一句话：提出 CrossGuard，通过在链上强制控制流白名单来拦截 DeFi 智能合约攻击，无需预先知晓具体攻击手法。
智能合约支撑着去中心化金融（DeFi）服务，却频频遭受可造成巨大经济损失的安全攻击；由于 DeFi 协议的可组合性与攻击手法的日益复杂，现有防护措施往往力不从心。作者对 37 个曾被攻击的 DeFi 协议的历史交易开展了大规模实证研究，发现正常交易通常只呈现有限数量的控制流，而攻击交易往往引入此前从未出现过的全新控制流。基于这一观察，作者提出 CrossGuard 框架，在链上强制实施控制流完整性：它不需要事先了解具体攻击方式，只需在合约部署时配置一次控制流白名单策略，并在运行时应用简化启发式，对不满足白名单规则的所有交易直接回滚。评估表明，仅在部署时配置一次的 CrossGuard 能成功阻断 37 个被分析攻击中的 35 个，误报率低至 0.26%，额外 gas 开销也很小，说明将控制流完整性引入智能合约是切实有效的安全增强手段。
Smart contracts power decentralized financial (DeFi) services but are vulnerable to security exploits that can lead to significant financial losses. Existing security measures often fail to adequately protect these contracts due to the composability of DeFi protocols and the increasing sophistication of attacks. Through a large-scale empirical study of historical transactions from the 37 hacked DeFi protocols, we discovered that while benign transactions typically exhibit a limited number of unique control flows, in stark contrast, attack transactions consistently introduce novel, previously unobserved control flows. Building on these insights, we developed CrossGuard, a novel framework that enforces control flow integrity onchain to secure smart contracts. Crucially, CrossGuard does not require prior knowledge of specific hacks. Instead, configured only once at deployment, it enforces control flow whitelisting policies and applies simplification heuristics at runtime. This approach monitors and prevents potential attacks by reverting all transactions that do not adhere to the established control flow whitelisting rules. Our evaluation demonstrates that CrossGuard effectively blocks 35 of the 37 analyzed attacks when configured only once at contract deployment, maintaining a low false positive rate of \(0.26\%\) and minimal additional gas costs. These results underscore the efficacy of applying control flow integrity to smart contracts, significantly enhancing security beyond traditional methods and addressing the evolving threat landscape in the DeFi ecosystem.
@inproceedings{paperbot11724,
title = {Enforcing Control Flow Integrity on DeFi Smart Contracts},
author = {Zhiyang Chen and Sidi Mohamed Beillahi and Pasha Barahimi and Cyrus Minwalla and Han Du and Andreas Veneris and Fan Long},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773266}
}