Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

LookAhead: Preventing DeFi Attacks via Unveiling Adversarial Contracts

Shoupeng Ren, Lipeng He, Tianyu Tu, Di Wu, Jian Liu, Kui Ren, Chun Chen

TL;DR

LookAhead tackles DeFi security by detecting adversarial contracts rather than adversarial transactions, addressing the blind spot created by private mempools. It introduces PSCFT, a pruned semantic representation of EVM bytecode, and combines a transformer with an ensemble meta-classifier to identify adversarial contracts with high precision and low false positives. The approach is validated on a large, manually labeled dataset of adversarial and benign contracts, achieving an F1-score of up to 0.8966 and a false positive rate as low as 0.16%, significantly outperforming prior work. Practical evaluations, including on-chain live experiments, demonstrate timely, just-in-time predictions within the rescue window and potential defense actions. The work provides a scalable dataset, a novel semantic-tokenization pipeline, and openly available tools to advance real-world DeFi defense.

Abstract

The exploitation of smart contract vulnerabilities in Decentralized Finance (DeFi) has resulted in financial losses exceeding 3 billion US dollars. Existing defense mechanisms primarily focus on detecting and reacting to adversarial transactions executed by attackers that target victim contracts. However, with the emergence of private transaction pools where transactions are sent directly to miners without first appearing in public mempools, current detection tools face significant challenges in identifying attack activities effectively. Based on the fact that most attack logic rely on deploying intermediate smart contracts as supporting components to the exploitation of victim contracts, novel detection methods have been proposed that focus on identifying these adversarial contracts instead of adversarial transactions. However, previous state-of-the-art approaches in this direction have failed to produce results satisfactory enough for real-world deployment. In this paper, we propose LookAhead, a new framework for detecting DeFi attacks via unveiling adversarial contracts. LookAhead leverages common attack patterns, code semantics and intrinsic characteristics found in adversarial smart contracts to train Machine Learning (ML)-based classifiers that can effectively distinguish adversarial contracts from benign ones and make timely predictions of different types of potential attacks. Experiments on our labeled datasets show that LookAhead achieves an F1-score as high as 0.8966, which represents an improvement of over 44.4% compared to the previous state-of-the-art solution, with a False Positive Rate (FPR) at only 0.16%.

LookAhead: Preventing DeFi Attacks via Unveiling Adversarial Contracts

TL;DR

LookAhead tackles DeFi security by detecting adversarial contracts rather than adversarial transactions, addressing the blind spot created by private mempools. It introduces PSCFT, a pruned semantic representation of EVM bytecode, and combines a transformer with an ensemble meta-classifier to identify adversarial contracts with high precision and low false positives. The approach is validated on a large, manually labeled dataset of adversarial and benign contracts, achieving an F1-score of up to 0.8966 and a false positive rate as low as 0.16%, significantly outperforming prior work. Practical evaluations, including on-chain live experiments, demonstrate timely, just-in-time predictions within the rescue window and potential defense actions. The work provides a scalable dataset, a novel semantic-tokenization pipeline, and openly available tools to advance real-world DeFi defense.

Abstract

The exploitation of smart contract vulnerabilities in Decentralized Finance (DeFi) has resulted in financial losses exceeding 3 billion US dollars. Existing defense mechanisms primarily focus on detecting and reacting to adversarial transactions executed by attackers that target victim contracts. However, with the emergence of private transaction pools where transactions are sent directly to miners without first appearing in public mempools, current detection tools face significant challenges in identifying attack activities effectively. Based on the fact that most attack logic rely on deploying intermediate smart contracts as supporting components to the exploitation of victim contracts, novel detection methods have been proposed that focus on identifying these adversarial contracts instead of adversarial transactions. However, previous state-of-the-art approaches in this direction have failed to produce results satisfactory enough for real-world deployment. In this paper, we propose LookAhead, a new framework for detecting DeFi attacks via unveiling adversarial contracts. LookAhead leverages common attack patterns, code semantics and intrinsic characteristics found in adversarial smart contracts to train Machine Learning (ML)-based classifiers that can effectively distinguish adversarial contracts from benign ones and make timely predictions of different types of potential attacks. Experiments on our labeled datasets show that LookAhead achieves an F1-score as high as 0.8966, which represents an improvement of over 44.4% compared to the previous state-of-the-art solution, with a False Positive Rate (FPR) at only 0.16%.
Paper Structure (50 sections, 5 figures, 2 tables)

This paper contains 50 sections, 5 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Ethereum & Decentralized Finance (DeFi)
  4. Maximal Extractable Value (MEV)
  5. Overview of LookAhead
  6. Motivating Example
  7. Rescue Possibility
  8. Adversarial Patterns
  9. Threat Model
  10. DeFi Attacks
  11. Adversaries
  12. Victim of Attacks
  13. Rescue Time Frame
  14. System Model
  15. Dataset Building
  16. ...and 35 more sections

Figures (5)

  • Figure 1: Read-only reentrancy attack on Conic Finance, using a private adversarial transaction to evade detection, could have been prevented during the rescue time frame.
  • Figure 2: a) Left: attack directly, b) Right: attack through adversarial contracts.
  • Figure 3: An overview of the LookAhead system.
  • Figure 4: Side-by-side comparison of raw IR and PSCFT.
  • Figure 5: LookAhead's system building workflow