Summary
The rebalancing policy of an automated concentrated liquidity manager turns on one number, the trigger fraction, which fixes how close the price may drift to a range edge before the position moves. That number lives in off-chain code and is never emitted on chain, yet it is recoverable from public events alone, because a proximity trigger leaves a step in the distribution of the price position at firing, the trigger tell. This paper recovers it, without cooperation, on 81 managers the programme never configured, and validates the read blind against one operator that disclosed its configuration only afterwards. The recovered fraction anticipates the timing of the next rebalance out of sample, and the countermeasure is published alongside the attack.
Abstract
An automated concentrated liquidity manager rebalances on a hidden control policy whose central parameter is a trigger fraction, fixing how close the price may drift to a range edge before the position moves. This paper recovers that fraction from public chain data alone, reading only standard market-maker events, without the operator’s cooperation or any knowledge of its contract. It survives in the distribution of the price position at firing, where a proximity trigger leaves a step this paper names the trigger tell. Range width, placement convention and correction mode are read from the same events, giving a four-axis fingerprint. Two propositions characterise the recovery. Under stated conditions the trigger fraction is the unique discontinuity of the firing-position density, and jitter convolves that discontinuity into a ramp, bounding what any discontinuity-location estimator can recover at any sample size. A step-ratio estimator attains a measured convergence rate, fixing the sample a target precision requires. The recovery is validated three ways, against a control operator whose fraction of 0.25 is independently known and recovered from scratch, against synthetic operators of planted fraction, and against an independently run manager that disclosed its configuration only after the recovery had been recorded, where the blind value matched to grid resolution. At population scale the law recurs across operators the programme never configured, at per-pool fractions spanning 0.10 to 0.42 that vary as much within an operator as between them. Manager class predicts trigger convention, giving a two-level taxonomy. Out of sample, the recovered fraction anticipates the timing of the control operator’s next rebalance. The same construction supplies the countermeasure, so the method that fingerprints an operator also shows how to stop being fingerprinted.
The tell and its countermeasure
What makes the recovery work is that a proximity trigger is a hard gate. Rebalances land where the price spends its time, weighted by the chance of firing once it is there, and the proximity trigger adds a way to fire that exists only inside the trigger zone. The firing density therefore inherits a step at exactly the trigger fraction, whatever shape the price path gave the rest of it, and the fraction is read off as the one point where the density jumps. Reading it takes no contract, no interface definition and no privileged log, only the operator’s own public events. Fewer than two hundred rebalances place the fraction within a hundredth.
Run the same construction backwards and it gives the defence. Jitter the trigger slightly before each rebalance and the hard gate becomes a soft one. The step smears into a ramp as wide as the jitter, and once smeared there is no jump left to find. A few hundredths of a range width suffices, at the cost of rebalancing marginally early or late. Between full smearing and none sits a trap. Under small jitter the recovery still returns a value, and that value is confident and wrong, riding the upper edge of the jittered band; only under larger jitter does the read collapse into the diffuse signature that reports nothing found. An operator cannot wait for the attack to announce that it has failed.
Cite as
@techreport{ryan2026operatorfingerprinting,
author = {Ryan, K. R.},
title = {Operator Fingerprinting: Recovering and Defending the Hidden Rebalancing Policy of Concentrated Liquidity Managers},
institution = {SSRN},
type = {SSRN preprint},
number = {7202340},
year = {2026},
month = jul,
url = {https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7202340},
}Fifth paper in the sequence begun by The Geometric Siphon and continued in The Hidden Microstructure. It generalises the trigger-geometry recovery of Operator Microstructure, runs its cross-operator replication, and measures at population scale the placement quantisation that Quantisation Microstructure derived from a single operator.