一句话：提出链上交易追踪与异常检测工具 DeFiWarder，防护 DeFi 应用中的代币泄漏漏洞。
DeFi 应用锁仓资金巨大，但智能合约中的代币泄漏漏洞可让攻击者异常提取远超存款的资金，导致严重损失。现有工具难以有效应对。DeFiWarder 记录智能合约执行日志/轨迹，精确恢复交易内代币转移，刻画用户与 DeFi 应用间资金流，并通过角色挖掘建立用户关系，最后用异常检测揭示代币泄漏漏洞与攻击行为。实验在 30 个 DeFi 应用中成功发现 25 个代币泄漏漏洞，且效率支持链上交易实时检测；还总结出五类主要原因。
Decentralized Finance (DeFi) apps have rapidly proliferated with the development of blockchain and smart contracts, whose maximum total value locked (TVL) has exceeded 100 billion dollars in the past few years. These apps allow users to interact and perform complicated financial activities. However, the vulnerabilities hiding in the smart contracts of DeFi apps have resulted in numerous security incidents, with most of them leading to funds (tokens) leaking and resulting in severe financial loss. In this paper, we summarize Token Leaking vulnerability of DeFi apps, which enable someone to abnormally withdraw funds that far exceed their deposits. Due to the massive amount of funds in DeFi apps, it is crucial to protect DeFi apps from Token Leaking vulnerabilities. Unfortunately, existing tools have limitations in addressing this vulnerability. To address this issue, we propose DeFiWarder, a tool that traces on-chain transactions and protects DeFi apps from Token Leaking vulnerabilities. Specifically, DeFiWarder first records the execution logs (traces) of smart contracts. It then accurately recovers token transfers within transactions to catch the funds flow between users and DeFi apps, as well as the relations between users based on role mining. Finally, DeFiWarder utilizes anomaly detection to reveal Token Leaking vulnerabilities and related attack behaviors. We conducted experiments to demonstrate the effectiveness and efficiency of DeFiWarder. Specifically, DeFi-Warder successfully revealed 25 Token Leaking vulnerabilities from 30 Defi apps. Moreover, its efficiency supports real-time detection of token leaking within on-chain transactions. In addition, we summarize five major reasons for Token Leaking vulnerability to assist DeFi apps in protecting their funds.
@inproceedings{SuLFZCZLW23,
title = {DeFiWarder: Protecting DeFi Apps from Token Leaking Vulnerabilities},
author = {Jianzhong Su and Xingwei Lin and Zhiyuan Fang and Zhirong Zhu and Jiachi Chen and Zibin Zheng and Wei Lv and Jiashui Wang},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00110}
}