DeFi

AMM

An AMM, or automated market maker, is a decentralized exchange design where smart contracts quote trades from liquidity and formulas instead of an order book.

An AMM lets users trade against a pool of tokens using math instead of matching buyers and sellers.

AMM Explained in Detail

An AMM uses a formula to quote trades from pool reserves. A common model is constant product pricing, where the product of two reserves stays roughly constant after fees.

AMM prices can change immediately when someone swaps, which makes spot prices risky as oracle inputs.

Smart contract example

x * y = k

In a constant product AMM, buying token X with token Y changes both reserves and moves the price.

AMM in Auditing

AMMs are often integrated into lending, vault, staking, routing, and liquidation systems. A protocol that trusts AMM spot prices may be vulnerable to price manipulation.

Auditors review AMM interactions for pricing, callbacks, slippage, rounding, and reentrancy.

Red flags in code

  • Spot AMM price is used for borrowing or collateral valuation.

  • Swaps omit slippage checks.

  • Custom invariant math is not tested near edge cases.

  • Callback hooks can call back into sensitive functions.

  • Low-liquidity pools affect high-value protocol actions.

How to test or review it

  • Simulate large swaps and reserve manipulation.

  • Test sandwich-like paths around user swaps.

  • Review callback trust and pool address verification.

  • Fuzz rounding around small reserves and large trades.

  • Prefer robust oracle design over raw AMM spot reads.

Liquidity Pool

A liquidity pool is a smart contract reserve of assets used for swaps, lending, liquidations, pricing, or vault accounting.

Slippage

Slippage is the difference between the expected trade price and the actual execution price, often caused by liquidity, volatility, or transaction ordering.

Sandwich Attack

A sandwich attack is a front-running pattern where an attacker places one transaction before and one after a victim trade to profit from the victim's price impact.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like AMM into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources