If It Walks Like an Arbitrage: Protocol-Agnostic Detection with Decidable Structural Equivalence

Whether a transaction performed an arbitrage, and by which route, is a question asked of its execution trace after the fact. We conjecture that such traces admit a normal form on which questions of this kind become queries, and we test it by building one and putting it to work. Each trace becomes an abstract syntax tree of token transfers, grouped by call- frame nesting. A term rewriting system of 16 rules reduces it. Rewriting terminates and carries exactly the transfers of the trace, whichever order the rules fire in. Under a deterministic kernel scanning the EVM-fixed trace order, every trace has a unique normal form, and the structural equivalence this induces on fund flows is decidable. Preservation, termination, soundness, uniqueness and decidability are mechanized in Rocq with zero admitted obligations. We report arbitrage detection in full: cycles emerge at the fixpoint and are read off the normal form with no protocol-specific patterns. Detection is the query we evaluate at scale; structural equivalence is a second query. The pipeline depends only on the standard ERC token and WETH ABIs, so the same binary runs unmodified on Arbitrum and BSC. We evaluate on two arbitrary block ranges, analysed in full with no transaction excluded: 220 000 Ethereum blocks against EigenPhi, a widely used MEV detection platform, and 1 000 shared blocks against ArbiNet, a graph neural network classifier. These are the only tools and label sets in this domain we were able to reuse. We report 469 801 confirmed arbitrages, overlapping 83.5% with EigenPhi and 81% with ArbiNet, together with 245 497 attempted arbitrages and 60 199 confirmed detections EigenPhi does not report. 99.2% follow from the fixpoint alone and are sound over the decoded transfers, and manual validation of 500 transactions finds no false positive among the confirmed.