In the 7 days to September 8, 2026, 17.97% of tracked Base DEX volume routed through contracts that no public label, no registry, and none of our own forensic passes can tie to a frontend or app. A week ago that figure was $590M, at 8.28%. The share more than doubled while Base DEX volume fell by roughly a third, so this is not a bigger pool of new flow we failed to keep up with: it is a smaller market in which the part we cannot place shrank far less than the part we can. The five contracts named below stayed named: we identified $228M of it, including the contract this note was originally built around. Here is what we found, how, and what is still open.
ClearTrace attributes DEX volume to the party that actually sent it, using four independent vectors: calldata-suffix trapping, proxy-router tracing (where the transaction target is not the venue), multi-hop origin tracing, and fee-recipient attribution, backed by a forensic labeling pipeline (verified-source lookups across four chains, deployer attribution, bytecode and behavioral fingerprints). On Base that resolves 82.03% of tracked volume to a named origin: frontends, aggregators, market-maker desks, MEV bots, vault systems.
"Unattributed" is the residue, counted strictly. It includes contracts our own pipeline has examined and explicitly failed to identify; on July 30, 2026 we corrected our coverage metric because those "manual review" placeholders had been counted on the attributed side, which had flattered the number. Everything named below has been through the full forensic pipeline. Where we could not name it, we say so.
Dune's own dex.trades resolver reports $4.86B of raw tracked volume for this
window, and every figure on this page is computed on all of it. That is a change from the
previous version of this note, which excluded two contracts the resolver itself named
FakeHook, at $1,786.5M carried in a single transaction apiece, a pricing artifact
rather than real trading. Those rows fall outside the 7 days to September 8, 2026, so there is
no exclusion left to make and no ex-outlier basis to state: we report $4.86B as tracked volume,
and raw tracked volume is the same number. Both this window and the one before it are stated on
the same all-in basis, so the fall in the denominator is a real fall in traded volume and not an
artifact ageing out of the comparison.
It is tracked volume, not the chain's total. Our $4.86B is 82.4% of DefiLlama's $5.89B for Base over the same window. We are under it again, where the previous window read 88.4% and older windows ran at 140% and 111% of DefiLlama. Both directions are the same warning: these are different measurements of the same chain, taken from different source data, and the gap between them moves by more in a week than any figure on this page. We went looking for a double-count when the ratio ran high and did not find one; every transaction is collapsed to a single notional before any volume is summed, and the excess was already present in the raw per-leg source data before our pipeline touched it. What we have not done is re-localize the gap now that it has crossed to the other side. So read every percentage here against our tracked set, not against Base as a whole.
About a third of it is bots. 34.49% of the denominator is MEV and arbitrage flow, which has no frontend by construction. So the 82.03% we attribute should not be read as 82.03% being apps. Most of what we resolve is bots, desks, and routers behaving exactly as expected. The unattributed slice is the part nobody can place at all.
The five contracts below were the top of this page's open list when we named them, in the week to August 17, 2026; the volumes shown are their volume in the current window. None of them is a company name, because none of them resolves to one: the evidence supports an operator and an architecture, not an identity. That is the standard we hold ourselves to, and it is why these read as descriptions rather than brands.
Now: Anonymous Vault Router (Safe 0xe296…5658). This is the contract the first version of this note led with, the one deployed at the same address on four chains that every entity database came back empty on. The reason every proxy lookup failed is that it stores its implementation in a custom storage slot rather than the EIP-1967 slot, so standard tooling reads nothing there. Reading that slot directly exposes a ~20KB implementation whose revert strings ("Bot address not whitelisted", "Not proxy owner and not whitelisted") match an already-labeled sibling cluster, and the governing Gnosis Safe is a hardcoded immutable in the runtime. Its callers are the cluster's own whitelisted bot fleet, not public users. Held unnamed by three prior runs; the thing that broke it was checking a non-standard slot.
Now: Anonymous Execution Proxy (operator 0xb045…7adb). Not identifiable
on its own, and it had been skipped by an earlier pass as too thin to judge. It became legible
as a fleet: 22 contracts on Base sharing one identical 680-byte runtime, all deployed
by the same automated EOA, and all returning that same EOA from owner(). A
per-user smart-wallet product would set the owner to each user; one owner across 22 contracts
is one operator. This member carries 74% of the fleet's volume. We first wrote this up as
private automated trading and had to correct ourselves hours later: it is running the
Aerodrome liquidity strategy described below, which we only saw once we started reading
position NFTs.
Now: MEV/Arbitrage Bot. Briefly the largest unattributed contract on Base
once the two above were named. Its code is unverified, but it keeps its revert strings, and
they settle the question: MIN_PROFIT, POOL_FLASH_FAILED,
NO_CALLBACK_ADAPTER, TAIL_NOT_AFTER_LOOP. A profit floor enforced in
the contract, a flash-loan callback and a cyclic route is the standard arbitrage design. The
traffic agrees: across all 17,122 transactions in the window there is exactly one function
selector, 95.6% of the calls revert, and 137 distinct unnamed EOAs drive it,
the busiest 16 of them carrying 73.5% of the traffic. No frontend reverts nineteen of every
twenty of its users' swaps for failing to clear a profit threshold.
Now: Anonymous Aerodrome LP Manager (operator 0x6c22…f64f). Nothing in
its own bytecode names it: it is a 352-byte proxy over an unverified implementation whose only
readable strings are about transferring gas. What names it is what it holds. Every
NFT it receives is minted by one contract, and that contract's metadata reads "Slipstream
Position NFT v1", symbol AERO-CL-POS: an Aerodrome concentrated-liquidity
position. AERO arrives 233 times and leaves 5, which is what harvested emissions look like.
It holds none of those positions. All 8,495 that passed through it in the
window were minted, staked into an Aerodrome CLGauge, withdrawn and burned, and
not one is still held. That is a two-transaction cycle rather than the single transaction we
first reported, and the gauge leg is where the harvested emissions come from.
Now: Anonymous Aerodrome LP Manager (factory 0x6694…a8a0). The same
business, run the opposite way: it holds 184 Slipstream positions rather than cycling them.
Its revert strings are all namespaced LST: and are pure position mechanics
(LST: invalid quoter, LST: rebalance failed, LST: Token
already exists for this pool+tick). It is deployed by a factory rather than by a
person, which is what a product looks like rather than a private fleet. We cannot tell you
what LST stands for, and we are not going to guess.
Three claims here were measured on a sample rather than across the window: this section's MEV contract, from 300 transactions; the Aerodrome manager's position cycle, from 200 NFTs; and the vault-gated router's absence of ERC-20 transfers, further down. We have re-run all three over the whole window. The router's held exactly, at zero transfers in or out. The Aerodrome cycle held in its conclusion, that the contract keeps none of the positions, but not in its mechanism, and is restated above. The MEV contract's did not hold: 300 transactions out of 17,122 gave 75% reverts and 16 senders, where the full window gives 95.6% and 137. That sample was not unlucky. The contract's traffic is concentrated enough that its busiest 16 senders carry 73.5% of it, so a small draw sees those senders and few others, and a rate computed from the same draw carries the same bias. No identification and no dollar figure changes. What does change is that a sampled figure should not have been set beside measured ones without saying which it was.
The residue is still a long tail, but a markedly shorter one than last week. $873M is spread across 3,406 contracts, only 74 of which moved more than $1M; the largest is 17.2% of the pool and the top ten together are 66%. The median open contract moved about $3,850. A week ago the same paragraph read $590M across 6,711 contracts, with the largest at 14.4% and the top ten at 40%. So the pool grew by $283M while the number of contracts holding it halved: this window's residue is concentrated in a handful of large unknowns rather than spread across the tail, which is the opposite of the shape we have described here before. All three have since been through the forensic pipeline. None of them resolves to a name, and we are not going to invent one, but the architecture and the traffic are legible enough to say what kind of thing each is, and to say what would settle it. Read them as characterisations, not identifications.
The five are identifications: an operator and an architecture, each resting on evidence that survived a check designed to break it. The three below are one step short. We can say what they behave like and rule things out, but nothing here ties any of them to a product, a desk or a person, so none of them has left the open pool and none is counted in the $228M.
Corrected 2026-09-08. The reading below replaces the one first published here. The original entry called this "an owner-operated router on Uniswap v4, and the first head-of-pool contract here that does not look like a bot," and rested that on roughly eight thousand distinct senders and a revert rate of zero. Both supports have failed. The senders are not independent of each other, and the revert rate was never zero. The volume figure, the counterparties and the bytecode readings are unchanged and are restated below.
Now: a wallet fleet trading against a float the contract owns. The tell is
that the callers never pay. Across 331,517 swap calls in the seven days to September
8, the number in which the caller attached any ETH is zero. On a buy the contract
sends WETH to the UniversalRouter and the token lands with the caller; on a sell
the caller sends the token and the WETH comes back to the contract. A router spends the
caller's money. This one spends its own, in both directions, every time.
Nor are the senders a population. We took the three thousand busiest and traced the first
funding each had ever received: they resolve to seven addresses, and the
seventh is 0x1ca0…e18e, this contract's own owner(). The
median seed is 0.00015 ETH, paid once, which is gas and not stake. The
trading capital never leaves the contract, and 86.5% of the swaps are round trips:
the same wallet buying and then selling the same token, 7,206 wallets doing it, median holding
time 56 minutes. Every swap call is 484 bytes exactly, a single hop at fee = 100
and tickSpacing = 1, the cheapest tier on v4, with those same parameters across
all 178 tokens it touched.
The counterparty picture stands as first published. Its only ERC-20 counterparties are
Uniswap's own infrastructure: inbound transfers are WETH from the v4 PoolManager,
outbound ones are WETH to the UniversalRouter, both verified under those names on
Base, and nothing else appears, which is what v4 flash accounting looks like from outside. So
do the bytecode readings. Its 18,614 bytes are unverified but keep their strings:
UniswapV2Library: IDENTICAL_ADDR, Ownable: caller is not the owner,
and tokenOut not allowed. owner() and storage slot 0 both return the
same EOA, which also deployed it.
The revert figure was wrong. We published "none of them reverted." The same window holds 1,443 reverts against 332,293 transactions, a rate of 0.434%, and no single day since this contract's first transaction on August 25 has been clean; the daily rate runs between 0.042% and 1.279%. The contrast the original paragraph drew still holds in direction, because 0.434% against the 95.6% and 74% of the contracts either side of it is a different kind of machine, but it is a low revert rate and not an absent one. We did not measure the reverts before publishing the zero. That is the same fault as reading an unmeasured signal as a real one, which is a fault this pipeline has had before.
What we are not saying. Not whose fleet this is, and not why it runs. Round trips against your own float serve several ends, some of them ordinary, and nothing here separates them or establishes intent. We are also not saying the $150.1M is fictitious: the swaps executed, the pools moved, and the volume sits in the tracked total, which is why it belongs in this pool rather than outside it. The narrower claim is the one we are confident of, that a sender count assembled this way carries no evidence about users and cannot support the reading we gave it. What would settle it: whether the six funders above the fleet answer to one desk or to several, which is a question about their own funding chain and not about this contract. The three vectors we said would settle it last time, a calldata suffix, a fee recipient, or a referral tag, have now been checked across every call in the window and none of them exists.
Now: signature-gated executor, one operator, two contracts. 41,867
transactions from 4,204 distinct senders through exactly
one function selector, with 44% reverting. Thousands of senders crowding a
single entrypoint and losing half the time is a race, not a product; nobody ships a consumer
flow that fails every other attempt. Its 10,786 bytes carry
\x19Ethereum Signed Message:, so the entrypoint verifies an off-chain
signature before it will act.
Its counterparties are 22 addresses in each direction across USDC, WETH and cbBTC, and one
of them is Morpho, verified under that name. A signature-gated single
entrypoint racing against a lending protocol is the shape of liquidation or a similar
time-sensitive strategy, and the asset mix fits. owner() returns the EOA
0xbdb6…0e60, which also owns
0xa654a1c821f7604b5500a2fe8de67a737497d10d, ninth in the open pool at $18.1M a
week. Different bytecode, same owner: one operator holding $122.6M of this
window's unattributed volume across two contracts.
What we are not saying. Not that it is liquidating Morpho positions; a lending protocol among a contract's counterparties is not proof of what it does there. What would settle it: decoding that one selector, and checking whether the reverts cluster on the same block as someone else's success, which is what losing a race looks like and what ordinary failure does not.
Now: vault-gated arbitrage router driven by a whitelisted EOA fleet. 160,861 transactions from only 296 distinct senders across 3 selectors, with 74% reverting. That is the same signature that settled the MEV contract named earlier on this page at 95.6% and 137 senders, an order of magnitude fewer callers than the contract at the head of this section and the opposite revert profile.
It never holds anything. Across the sampled window it has no ERC-20 transfers in
or out at all, despite $94.3M of routed volume, so value moves between other parties
and this contract only directs it. Its 8,688 unverified bytes say the same thing in words:
Unable to forward call, Only Vault can call this function,
Mismatch between provided vault and contract vault, and a caller gate that is
explicit about who may use it, only eoa allowed to call and
eoa not whitelisted. There is no owner(); authority sits with the
vault, not with this contract.
What we are not saying. Not whose fleet it is. The whitelist is the
operator's, and we have not resolved the vault it answers to.
What would settle it: reading that vault address out of its storage layout
and checking whether its 296 senders overlap the whitelisted cluster behind
0x278d858f…, whose implementation gates on
Bot address not whitelisted in the same idiom. If they overlap, these are one
operation and this page has already named half of it.
These three together are $349M, or 40% of the whole pool. Two of the three behave like automated trading. The one at the head of this section does not, and that is the result worth taking away from this window.
What we know: unverified contract, ~9.1KB of bytecode. Executes
Seaport-style fulfillBasicOrder settlement calls alongside its DEX activity. Holds
an inventory of airdropped spam tokens, which pollutes behavioral fingerprinting. No deployer
attribution. Volume is real routed DEX flow, not transfer noise.
What we know: unverified, ~21.9KB of bytecode, so a substantial program rather than a minimal proxy. No deployer attribution, no named counterparties in its flow, and the same airdropped-spam-token pollution. Behavior is consistent with an owned routing or inventory contract; whose, we cannot say.
Update: no longer open. The attribution engine has since labeled this contract (it currently resolves as an automated trading contract) and it has left the open pool. Its volume is shown for continuity with the previous version of this note; it is not part of the $873M above.
What we know: listed here in the previous version of this note as the second-largest open contract. It is no longer near the head of the pool: its volume fell to $3.9M this window while three larger unknowns appeared above it. Still unexamined, and no attribution claim is made.
All figures are tracked DEX volume over the 7 days ending September 8, 2026, with attribution labels as of September 8, 2026. Attribution volume refreshes on the Monday sync, so the volume window and the label date are stated separately. Updated 2026-09-08. The prior version of this note covered the week to August 24, 2026, where the unattributed slice read $590M of $7.13B, or 8.28%. Tracked volume fell about a third to $4.86B while the unattributed slice rose to $873M, so the share more than doubled to 17.97%. Both windows are stated on the same all-in basis, with nothing excluded from either denominator. The 08-24 window was itself revised on 08-30, when labeling with the volume window unchanged drained that pool from $663M (9.29% of tracked) to $590M (8.28%); the $590M is the figure this window is compared against.
Growth-number integrity. When a chain, a grants program, or an incentive campaign reports DEX volume, the unattributable slice is the part no reviewer can classify as organic or bot. On Base that slice is $873M a week. You cannot say what incentives bought until you can say who sent the volume.
Unknown winners. Not every unknown is a bot, though of the five we named here, four were infrastructure and one was outright arbitrage. Some of the volume we have resolved on Base traced back to real products, including a major exchange's aggregator router that carried tens of millions before it was labeled. A contract quietly moving eight figures a week might be extraction, or it might be infrastructure for an app succeeding on your chain that no ecosystem team has on its radar. Either answer is worth having.
If you can tie any of these contracts to a frontend, app, desk, or bot operator, or you know someone who can, I want to hear from you: andrew@cleartracedata.com. Verified labels go into the open attribution dataset with credit if you want it, and the coverage number above moves for everyone who uses the data.
We hold ourselves to a verification standard: a label ships only when the evidence survives the same forensic checks that failed to name these contracts in the first place. That standard is also why the five we named here are named for their architecture and their operator address rather than for a company we cannot prove is behind them.
Data: ClearTrace attribution engine, tracked Base DEX volume, 7-day window ending September 8, 2026, labels as of September 8, 2026. Attribution volume refreshes on the Monday sync, so the volume window and the label date are deliberately stated separately. Coverage percentages are volume-weighted and use our corrected classifier, which counts explicit non-identifications as unattributed. Contract observations are from public on-chain records; "unverified" means no source code is published on the chain explorer. Written by Andrew Maury, founder of ClearTrace. ClearTrace is a neutral measurement service: no venue, chain, or aggregator pays for placement in our data.