Risley v. Uniswap Ruling: A Massive Win for DeFi

The Second Circuit Court of Appeals’ recent ruling in Risley v. Universal Navigation, Inc. (Uniswap Labs) carries favorable implications for the future of decentralized finance (DeFi). The court recognized a principle that DeFi Education Fund (DEF) has long been advocating for in Congress and the courts: a developer of neutral, decentralized software should not be held liable for a third party’s misuse of that software. 

“In sum, we agree with the district court that it “defies logic” that a drafter of a smart contract, a computer code, could be held liable under the Exchange Act for a third-party user’s misuse of the platform.” 

The DEF team applauds the court’s recognition of the technological realities of DeFi and its careful analysis differentiating the developers of technology from third party users of that technology. 

Background

Since April 2022, Uniswap Labs and certain venture capital (VC) investors have been defending a class-action lawsuit alleging that they violated U.S. securities laws by facilitating the trading of certain “scam tokens” on the decentralized exchange (DEX) Uniswap. The United States District Court for the Southern District of New York granted Uniswap Lab’s motions to dismiss in August 2023, and the plaintiffs appealed to the Second Circuit.

The plaintiffs brought claims under Section 12(a)(1) of the Securities Act, which allows private plaintiffs to recover damages arising from the defendant’s offer and sale of unregistered securities, and Section 29(b) of the Exchange Act, which allows for the rescission of contracts made in violation of the Exchange Act. The plaintiffs also brought claims under Section 15 of the Securities Act and Section 20 of the Exchange Act, which impose liability on individuals that control an entity that violates the securities laws, otherwise known as “control person liability.”

Essentially, the court was tasked with determining whether Uniswap Lab’s developers or the VCs were liable for the conduct of third-party token creators whose tokens were available for trade on the DEX. As the court stated: 

“The threshold issue in this case is whether the developers of automated computer codes that facilitate the transfer of cryptocurrency on a decentralized exchange may be held liable under federal securities laws for the alleged fraudulent conduct of third parties on that exchange.”

To recover under their 12(a)(1) claim, the plaintiffs needed to show that either (1) the defendants were “sellers” of the tokens at issue, or (2) that they actively solicited the sale of the tokens to plaintiffs for their own financial gain. The Second Circuit found that the plaintiffs failed to prove either theory. 

Rejecting the first theory, that the defendants were “sellers” of the tokens at issue, the court explained that extending 12(a)(1) liability to the Uniswap smart contracts, “whose only function is to execute the trades,” would be akin to “holding the NASDAQ or New York Stock Exchange liable as facilitators of any fraudulent stock purchases on their exchanges.”

The court also rejected the plaintiffs’ theory that Uniswap Labs and the VC defendants solicited the sale of the tokens for their own financial gain. The court found that the defendants’ connection to the scam tokens was too indirect. Simply promoting Uniswap or their own token, UNI, was not enough to count as actively encouraging or profiting from the sale of the scam tokens in question. Therefore, the court affirmed the district court’s dismissal of these claims. 

The Second Circuit also affirmed the district court’s dismissal of the plaintiff’s claim under Section 29(b), holding that the Uniswap smart contracts do not constitute contracts subject to recission under the Exchange Act. The court held that the plaintiffs failed to allege an unlawful contract between themselves and the defendants that could be rescinded. Section 29(b) only allows for rescission of contracts made in violation of the Exchange Act, not unlawful transactions occurring under otherwise lawful contracts. Here, the so-called "contracts" that the plaintiffs alleged to be unlawful were smart contracts—automated protocols facilitating trades on the Uniswap Protocol. The court found that these smart contracts function more like overarching user agreements than securities transactions. 

…”we nevertheless agree with the district court that those contracts are not subject to recission because they are more analogous to overarching user agreements than to securities transactions conducted by traditional broker dealers.”

Even if each trade on the protocol could be considered a separate contract, the relevant contractual relationship was between the token creator or liquidity provider and the purchaser, not between the purchaser and the protocol developers or the VCs. Thus, no unlawful contract existed between plaintiffs and defendants, and plaintiffs’ Exchange Act claim fails. 

The Second Circuit also agreed with the district court that the defendants’ role in drafting and deploying smart contracts was unrelated to the fraudulent activities conducted by third-party token issuers, as such falling outside the scope of Section 29(b). In other words, Uniswap’s smart contracts were only collateral to the third-party scam activity, more akin to tools being misused by others than any kind of contract that can be rescinded under the Exchange Act. 

The Second Circuit also affirmed the dismissal of the plaintiffs' “control person liability” claims under Section 15 of the Securities Act and Section 20 of the Exchange Act, which imposes liability on individuals that control an entity that violates the securities laws. The court explained in a footnote that control person liability requires a primary violation of the securities laws, and since the plaintiffs failed to establish a primary violation—either under Section 12(a)(1) of the Securities Act or Section 29(b) of the Exchange Act—the control person claims by default could not proceed.

The Second Circuit also sent back the case to the district court to consider the state law claims on their merits, giving the plaintiffs another chance on their state law fraud claims. The Second Circuit ruled that the lower court wrongly declined jurisdiction and that the plaintiffs had properly invoked federal jurisdiction under the Class Action Fairness Act (CAFA). 

Implications for DeFi’s Future 

The Risley decision is a major win for DeFi because it reinforces the distinction between decentralized platforms for peer-to-peer transactions and the actual creators or sellers of tokens. By ruling that Uniswap Labs and the VC defendants could not be held liable for “scam tokens” traded on the platform, the Second Circuit effectively shielded developers of DEX protocols from liability for the actions of third-parties, as well as liquidity providers using the DEX. The court maintained that the same principle holds in the traditional financial system: we do not hold NASDAQ or the NYSE responsible for the actions of third-parties engaged in transactions on the exchange.

Additionally, the court’s rejection of the Section 29(b) claim underscores that the Uniswap smart contracts function as neutral, automated tools that do not form an agreement subject to recission under the Exchange Act between Uniswap Labs and the purchasers of third-party tokens on the protocol. This underscores that DEXs do not enter into individual contracts for each transaction occurring through the platform. 

The Risley decision also contributes to the growing legal debate over whether developers of decentralized or noncustodial technology can be held liable for illicit activities conducted by third parties using their platforms. In Risley, the Second Circuit declined to impose liability on Uniswap Lab’s developers and the VCs, emphasizing that the protocol’s smart contracts merely “facilitated” (as phrased by the court) transactions “if approved by the user,” and were not directly involved in the sale of scam tokens. 

The ruling is also notable because it is a Summary Order, which means it has no precedential value. Federal appeals courts often issue Summary Orders when they are applying the existing law to the facts of the case rather than making new law. One might infer that the Second Circuit believes the law on third party liability is clear, even if DeFi is a new technology. 

The ruling aligns with a broader argument in the DeFi industry— creating and maintaining neutral, decentralized infrastructure does not equate to exercising control over or being complicit in how users interact with the technology. Although the court’s ruling in Risley shields developers of protocols from civil liability under the securities statutes, the same principle arises in recent criminal prosecutions. Namely, the Risley holding stands in contrast to the government’s position in prosecutions targeting the developers of the Tornado Cash protocol and Samourai Wallet application, where the government has taken an expansive view of liability, treating software developers as responsible for the alleged misuse of their technology by a third-party. 

The DEF team will continue to push for this critical understanding in Congress and the courts, as we seek to ensure that DeFi builders are free to create neutral, decentralized, noncustodial software protocols without fear of being held unreasonably liable for the actions of third parties. 

This analysis was written by DEF’s Legal Interns Spencer Peek and Greg Marcus, students at the University of Miami Law School.