If It Walks Like an Arbitrage: Protocol-Agnostic Detection with Decidable Structural Equivalence

Ethereum transactions admit a canonical structural form. Each execution trace is built into an abstract syntax tree of token transfers grouped by call-frame nesting and reduced by a convergent term rewriting system of 15 rules to a unique canonical form. The system is terminating, sound, and confluent, and the induced structural equivalence on fund flows is decidable. All five properties are mechanized in Rocq with zero admitted obligations. The canonical form makes structural questions about fund flows decidable, opening the way to strategy-family classification, bot fingerprinting, and equivalence-based attribution. In this paper, we demonstrate the canonical form on arbitrage detection: cycles emerge at fixpoint and are read off the canonical form, with no protocol-specific patterns. The pipeline depends only on the standard ERC token and WETH ABIs and no protocol-specific events, so the same binary runs unmodified on Arbitrum and BSC. We evaluate on 220 000 Ethereum blocks against Eigenphi (production MEV platform) and on 1 000 shared blocks against ArbiNet (GNN classifier). The system produces 469 801 confirmed detections and 245 497 attempted arbitrages; across all detections it agrees with Eigenphi on 83.5% and covers 81% of ArbiNet, while surfacing 60 199 exclusive confirmed detections. 99.2% of all detections are produced by the fixpoint alone and are sound by construction. Manual validation of 500 transactions finds no false positives in the confirmed tier. Forensic reanalysis of 200 Eigenphi-exclusive detections finds 63.5% have no cycle in canonical form; 9.0% have cycles the fixpoint detects but our conservative classifier does n