The Greed Trap: Uncovering Intrinsic Ethereum Honeypots Through Symbolic Execution

Abstract

Smart contracts are computer programs that run on blockchain networks, enabling secure, transparent, and decentralized transactions. However, the security of smart contracts has always been a critical issue in the blockchain community. One major concern in recent years is the proliferation of honeypots - malicious contracts that deceive users into depositing funds, only to discover that they cannot withdraw their money and have lost their original deposit. In this research, we present a novel classification of honeypots and introduce a new type of contract that allows for the development of a future-proof method for detecting honeypots based on the contract owner and cash flow. We implement this method in a detection tool called HoneyVader, which uses symbolic execution to identify real-world honeypot contracts. Our tool analyzes over 2 million contracts deployed on the Ethereum network, detecting 139 honeypots. By using HoneyVader, we are able to uncover previously unknown zero-day honeypots and new techniques used by attackers, in addition to the ones identified in previous works.