IBM Promontory’s DeFi report for EU Commission reads like a plan for “hypnotic ice cream” espionage
EU Commission’s DeFi Study: IBM Promontory Struggles with Basic Blockchain and DeFi Concepts
“Oh EU Commission, your report brings me to my knees…”
That was part of my James Bond spoof sing-along text while reading their report from December.
Will there be a sequel? You Only Read Twice. Welcome to the EU’s DeFi Surveillance Headquarters—We Have Reports, Consultants, and a Soundtrack.
This time, the EU Commission was interested in DeFi and hired IBM Promontory to write a report ‘Embedded supervision of decentralized finance,’ published on 7 February 2025.
The paper’s objective was allegedly
“to assess the feasibility and potential of embedded supervision within the DeFi landscape.”
The term "embedded supervision" is indeed used, but what they describe is more akin to pervasive surveillance rather than actual regulatory oversight. If the EU Commission were to propose an upgrade to MiCA to bring DeFi within its scope, it would provide a legal mandate to enforce compliance. However, the report conceptualizes some covert operation allowing for passive data extraction from public blockchains without meaningful engagement with protocols.
In banking, regulators simply state what information they require, specify the format and the reporting channel, and demand quick compliance—and that usually works. So why not try something similar with DeFi? They could demand compliance from Aave, Maker, etc., or use banks as choke points to enforce reporting requirements.
If the goal was to explore what is technically possible before drafting new regulations, then the report serves a purpose. However, one wouldn’t normally publish such a document—doing so reveals their objectives, weakening their position in any future negotiations for voluntary disclosure from DeFi providers.
Since the EU Commission is a virtuoso at regulatory tactics, the fact that the report was published suggests either:
There is no intent to engage bilaterally with DeFi protocols, or
There is more material that hasn’t been published.
Or the report isn’t even material to the project… hmm, how about Heavenly Wolf (AKA "embedded DeFi supervision")?
In the James Bond franchise, Heavenly Wolf was a plan to penetrate NORAD Headquarters using hypnotic ice cream to steal computer tapes. So maybe the Commission is attempting something similar—no ice cream, but hypnotic reports.
Not meant to enforce compliance, but to create the illusion of control, making DeFi players self-censor or preemptively cooperate before actual rules are even in place.
Or it means nothing.
The problem with the material we have is—and the authors fail to account for this—that spying on DeFi transactions is futile because:
It doesn’t lead to enforceable compliance.
Users will obfuscate transactions (more mixers, privacy chains). In other words, anyone who has something to hide won’t sit idle—they will adapt, rendering today’s findings meaningless in the future.
Speaking of the authors, the report was written by five people, and all five appear to be male. While such things can happen in small teams, and I won’t critique further, it still stood out as unusual to me.
“IBM Promontory developed a software application to retrieve and analyze data from the Ethereum ledger. The development process encountered significant challenges, including as regards ledger synchronization and smart contract analysis. Full on-premises ledger synchronization was complex due to the Ethereum ledger's size, necessitating high-performance computing resources and substantial storage capacity. Additionally, analyzing smart contracts required a detailed examination of each contract’s underlying code, rules, conditions, and triggers.”
This is a statement from the executive summary and thus could indicate what is yet to come. The consultant seems to deal with blockchain technology for the first time even though there is no novel solution required. Yet, they’re acting like they discovered gravity.
Running an Ethereum node isn’t groundbreaking—it’s entry-level blockchain engineering.
Substantial storage capacity because of an Ethereum node? Come on. This is not a relevant issue in an institutional setting, and I am very confident that the ECB could find 2TB of unused storage capacity somewhere. If not, we can all chip in: a 2TB portable SSD from Samsung on Amazon costs around £170. Not cheap, but it includes free delivery.
Smart contracts aren’t standardized? No kidding. That’s why block explorers, indexers, and forensic analytics firms exist.
Was IBM Promontory a Consultant to the EU Commission or Was This a Mentoring Program For The Benefit of IBM?
They spent resources “developing” a tool to do what existing services already provide.
Their main findings?
Ethereum has a large ledger.
You need hardware to process blockchain data.
Smart contracts are complex and non-standardized.
Groundbreaking? This isn’t an advanced regulatory strategy—this is the homework of a team that just entered the blockchain space.
“The data analysis confirmed that public distributed ledger technologies provide real-time access to core transaction information, thereby enabling the development of surveillance tools and data collection mechanisms to meet supervision requirements.”
I shall leave the fact that IBM Promontory just discovered what permissionless chains are uncommented—but not their assertion that blockchain transparency inherently enables supervision, market abuse detection, and liquidity oversight, which is not supported by technical realities.
While blockchain transaction data is openly accessible, it does not inherently provide the necessary context to differentiate between legitimate and manipulative activity. Without clear definitions of market abuse in DeFi, a structured analytical framework, and advanced pattern detection methodologies, surveillance alone is unlikely to yield actionable regulatory insights.
They do mention that a few paragraphs later but seem oblivious to the apparent contradiction in their claim that on-chain data alone suffices to meet regulatory objectives. I cannot understand why they don’t see the problem.
“Data enrichment: Sole reliance on on-chain data is insufficient for comprehensive supervision. Regulators need to supplement on-chain data with manually collected off-chain data [..]”
What exactly do they expect EU authorities to do here? Hack some computers abroad to find out who owns a wallet?
Public Ledgers Do Not Automatically Enable Market Manipulation Detection
In traditional finance, market manipulation detection relies on order book analysis, trade execution patterns, and insider information monitoring—none of which apply in the same way to automated market makers (AMMs) or decentralized liquidity pools.
DeFi manipulation often occurs through mechanisms like miner extractable value (MEV), oracle manipulation, and flash loan attacks, which are not immediately apparent from raw transaction data alone.
Without sophisticated algorithmic analysis of trading patterns and smart contract interactions, simply monitoring blockchain transactions offers little insight into whether trades are manipulative or merely large, legitimate transactions. In fact, securities regulators also need technical solutions to run data analysis. What makes this complicated is the market structure.
Liquidity Supervision in DeFi is Structurally Different from TradFi
Liquidity in DeFi is fragmented across multiple chains, protocols, and asset types, making any single-source liquidity monitoring approach inherently incomplete.
Unlike centralized finance, where completeness of data for trading-related activity is enforced, DeFi liquidity is dynamic—constantly being bridged, staked, collateralized, or deployed in derivative contracts.
And somebody with a wallet is not necessarily subject to a regulatory regime that would criminalize market abuse in crypto. And how would the Commission ensure they are not spying on US citizens wishing to exercise their freedom to engage in ‘market manipulation’—or is the plan for the EU to start running market monitoring as a service for other jurisdictions? (‘EU SaaS – Your outsourcing solution from the heart of Europe’).
The same assets can be counted multiple times across different protocols due to cross-chain interactions and lending mechanisms, complicating any attempt at macro-supervision based on a single on-chain balance alone.
The Report Does Not Define What Constitutes Market Manipulation in DeFi
Regulatory bodies must provide definitions of manipulation. The report does not outline what behaviors it considers manipulative within DeFi frameworks.
If we don’t have an order book but instead algorithmic adjustments, many concepts from securities markets won’t apply.
And that leads to a triumph of strategic insight:
'As a next step, IBM Promontory proposes building on this initial initiative by developing a Proof of Concept [..]'
Hire us back! Oy vey, they got a lot of chutzpah.
The theory of distributed ledger technology (DLT) and blockchain emerged at the beginnin of the 21st century, with the first implementation of bitcoin in 2009.
DLT is not a theory (maybe a concept?)—it’s an engineering reality that has been implemented since at least the late 1980s. For instance, David Chaum (1982) in case IBM wants to look that up.
If something exists in working code, it’s not a theory—it’s a technology.
Bitcoin was not the beginning of DLT—it was one specific implementation of a cryptographic ledger with decentralized consensus.
Btw, we are only on page 8 out of 125! 😢 And I am not sure I can afford to read a 100 pages more of this.
“The project was executed in four phases.
Phase 1: Selection of Protocols and Benchmarks
Phase 2: Development of Automated Data Collection Application [..]”
This is not hypothesis-driven research—this is reverse-engineering a justification for their choices. If you pre-select protocols before knowing which data flows matter, you lock yourself into a narrow dataset.
This guarantees that whatever "findings" they come up with will be incomplete.
They Could Have Just Used Etherscan or On-Chain Indexers. If their goal was scientific rigor, they would first explore what data is naturally available across DeFi—not make an arbitrary list of protocols first. Using Etherscan or The Graph isn’t unscientific—what’s unscientific is their ad-hoc process.
The Commission’s Joint Research Centre is usually quite switched on such things and it’s shame they were not involved and could have fixed that.
“Aave is a decentralized lending and borrowing protocol on Ethereum. It enables users to deposit their crypto assets and earn interest on them or borrow assets by providing collateral. Aave utilizes smart contracts to automate the lending and borrowing process.
Compound is a decentralized lending and borrowing protocol that allows users to lend and borrow various crypto assets. It operates through algorithmically determined interest rates and utilizes collateralized loans.”
Aave's description emphasizes smart contracts automating the lending process, while Compound’s description does not.
Compound's description highlights algorithmic interest rates, but Aave also has dynamic interest rates and risk parameters—why is that omitted?
Aave's description says "users can deposit and earn interest or borrow with collateral," but Compound does exactly the same thing.
If this were a serious research report, both protocols should be described using a consistent framework. Instead, they used different phrasing and terminology for similar concepts, which suggests they weren’t thinking systematically.
And the chosen terminology is also problematic. A DeFi protocol like Nexus is not an insurance company, and they don’t claim to be one either. They describe themselves as an alternative to insurance, which is fine. My shoes are, in a way, an alternative to traveling in an Airbus jet—but that doesn’t mean all alternatives function the same way.
Nexus is a mutual risk-sharing pool governed by smart contracts and member voting. Payouts aren’t legally guaranteed—they are governed by member votes. Instead of "insurance," they should use decentralized risk-sharing protocol or something similar.
1. IBM Promontory claims they studied all ERC-20 smart contracts of each protocol to analyze token exchange on a DEX.
However, this approach fails to capture the full transaction flow because ERC-20 alone is not sufficient to execute a swap on a DEX like Uniswap.
If they only analyzed ERC-20 contracts, they missed these essential protocol-level mechanics.
2. Studying Only the “Latest Versions” is Misleading
DeFi protocols don’t retire old contracts—legacy versions continue to operate and still hold liquidity.
Just because a new contract exists doesn’t mean it’s the only one in use—liquidity might still be locked in older Uniswap pools.
By limiting their research to the latest versions, they ignored historical transaction flows and backward compatibility issues.
3. Uniswap is Built on Far More Than Just “Slightly Less Than Ten” Smart Contracts
Uniswap V2 & V3 include:
Factory contracts (to create new pairs).
Pair contracts (handling token reserves and pricing).
Oracle contracts (for time-weighted average prices).
Staking and reward contracts (for liquidity incentives).
If they only analyzed under 10 smart contracts per protocol, they clearly missed a significant portion of the DEX’s full transaction logic.
4. Ignoring Non-Transactional Smart Contracts is a Strategic Error
They excluded contracts that “collect data but don’t execute transactions”—but data collection is crucial for risk and compliance.
Oracles, governance voting mechanisms, and treasury contracts influence how markets move, even if they don’t directly swap tokens.
Supervision isn’t just about transactions—it’s about understanding how the system operates.
What This Means
Their study is incomplete and oversimplifies DeFi mechanics.
If they only studied ERC-20 contracts, they didn't analyze the full exchange process.
Their focus on “latest versions” ignores real-world liquidity spread across older contracts.
Excluding non-transactional contracts limits regulatory insight into systemic risks.
“IBM Promontory engaged with Chainalysis, a leading company in the market, to analyze financial flows across different blockchains. Based on this collaboration, it appears that financial flows are often converted into fiat currencies via centralized crypto service providers such as Coinbase.”
I am not making this up, it’s in their report. The hired consultant hires another consultant to produce the insight that Coinbase is involved in cash on-ramp/off-ramp.
They highlight what regulators already rely on—KYC-compliant CEXs like Coinbase are the primary way to link DeFi addresses to real-world identities.
This undermines the need for their entire "embedded supervision" strategy—because if you want to track financial flows, you already have control over the centralized fiat exits which is more effective than IBM spying on Aave.
What’s next:
💡 "After extensive research, we have determined that traditional securities are traded on stock exchanges like the London Stock Exchange (LSE) and the New York Stock Exchange (NYSE)."
💰 "We recommend that regulators consider monitoring these entities as a way to track financial flows."
“Sellers deposit their tokens (or instruments) into a liquidity pool, and buyers asynchronously purchase tokens from this pool, exchanging other tokens stored in an equivalent liquidity pool. The price is determined by the size of the liquidity pools and mathematical formulas designed to ensure liquidity and accurate price formation.”
They correctly describe the mechanics of a DEX, but then completely misunderstand price formation.
Crypto has no intrinsic valuation framework. The price is entirely liquidity-driven, meaning:
Price only reflects available supply and demand, not fundamental value.
There is no widely accepted economic model to "value" Bitcoin or Ethereum.
If liquidity disappears, pricing collapses instantly.
AMMs Don’t Ensure “Accurate” Price Formation—They Ensure Continuous Trading
AMMs (like Uniswap) set prices algorithmically based on liquidity pool ratios.
This means prices are entirely endogenous—they reflect who is trading at any given moment, not fair value.
Slippage, impermanent loss, and front-running (MEV) distort prices further.
This is Not “Accurate Price Formation” in Any Economic Theory.
Can there even be market manipulation under such conditions. It’s a serious question. If prices are always set by supply/demand at that moment, can any price truly be "manipulated" if there’s no baseline fair value?
Since AMMs do not have an intrinsic price anchor, "manipulation" can only be defined in terms of breaking DeFi mechanisms, such as:
Oracle manipulation (feeding false price data into a protocol).
MEV extraction that unfairly advantages insiders (e.g., sandwich attacks).
Governance attacks (exploiting voting mechanisms to drain treasuries).
None of these relate to "price manipulation" in the TradFi sense—they are closer to exploiting software vulnerabilities than to financial market manipulation. This is a huge intellectual gap in their work.
If You Can’t Define DeFi Market Manipulation, You Can’t Regulate It—So What Was This Report For?
They claim that liquidity pools operate "entirely as smart contracts," implying they function without external dependencies—but that’s wrong. DeFi smart contracts don’t operate in isolation—they need external price feeds and user interactions to function properly.
When traders or liquidity providers interact with a pool, they typically use:
Frontend interfaces (like Uniswap’s web app).
APIs that bundle transaction calls.
Third-party aggregators that route orders.
Very few users interact with the raw smart contract directly.
Even in DeFi, most transactions involve pre-processed instructions from APIs before they are executed on-chain.
IBM Promontory claims that arbitrage bots maintain price equivalence across liquidity pools, comparing DeFi arbitrage to multi-listed securities in TradFi—but this is fundamentally incorrect.
Their Statement is Wrong Again!!
There is No Universal Price in DeFi, Even on a Single Chain
Unlike traditional finance, crypto assets have no centralized pricing mechanism—each DEX, AMM, and lending pool sets its own price based on liquidity and trading activity.
Prices vary between liquidity pools.
“Synchronizing the Ethereum ledger on IBM Promontory’s infrastructure proved to be a complex endeavour due to the substantial size of the Ethereum ledger, which currently exceeds 1272.52 GB, and its slow synchronization process. Achieving complete synchronization with the Ethereum ledger using GETH's full synchronization default setting necessitates high-performance machines [..]”
IBM Promontory makes it sound like running a full Ethereum node requires some kind of supercomputer—but 1.2TB is nothing in modern data infrastructure. My laptop has that capacity. 1.2TB is not a "High-Performance" Storage Requirement. It is a consumer-grade laptop.
1272.52GB? If Only Their Research Had This Level of Precision Where It Actually Mattered.
This report is tedious to read, but its shortcomings are significant. The issues are too numerous to list exhaustively, but among the most critical are the following.
The paper asserts that "smart contracts cannot be altered once deployed," which is misleading. While smart contracts are generally immutable, many include upgradeability mechanisms (e.g., proxy patterns like OpenZeppelin's Transparent Proxy). Additionally, smart contracts often contain admin functions or governance-controlled upgrade paths, allowing developers to modify functionality post-deployment
The document describes DeFi as entirely "trustless" but fails to acknowledge admin keys and governance control mechanisms, which can centralize power. For example, many DeFi protocols retain privileged roles that can pause trading, adjust collateralization parameters, or upgrade contracts. The potential for governance token centralization also contradicts the claim that DeFi protocols are purely decentralized.
The paper does not sufficiently address smart contract security risks. While it mentions that bugs can exist, it overlooks attack vectors like reentrancy attacks, oracle manipulation, and governance takeovers.
While the paper correctly states that the Ethereum Virtual Machine (EVM) enables smart contract execution, it does not discuss EVM-compatible chains like Binance Smart Chain, Avalanche, and Polygon, which extend DeFi beyond Ethereum. This is a significant omission given that many DeFi protocols deploy on multiple chains
The explanation of lending mechanisms is oversimplified, omitting how automated liquidation mechanisms function. It should mention liquidation bots, incentive structures, and the role of price oracles in preventing under-collateralization
Regardless, this document is of questionable quality (but I stopped reading halfway through because it is 😵💫 ), and I find it hard to imagine how the EU Commission could rely on it.