The $540.85M of Base DEX volume nobody can attribute

Now: Anonymous Vault Router (Safe 0xe296…5658). This is the contract the first version of this note led with, the one deployed at the same address on four chains that every entity database came back empty on. The reason every proxy lookup failed is that it stores its implementation in a custom storage slot rather than the EIP-1967 slot, so standard tooling reads nothing there. Reading that slot directly exposes a ~20KB implementation whose revert strings ("Bot address not whitelisted", "Not proxy owner and not whitelisted") match an already-labeled sibling cluster, and the governing Gnosis Safe is a hardcoded immutable in the runtime. Its callers are the cluster's own whitelisted bot fleet, not public users. Held unnamed by three prior runs, until a non-standard storage slot was checked.

Now: Anonymous Execution Proxy (operator 0xb045…7adb). Not identifiable on its own, and it had been skipped by an earlier pass as too thin to judge. It became legible as a fleet: 22 contracts on Base sharing one identical 680-byte runtime, all deployed by the same automated EOA, and all returning that same EOA from owner(). A per-user smart-wallet product would set the owner to each user; one owner across 22 contracts is one operator. This member carries 74% of the fleet's volume. We first wrote this up as private automated trading and had to correct ourselves hours later: it is running the Aerodrome liquidity strategy described below, which we only saw once we started reading position NFTs.

Now: MEV/Arbitrage Bot. Briefly the largest unattributed contract on Base once the two above were named. Its code is unverified, but it keeps its revert strings, and they settle the question: MIN_PROFIT, POOL_FLASH_FAILED, NO_CALLBACK_ADAPTER, TAIL_NOT_AFTER_LOOP. A profit floor enforced in the contract, a flash-loan callback and a cyclic route is the standard arbitrage design. The traffic agrees: across all 17,122 transactions in the window there is exactly one function selector, 95.6% of the calls revert, and 137 distinct unnamed EOAs drive it, the busiest 16 of them carrying 73.5% of the traffic. No frontend reverts nineteen of every twenty of its users' swaps for failing to clear a profit threshold.

Now: Anonymous Aerodrome LP Manager (operator 0x6c22…f64f). Nothing in its own bytecode names it: it is a 352-byte proxy over an unverified implementation whose only readable strings are about transferring gas. What names it is what it holds. Every NFT it receives is minted by one contract, and that contract's metadata reads "Slipstream Position NFT v1", symbol AERO-CL-POS: an Aerodrome concentrated-liquidity position. AERO arrives 233 times and leaves 5, which is what harvested emissions look like. It holds none of those positions. All 8,495 that passed through it in the window were minted, staked into an Aerodrome CLGauge, withdrawn and burned, and not one is still held. That is a two-transaction cycle rather than the single transaction we first reported, and the gauge leg is where the harvested emissions come from.

Now: Anonymous Aerodrome LP Manager (factory 0x6694…a8a0). The same business, run the opposite way: it holds 184 Slipstream positions rather than cycling them. Its revert strings are all namespaced LST: and are pure position mechanics (LST: invalid quoter, LST: rebalance failed, LST: Token already exists for this pool+tick). It is deployed by a factory rather than by a person, which is what a product looks like rather than a private fleet. We cannot tell you what LST stands for.

Now: Anonymous Vault Swap Executor (multi-DEX). Named September 15, 2026. The previous version of this note carried this contract as open and characterised it as a vault-gated arbitrage router driven by a whitelisted EOA fleet, from its revert strings and its 74% revert rate. An earlier pass had called it opaque. It is not: its 8,688-byte runtime reads directly. The only permitted caller is a vault whose identity is checked against a stored value (Only Vault can call this function, Mismatch between provided vault and contract vault), enforced at three separate caller-check sites in the bytecode. The venue surface is what settles the multi-DEX part: the external ABI carries five distinct V3-fork swap callbacks, for Uniswap, PancakeSwap, Algebra, Ramses and Hyperswap, plus an admin-curated pool registry. That is an executor built to be driven by one vault across several venues. Whose vault is still not established, and that is why the name is a description.

Now: Anonymous Execution Router (operator 0xbdb6…0e60). Named September 15, 2026. A router, not a bot and not an unattributed venue: our own router-entry data already carried it as a routing address at $111.3M across 43,284 legs, and an earlier version of this note had found its owner, the same EOA that owns the signature-gated executor further down. What settled the architecture was reading the deployer's nonce. It stands at 5,906, which means 5,905 contract creations, and the children can be derived from that nonce alone and checked on chain. Every one is a 129-byte call-forwarder with an identical code hash: it checks that the caller is this factory, reads a target address from the first twenty bytes of calldata, and forwards the rest. Thousands of disposable forwarders behind one owner-operated router is a fleet, and the operator is the address that owns it.

Corrected 2026-09-08; measurements below are from the window ending September 8, 2026 and have not been re-run on this one. Volume has fallen for a second week, $150.1M to $99.1M to $82.0M, and it is no longer the largest open contract: 0x4a8c4de8… below has overtaken it. The original entry called this "an owner-operated router on Uniswap v4, and the first head-of-pool contract here that does not look like a bot," and rested that on roughly eight thousand distinct senders and a revert rate of zero. Both supports have failed. The senders are not independent of each other, and the revert rate was never zero. The volume figure, the counterparties and the bytecode readings are unchanged and are restated below.

Now: a wallet fleet trading against a float the contract owns. The callers never pay. Across 331,517 swap calls in the seven days to September 8, the number in which the caller attached any ETH is zero. On a buy the contract sends WETH to the UniversalRouter and the token lands with the caller; on a sell the caller sends the token and the WETH comes back to the contract. A router spends the caller's money. This one spends its own, in both directions, every time.

Nor are the senders a population. We took the three thousand busiest and traced the first funding each had ever received: they resolve to seven addresses, and the seventh is 0x1ca0…e18e, this contract's own owner(). The median seed is 0.00015 ETH, paid once, which is gas and not stake. The trading capital never leaves the contract, and 86.5% of the swaps are round trips: the same wallet buying and then selling the same token, 7,206 wallets doing it, median holding time 56 minutes. Every swap call is 484 bytes exactly, a single hop at fee = 100 and tickSpacing = 1, the cheapest tier on v4, with those same parameters across all 178 tokens it touched.

The counterparty picture stands as first published. Its only ERC-20 counterparties are Uniswap's own infrastructure: inbound transfers are WETH from the v4 PoolManager, outbound ones are WETH to the UniversalRouter, both verified under those names on Base, and nothing else appears, which is what v4 flash accounting looks like from outside. So do the bytecode readings. Its 18,614 bytes are unverified but keep their strings: UniswapV2Library: IDENTICAL_ADDR, Ownable: caller is not the owner, and tokenOut not allowed. owner() and storage slot 0 both return the same EOA, which also deployed it.

The revert figure was wrong. We published "none of them reverted." The same window holds 1,443 reverts against 332,293 transactions, a rate of 0.434%, and no single day since this contract's first transaction on August 25 has been clean; the daily rate runs between 0.042% and 1.279%. The contrast the original paragraph drew still holds in direction: 0.434% against the 95.6% revert rate on this page's MEV bot, named above, is a different kind of machine, but it is a low revert rate and not an absent one. We did not measure the reverts before publishing the zero. That is the same fault as reading an unmeasured signal as a real one, which is a fault this pipeline has had before.

What we are not saying. Not whose fleet this is, and not why it runs. Round trips against your own float serve several ends, some of them ordinary, and nothing here separates them or establishes intent. We are also not saying the $150.1M measured that week (now $82.0M) is fictitious: the swaps executed, the pools moved, and the volume sat in the tracked total, which is why it belonged in this pool rather than outside it. The narrower claim is the one we are confident of, that a sender count assembled this way carries no evidence about users and cannot support the reading we gave it. What would settle it: whether the six funders above the fleet answer to one desk or to several, which is a question about their own funding chain and not about this contract. The three vectors we said would settle it last time, a calldata suffix, a fee recipient, or a referral tag, have now been checked across every call in the window and none of them exists.

Out of the pool entirely: $104.5M two windows ago, $3.3M in the last one, and nothing at all in this one. The characterisation below was measured on the window ending September 8, 2026 and stands as a description of what the contract is; the volume no longer does. Its sibling under the same owner, 0xa654a1c8…, has since been named above. Then: signature-gated executor, one operator, two contracts. 41,867 transactions from 4,204 distinct senders through exactly one function selector, with 44% reverting. Thousands of senders crowding a single entrypoint and losing half the time is a race, not a product; nobody ships a consumer flow that fails every other attempt. Its 10,786 bytes carry \x19Ethereum Signed Message:, so the entrypoint verifies an off-chain signature before it will act.

Its counterparties are 22 addresses in each direction across USDC, WETH and cbBTC, and one of them is Morpho, verified under that name. A signature-gated single entrypoint racing against a lending protocol is the shape of liquidation or a similar time-sensitive strategy, and the asset mix fits. owner() returns the EOA 0xbdb6…0e60, which also owns 0xa654a1c821f7604b5500a2fe8de67a737497d10d, which was ninth in the open pool at $18.1M a week when this was written and is now named above at $121.7M. Different bytecode, same owner: one operator, two contracts, and the router half is no longer open.

What we are not saying. Not that it is liquidating Morpho positions; a lending protocol among a contract's counterparties is not proof of what it does there. What would settle it: decoding that one selector, and checking whether the reverts cluster on the same block as someone else's success, which is what losing a race looks like and what ordinary failure does not.

What we know: this is now the largest open contract on Base, up from $75.6M. Unverified, ~9.1KB of bytecode. Executes Seaport-style fulfillBasicOrder settlement calls alongside its DEX activity. Holds an inventory of airdropped spam tokens, which pollutes behavioral fingerprinting. No deployer attribution. Volume is real routed DEX flow, not transfer noise.

Dossiered on September 22, for the first time. Two earlier passes skipped it without spending the budget on a full forensic profile. The profile came back with nothing to hold: no deployer attribution, no visible funders, zero named counterparties, no standard read interface, and a selector hint of balanceOf and nothing else. Its volume rose while its evidence did not. We are recording the dossier path as exhausted for this address so the next pass does not spend on it again; what is left is a status-carrying query over the chain's own transaction table, which is a different instrument.

What we know: was third-largest when it entered this list at $24.0M and has fallen to $13.4M, which puts it below the two contracts now sitting third and fourth. Still unexamined. No characterisation is offered and no attribution claim is made; it is here so the head of the pool is stated in full.

What we know: listed three versions ago as the second-largest open contract. It has kept falling, $5.3M in the last window and $0.2M in this one, and is nowhere near the head of the pool. Still unexamined, and no attribution claim is made.