Angels or demons: investigating and detecting decentralized financial traps on ethereum smart contracts

Abstract

Decentralized Finance (DeFi) uses blockchain technologies to transform traditional financial activities into\ndecentralized platforms that run without intermediaries and centralized institutions. Smart contracts are\nprograms that run on the blockchain, and by utilizing smart contracts, developers can more easily develop\nDeFi applications. Some key features of smart contracts – self-executed and immutability – ensure the\ntrustworthiness, transparency and efficiency of DeFi applications, and have led to a fast-growing DeFi market.\nHowever, misbehaving developers can add traps or backdoor code snippets to a smart contract, which are\nhard for contract users to discover. We call these code snippets in a DeFi smart contract as “DeFi Contract\nTraps" (DCTs). In this paper, we identify five DeFi contract traps and introduce their behaviors, describe\nhow attackers use them to make unfair profits, and analyse their prevalence in the Ethereum platform. We\npropose a symbolic execution tool, DeFiDefender, to detect such traps and use a manually labeled small-scale\ndataset that consists of 700 smart contracts to evaluate it. Our results show that our tool is not only highly\neffective but also highly efficient. DeFiDefender only needs 0.48s to analyze one DeFi smart contract and\nobtains a high average accuracy (98.17%), precision (99.74%), and recall (89.24%). Among the five DeFi contract\ntraps introduced in this paper, four of them can be detected through contract bytecode without the need for\nsource code. We also apply DeFiDefender to a large-scale dataset that consists of 20,679 real DeFi related\nEthereum smart contracts. We found that 52.13% of these DeFi smart contracts contain at least one contract\ntrap. Although a smart contract that contains contract traps is not necessarily malicious, our finding suggests\nthat DeFi related contracts have many centralized issues in a zero-trust environment and in the absence of a\ntrusted part