Walk through enough TRON wallets and a second pattern emerges, distinct from the USDT-dominated transfer activity. A handful of contract addresses keep showing up in transaction histories — sometimes as the destination, sometimes routing internal flows that touch four or five other contracts in a single transaction. Those addresses are TRON’s decentralized exchanges.
For an investigator, DEX activity is one of the easiest signals to misread. A wallet that interacts with a router contract within minutes of activation looks, at a glance, like it was created by that router. It was not. TRON’s protocol rules forbid that interpretation. The wallet was created by an externally-owned account and then immediately started trading.
Understanding what TRON’s DEXes actually are, which contracts to recognize, and why TRONORIGIN’s heuristic filters DEX routers out of origin scoring is the difference between accurate attribution and a wrong conclusion drawn from noisy data.
One protocol, three brand eras
TRON’s DEX activity is dominated by one protocol: SunSwap. Its history involves three brand names and several router replacements, which is the source of most of the confusion an investigator runs into.
JustSwap launched on August 18, 2020, built by the TRON Foundation and modeled on Uniswap. The launch announcement, signed by Justin Sun, compared it directly to Uniswap and reported (per the open letter itself) $5.8 million in trading volume within fifteen hours of going live. JustSwap was a stand-alone product under the TRON Foundation’s justswap.io brand.
SunSwap acquired and absorbed JustSwap on October 20, 2021. The TRON Foundation’s announcement framed it as a SUN.io acquisition; in practice, the on-chain contracts did not move. The original JustSwap Factory contract at TXk8rQSAvPvBBNtqSoY6nCfsXWCSSpTVQF is today officially tagged on TronScan as SUN: SunSwapV1 Factory. The factory’s bytecode has not changed. Only the label did.
That detail is investigatively useful. A wallet whose history shows interactions with “JustSwap” pre-October 2021 has on-chain history pointing to the same address that is now SunSwap V1. There is no separate JustSwap protocol to research. There is no JustSwap-to-SunSwap migration event in the data. Both names describe the same set of contracts.
SunSwap V2 went live on December 21, 2021, redeployed as a Uniswap V2 fork. The router contract’s on-chain name is literally UniswapV2Router02 — not a rewrite, not a port. The protocol team forked the Uniswap V2 codebase and redeployed it on TRON, charging the same 0.3% per-trade fee but routing it through SunSwap’s own 0.25%/0.05% split (LPs and SUN-token holders) rather than the upstream Uniswap V2 default of sending the full fee to LPs.
SunSwap V3 followed on June 28, 2023, again forking the upstream — this time Uniswap V3, with concentrated liquidity and four fee tiers (0.01%, 0.05%, 0.3%, 1%). As of May 2026, per DefiLlama, V3 holds roughly $110M in TVL on TRON and clears about $46M in 24-hour volume. V2’s TVL has effectively collapsed to zero, though its router still processes $4M+ per day in pass-through volume from aggregator routing.
The Smart Router moving target
Above the three versioned pool sets sits a router that can split a single user swap across V1, V2, V3, and SUN.io’s stableswap venues in one transaction. The protocol team has reissued this router three times.
The first Smart Exchange Router (TCFNp179Lg46D16zKoumd4Poa2WFFdtqYj) is tagged on TronScan as deprecated. A second-generation Smart Router (TJ4NNy8xZEqsowCBhLvZ45LCqPdGjkET5j) is also tagged deprecated. The most recent replacement is the Universal Router (TSJEtPuqHpvSaVnSwvCsngaeBxrGUzp95Q), launched February 5, 2026 alongside a Permit2 deployment — and already tagged deprecated by TronScan within three months. The deprecation tag is the rotation signal an investigator should watch for.
The pattern an investigator should internalize. The V2 and V3 routers and factories are stable. The Smart/Universal Router is not. A wallet’s “smart router” interactions from 2022 will resolve to a different address than its smart router interactions from 2026. Memorize the V2 and V3 anchor addresses and look up the current top-of-stack router on TronScan when needed.
Contract address reference
The addresses below come from upstream attestation — the sun-protocol GitHub deployment tables and TronScan’s public contract-tag registry — rather than from any third-party catalog. The V2 and V3 anchors are the ones to memorize; the Smart/Universal Router rotates.
| Component | Address | Notes |
|---|---|---|
| SunSwap V2 SwapRouter | TNJVzGqKBWkJxJB5XYSqGAwUTV15U24pPq | Verbatim Uniswap V2 fork; TronScan tag SUN: SunSwap V2Router |
| SunSwap V2 Factory | TKWJdrQkqHisa1X8HUdHEfREvTzw4pMAaY | Spawns V2 pair contracts |
| SunSwap V3 SwapRouter | TQAvWQpT9H916GckwWDJNhYZvQMkuRL7PN | Verbatim Uniswap V3 fork; TronScan tag SUN: SunSwapV3 SwapRouter |
| SunSwap V3 Factory | TThJt8zaJzJMhCEScH7zWKnp5buVZqys9x | Spawns V3 pool contracts |
| SunSwap V3 NonfungiblePositionManager | TLSWrv7eC1AZCXkRjpqMZUmvgd99cj7pPF | V3 LP positions tokenized as NFTs |
| SunSwap V3 Quoter | TLhZ48yfHygMLM2uZr87zJJusHjGen97gh | Off-chain price-quoting helper |
| SunSwap V1 Factory (ex-JustSwap) | TXk8rQSAvPvBBNtqSoY6nCfsXWCSSpTVQF | Bytecode unchanged since 2020; rebranded Oct 2021 |
| Smart Exchange Router (deprecated) | TCFNp179Lg46D16zKoumd4Poa2WFFdtqYj | First-generation multi-pool router |
| Smart Exchange Router (deprecated) | TJ4NNy8xZEqsowCBhLvZ45LCqPdGjkET5j | Second-generation multi-pool router |
| Universal Router (Feb 2026; tagged deprecated by May 2026) | TSJEtPuqHpvSaVnSwvCsngaeBxrGUzp95Q | Current routing surface; rotation imminent |
| Permit2 | TTJxU3P8rHycAyFY4kVtGNfmnMH4ezcuM9 | ERC-2612-style approval delegation companion to Universal Router |
Beyond SunSwap proper, the routable surface as of May 2026 includes SUN.io’s stablecoin venues — a peg-stability module (PSM) and a Curve-style stableswap pool (“SunCurve”) — and a handful of adjacent contracts. The SunPump token-launch router uses bonding-curve mechanics rather than constant-product AMM and appears in wallet histories that traffic in newly-launched TRC-20 tokens. SunPump does not have the depth or scale of SunSwap and does not need an entry in the investigator’s mental map beyond “swap-related router, not an origin candidate.”
What a swap looks like on-chain
A single SunSwap V2 swap appears in a wallet’s history as a TriggerSmartContract call to the V2 router (TNJVzGqK…), invoking one of the standard Uniswap V2 swap methods — swapExactTokensForTokens, swapTokensForExactTokens, swapExactTRXForTokens, and the rest of the set. The router then calls into one or more pool contracts.
Each pool touched emits the standard Uniswap V2 Swap event. The event signature is Swap(address indexed sender, uint amount0In, uint amount1In, uint amount0Out, uint amount1Out, address indexed to), with topic-0 hash 0xd78ad95fa46c994b6551d0da85fc275fe613ce37657fb8d5e3d130840159d822. Two parameters matter for attribution:
senderis the address that called into the pool — almost always the router contract, not the user.tois the address that receives the output tokens. For a direct user-initiated swap this is the user. For multi-hop routes this can be an intermediate pool.
The implication for reading a wallet’s history: an address appearing as to in a Swap event tells you that wallet received output tokens from a DEX trade. It does not tell you the wallet’s owner initiated the trade. Aggregators and arbitrage bots route output to addresses on behalf of other parties routinely.
Smart Router swaps inflate the noise further. A single Universal Router or Smart Router call encodes a multi-pool path as one calldata payload. The user submits one outbound transaction; the receipt logs Swap events from every pool the route touched — potentially mixing V1, V2, V3, and stableswap pools in a single trade. An investigator scanning a wallet’s “interactions list” sees what looks like activity across many contracts. It was one swap.
This is the on-chain reason TRONORIGIN’s behavioral tag DEFI_HEAVY_USER_V4 fires at a low threshold: five DEX-router interactions or 20% of inbound transactions from routers. A handful of routine swaps inflates the contract-interaction count enough to flag without any unusual user behavior. The threshold is calibrated to the noise, not to true activity volume.
Why TRONORIGIN excludes DEX routers from origin scoring
The protocol-level reason DEX routers cannot be wallet origins is older than TRONORIGIN and older than any of the SunSwap brand eras. TRON smart contracts cannot create new accounts. Activation requires an externally-owned account — see /learn/account-activation/ for the full mechanics — and routers are smart contracts. The router cannot, at the protocol level, be the actor that brought a wallet into existence.
That rule turns DEX-router-as-origin into a deterministic false positive rather than a judgment call. If the heuristic ever surfaced a router as the most-likely origin for a wallet, the heuristic would be wrong before the evidence was weighed.
TRONORIGIN’s heuristic (V4 generation) includes explicit DEX-router filtering for exactly this reason. The heuristic excludes a curated registry of SunSwap, JustSwap, JustLend, SUN.io, SunPump, and ParaSwap router and factory addresses from origin candidate scoring. The filter has a guardrail: if a wallet’s transaction history contains only DEX router interactions and no other plausible origin candidates, the filter loosens so the scoring engine still produces a result. The common case — a heavy DeFi user with both router noise and real funding flows — sees the routers filtered out and the funding flows surfaced.
The investigator-facing version of the rule. When you see a wallet whose earliest transactions are all SunSwap router calls, the correct reading is not “this wallet was created by SunSwap.” The correct reading is “this wallet was activated by an EOA the heuristic should be able to identify, and then immediately started swapping.” Reach for the activation event — the very first transaction — and the funding source behind it. The routers are scenery.
Investigative takeaways
Three things to carry away from this article and reuse on every TRON-DEX-touching wallet you investigate.
First, the V2 and V3 anchor addresses are the ones to memorize. TNJVzGqK… (V2 Router) and TQAvWQpT… (V3 SwapRouter) are stable. They have been stable for years and they will likely remain so. The Smart Router rotates; do not memorize it.
Second, JustSwap and SunSwap are the same protocol. Any pre-October-2021 reference to “JustSwap” in a wallet’s history points to addresses that are now officially labeled SunSwap V1. The rebrand was a label change, not a migration, and the contract at TXk8rQSA… is the canonical demonstration.
Third, swap activity is not origin. It is the most common noise pattern on TRON wallet histories and the most-misread one. The TRONORIGIN heuristic filters it because the protocol forbids contracts from being origins, not because the engineers found DEX activity distracting. If your independent analysis surfaces a router as an origin candidate, the analysis has a bug. Trace back to the activation event and the EOA behind it instead.
Sources
- TRON DAO Medium — Justin’s Open Letter on JustSwap Launch (Aug 18, 2020) — primary, TRON Foundation, signed by Justin Sun; establishes JustSwap’s launch date and Uniswap-modeled design.
- TRON DAO Medium — SUN.io Officially Acquires JustSwap (Oct 20, 2021) — primary, TRON Foundation announcement of the rebrand.
- SunSwap Zendesk — Announcement on SUN’s Acquisition of JustSwap — primary, SunSwap support docs; corroborates the acquisition and rename.
- sun-protocol/sunswap-v2-contracts (GitHub) — primary, protocol team’s own repo; canonical V2 deployment addresses and
UniswapV2Router02contract name. - sun-protocol/SunswapV3Contracts (GitHub) — primary; V3 deployment addresses.
- sun-protocol/smart-exchange-router (GitHub) — primary; documents multi-version routing across V1/V2/V3/PSM/SunCurve.
- SUN.io Zendesk — Announcement on Launching SunSwap V3 (June 28, 2023) — primary; V3 launch date and concentrated-liquidity design.
- SUN.io Zendesk — Universal Router & Permit2 Upgrade (Feb 5, 2026) — primary; Universal Router and Permit2 contract addresses and launch date.
- DefiLlama — SunSwap V3 protocol page — primary data provider; TVL and 24h volume figures (as of May 2026).
- DefiLlama — SunSwap V2 protocol page — primary; documents the V2 TVL collapse and continued routing-volume pass-through.
- DefiLlama — SunSwap V1 protocol page — primary; V1 TVL.
- Uniswap V3 Pool events reference — primary; Swap event signatures that SunSwap V3 inherits unchanged.
- TronScan public contract-tag API — primary; on-chain contract identity attestation for every address listed in the reference table.
- TRONORIGIN HEURISTIC_SPEC.md — project’s own scoring specification; documents the DEX-router exclusion rule and the
DEFI_HEAVY_USER_V4behavioral tag. - TRONORIGIN TECHNICAL_WHITEPAPER.md — project’s own protocol-mechanics reference; documents the smart-contracts-cannot-activate-accounts rule.