What do DEX aggregators and routers do, and what are the main risks of swapping on a DEX?

Why routing matters

Uniswap v2 lets anyone create a pool for any two ERC-20 tokens, and v3 allows several pools for the same pair, each with its own fee.^7,8 The v2 whitepaper says so many pools can make it harder to find the best path for a trade, and that a router or aggregator can handle the routing.⁷

Routers

A router is a smart contract that sends your swap through one or more pools. Uniswap's Universal Router, for example, combines trades across Uniswap v2, v3 and v4, and can split and interleave them in one transaction.¹ Uniswap's documentation says it has no owner and cannot be upgraded.¹

Uniswap Labs' terms add a limit. Its "Auto Routing" only routes through pools on the Uniswap protocol, and it says it can't guarantee the best price.⁹

Aggregators

An aggregator looks wider. 1inch, which runs one, describes an aggregator as a protocol that compares swap prices across many DEXs at once, then routes your order along the best path, splitting it when that pays more.²

The reason to split is price impact. As 1inch puts it, an AMM prices a swap from its reserves, so the larger your order compared with the pool, the worse your average rate.^2,10 Smaller slices in several pools each move the price less.²

1inch says it never takes custody of your tokens. It also says an aggregator cannot remove market risk.² Naming 1inch here is not a recommendation.

Approvals: letting a contract spend your tokens

A router can only move your tokens if you allow it. Uniswap's documentation, for example, says its Universal Router pulls tokens through a contract called Permit2: you approve Permit2 once for each token, then sign to authorise each swap.¹

Approvals can be abused, as Module 10 explains. ethereum.org warns that some malicious developers build backdoors into contracts to reach the funds of users who interact with them.³ Its advice:³

• Only approve what you need. It recommends never giving a project unlimited access to your tokens.³
• Revoke approvals regularly. Disconnecting your wallet from a website does not cancel an approval.³
• Avoid untested new projects.³

Bugs in the code

ethereum.org warns that Ethereum products, like any software, can suffer from bugs and exploits.⁴ The BIS notes that DeFi insurance exists for risks such as exchange hacks and smart contract failures.¹¹ Uniswap Labs' terms warn that blockchain transactions are irreversible once confirmed.⁹

Fake tokens with the same name

Anyone can create a token. ethereum.org warns that ERC-20 token contracts can use the same name and symbol as other tokens, so you cannot rely on those for safety.⁵ A scam token may look like the real one but be worth nothing.⁵

What a scam token cannot copy is the contract address.⁵ ethereum.org says the best source for a real token's address is the organisation whose token it is.⁵ Uniswap Labs' terms say its products may show warning labels on some tokens, but that its token information is not a recommendation that a token is safe.⁹ Module 12 explains token contracts.

Traders who jump ahead

Unless it is sent privately, your swap waits in public, in the mempool, before it is added to a block (Module 2 explains this).⁶ ethereum.org describes "sandwich" trading: a trader watches for large DEX swaps, buys just before one, then sells just after it, at the higher price the big swap caused.⁶ People who are sandwiched get worse prices.⁶

Uniswap's documentation for v2, an older version, says the Uniswap front-end used a slippage tolerance, 0.5% by default. The swap only goes through if the rate is no more than that much worse than expected.¹² Module 18 explains how Uniswap Labs' app now sets one automatically, and covers sandwich attacks in more detail.