HoneyRank: A Low-Cost Discovering Method of 0-Day Ethereum Smart Contract Honeypots

Abstract

One attack method that actively deploys smart contract honeypots has recently become popular. A contract honeypot is a smart contract that pretends to have vulnerabilities, enticing victims who call the contract to lose funds. However, previous works detected contract honeypots by individual characteristics, such as codes and ledger details. They overlooked the connection between the two parties in the transaction. Therefore, we propose the HoneyRank algorithm, which uses known honeypots as initial seeds to construct a contract honeypot transaction relationship network (HoneyNet) and source code text similarity detection to discover 0-day honeypots that previous work missed in the same detected block height range. This low-cost method detects only a few highly suspicious smart contracts and does not require machine learning training. Specifically, we trace transaction history data to collect the accounts and relationships of honeypot seeds, attackers, and victims and construct a HoneyNet. Based on transaction behavior inference, we label and calculate the source code similarity between high-risk smart contracts and ground truth honeypots. Finally, we select the high-similarity smart contracts to confirm honeypots manually. Besides, we analyze the criminal associations in a HoneyNet. As far as we know, we are the first to construct a HoneyNet and use it to find new honeypots. These honeypots visually reveal the potential connections between the attackers (creators of the honeypot) and the victims. We discovered 54 0-day honeypots never found by previous methods and mined 11 attacker communities composed of attackers and puppet accounts for the first time.