Self-Execution

Automated Market Makers (AMMs) are self-executing smart contracts that algorithmically set asset prices and facilitate peer-to-pool trading. They operate on a deterministic pricing formula, such as the constant product formula x * y = k, to provide liquidity 24/7.

• Core Mechanism: Liquidity providers deposit token pairs, and the contract automatically executes swaps based on the formula.
• Key Example: Uniswap's core pools are governed entirely by on-chain code, with execution triggered by any user transaction.

In protocols like Aave and Compound, lending pools are self-executing contracts that autonomously manage deposits, loans, and liquidations.

• Automated Functions: The contract automatically accrues interest, calculates borrowing power based on collateral, and executes liquidation when a user's health factor falls below a threshold.
• Non-Custodial: All asset management and risk enforcement is performed by the contract's immutable logic, removing the need for a trusted intermediary to approve loans or seize collateral.

A Decentralized Autonomous Organization (DAO) is a self-executing governance system where rules and treasury actions are encoded in smart contracts.

• Proposal Execution: Once a governance vote passes predefined thresholds, the associated transaction (e.g., fund transfer, parameter change) is executed automatically by the contract.
• Transparent Enforcement: This ensures that the outcome of collective decision-making is implemented exactly as specified, without requiring manual intervention by a central party.

Cross-chain bridges often rely on self-executing contracts on both the source and destination chains to automate asset transfers.

• Lock-and-Mint: A user's assets are locked in a contract on Chain A, which triggers a verifiable event. A relayer or oracle submits proof to a contract on Chain B, which then automatically mints a representative token.
• Atomic Swaps: Using Hashed Timelock Contracts (HTLCs), two parties can exchange assets across chains with execution guaranteed by time-locked cryptographic conditions.

Decentralized oracle networks like Chainlink provide self-executing data feeds that update on-chain without manual triggers.

• Automated Updates: A decentralized network of nodes independently fetches data, reaches consensus off-chain, and submits it in a transaction. An aggregator contract on-chain automatically calculates the median value and updates the latest answer.
• Critical for DeFi: This automated, reliable data delivery is essential for triggering liquidations, settling derivatives, and executing limit orders in other self-executing systems.

Decentralized perpetual futures exchanges (e.g., dYdX, GMX) use self-executing contracts to manage complex trading mechanics autonomously.

• Automated Functions: Contracts automatically calculate and deduct funding payments between long and short traders, manage collateral and leverage, and execute liquidations when positions become undercollateralized.
• Order Matching: While some use off-chain order books, the final trade settlement, P&L distribution, and fee collection are enforced on-chain by the protocol's core smart contracts.

A classic vulnerability where an external contract's callback function can re-enter the calling contract before its state is finalized, allowing repeated withdrawals. Key defenses include:

• Checks-Effects-Interactions Pattern: Update all internal state before making external calls.
• Reentrancy Guards: Use a mutex lock (e.g., OpenZeppelin's ReentrancyGuard) to block nested calls.
• Pull Payment Patterns: Let users withdraw funds instead of contracts pushing them.

Contracts that self-execute based on external data (e.g., price feeds) are vulnerable if the oracle is compromised. Attackers can exploit stale or manipulated data to trigger unintended actions.

• Use Decentralized Oracles: Rely on networks like Chainlink for tamper-resistant data.
• Circuit Breakers: Implement price sanity checks and pause mechanisms for extreme deviations.
• Time-Weighted Average Prices (TWAPs): Use DEX-based oracles that average prices over time to resist short-term manipulation.

The transparent mempool allows bots to observe and exploit pending transactions. For self-executing logic, this can lead to:

• Transaction Ordering Dependence: Outcomes change based on transaction sequence.
• Sandwich Attacks: Bots place orders before and after a user's trade to extract value.
• Mitigations: Use commit-reveal schemes, private transaction pools (e.g., Flashbots), or fair sequencing services to reduce exploitable visibility.

Self-executing functions with unbounded loops or complex logic can be DoS'd if they exceed the block gas limit or are targeted by block-stuffing attacks.

• Gas Optimization: Audit and minimize opcode usage in critical functions.
• Pull over Push: Avoid iterating over dynamically-sized arrays; let users claim assets individually.
• Circuit Breakers: Include emergency pauses for functions vulnerable to gas-griefing.

While upgradeable contracts allow bug fixes, they introduce centralization risks if admin keys are compromised. The proxy pattern separates logic and storage, but the proxy admin holds significant power.

• Timelocks: Delay administrative actions (e.g., upgrades, pausing) to allow community reaction.
• Multisig & DAO Governance: Distribute control via multi-signature wallets or decentralized autonomous organizations.
• Transparent Proxies: Use patterns that prevent selector clashes between admin and user functions.

Even without external attacks, flawed business logic can cause catastrophic failure. Common issues include:

• Integer Overflow/Underflow: Use SafeMath libraries or Solidity 0.8+'s built-in checks.
• Incorrect Access Control: Missing modifiers (e.g., onlyOwner) on sensitive functions.
• Unchecked Return Values: Failing to verify the success of low-level call or delegatecall operations.
• Precision Loss: Rounding errors in financial calculations due to integer arithmetic.