A decentralized exchange (DEX) is a set of smart contracts on a blockchain that lets you swap one token for another straight from your own wallet. No company takes custody of your funds. You sign each trade yourself, the contract settles it on-chain, and anyone can check the result. Ethereum's own documentation puts it simply: DEXs "let you trade different tokens whenever you want" and "you never give up control of your assets." Self-custody comes with costs that a custodial platform would otherwise carry for you: network fees, price impact, front-running bots, token approvals and the job of keeping your keys safe. This guide explains each one.
What changed most recently: the SEC's April 2026 staff statement
On 13 April 2026 the US SEC's Division of Trading and Markets published a Staff Statement Regarding Broker-Dealer Registration of Certain User Interfaces Utilized to Prepare Transactions in Crypto Asset Securities. Staff said they would not object if certain front ends work without registering as broker-dealers. These are websites, browser extensions or apps that turn a user's chosen trade parameters into blockchain commands, which the user then signs from a self-custodial wallet.
What it covers, and what it doesn't:
- Scope. It deals only with broker-dealer registration under Section 15(a) of the Exchange Act, and only for crypto asset securities. It is a staff view with no legal force. The Commission has neither approved nor disapproved it.
- Conditions. The provider must have no "custody of, or access to" the user's private key and no discretion over transactions. Default venues must be chosen by objective criteria, and no route may be labelled "best price". Fees must be fixed rather than tied to trade size, and payment for order flow is excluded. Required disclosures include that the provider is "not registered with or regulated by the Securities and Exchange Commission", plus the risks of maximal extractable value (MEV).
- Excluded activities. Soliciting trades, giving recommendations, holding user funds, and executing, settling or routing orders all fall outside the statement.
- Duration. It is described as an interim step and "will be considered withdrawn effective five years from April 13, 2026" unless the Commission acts first.
Commissioner Hester Peirce welcomed the statement on the same day but said she prefers a lasting fix through rulemaking.
The statement makes official a distinction that matters for anyone using a DEX. The contracts that hold liquidity and settle trades are one thing. The interface you click is another, run by an identifiable party. That party can be regulated, can filter what you see and can be impersonated by phishing sites. The contracts keep running either way.
Earlier US change: on 10 April 2025 a Congressional Review Act resolution was signed that overturned the IRS rule of December 2024. That rule would have treated some DeFi front-end operators as brokers that must file Form 1099-DA reports.
In the EU, recital 22 of the Markets in Crypto-Assets Regulation (MiCA) places crypto-asset services provided "in a fully decentralised manner without any intermediary" outside its scope. The regulation does not define "fully decentralised", and EU supervisors have said they will assess it case by case.
How a DEX works
A centralized platform keeps an internal database of balances and matches orders on its own servers. On a DEX the matching and settlement logic sits in contract code. The trade either executes as the code specifies or the transaction fails. In both cases the record sits on a public ledger.
There are three main designs.
Automated market makers (AMMs)
Most DEX swaps go through an AMM. You don't trade with another person. You trade with a liquidity pool, a contract holding reserves of two tokens. The best-known pricing rule is the constant product formula, x · y = k. Vitalik Buterin described this design in a March 2018 Ethereum Research post: the contract "always maintains the invariant that x*y=k for some constant k". The marginal price rises the more of one token you take out.
Worked example (fees ignored):
- The pool holds 100 ETH and 200,000 USDC, so k = 20,000,000 and the starting price is 2,000 USDC per ETH.
- You buy 1 ETH. The pool must end with 20,000,000 ÷ 99 = 202,020.20 USDC.
- You pay 2,020.20 USDC, which is 20.20 USDC (about 1%) above the starting price. That gap is price impact, and it grows as your trade gets larger relative to the pool.
Pools are funded by liquidity providers (LPs), who deposit both tokens and earn a share of trading fees. Buterin's 2018 post uses 0.3% as an example fee. Actual fees differ by protocol and pool, so check them before you trade.
Order-book DEXs
These keep a list of buy and sell orders like a traditional exchange. Placing, changing and cancelling every order on-chain costs a network fee each time. For that reason many order-book designs match orders off-chain or on a dedicated chain and settle on-chain. Find out where matching happens on any venue you use, because that is where you are trusting an operator.
Aggregators
An aggregator checks prices across many pools and venues. It may split one trade across several routes to get a better net result. The trade still settles on-chain from your wallet.
What a DEX trade really costs
- Network (gas) fee. You pay this to the blockchain, not to the DEX. Ethereum mainnet fees rise with congestion. Ethereum's Dencun upgrade went live on 13 March 2024. It added cheaper temporary data "blobs" (EIP-4844), which ethereum.org says "primarily focuses on the reduction of L2 fees". So the same swap usually costs much less on a layer-2 rollup than on mainnet.
- Pool or protocol fee. This is a percentage of the trade that goes to LPs and sometimes to the protocol. It varies by pool.
- Price impact. See the worked example above. Shallow pools mean large impact.
- Slippage. This is the gap between the quote you see and the price you get once the transaction confirms. Your slippage tolerance sets how far the price may move before the trade reverts. A wide tolerance also gives front-running bots more room (see MEV below).
- Approval transactions. Under the ERC-20 token standard (EIP-20),
approve"allows_spenderto withdraw from your account multiple times, up to the_valueamount." The first time you swap a token, you usually sign an approval before the swap itself. It costs gas and moves no tokens. An approval for an unlimited amount stays active until you lower it. If that contract is ever exploited, it can reach your tokens.
How much does pool size move your price?
Enter a pool's two reserves and how much ETH you want to buy to see what a constant-product pool charges before fees.
| ETH held in the pool | USDC held in the pool | ETH you want to buy | USDC you pay before pool fees and gas |
|---|---|---|---|
| 100 ETH | 200,000 USDC | 1 ETH | 2,020.2 USDC |
| 100 ETH | 200,000 USDC | 5 ETH | 10,526.32 USDC |
| 1,000 ETH | 2,000,000 USDC | 1 ETH | 2,002 USDC |
- Pool reserves and trade size are your own inputs; the defaults repeat the article's worked example, where 1 ETH costs 2,020.20 USDC against a 2,000 USDC starting price.
- The amount paid above ETH bought × starting price is price impact, and it grows as your trade gets larger relative to the pool.
This applies only the constant-product rule with fees ignored: it leaves out the pool fee, gas, approvals, slippage from other trades and MEV, and it cannot tell you a real pool's reserves.
Risks
Front-running and sandwich attacks (MEV)
Ethereum.org defines maximal extractable value as "the maximum value that can be extracted from block production" beyond the block reward and gas fees. The term began as "miner extractable value" under proof-of-work.
In a sandwich attack, a bot "will watch the mempool for large DEX trades". It buys just before your trade and sells just after, so you get a worse price.
One countermeasure is to send transactions privately instead of through the public mempool. Flashbots says transactions sent through its Protect service go "to a private Flashbots mempool where they will be hidden from frontrunning and sandwich bots." This reduces exposure but does not guarantee protection.
Smart contract risk
Ethereum.org notes that DeFi products, "like any software, can suffer from bugs and exploits." An audit lowers this risk but does not remove it. A contract that is new, unaudited or upgradeable by a single key carries more risk.
Impermanent loss for liquidity providers
When the price ratio of a pool's two tokens changes, the pool rebalances. The LP ends up holding more of the token that fell in relative value.
Take the same pool and suppose ETH goes from 2,000 to 4,000 USDC. Arbitrage moves the pool to about 70.71 ETH and 282,843 USDC, worth about 565,685 USDC. Simply holding the original 100 ETH and 200,000 USDC would be worth 600,000 USDC. Before fees, that is about 5.7% less. For a constant-product pool the general formula is 2√r ÷ (1 + r) − 1, where r is the price change ratio.
A 2022 paper by Milionis, Moallemi, Roughgarden and Zhang separates an LP's return into market exposure and a component it describes as "accrued fees minus losses to arbitrageurs" (loss-versus-rebalancing).
Scam tokens and liquidity pulls
Anyone can create a token and a pool, so fake and malicious tokens are common. Warning signs include:
- liquidity that the deployer can withdraw at any time
- contract functions that let the owner mint tokens or block selling
- a token whose name copies a known project but has a different contract address
Always check the contract address on a block explorer, not just the ticker.
Key and interface risk
There is no password reset. A BIP-39 recovery phrase (12, 15, 18, 21 or 24 words) gives full control of the wallet to whoever holds it. Fake DEX front ends are a common way to get users to sign malicious approvals. Bookmark the interface you use, and read every signature request before you confirm it.
Using a DEX safely: a short checklist
- Use a self-custodial wallet and store its recovery phrase offline. See our guide on how to set up a MetaMask wallet.
- Keep some of the chain's native token (for example ETH on Ethereum) to pay gas.
- Confirm the token contract address, not just the name.
- Check pool depth and the quoted price impact before you confirm.
- Keep slippage tolerance as low as the trade allows.
- Approve only the amount you need, and remove old approvals you no longer use.
- For large trades, think about private transaction routing to reduce sandwich risk.
- Try a small amount first.
DEX or custodial platform?
| DEX | Custodial platform | |
|---|---|---|
| Who holds the keys | You | The platform |
| Account and identity checks | Usually none at contract level; front ends may apply their own | Typically required |
| Fiat deposits | No; you need crypto in your wallet first | Usually yes |
| Token availability | Any token someone has created a pool for, scams included | Selected listings |
| Main failure points | Contract bugs, MEV, your own mistakes, fake front ends | Platform insolvency, hacks, frozen withdrawals |
| Recourse | Little to none; transactions are final | Depends on the platform and jurisdiction |
Related reading: how AMMs work, what impermanent loss means, locked liquidity in crypto and how Ethereum smart contracts work.
Limitations: fees, regulatory status and protocol designs change, and this guide does not cover every chain or DEX type. Nothing here is investment, legal or tax advice.
