一句话：首次系统定义 DeFi 质押的六类逻辑缺陷，并提出结合 LLM 与静态分析的检测工具 SSR。
DeFi 质押是 DeFi 生态中最主要的应用之一，但合约中的逻辑缺陷会让攻击者通过操纵奖励数额、重复领取奖励等方式骗取不该获得的收益。本文开展了首个针对 DeFi 质押逻辑缺陷的定义与检测研究：通过分析 64 起安全事件和 144 份审计报告，归纳出六类逻辑缺陷，并给出详细说明与代码示例。在此基础上实现静态分析工具 SSR，它利用大语言模型抽取质押逻辑的基础信息并构建 DeFi 质押模型，再结合模型与相应语义特征识别缺陷。作者基于已知安全事件与审计报告构建了 ground truth 数据集进行评估，SSR 的精确率为 92.31%、召回率为 87.92%、F1 为 88.85%。此外，在由 15,992 个真实 DeFi 质押合约组成的大规模数据集上，SSR 检出 3,557 个（22.24%）合约至少含有一类逻辑缺陷。
Decentralized Finance (DeFi) staking is one of the most prominent applications within the DeFi ecosystem, where DeFi projects enable users to stake tokens on the platform and reward participants with additional tokens. However, logical defects in DeFi staking could enable attackers to claim unwarranted rewards by manipulating reward amounts, repeatedly claiming rewards, or engaging in other malicious actions. To mitigate these threats, we conducted the first study focused on defining and detecting logical defects in DeFi staking. Through the analysis of 64 security incidents and 144 audit reports, we identified six distinct types of logical defects, each accompanied by detailed descriptions and code examples. Building on this empirical research, we developed SSR (Safeguarding Staking Reward), a static analysis tool designed to detect logical defects in DeFi staking contracts. SSR utilizes a large language model (LLM) to extract fundamental information about staking logic and constructs a DeFi staking model. It then identifies logical defects by analyzing the model and the associated semantic features. We constructed a ground truth dataset based on known security incidents and audit reports to evaluate the effectiveness of SSR. The results indicate that SSR achieves an overall precision of 92.31%, a recall of 87.92%, and an F1-score of 88.85%. Additionally, to assess the prevalence of logical defects in real-world smart contracts, we compiled a large-scale dataset of 15,992 DeFi staking contracts. SSR detected that 3,557 (22.24%) of these contracts contained at least one logical defect.
DOI 原文 ·
@inproceedings{paperbot9281,
title = {SSR: Safeguarding Staking Rewards by Defining and Detecting Logical Defects in DeFi Staking},
author = {Zewei Lin and Jiachi Chen and Jingwen Zhang and Zexu Wang and Yuming Feng and Weizhe Zhang and Zibin Zheng},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00054}
}