PropAMMs Got the Price Right. They Ran Out of Inventory.

On 29 October, the attacker behind the Binance drain converted 405M USDT into ETH on Ethereum over 35 minutes, beginning at 20:34 UTC. The concentrated buying pushed the onchain price of ETH more than 20% above Binance. This analysis examines how nine Ethereum PropAMMs responded, how much of their activity passed through the PropAMM router, and how Uniswap v3, Uniswap v4, and other venues priced the same flow.

The central finding: The PropAMMs priced the trades correctly, but their inventory was exhausted almost immediately. In the first two minutes, they sold 1,333.5 ETH at approximately the Binance price. Thirty-eight addresses bought that ETH, and most resold it into Uniswap in the same transaction at prices about 3% higher. Across the night, PropAMM trades had approximately zero five-minute markout against Binance. The cost was not mispricing; it was spending 5.6 to 11.7 hours without ETH to sell.

Timeline (UTC)

Time	What happened
29 Oct 20:30	The seven PropAMM vaults hold about 1,490 ETH, Metric's ETH in Uniswap v4 aside
20:34	The attacker's first swap lands; the PropAMM sell-out begins
20:36	Sell-out over: 1,333.5 ETH sold to 38 addresses. Uniswap trades more than 10% above Binance
21:01	Tether freezes the attacker's collector address
21:09	The attacker's last ETH purchase. Uniswap v3's main ETH/USDC pool peaks about 21% above Binance
21:23	The Uniswap premium falls below 10%
21:37	Uniswap is back within 1% of Binance
21:44	Metric sells ETH again
30 Oct 02:07	Goliath is the first vault back above 5 ETH
08:15	Kipseli is the last vault back above 5 ETH, two minutes after Fermi

The first two minutes

The attacker's first swap landed at 20:34. By 20:36, the PropAMMs had sold 1,333.5 ETH to 38 addresses at the Binance price. Fermi alone sold 1,009 ETH. None of these initial trades went through the PropAMM router.

The buyers were arbitrageurs. In 39 of the 43 transactions, a buyer took ETH from a PropAMM at the Binance price and sold it directly into a Uniswap v3 or v4 pool, where ETH was already trading about 3% higher. Those transactions moved 1,195 ETH and generated approximately $67k before gas and builder payments. The ETH ended up in the pools from which the attacker was buying.

Venue	ETH at 20:30	ETH at 20:37	Back above 5 ETH (30 Oct, UTC)	Hours without ETH
Fermi	1,191.6	0.0	08:13	11.7
Kipseli	78.3	0.0	08:15	11.7
Tempest	93.0	0.0	04:11	7.6
Stelaxis	58.4	0.5	03:54	7.3
ElZorro	4.6	0.1	03:51	7.3
Bebop and TaurusFi (one vault)	43.1	1.0	02:19	5.8
Goliath	24.8	0.1	02:07	5.6

All PropAMM volume, and the share routed

Most PropAMM volume does not pass through the PropAMM router. Solvers such as CoW Protocol, aggregators, and arbitrage bots can call the venues directly. We therefore measured every fill across every route, then isolated the subset that passed through the router.

From 20:00 on 29 October to 10:00 on 30 October, the nine PropAMMs executed 3,489 ETH trades worth $40.1M. The router carried 183 trades worth $2.99M, or 7.5% of total volume. The two-minute sell-out included no router trades.

The router's quiet hours were not caused by a routing problem. From 21:00 to midnight, the PropAMMs executed only about $0.2M of ETH volume across all routes because they had no ETH left to sell. Volume returned as the vaults refilled, both through the router and through direct calls.

Compared with a normal week, the router went from about 20 trades an hour to none in the 21:00 hour, and stayed well below normal until the vaults refilled after 03:00.

Venue	Trades	Volume ($M)	Router trades	Router volume ($M)	Net ETH sold	5-min markout ($k)
Metric	1,256	19.56	55	1.54	19.0	+0.4
Fermi	553	7.71	21	0.31	1,235.9	-2.4
TaurusFi	416	4.39	20	0.42	116.1	+2.7
Goliath	535	4.32	70	0.57	17.6	-0.3
Stelaxis	331	1.39	10	0.05	83.4	+0.7
Tempest	148	0.99	6	0.09	79.1	-0.4
Kipseli	60	0.85	0	0.00	84.9	-0.4
Bebop	91	0.60	0	0.00	-60.6	-0.1
ElZorro	99	0.27	1	0.00	4.6	+0.1
Total	3,489	40.09	183	2.99	1,580.0	+0.2

What happened on Uniswap v4 and other venues

The attacker's buying was routed through liquidity pools. On 29 October, Uniswap v3 traded $1.25B of ETH against USDC and USDT on Ethereum, compared with approximately $130M on an average day during the previous week. Uniswap v4 traded $425M, compared with approximately $23M.

From 20:34 to 21:10 UTC, while the attacker was buying, every pool-based venue sold ETH at a substantial premium to Binance:

Venue	Volume ($M)	ETH sold	Avg. premium over Binance	LP markout 20:34–21:10 ($M)	LP markout full night ($M)
Uniswap v3	515.5	37,383	+16.6%	+11.09	+2.44
Uniswap v4	228.6	17,025	+16.2%	+5.90	+1.11
Uniswap v2	14.0	741	+18.0%	+0.27	+0.13
Fluid	10.1	1,108	+12.3%	+0.27	+0.03
Curve	7.1	718	+22.0%	+0.29	+0.13
Native (RFQ)	3.9	1,697	+0.1%	-0.01	+0.03

Uniswap v3 and v4 moved together. Both traded more than 10% above Binance from approximately 20:36 to 21:23, then returned to within 1% by 21:37. Uniswap v3's main ETH/USDC pool (0.05% fee) peaked about 21% above Binance at 21:09, the minute of the attacker's final purchase. The largest individual pool was Uniswap v3's WETH/USDT 0.3% pool: it sold 21,671 ETH during those 36 minutes at an average premium of 18.9% over Binance.

The other side of the attacker's trades was the pools' liquidity providers. Measured against Binance five minutes later, LPs earned $11.1M on Uniswap v3 and $5.9M on Uniswap v4 during those 36 minutes. Over the full night, those figures fell to $2.4M and $1.1M. As the premium closed, arbitrageurs sold ETH back into the pools at prices above Binance, and the pools bought it.

What this means for PropAMM design

Venues that quoted from an exchange price behaved more like the PropAMMs. Native, an RFQ venue, and Metric, a PropAMM implemented as a Uniswap v4 hook, filled at approximately the Binance price throughout the night.

Inventory, not pricing, was the exposure

The PropAMMs priced the night correctly and still sold out in two minutes. A venue's size determines how much it can sell during a dislocation; inventory determines how long it can remain active afterward. Fermi held 1,190 ETH at 20:30 and none at 20:37. It took 11.7 hours to return above 5 ETH.

Following Binance alone can hand the onchain premium to arbitrageurs

When the onchain price moves several percentage points away from the exchange price, a quote anchored to Binance becomes the cheapest ETH available onchain. In this event, arbitrageurs bought that ETH and resold it into pools in the same transaction. A quote that also accounts for pool prices, widening when pools move away from the exchange, could have preserved inventory for the hours when ETH was scarce.

The router is a small part of the order flow

The router carried 7.5% of PropAMM volume that night and none of the initial sell-out. Much of the flow that tests these venues comes from solvers, aggregators, and arbitrage bots calling them directly. Any inventory or pricing protection therefore needs to be implemented in the venue's own quotes, not only in the router.

Passive liquidity captured the dislocation, then gave most of it back

Uniswap liquidity providers sold to the forced buyer at a substantial premium, averaging 16% on v3 and v4. As the gap closed, arbitrageurs sold ETH back into the pools at prices still above the exchange price, and the pools bought it. By morning, approximately 80% of the LPs' early markout gains had disappeared.

---

Sources and method

• Venues. The nine PropAMMs listed in lambdaclass/propamm-router-contracts. Router address: 0x4ddf368080cd7946db5b459ad591c350158175e1.
• Fills. Every WETH, ETH, USDC, and USDT transfer into or out of each venue's vault, using Ethereum transfers and traces on Dune, from 29 October 17:00 to 30 October 10:00 UTC. A fill is a transaction in which the vault swaps ETH against a stablecoin. Metric's trades are taken from Dune's dex.trades. A fill counts as a router fill when its transaction calls the router.
• Inventories. WETH plus native ETH in each vault, read onchain at block 26,299,997 and reconstructed block by block from that night's flows. "Back above 5 ETH" is the first time a vault held at least 5 ETH continuously for five minutes.
• Other venues. ETH–USDC and ETH–USDT trades on Ethereum from Dune's dex.trades. The baseline is the average from 22 to 28 October.
• Prices and markouts. Binance ETHUSDT one-second closes. Premium is the trade price relative to Binance at the same second. Markout is ETH × (Binance price five minutes later − trade price), calculated from the venue or liquidity provider's perspective.
• Attacker trades. From POL Labs' Binance drain analysis.