PaperlayerView exact revision on arXiv

Source-linked AI summary

If It Walks Like an Arbitrage: Protocol-Agnostic Detection with Decidable Structural Equivalence

Adam Khayam, Hamid Kolli, Mohamed Iguernalala, Çagdas Bozman

arXiv:2608.20377v1q-fin.CPcs.CRcs.LG

TL;DR

The paper asks how to identify arbitrage structure in Ethereum execution traces and determine when two traces implement the same strategy. It builds a call-hierarchy-preserving AST of transfers, repeatedly rewrites it to a canonical form, and uses the resulting structure for detection and equivalence queries. The evaluation compares the system with Eigenphi and ArbiNet across Ethereum blocks, while the formal development establishes termination, soundness, confluence, and decidability.

  • Problem

    Existing systems do not answer what arbitrage structure an execution trace contains or when two traces implement the same strategy.

  • Method

    The system converts decoded execution traces into a sender-enriched AST and repeatedly rewrites it until cycles and a canonical form emerge.

  • Results

    The evaluation compares Argos with Eigenphi on 220 000 Ethereum blocks and with ArbiNet on 1 000 shared blocks.

  • Takeaways & Limitations

    Canonical forms support decidable structural equivalence and make detection, family classification, and related fund-flow queries expressible over the same substrate.

  • Takeaways & Limitations

    The system analyzes single-transaction execution traces and cannot detect cross-transaction, cross-chain-through-bridges, or non-atomic arbitrage.

Abstract

from arXiv · show

Ethereum transactions admit a canonical structural form. Each execution trace is built into an abstract syntax tree of token transfers grouped by call-frame nesting and reduced by a convergent term rewriting system of 15 rules to a unique canonical form. The system is terminating, sound, and confluent, and the induced structural equivalence on fund flows is decidable. All five properties are mechanized in Rocq with zero admitted obligations. The canonical form makes structural questions about fund flows decidable, opening the way to strategy-family classification, bot fingerprinting, and equivalence-based attribution. In this paper, we demonstrate the canonical form on arbitrage detection: cycles emerge at fixpoint and are read off the canonical form, with no protocol-specific patterns. The pipeline depends only on the standard ERC token and WETH ABIs and no protocol-specific events, so the same binary runs unmodified on Arbitrum and BSC. We evaluate on 220 000 Ethereum blocks against Eigenphi (production MEV platform) and on 1 000 shared blocks against ArbiNet (GNN classifier). The system produces 469 801 confirmed detections and 245 497 attempted arbitrages; across all detections it agrees with Eigenphi on 83.5% and covers 81% of ArbiNet, while surfacing 60 199 exclusive confirmed detections. 99.2% of all detections are produced by the fixpoint alone and are sound by construction. Manual validation of 500 transactions finds no false positives in the confirmed tier. Forensic reanalysis of 200 Eigenphi-exclusive detections finds 63.5% have no cycle in canonical form; 9.0% have cycles the fixpoint detects but our conservative classifier does n

1 Introduction

The paper introduces a canonical, protocol-agnostic structural representation for Ethereum fund flows and demonstrates arbitrage detection as a query over it. Its formal guarantees and empirical evaluation support decidable equivalence and practical forensic classification.

  • Motivation: Arbitrage detection requires identifying structures in execution traces and determining when two traces implement the same strategy.Existing approaches discussed in the paper include fixed attack catalogs, aggregate graph cycles, and machine-learning labels.
  • Illustrative examples: Three artificial arbitrage topologies share token closure and positive net delta despite differing call hierarchies.The examples motivate structural rather than topology-specific detection.
  • Approach: The system transforms execution traces into transfer ASTs and repeatedly chains, merges, and annotates nodes until a canonical fixpoint is reached.The rewriting system is described as terminating and confluent, yielding a unique canonical form.
  • Approach: A sender-enriched AST preserves call hierarchy and distinguishes swap from relay without protocol-specific knowledge or event catalogs.The same binary is used for Arbitrum and BSC.
  • Contributions: Flash-loan arbitrages emerge structurally without lending-specific logic, and verdicts include transfer chains, profit calculations, and diagnostic reasons.This extends the structural approach beyond protocol-specific arbitrage patterns.
  • Evaluation: The evaluation covers 220 000 Ethereum blocks against Eigenphi and compares performance with ArbiNet on 1 000 shared blocks.The evaluation pipeline, Rocq sources, and binaries are reported as publicly available.

2 Preliminaries

The preliminaries define Ethereum execution traces, transfer representations, call-hierarchy-preserving ASTs, transfer chains, arbitrage cycles, and the two-layer detection pipeline.

  • Ethereum execution model: Ethereum transactions are signed by EOAs and may invoke nested smart-contract calls through CALL, DELEGATECALL, and STATICCALL.These internal calls form the execution call tree.
  • Transfer representation: Each transfer is represented by source, destination, amount or identifier, token type, and the sender of its nearest enclosing CALL frame.DELEGATECALL does not update the sender field, preserving the external caller context for proxy contracts.
  • Cash flow tree: The cash flow tree mirrors the EVM call stack, with Tree nodes for calls and Leaf nodes for transfers ordered by trace position.This nesting preserves relationships among transfers produced within the same contract invocation.
  • Chains and tokens: A transfer chain links each transfer’s destination to the next transfer’s source, while chains can compose through token or balance continuity.Closing a chain into a cycle requires matching token types, including ETH and WETH equivalence at boundaries.
  • Arbitrage cycles: An arbitrage cycle returns to its origin, has token-equivalent endpoints, and has a strictly positive net balance in its cycle token.Transaction-level gross and net balances aggregate cycle deltas and subtract transaction costs.
  • Pipeline overview: The pipeline decodes raw traces into an ABI-decoded AST, then analyzes the AST in memory through rewriting, profit computation, and classification.OSINT enrichment is attached in the decode layer but is not consumed by detection.

3 Detection Algorithm

The algorithm converts execution traces into sender-enriched ASTs, rewrites transfer leaves and nodes to a fixpoint, and classifies validated cycles. Termination, confluence, preservation, soundness, and decidable equivalence are formally established.

  • 3.1 From Traces to ASTs: The pipeline constructs an AST whose Tree nodes represent nested call frames and whose Leaf nodes represent token transfers ordered by trace position.Each leaf retains the transfer’s sender from the enclosing call frame, and the initial tree faithfully represents the decoded trace.
  • 3.3 Manipulation of the AST Nodes: Node-level rewriting chains same-token pass-throughs, merges parallel chains, and connects complementary chains so multi-cycle flows become closed cycles.Intermediate addresses absorbed during chaining are recorded as middlemen, while cycle connection handles chains that do not close within one subtree.
  • 3.2 Manipulation of the AST Leaves: Trimming removes structural noise while preserving every transfer leaf, then leaf manipulation chains compatible sibling transfers and lifts fully reduced subtrees.The resulting representation retains transfer chains and residual leaves for subsequent node-level processing.
  • 3.4 Fixpoint and Termination: The fixpoint terminates because each pass labels a chain or strictly reduces a node’s child count, reaching normal form in at most 3n−2 passes.Labels are monotonic, and practical convergence occurs in k iterations whose growth depends on the maximum chain depth.
  • 3.4–3.5 Validation and Classification: An Arbitrage verdict requires a closed, token-matching, positive cycle with no leftovers; incomplete reconstruction instead yields a Warning and diagnostic reasons.Leftovers commonly reflect missing transfer decodings or routing that pairwise chaining cannot resolve, potentially making profit calculations incomplete.
  • 3.6 Formal Properties: The 15-rule rewriting system is terminating and confluent, yielding a unique canonical form that makes structural equivalence decidable.Preservation ensures rewritten chains and transfers originate in the initial AST, while Rocq mechanizes the formal properties and supports extraction of a verified reference implementation.

4 Implications of Decidability

The canonical form supports decidable structural queries beyond arbitrage detection, including equivalence and strategy-family classification. These queries operate over normalized fund-flow trees without changing the rewriting kernel.

  • Any predicate built from canonicalization, syntactic equality, skeleton mapping, finite membership, or delta inspection inherits decidability.
  • Arbitrage detection is a linear-time predicate over canonical forms, identifying token-closed cycles with positive delta.
  • Structural equivalence is decidable by reducing two call-flow trees and comparing their canonical forms, even for deeply nested traces.
  • The abstraction framework could support structural retrieval and unsupervised strategy discovery, but identifying natural MEV abstractions and their expressiveness remains future work.
  • Flash-loan-wrapped arbitrages extend the grammar through leftover-cycle nodes while preserving the rewriting kernel and trust base.
  • Family classification abstracts away token names, arity, and path length, so tx𝑅 and tx𝑆 share a skeleton despite different concrete forms.

5 Evaluation

The evaluation tests Argos across large Ethereum data and a shared ArbiNet subset, showing graduated agreement, substantial exclusive coverage, and strong manual validation. Structural analysis also characterizes attempted arbitrages, cycle batching, recovery paths, and latency.

  • Detection Accuracy: 83.5% agreement with Eigenphi covers 542 279 of 649 790 detections, with agreement varying monotonically across confidence tiers.Confirmed detections have 87.2% Eigenphi agreement, while uncertain detections have 21.0%.
  • Detection Accuracy: 60 199 confirmed arbitrages are exclusive to Argos, alongside 148 422 attempted, 11 612 probable, and 28 081 uncertain detections.These 248 314 Argos-only transactions represent activity not flagged by Eigenphi.
  • Manual Validation: 100% of sampled confirmed detections in both baseline-overlap and Argos-only categories are genuine arbitrages except for one ambiguous Argos-only case.The baseline-overlap sample contains 100 genuine arbitrages; the Argos-only confirmed sample contains 99 genuine and one ambiguous transaction.
  • Manual Validation: 63.5% of 200 Eigenphi-only detections have no canonical-form cycle, while 9.0% contain genuine cycles at inner contract addresses that conservative classification does not surface.Another 27.5% contain cross-token routing cycles rather than arbitrages.
  • Comparison with ArbiNet: 81% overlap with ArbiNet on 1 000 shared blocks includes 634 Argos-exclusive detections, including 148 confirmed and 411 attempted arbitrages.Argos also covers 92% of Eigenphi detections on this subset.
  • Topology and Performance: 89.1% of transactions reduce to one cycle, while 6.7% reduce to two and 4.1% to three or more; 28.5% of warnings contain leftover cycles recovered structurally.Structural pairing discovers flash-loan round-trips in 51% of exclusive confirmed detections.
  • Topology and Performance: 245 497 attempted arbitrages comprise 31.1% of detections, and their per-block ratio has a median of 0.33 with prominent modes at 0, 1/2, and 1.The fractional peaks are consistent with small-k competition, with k≤4 cycles per block.
  • Topology and Performance: 0.25 ms median and 2.24 ms P95 full-pipeline latency exclude trace retrieval, while the rewriting algorithm alone takes 0.07 ms median and 0.47 ms P95.Only 0.02% of transactions containing an arbitrage cycle exceed 100 ms.

6 Related Work

Prior detectors trade off protocol coverage, transaction-level explainability, and formal guarantees. This work instead treats arbitrage as a query over a canonical structural representation while retaining execution context.

  • Earlier measurements and graph methods identify arbitrage at scale but can undercount protocol variants or lose transaction-level execution context.Qin et al. reported a lower bound based on known protocol signatures, while graph methods aggregate transfers across blocks.
  • Cycles in flat transfer graphs do not reliably indicate arbitrage because non-exploitative flows such as yield harvesting can also be cyclic.
  • Protocol-specific detectors require handcrafted catalogs that must be extended for new variants and provide no formal guarantees.Examples include DeFiRanger, ActLifter, and a detector using 44 handcrafted patterns.
  • Machine-learning classifiers offer catalog-free generality but produce labels without the transfer chains that explain them.ArbiNet provides binary labels from training data, whereas this system reconstructs transfer chains, calculates profit, and supplies diagnostic reasons.
  • The proposed approach makes arbitrage one query over a canonical-form substrate with mechanized structural soundness and decidable equivalence.Its formal relationship to symbolic protocol-state enumeration remains open future work.

7 Limitations

The formal guarantees apply to decoded transfers, while the evaluated system is limited to single-transaction, atomic execution within a single 30-day window.

  • Theorems apply only to transfers emitted by the decoder, so decode-layer coverage remains a separate empirical question.Missing transfers can reduce recall without compromising soundness.
  • The system cannot detect multi-transaction strategies, cross-chain arbitrages routed through bridges, or non-atomic arbitrage.Non-atomic flows pairing on-chain swaps with off-chain CEX trades account for 25%+ of DEX volume in cited work.
  • The evaluation covers a single 30-day window, and no public historical MEV label datasets exist for cross-regime comparison.

8 Conclusion

The paper presents canonical structural forms as a formal algebra for Ethereum fund flows, using arbitrage detection as its simplest query. The conclusion points toward broader chain and strategy coverage through new structural predicates.

  • Every decoded Ethereum transaction reduces to a unique canonical form, making structural equivalence under R1–R15 decidable.The rewriting system is terminating and confluent, and its five formal properties are mechanized in Rocq with zero Admitted obligations.
  • The EVM call hierarchy and sender information let arbitrage cycles emerge from the fixpoint instead of requiring explicit cycle search.Canonicalization is the primary output; detection is one query over it.
  • The same rewriting system extends beyond Ethereum, with Appendix D running the binary on Arbitrum and BNB Smart Chain after only a configuration change.
  • Future annotation predicates could apply the canonical-form approach to flash-loan attacks, liquidations, governance exploits, sandwiches, and cross-transaction attacks.
  • The paper frames canonical form as carrying structural answers for broader flow patterns, including wash trades and sandwich attacks.

Ethical Considerations

The study uses public blockchain data and considers dual-use, privacy, and classification-neutrality concerns. Its outputs expose executed transfer structure, while intent interpretation remains with the analyst.

  • The evaluation uses publicly available Ethereum transactions, execution traces, and transfer events, without private data, human subjects, or live-market interaction.No IRB/ERB approval was required.
  • Flagged transactions include complete transfer chains, profit calculations, and pool identifiers that could help reverseengineer competitors’ executed strategies.The authors note that these opportunities have already executed and that comparable information is publicly or commercially available.
  • The published dataset contains hashes, block numbers, structural verdicts, and timing measurements, while detection uses transfer tuples and call hierarchy rather than OSINT labels.Address metadata comes from public sources but is not used by the analysis layer.
  • The classifier identifies cyclic token flows with positive net balance regardless of intent and does not distinguish beneficial arbitrage from exploitative extraction.Interpretation of intent is deliberately left to the analyst.

Open Science

The paper releases formal proofs, evaluation data, reproducible pipelines, and compiled detection tools, while documenting protocol-agnostic coverage across AMM designs and a fully mechanized Rocq development.

  • Artifacts: The release includes formal proofs, empirical-evaluation artifacts, and binaries sufficient to reproduce the paper’s core contributions.The formalization reproduces proofs, while the remaining artifacts reproduce the empirical evaluation.
  • Evaluation: The evaluation dataset records verdicts, diagnostic reasons, cycle counts, latency, Eigenphi labels, and ArbiNet predictions across the comparison ranges.The dataset supports reproducing the reported statistics, figures, and tables.
  • Detection tool: The released binaries support offline trace analysis and RPC-based inspection on EVM-compatible chains, including Arbitrum and BSC.Changing the RPC URL and wrapped-token address enables testing on other EVM chains.
  • Protocol scope: The detector is insensitive to AMM pricing-family choice because distinct pool mechanisms expose the same transfer-event interface at the EVM trace level.Curve’s multi-token reserves and Balancer’s vault routing are handled through transfer chaining, while v3 tick crossings preserve the AST structure.
  • Formalization: 5 564 lines, 157 lemmas, 8 theorems, 4 corollaries, and 0 admitted or axiom uses comprise the self-contained Rocq development.The development mechanizes Preservation, Termination, Soundness, Confluence, and Decidability of Structural Equivalence.

B.3 Proof of Theorem 3.3 (Soundness)

The soundness proof establishes that an Arbitrage verdict requires a structurally valid, profitable, and fully accounted-for cycle, while explicitly leaving room for false negatives.

  • Verdict conditions: Algorithm 4 returns Arbitrage only when no cycles, leftovers, negative net balance, or mixed-balance reasons are present.Its strict priority cascade otherwise returns None or Warning.
  • Economic soundness: Positive gross balance is required at the cycle’s entry token, and net balance is computed after subtracting gas costs.Validate-Deltas downgrades chains with nonpositive gross delta before Algorithm 4 evaluates aggregate net balance.
  • Value attribution: No leftovers guarantees that every transfer is accounted for, preventing hidden outgoing flows from invalidating the profit calculation.If leftovers exist, the cascade returns Warning before the Arbitrage verdict.
  • Structural soundness: An Arbitrage verdict implies at least one closed, token-matched cycle satisfying the structural conditions of Definition 2.5.Closure and token matching are established through cycle annotation and promotion rules.
  • Boundary: The soundness guarantee excludes false positives for Arbitrage but does not exclude false negatives when genuine arbitrages contain leftovers or mixed balances.The converse from genuine arbitrage to Arbitrage verdict does not hold.

B.4 Proof of Theorem 3.4 (Confluence)

The confluence proof uses execution-order structure, deterministic rule selection, commuting tree operations, and fixpoint termination to show that every trace has one reduced AST.

  • Deterministic traversal: Sequential execution orders siblings by trace position, providing the traversal order used to disambiguate overlapping rewrite sites.The algorithm processes siblings left-to-right and selects one rule through priority cascades.
  • Chaining: Greedy chaining selects the first compatible sibling, and swap-pair uniqueness makes that compatible partner unique for each address and token pair.Separate EVM call frames place transfers from distinct pool invocations in distinct AST subtrees.
  • Lifting: Lifting is deterministic because liftable nodes are structurally determined, independent lifts commute, and nested lifts must proceed bottom-up.These properties yield the same tree regardless of the order of independent lifts.
  • Merging: Parallel-path merging is order-independent because union and component-wise delta addition are associative and commutative.Consequently, merging k chains with shared endpoints produces the same final node regardless of pairing order.
  • Fixpoint: Annotation depends only on chain attributes, while repeated annotate-connect passes converge because termination and the fixpoint guard eliminate ordering differences.Each pass and the full sequence of intermediate trees are uniquely determined by the input.
  • Conclusion: The complete pipeline produces a final reduced AST and verdict uniquely determined by the input execution trace.The proof combines unique stage outputs with the terminating fixpoint construction.

B.5 Proof of Theorem 3.6 (Decidable equivalence)

Termination and confluence give each trace a unique normal form, so structural equivalence is decidable by reducing both traces and comparing their canonical trees; arbitrage cycles refine graph cycles.

  • Canonical forms: Every term reaches a normal form in at most 3n−2 steps, and confluence makes the rewriting system convergent.Thus every term has a unique normal form T↓.
  • Equivalence: Two traces are equivalent exactly when their normal forms coincide, because joinability implies equal normal forms and equal normal forms imply joinability.The argument uses confluence in both directions.
  • Decidability: Structural equivalence is decidable because normal-form computation terminates and syntactic equality of trees is decidable.The result applies to the rewrite relation’s word problem.
  • Cycle refinement: Every arbitrage-labeled chain in the reduced AST forms a closed walk in the transaction’s transfer graph, but not every graph cycle qualifies.A transaction can contain eight closed graph walks without satisfying the token-matching condition required by R14.
  • Mechanized boundary: The mechanized development treats address and token types as opaque with decidable equality, while token equivalence is supplied as a deployment predicate.The theorems hold for extraction instantiations under the stated well-formedness obligation.

C.1 A Stablecoin Migration Exploit

The case study shows a confirmed arbitrage whose canonical AST exposes both a multi-hop stablecoin route and profit from a token-contract migration. The same structural analysis also identifies a flash-loan-funded arbitrage with a large cross-protocol return.

  • Stablecoin migration: Two of ten reduced AST chains are annotated as arbitrage cycles, while the remaining eight are individual swaps.The final tree has 10 chain nodes and four leftover leaves after 10 reduction steps.
  • Stablecoin migration: Three chained swaps connect agEUR, EURe, EUROC, and agEUR into the main arbitrage cycle.The fixpoint connects the agEUR→EURe→EUROC→agEUR route into one cycle.
  • Stablecoin migration: 2,413 EURe is netted from the old-versus-new EURe contract distinction without requiring knowledge of the migration.The algorithm detects differing EURe token amounts as a positive delta and routes the new-contract tokens onward.
  • Stablecoin migration: The operation is funded by a 2,413.95 agEUR Balancer flash loan whose borrow and repayment collapse into one leftover cycle.The recovery pass recognizes the matched transfers as a specular pair.
  • Flash-loan arbitrage: A second confirmed arbitrage turns 17.72 ETH into 17,930 WETH through Bancor, BNT, and AAVE in a three-hop route.The AST records a 1,000× return and attributes the discrepancy to the AAVE/WETH pool, without determining its cause.
  • Flash-loan arbitrage: 13,088 ETH goes to the block builder and 4,824 ETH to the EOA after the bot unwraps the remaining WETH.The builder payment represents 73% of gross profit.

C.3 A Yield Harvest That Looks Like an Arbitrage

This case study distinguishes yield harvesting from arbitrage by requiring token continuity at cycle boundaries and evaluating the resulting balance. Although flat transfer graphs show address-level cycles, the reduced AST explains why the transaction is not an arbitrage.

  • AST analysis: Eight reduced closed loops all represent swaps or reward sales with differing input and output tokens, so none satisfies the cycle condition.Every row has s(C) = d(C), but no row satisfies the token-equivalence rules.
  • Flow structure: The transaction’s USDC flows form a funnel from multiple pools into the contract and onward to the sender, not a cycle.No USDC returns to the pool from which it came.
  • Economic interpretation: The operation harvests CRV and CVX rewards, sells them through WETH for USDC, and unwinds a Curve position rather than seeking trading profit.The final balance is negative because gas exceeds the small ETH residual.
  • Verdict: The verdict is not an arbitrage because no cycle has matching boundary tokens, gross balance is mixed, and net profit is negative.The same conclusion is stated directly in the case-study verdict.
  • Why the AST matters: An aggregate transfer graph can expose address-level cycles here, but the AST preserves call hierarchy and token continuity to explain why they are independent operations.The reduced AST makes each operation auditable without protocol knowledge.

D.1 Arbitrum

The portability tests run the same detection binary on Arbitrum and BSC with only the wrapped-asset address changed. Representative transactions reduce to canonical shapes matching Ethereum arbitrages, while detection rates reflect each chain’s transaction mix and coverage.

  • Arbitrum setup: Arbitrum required no changes to rewriting rules, cycle heuristics, or thresholds; only the WETH address was configured.The binary used the same source code as the main evaluation.
  • Arbitrum results: 50 confirmed arbitrages and 952 warnings were found among 23,250 Arbitrum transactions.The overall flagged rate was 4.3%, and confirmed arbitrages averaged 2.0 cycles per transaction.
  • Arbitrum case study: The representative Arbitrum transaction reduces to the same canonical shape as Ethereum triangular arbitrages: two chained swaps and a leftover extraction.Its 0.024 USDC surplus is forwarded externally, so the system classifies it as Warning rather than Arbitrage.
  • BSC results: BSC produced 88 confirmed arbitrages and 922 warnings among 38,126 EIP-1559 transactions, with 2.6% flagged overall.The full-transaction denominator includes legacy transactions outside the covered population and is not the meaningful comparison.
  • BSC case study: The BSC case reduces to the same triangular canonical shape as Ethereum and Arbitrum, with R1 and R14 firing in the same order.The case contains three chained swaps through different pools and a positive WBNB surplus.
  • Portability implications: Across both chains, the only chain-specific parameter is the wrapped-asset address, and detection operates without OSINT labels or protocol metadata.The approach reasons over token flows and sender fields rather than external names.

E ArbiNet Comparison: Case Study

The ArbiNet case study shows agreement on some transactions but substantive disagreements on token identity and unseen routing patterns. Structural rewriting rejects a stablecoin-based false positive while detecting multi-hop and Uniswap V4 arbitrages missed by the GNN.

  • Agreement: Three transactions are flagged as arbitrage by Eigenphi, ArbiNet, and the structural system, forming a high-confidence consensus set.The agreement spans protocol-specific heuristics, GNN classification, and structural rewriting.
  • Partial agreement: One transaction is classified as a warning because its real cycle has mixed post-gas balances, making the economic outcome indeterminate.The cycle is genuine, but gas costs exceed gross profit across the relevant balances.
  • ArbiNet false positive: ArbiNet’s CoW settlement false positive has USDC input and USDT output at cycle boundaries, violating structural token identity despite stablecoin price equivalence.The structural condition requires τin = τout rather than economic interchangeability.
  • ArbiNet false negatives: ArbiNet misses a three-pool multi-hop arbitrage and a Uniswap V4 triangular arbitrage that the structural system and, in one case, Eigenphi confirm.The reported examples involve routing contracts absent from ArbiNet’s training data and post-2022 contracts.
  • Structural advantage: The algorithm infers swap structure from complementary Transfer events and call-frame identity rather than requiring protocol-specific swap events.The swap structure is produced by the algorithm, not supplied as an input.
  • Structural advantage: The reduced AST filters topology-based false positives, supports detections outside training sets, and gives analysts an explainable decomposition of fund flows.These advantages are stated as the case study’s comparison with GNN-based classification.
Loading 2608.20377v1…