DeFiGuard: A Price Manipulation Detection Service in DeFi using Graph Neural Networks

TL;DR

DeFiGuard targets the safety gap in DeFi by detecting price manipulation attacks (PMA) through graph-based learning. It converts each transaction into a cash flow graph $\mathcal{G} = (\mathcal{V}, \mathcal{E}, \mathcal{X})$ and trains Graph Neural Networks to perform graph classification, predicting $\mathcal{P} \in \{0,1\}$. The system consists of three modular components—Transaction Parser, Graph Builder, and Graph Classifier—and introduces four node features: $X_{type}$, $X_{frequency}$, $X_{diversity}$, and $X_{profit}$ to capture trading behavior. Evaluation on a PMA-rich dataset shows that DeFiGuard with GraphSAGE achieves up to 93.25% accuracy and 96.18% AUC-ROC, with per-transaction inference times well under block production times, enabling timely mitigation. The approach demonstrates strong effectiveness, adaptability, and practicality for real-time PMA detection in DeFi, and the authors plan to release the graph-based dataset to support ongoing research.

Abstract

The prosperity of Decentralized Finance (DeFi) unveils underlying risks, with reported losses surpassing 3.2 billion USD between 2018 and 2022 due to vulnerabilities in Decentralized Applications (DApps). One significant threat is the Price Manipulation Attack (PMA) that alters asset prices during transaction execution. As a result, PMA accounts for over 50 million USD in losses. To address the urgent need for efficient PMA detection, this paper introduces a novel detection service, DeFiGuard, using Graph Neural Networks (GNNs). In this paper, we propose cash flow graphs with four distinct features, which capture the trading behaviors from transactions. Moreover, DeFiGuard integrates transaction parsing, graph construction, model training, and PMA detection. Evaluations on a dataset of 208 PMA and 2,080 non-PMA transactions show that DeFiGuard with GNN models outperforms the baseline in Accuracy, TPR, FPR, and AUC-ROC. The results of ablation studies suggest that the combination of the four proposed node features enhances DeFiGuard's efficacy. Moreover, DeFiGuard classifies transactions within 0.892 to 5.317 seconds, which provides sufficient time for the victims (DApps and users) to take action to rescue their vulnerable funds. In conclusion, this research offers a significant step towards safeguarding the DeFi landscape from PMAs using GNNs.

Figures (7)

• Figure 1: The high-level architecture of DeFiGuard.
• Figure 2: The graph construction process.
• Figure 3: An example of a cash flow graph with four distinct features.
• Figure 4: Probability distribution analysis for graph-based metrics.
• Figure 5: Probability distribution analysis for transaction-based metrics.