Are decentralized exchanges tracking your trades?

Decentralized cryptocurrency exchanges are supposed to be the privacy advocate’s alternative to centralized exchanges, which by law must identify their users and report certain information to the government. Since no one owns or controls a decentralized protocol, there is no one standing in the middle collecting information about users and their transactions. 

Well, that’s the theory. 

In practice, the startups behind some of the top DEXs are deploying fairly sophisticated surveillance tools.

Recently it was highlighted that Brooklyn-based Uniswap Labs, the company behind Uniswap, the most popular DEX on Ethereum by trading volume, has a partnership with TRM Labs, a blockchain analytics firm that works with government agencies to investigate crypto-related crime and provides transaction analysis for the US Internal Revenue Service.

Uniswap isn’t the only DEX that is collecting on-chain and off-chain information about its users. Other DEXs, such as dYdX — which saw soaring volume this year — and DEX aggregator 1inch do so, too. These sites detail their tracking activities in their privacy policies.

DEX aggregator ParaSwap, meanwhile, says that although it collects user data, it goes to great lengths to preserve privacy. ParaSwap tries to collect a minimal amount of data and only stores it for a short period of time.

The Block reached out to five of the top DEXs and aggregators to ask about their user data collection practices. We also analyzed the privacy policies that some of these platforms have published. We did not receive a comment by press time from Binance Smart Chain-based DEX PancakeSwap. We were unable to determine how to contact Curve Finance, and were unable to locate privacy policies for PancakeSwap and Curve Finance.

Below we highlight what we learned from this reporting.

Uniswap: Monitoring for compliance reasons

One reason DEXs are collecting user data is that regulators in the U.S. have been piling more pressure on decentralized finance protocols. According to previous reports, the Securities and Exchange Commission is conducting a civil investigation into Uniswap Labs, and many other DeFi projects have been getting letters from the SEC and other regulators curious about their operations.

This is leading the organizations behind these platforms to introduce more measures that resemble the practices of centralized exchanges and banks  — even though, unlike centralized platforms, DEXs don’t technically handle the funds. 

Uniswap Labs is working with TRM to detect the risk of wallet addresses that are using the Uniswap exchange — such as if stolen money is being sent through it. When somebody makes a trade on Uniswap, their wallet address and the transaction hash — a long number unique to the specific transaction — get passed along to TRM, along with a timestamp.

“The initial assessment will help us understand how the Uniswap Labs app is being exposed to risk. If there are any future steps they will be decided after the assessment, and just as we have been with this step, we will provide full disclosure to users before implementing it,” said a spokesperson for Uniswap Labs.

Uniswap Labs says it has not received any wallet addresses from TRM Labs as a result of this partnership, nor have any users been identified. 

The firm also uses Google Analytics to collect data on those using the website, including the type of devices they are using and their screen resolution. It also asks for IP addresses.

The Uniswap website collects this data at two points: when you first access the website and the moment after you make a transaction, according to Sebastian Burgel, founder of data privacy startup HOPR. According to Uniswap Labs, however, it doesn't collect IP addresses as they are anonymized before they are stored by Google.

Burgel remains skeptical. “In my opinion, it's really concerning that DeFi users have to be exposed to hardcore on-chain and off-chain tracking and then rely on unofficial pinky promises that the data which does get tracked is officially not stored by Uniswap themselves or Google,” he says.

dYdX: Trying to prevent illegal activity

dYdX is a DEX that exploded in popularity in September due to its mix of token incentives and its use of scaling solution StarkEx.

According to dYdX’s privacy policy, it collects both on-chain and off-chain data, taking note of its users' blockchain transactions as well as information about their computer and their IP address. 

For the on-chain data, it looks at the Ethereum wallet each user signs in with to use the service, along with the wallet's transaction history and previous trades. It will then also monitor the transactions they make on dYdX, taking account of the type of transaction, the transaction amount and the timestamp.

dYdX also takes note of off-chain data including the user's IP address, location information and what operating system they’re using. Plus, it records their browser fingerprint, a collection of data about the user's computer that’s designed to make it possible to identify their computer from any other.

dYdX says that it collects this data in order to run and improve the website, and create aggregated data for it to look at. It will also use the data to protect against and investigate fraudulent or illegal activity on the platform. The firm says it will retain this information for a minimum of five years.

1inch: Tracking down hackers

The team behind DEX aggregator 1inch thinks it’s in the community’s best interest to track their trades.

1inch compares rates across different DEXs and submits transactions to the one offering the lowest fee. It has more than a million users, and 146,000 traders have used it in the last 30 days. Over the last two years, according to TechCrunch, 1inch has facilitated more than $100 billion in trades. And like Uniswap and dYdX, it also tracks both on-chain and off-chain data about its users.

1inch collects more data, though. According to its privacy policy, when someone uses 1inch, it tracks their IP address, traffic patterns, what type of device they are using, what type of browser they are using and location information. At the same time, 1inch is collecting the user's blockchain wallet information along with the transaction data. 

1inch says that it aggregates the data and does not use it for any purpose at an individual user level. It says it does so to protect its legitimate interests, including keeping the aggregator working well and protecting against risks.

Yet 1inch does sometimes use this data to identify individuals. In 2020, the aggregator identified the hacker behind the exploit of the DeFi lending platform dForce by tracking their trades.

The hacker had been using 1inch via a VPN or through a proxy. Yet 1inch was still able to identify their IP address and other data about their computer, such as their type of computer, screen resolution and the platform’s native language. 

While the aggregator wouldn’t share the perpetrator’s IP address with dForce, it did do so with the Singapore police force’s criminal investigations department, after a request was received. The sharing of this information led to the return of the stolen funds.

1inch's official stance is that if a user doesn’t want to be tracked, they should use the Tor network.

ParaSwap: Minimizing data collection

Paraswap, another popular DEX aggregator, positions its approach to data collection as uniquely privacy-focused.

Per its privacy policy, the exchange collects personal data such as IP addresses and transaction information for the purpose of making transactions happen. ParaSwap founder Mounir Benchemled says that the aggregator stores IP addresses but not blockchain information. He says the IP addresses are not used for analytics purposes and claims they can't be linked to transactions. They are stored so the site can block IP addresses that have previously been used to mount DDoS attacks against the site.

ParaSwap says it analyzes its usage logs, analytics data and user data derived from API interactions for price requests in an anonymous fashion. It says it keeps usage logs for up to one week — in order to make sure the website is working and improve its performance.

"When it comes to privacy, the devil lies in the details — while privacy is indeed a spectrum, we are highly aware that even one detail leaking out will get you identified," wrote Benchemled in an April 2020 article focused on ParaSwap's privacy. "At ParaSwap we understand the severity of this risk and we are working on designing our infrastructure in order to make any leakage impossible."