal core may survive, but the paper's current claims of quantitative analysis of under-collateralized loan attacks are not supported by the computations as written."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the quantitative MEV interference definition is a real, useful extension of the qualitative non-interference notion from [6], and the main structural theorems are actually proved rather than hand-waved. It deserves a serious referee. But the showcase lending-pool example has a parameter bug that should be fixed before publication.\n\nThe new thing is Definition 1: I(S⇝∆) = 1 − MEV_†∆(S|∆,†∆)/MEV(S|∆,†∆), with the zero case handled. This gives a state-dependent, quantitative measure of how much the context amplifies losses to newly deployed contracts, and it collapses to the old binary non-interference notion exactly when I=0. Theorem 1 (monotonicity under adding contracts), Theorem 2 (irrelevance of non-adversary wallets), and Theorem 3 (preservation under front-running by sender-agnostic, token-independent contracts) are meaningful statements. The proofs in Appendix A are real proofs built on the local-MEV lemmas from [6]; the dependency is legitimate, not circular. The use cases illustrate the intended semantics, including the airdrop/fee example where I ≤ r/100, which is easy to read and correct.\n\nThe soft spots are in the examples, not in the core definition. Example 6 silently assumes Cmin < 1. For any standard lending protocol, Cmin > 1, and the displayed restricted MEV n(1/Cmin − 1) is negative. Since MEV is a maximum loss and the adversary can always choose to do nothing, the true value is 0 in that regime. The closed form for I then exceeds 1, contradicting Lemma 1(iii). The derivation would only be consistent for an already under-collateralized protocol, which is not the attack scenario the text describes. This needs a fix and an explicit parameter range. Example 5 has a smaller presentation issue: the main text states equalities, while Appendix B derives inequalities after flooring integer arithmetic; the formulas should be marked as bounds. Also, the partial-order/no-reentrancy assumption is load-bearing for Lemma A.3 and Theorem 3; the footnote dismissal of reentrancy as removable by programming patterns is not backed by a proof, and should be stated as a modeling restriction rather than a non-issue.\n\nWho is this for: people doing static analysis or risk assessment of DeFi compositions. It is an incremental but solid contribution, not a paradigm shift. My recommendation: send it to peer review. The central definition and theorems deserve referee time; the example bugs are locatable and fixable. I would ask for a corrected Example 6, a bounds-clear Example 5, and a more honest statement about the call-graph restriction.","headline":"A quantitative MEV-interference ratio with real proofs, but the lending-pool example silently assumes Cmin<1 and needs fixing.","tokens_in":25747,"tokens_out":5269,"would_cite":true,"duration_ms":49976,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper introduces MEV interference, a quantitative measure of how much an adversary's ability to manipulate a surrounding smart-contract context amplifies economic losses to newly deployed contracts.","keywords":["smart contracts","DeFi","MEV","economic security","non-interference","oracle manipulation","quantitative security","lending protocols"],"falsifier":"Find a real or constructible smart-contract composition with a reentrant or cyclic call graph in which an adversary can route an internal call from a target contract back into the context, and show that the unrestricted MEV then exceeds what the paper's formula assigns to any well-formed state; this would break Lemma A.3, which Theorem 3 uses.","tokens_in":24839,"feed_emoji":"📉","tokens_out":5164,"duration_ms":51646,"temperature":0.7,"pith_summary":"The paper introduces a quantitative security notion, MEV interference, that measures how much an adversary's ability to manipulate the surrounding context amplifies economic losses to newly deployed smart contracts. It extends the earlier binary MEV non-interference relation into a continuous scale from 0 to 1, where zero means the context adds nothing to an attack and one means all extractable loss comes from manipulating the context. The paper proves basic properties of the measure (boundedness, monotonicity, wallet independence, and invariance under front-running under certain conditions) and applies it to archetypal DeFi compositions, producing closed-form interference formulas for airdrop, exchange, bet, and lending-pool contracts. A sympathetic reading is that this provides the first quantitative, state-dependent way to rank how dangerous a context is to a set of contracts, rather than merely classifying a composition as secure or insecure.","feed_headline":"New metric measures how much DeFi context amplifies attacks","feed_subtitle":"The measure runs from 0 to 1; zero means the context adds no economic leverage to an attacker.","key_machinery":"The load-bearing object is the MEV interference ratio of Definition 1, which compares two 'local MEV' quantities over the same target contracts: the maximum loss adversaries can inflict when restricted to calling only the target contracts, versus when they may also call the surrounding context. The ratio is normalized into [0,1] by subtracting from 1 the restricted-to-unrestricted loss ratio, and it is set to 0 when the unrestricted loss is 0. Every theorem in the paper is a statement about how this ratio behaves when the context is widened or when the adversary's callable set is changed, and the use cases are closed-form evaluations of the ratio for concrete contracts.","core_discovery":"Definition 1 defines the MEV interference of a state S on contracts ∆ as I(S⇝∆) = 1 − MEV_{†∆}(S|∆,†∆) / MEV(S|∆,†∆), and 0 when the unrestricted loss is zero. The numerator is the maximum wealth loss an adversary can inflict on ∆ by calling only contracts in ∆; the denominator allows calls to any contract in the composition, including ∆'s dependencies in the context S. The ratio measures how much of ∆'s exposure is due to the context. The paper proves that I agrees with the existing MEV non-interference notion of [6] (I = 0 iff non-interferent), that it is monotone in the context (Theorem 1), independent of non-adversarial wallet balances (Theorem 2), and preserved under front-running when the target's dependencies are sender-agnostic and token-independent (Theorem 3). In the use cases, the measure quantifies oracle-manipulation and under-collateralized-loan attacks with explicit formulas, showing, for example, that a richer adversary sometimes needs the context less, while the interference can be near 1 when price manipulation is required.","pith_inferences":["A natural next step is to make the mempool a parameter of the restricted MEV, which the authors flag as future work; doing so would make I depend on pending user transactions and could rank compositions by attackable surface in real time.","The same ratio could be adapted to other damage metrics beyond token wealth, such as loss of user funds or protocol insolvency, by replacing the wealth function in Equation (1).","Because I(S⇝∆)=1 whenever the target has no independent exposure, the measure deliberately saturates; comparing two different attacks by raw loss amounts would require pairing I with the unrestricted MEV, not replacing it.","Testable conjecture implied by the examples: for constant-product AMMs, I decreases as the adversary's capital grows in the Airdrop/Exchange case but increases in the AMM/Bet and AMM/Lending cases, suggesting the direction of the wealth effect depends on whether the context is a source of funding or of price manipulation."],"forward_implications":["A composition with I(S⇝∆)=0 is economically non-interferent in the sense of [6], so the binary criterion becomes the zero case of a continuous scale.","Adding more contracts to the context can only increase or preserve the measured interference, never decrease it (Theorem 1).","Non-adversarial users' token balances do not affect the measured interference, so analyses can ignore all wallets except the adversary's (Theorem 2).","If the target's dependencies are sender-agnostic and token-independent from other contracts, front-running the target with extra contracts does not change its measured interference (Theorem 3).","For archetypal DeFi compositions, the measure yields closed-form expressions that quantify how AMM reserve sizes, collateralization thresholds, and adversary wealth affect the severity of oracle-manipulation and under-collateralized-loan attacks."],"supporting_citations":[{"why":"Supplies the local-MEV definition, the adversary model, and the qualitative MEV non-interference notion that Definition 1 extends and is shown to agree with.","marker":"[6]"},{"why":"Introduces the MEV-based economic security criterion for smart contract systems that the paper generalizes from a binary to a quantitative setting.","marker":"[3]"},{"why":"Provides the non-interference principle that motivates interpreting MEV non-interference and hence the interference ratio.","marker":"[11]"},{"why":"Defines Maximal Extractable Value in the consensus-adversary setting that grounds the loss measure.","marker":"[10]"}],"fun_headline_variants":["Quantifying how DeFi context amplifies economic attacks","New metric: interference in DeFi attack amplification","Measuring attack amplification from smart contract links","A number for DeFi context-based attack leverage","DeFi attack amplification: a metric from 0 to 1"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The model assumes contract call graphs are acyclic and states are well-formed, meaning a contract can only call contracts deployed before it; this rules out reentrancy and cyclic dependencies, and the compositionality proofs (especially Lemma A.3 and Theorem 3) rely on there being no internal calls crossing the boundary between the context and the target contracts.","fun_headline_variants_meta":{"raw":{"variants":["Quantifying how DeFi context amplifies economic attacks","New metric: interference in DeFi attack amplification","Measuring attack amplification from smart contract links","A number for DeFi context-based attack leverage","DeFi attack amplification: a metric from 0 to 1"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000295,"raw_usage":{"total_tokens":1703,"prompt_tokens":919,"completion_tokens":784,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":535,"completion_tokens_details":{"reasoning_tokens":710}},"tokens_in":535,"tokens_out":784,"duration_ms":5877,"temperature":1.0,"reasoning_tokens":710,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T14:21:23.025258+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Find a real or constructible smart-contract composition with a reentrant or cyclic call graph in which an adversary can route an internal call from a target contract back into the context, and show that the unrestricted MEV then exceeds what the paper's formula assigns to any well-formed state; this would break Lemma A.3, which Theorem 3 uses.","supporting_citations":[{"cited_title":"In: Financial Cryptography and Data Security (FC 2024)","cited_arxiv_id":null,"evidence_quote":"Supplies the local-MEV definition, the adversary model, and the qualitative MEV non-interference notion that Definition 1 extends and is shown to agree with."}],"review_version":1}