DeFi infrastructure firm Enso has identified a new type of malicious liquidity pool it calls 'toxic pools.' Unlike typical exploits that drain wallets directly, these pools manipulate transaction simulations to deceive traders and the infrastructure they rely on. The firm describes the tactic as a 'Jekyll and Hyde' approach.
How the attack works
These toxic pools don't steal funds in a straightforward way. Instead, they present a normal-looking transaction during simulation — the 'Jekyll' face — but then execute a completely different, harmful outcome once the transaction is confirmed on-chain — the 'Hyde' side. This means that even careful traders who use simulators to check a trade before signing it can be tricked into approving a malicious swap.
The infrastructure angle
Enso notes that the pools specifically target the core infrastructure that crypto traders depend on, such as aggregators, wallets, and simulation tools. By corrupting the simulation layer, attackers can bypass the safety checks that have become standard in DeFi. The firm didn't name which platforms are affected, but said the vulnerability is broad.
Enso has not yet disclosed a method to automatically detect these pools or a patch for the simulation layer. The industry is now left to figure out how to trust transaction simulations again — or build new verification steps into the trading process. The firm says it will share more details in a forthcoming technical report.
