With the total volume and liquidity reaching new heights since DEFI-summer, we thought it would be interesting to take a look at the data behind Uniswap, the biggest decentralized exchange to date. While its volume doesn’t come close to the volume traded on the biggest centralized exchanges, the variety of tokens is enormous. If this seems like a good thing, it isn’t. There are nearly 30 thousand pairs listed on Uniswap and because they can be listed at nearly no cost, it’s a playground for people, or groups of people, with bad intentions. The graph below shows the amount of pairs that have been listed on each day since april 2020. During the month of October 2020, approximately 7500 pairs were listed, with some days topping off at over 300 per day, that’s one every 5 minutes.
Anyone who has traded on Uniswap is familiar with the ”Token Safety Alert” message that pops up whenever you’re visiting a pair. Since Uniswap is a decentralized exchange, and thus there is no team actively scanning these tokens and projects, it’s probably the best they can do. Looking at the numbers, we can conclude that not even 10% of the pairs on Uniswap can be freely traded.
To determine if one could ’freely trade’ within a pair, we looked at the liquidity of the pool at the beginning of February 2021. From the nearly 30 thousand pairs on Uniswap, exactly 2223 pools had more than $100 in them. Over 26 thousand pairs have exactly $0 liquidity. As a side note, many legitimate projects on Uniswap have one main ETH pair, and multiple other (failed) pairs that were started by the community. These pairs have no liquidity, but are not suspicious pools.
From the 25 thousand unique tokens, there are approximately 14 500 unique tickers. Not looking at WETH, USDC, USDT and DAI, the top 20 tokens based on frequency are given below.
Take a look at pneumonoultramicroscopicsilicovolcanoconiosis1 and wzdfchsqhwcbgwbuzsgwrsrsldc. You are not having a stroke, these are real ERC20 tokens listed on Uniswap. As you could’ve guessed, none of these tokens have any liquidity. Of course you shouldn’t judge a book by its cover, but if the cover is pneumonoultramicroscopicsilicovolcanoconiosis, you might want to rethink.
The graph below shows the amount of pools with liquidity within the given range. As mentioned before, a big part of the <1k pools belong to community members starting an exotic pair.
When a hyped project is announcing a listing on Uniswap, a lot of pairs pop up out of nowhere with the same ticker. An example of this was the UMB listing on February 9th 2021. The same day the real token listed on Uniswap, a total of 8 tokens with the same ticker were detected. Since being one of the first buyers on a Uniswap listing has its perks (the bonding curve often makes for parabolic launches), many people buy based on ticker and don’t verify the contract address.
- Pair address : 0x02805e505116863cfbbb0e3f22ae1ffad9cf27b6
2. Pair address : 0xbb5db92ab739ae3537a9a544d49853e8dc60be13
- Date : 2021-02-09 12:08:05
Contract : 0x58160b1338e482828790f8b41a0483c649a8b84b Ticker : UMB/WETH
Pool size : 6000000 UMB/70 ETH
Current status : Rugpulled
Estimated profit : 3.6 ETH
- Date : 2021-02-09 12:34:51
Contract : 0x775fd16efc9aac08f67369e89811095ac17a5999 Ticker : UMB/WETH
Pool size : 7036492 UMB/200 ETH
Current status : Rugpulled
Estimated profit : 11.7 ETH
- Date : 2021-02-09 13:08:055
Contract : 0xf6444de39529d6057e107e6a90f0e803558d0dc1 Ticker : UMB/WETH
Pool size : 2600000 UMB/75 ETH
Current status : Rugpulled
Estimated profit : 13 ETH
- Date : 2021-02-09 13:57:32
Contract : 0x838f02f8a98cc4f17248b72182acdb33c1895a90 Ticker : UMB/WETH
Pool size : 1000000 UMB/30 ETH (+40 ETH) Current status : Rugpulled
Estimated profit : 27.7 ETH
- Date : 2021-02-09 14:30:46
Contract : 0xefe635624608808cd4a806eca3cc971c0ed9987c Ticker : UMB/WETH
Pool size : 1000000 UMB/40 ETH
Current status : Rugpulled
Estimated profit : 1.3 ETH
- Date : 2021-02-09 14:32:08
Contract : 0x8b65ce1de931c977fc05ef377712b0697dfe6b3a Ticker : UMB/WETH
Pool size : 7000000 UMB/200 ETH
Current status : Rugpulled
Estimated profit : 22.8 ETH
- Date : 2021-02-09 14:37:48
Contract : 0x5a4bd25c213a56bc0f281121ae752e51c9347161 Ticker : UMB/WETH
Pool size : 250000 UMB/1.3 ETH
Current status : Rugpulled
Estimated profit : 0 ETH
- Date : 2021-02-09 14:50:26
Contract : 0xfe4a6a2565d52b442edba16c1fbbdc9f26b6d275 Ticker : WETH/UMB
Pool size : 8595843 UMB/249 ETH
Current status : Rugpulled
Estimated profit : 26.5 ETH
- Date : 2021-02-09 16:11:38
Contract : 0xc08eeae938efa1ff974d8304c19deb803b764bf5 Ticker : UMB/WETH
Pool size : 3448276 UMB/1 ETH
Current status : Active
Estimated profit : 0 ETH
The estimated profit is based on the amount of ETH that was pulled out minus the ETH that was put in the pool. The only reason these wallets can exit with more ETH than they originally put in, is because the tokens they put in are not legitimate tokens. Once you buy them, you are not able to sell them. There are multiple ways to do this, and without thoroughly inspecting the token contract, it’s best to not immediately jump in. You can see creating fake tokens is a pretty lucrative business, with one wallet making a profit of almost 30 ETH in under 3 hours.
The first method involves the approve function on Uniswap. When swapping a token on your wallet for the first time on Uniswap, you have to approve the token. By doing this, you allow Uniswap to spend your tokens. In theory you can limit this amount to exactly how much you want to swap. As this transaction is put on the blockchain and thus costs gas, it’s better to allow Uniswap to spend an infinite amount (2256-1) of your tokens, which is exactly what the built-in function on the Unisap GUI does for you. ERC20 tokens that are used in scams often don’t have this approve function and immediately revert or reset the allowance to zero. This means that Uniswap cannot spend your tokens and you’ll be stuck with them forever.
Another method withdraws the tokens from your wallet before the swap on Uniswap happens. You can literally see this in the contract, and since you buy the tokens, there’s not much you can do. At first, everything seems normal, the token gets approved, the swap is put on the blockchain, great. When you look at the transaction on Etherscan however, you’ll see that before the tokens are sent to Uniswap, 99.99% of your tokens are withdrawn.
The final and most straightforward method is the whitelisting of addresses. Some ERC20 tokens will have an owner function. This is then used to revert any action on the token that is not coming from the owner, i.e. the scammer, of the token. Not every token with that function is a scam, and not every scam token has that function. There’s not much you can do about this. Some tokens also have other addresses whitelisted, to create the illusion of selling in the pool. A pool with only buy transactions seems suspicious, so the scammer can have for example 5 addresses from which they can sell small portions of tokens, to make it \look like they are not taking your money.
In conclusion, it is in your best interest to not buy any token on Uniswap if you’re not sure about the token address. Many token projects that list on Uniswap will give you the token contract beforehand, to prevent their community from buying into those scams.