Is the AMM price the same as the market price?

Not automatically. The AMM price is only the pool's reserve ratio. It tracks the wider market because arbitrage traders profit whenever it drifts, but a thinly funded pool can be pushed away from the market cheaply, which is the basis of several exploits.

What is the difference between price impact and slippage?

Price impact is the built-in worsening of your rate as your trade moves along the pricing curve; it depends on trade size versus pool depth. Slippage is the risk that the price changes between signing and confirmation because other transactions land first.

Do liquidity providers always earn money from fees?

No. Fees accrue to the pool, but providers are also exposed to impermanent loss and to the risk that a token in the pair fails. Whether fees offset those effects depends on conditions no one can guarantee in advance.

Why do large trades get a worse rate?

Because the reserves must satisfy the invariant, the input-to-output relationship is a curve. A large trade shifts the reserve ratio substantially, so each additional unit is priced worse than the last. This is inherent to the formula, not a fee.

Are all AMMs based on x*y=k?

No. Constant product is the most common design, but stableswap curves optimise for assets that trade near parity, and concentrated-liquidity designs let providers supply within a chosen price range. Each changes the pricing behaviour and the risk profile.

How Automated Market Makers (AMMs) Work

AMMs replace an order book with a formula and a shared pool of tokens. Here is the mechanism, the pricing curve, and where the risk actually sits.

From order books to pools

A traditional exchange matches a buyer with a seller. Every trade needs a counterparty who wants the opposite side at the same price, and a matching engine sits in the middle keeping an order book. An automated market maker (AMM) removes the counterparty and the book. Instead of matching people, it lets you trade against a shared pot of tokens called a liquidity pool, and it prices the trade with a fixed mathematical rule that lives in a smart contract.

This matters for security because the pricing rule, the custody of funds, and the settlement all execute on-chain in code that anyone can read. There is no operator quoting prices by hand. The trade-off is that the same public, autonomous code is also the attack surface: the rule cannot exercise judgement, and it will do exactly what it is written to do under every input, including adversarial ones.

The constant product rule

The most widely deployed AMM design is the constant product market maker introduced by Uniswap v2. A pool holds reserves of two tokens, call them reserve x of token A and reserve y of token B. The contract enforces a single invariant:

x * y = k

Here k is a constant that the contract tries to hold steady across trades (ignoring fees). When someone swaps, they add one token to the pool and remove the other. The contract lets you take out only as much of the second token as keeps the product at or above k. That constraint alone determines the price.

The spot price of token A in terms of token B is simply the ratio of reserves, y / x. There is no external price feed. The pool’s own composition is the price. If A becomes scarce in the pool, x falls, y / x rises, and A costs more B. This is the mechanism that keeps a pool roughly in line with the wider market: when the pool price drifts from prices elsewhere, arbitrage traders buy the cheap side until the ratio matches again, and in doing so they pay the pool.

Why the price moves against you

Because reserves must satisfy x * y = k, the relationship between how much you put in and how much you get out is a curve, not a straight line. Small trades relative to the pool’s depth execute close to the spot price. Large trades move the ratio significantly and therefore get a progressively worse rate. This is price impact, and it is a property of the invariant itself, not a fee.

Slippage is the related idea that the price can change between the moment you sign a transaction and the moment it is mined, because other trades may land first. Wallets let you set a slippage tolerance; the swap reverts if the realised price falls outside it. Setting this tolerance too high is a common way users lose value to sandwich attacks, described below.

Liquidity providers and fees

The reserves come from liquidity providers (LPs), who deposit both tokens and in return receive LP tokens representing their proportional share of the pool. When they withdraw, they burn the LP tokens and take back their share of whatever the reserves now are. Each swap charges a fee that is added to the reserves, so the pool grows over time and LPs redeem a slightly larger share than they would from swaps alone.

Two points are easy to miss. First, an LP does not get back the same quantities they put in; they get back a share of the current reserves, whose composition has shifted with trading. Second, holding LP tokens exposes a provider to a specific effect called impermanent loss, covered in a separate article, which compares the value of the pool position to simply holding the two tokens. Fee income and this effect pull in opposite directions, and whether one outweighs the other depends entirely on conditions that no one can promise in advance.

Not all AMMs use x*y=k

The constant product rule is general but not optimal for every pair. Other invariants exist:

Stableswap curves, used by Curve for assets meant to trade near parity (such as two dollar-referenced stablecoins), blend a constant-sum and a constant-product formula. This concentrates liquidity around the 1:1 point so large trades between similar assets suffer far less price impact, at the cost of behaving worse if the assets diverge.
Concentrated liquidity, introduced by Uniswap v3, lets LPs supply capital only within a chosen price range rather than across the whole curve. This can improve capital efficiency but requires active management and changes the risk profile, because liquidity outside the active range earns nothing and the position becomes entirely one asset at the range edges.

The underlying security lesson is constant across designs: the invariant defines the behaviour, and any deviation between how the invariant is coded and how it is assumed to behave is where value leaks.

Where AMMs go wrong

Understanding the mechanics makes the risks legible. The main categories are:

Smart contract risk. The pool is code. A bug in the swap accounting, the fee logic, or the LP share maths can be exploited directly. Audits reduce but do not eliminate this, as discussed elsewhere on this site.
Oracle and pricing manipulation. Because a pool’s spot price is just its reserve ratio, a lightly funded pool’s price can be moved cheaply. Protocols that read an AMM spot price as an oracle have been drained when an attacker distorts the pool within a single transaction, often funded by a flash loan. Time-weighted average prices and external oracles are mitigations, not cures.
Sandwich attacks and MEV. Because pending trades are visible in the mempool and price impact is predictable, a searcher can place a buy immediately before your large trade and a sell immediately after, profiting from the price you moved. A wide slippage tolerance makes this more profitable at your expense.
Asset risk. A pool is only as sound as its tokens. If one token in a pair loses its peg or its issuer fails, arbitrageurs will trade the failing asset into the pool and drain the healthy one, leaving LPs holding the impaired token.

None of these are exotic. They follow directly from the two facts that define an AMM: the price is the reserve ratio, and the contract executes deterministically for anyone who can craft a transaction.

A mental model to keep

An AMM is a vending machine priced by a formula rather than a person. It is always open, never refuses a valid trade, and cannot be reasoned with. That reliability is its strength and its weakness. If you provide liquidity, you are underwriting that machine’s inventory and taking on its price behaviour; if you trade, you are moving along a curve whose steepness depends on how much liquidity others have supplied. Read the invariant, check the depth, and treat the contract as the untrusted party it functionally is until you have reason to believe otherwise.

Sources

Note: CamoCrypt is security & education only — no prices, no predictions, no investment advice. Verify every address and contract yourself; we cannot recover lost funds and neither can anyone who contacts you claiming they can.

How automated market makers work