一句话：结合 LLM 语义恢复与状态引导搜索，在具体链上快照合成可获利的 DeFi 价格操纵利用。
价格操纵是 DeFi 中最具破坏性的漏洞之一。现有方法多止于告警或依赖固定模板，难以在具体链上状态下判定协议能否被获利利用。SPSYN 结合语义恢复与状态引导搜索：先提取结构化跨合约上下文，用 LLM 恢复攻击相关的受害者侧函数角色，组织为阶段一致的候选与场景引导种子；再在语义感知状态机上对具体链快照做状态引导搜索，利用运行时反馈引导序列扩展与变异。语义恢复缩小搜索空间，实际执行验证可获利性。在 29 个历史事件上，SPSYN 为 27 个（93.1%）合成获利见证，优于 ItyFuzz、CPMMX、FlashSyn，中位首次见证时间 114 秒；链上部署另发现 9 个未报告漏洞，潜在利润 3.51 万美元。
Price manipulation is one of the most damaging vulnerability classes in decentralized finance (DeFi) protocols. Existing approaches mainly stop at warning generation or rely on rigid attack templates, and therefore struggle to determine whether a victim protocol is profitably exploitable under a concrete chain state. This problem is challenging because the attack-relevant victim-side steps are highly protocol-specific, while successful exploitation further depends on brittle runtime conditions such as reserve states, token-specific guards, and narrow numeric ratios. In this paper, we present SPSYN, a DeFi price-manipulation exploit synthesizer that combines semantic recovery with state-guided search. SPSYN first extracts structured cross-contract contexts and uses an LLM to recover attack-relevant victim-side function roles. It then organizes the recovered functions into stage-consistent candidates and scenario-guided initial seeds. Finally, it synthesizes exploit witnesses on a concrete chain snapshot through state-guided search under a semantic-aware state machine. Runtime observations reveal whether the transformed sequence has established a meaningful anomaly, whether it should continue to be expanded, and how later mutations should be refined. In this design, semantic recovery narrows the search to the right victim-side actions, while exploitability is validated through actual execution on the target snapshot. On 29 historical incidents, SPSYN synthesizes profitable exploit witnesses for 27 cases (93.1%), outperforming ItyFuzz (11/29), CPMMX (19/29), and FlashSyn (7/29), with a median time-to-first witness of 114 seconds on successful cases. During on-chain deployment across Ethereum and Binance Smart Chain, SPSYN further discovers 9 previously unreported profitable vulnerabilities with a cumulative potential profit of $35.1K.
@inproceedings{paperbot12186,
title = {SPSYN: Synthesizing DeFi Price-Manipulation Exploits via Semantic Recovery and State-Guided Search},
author = {Bosi Zhang and Ningyu He and Guangdong Bai and Haoyu Wang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837520}
}