DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications

Wu, Siwei; Wang, Dabao; He, Jim; Zhou, Yajin; Wu, Lei; Yuan, Xingliang; He, Qinming; Ren, Kui

doi:10.48550/arxiv.2104.15068

Cited by 3 publications

(5 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To get more loans, attackers can boost the cryptocurrency exchange rate on the oracle by modifying the real-time price-related status before the loan is made. For example, an attacker can gain a larger quantity of tokens by directly manipulating token prices in the asset pool or increasing the price of collateral before lending [58], putting the borrower in danger of bad debt.…”

Section: ) Lending Market Imperfectionmentioning

confidence: 99%

“…The arbitrageur uses part of the borrowed assets to raise or lower the price of the assets in the AMM liquidity pool, that is, the asset exchange ratio. The arbitrageurs then use the remaining loan to make another trade for profit [58]. Finally, they repay the loan.…”

Section: Application Layer Vulnerabilities 1) Utilization Of Flash Loansmentioning

confidence: 99%

“…DeFiRanger [58] is a price manipulation checker that first collects transactions on Ethereum and constructs a tree structure on the flow of cash. Then it defines the style based on DeFi attack behavior and recovers the low-level semantics to high-level semantics.…”

Section: Figure 5 Diagram Of Blockeye Core Processmentioning

confidence: 99%

See 2 more Smart Citations

A Survey of DeFi Security: Challenges and Opportunities

Li¹,

Bu²,

Li³

et al. 2022

Preprint

View full text Add to dashboard Cite

Decentralized finance (DeFi), which is a promising domain since the era of blockchain 2.0, locked $200 billion in April 2022. However, it quickly dropped to $100 billion in May 2022, which makes us realize that security issues in this area are still a challenging job. DeFi is more complex than traditional finance because it is decentralized through blockchain and without a trustworthy third-party institution to act as a guarantee. So it owns not only financial properties but also technical aspects. Existing synthesis work for DeFi tends to ignore the relevance of various layers of security for the whole system. In addition, distinct layers have different means of protection against specific vulnerabilities, which is not considered by existing analytical work. In this paper, we perform a vulnerability analysis for the entire technology layer of the DeFi application, and then we collect the most impactive attacks in recent years. Finally, we summarize the existing optimization approaches for different layers and provide some challenges and future directions.

show abstract

Section: ) Lending Market Imperfectionmentioning

confidence: 99%

Section: Application Layer Vulnerabilities 1) Utilization Of Flash Loansmentioning

confidence: 99%

See 1 more Smart Citation

A Survey of DeFi Security: Challenges and Opportunities

Li¹,

Bu²,

Li³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…The security of DeFi is also a hot research topic. There are many researchers studying on the price manipulation of DeFi [37,61,63,64,68,72]. For example, Boonpeam et al [37] investigate arbitrage strategies and factors for profit-maximizing on decentralized exchanges, while Wang et al [68] focus on cyclic arbitrage on Uniswap and evaluate its impact.…”

Section: Related Workmentioning

confidence: 99%

Trade or Trick? Detecting and Characterizing Scam Tokens on Uniswap Decentralized Exchange

Xia¹,

wang²,

Gao³

et al. 2021

Preprint

View full text Add to dashboard Cite

The prosperity of the cryptocurrency ecosystem drives the needs for digital asset trading platforms. Beyond centralized exchanges (CEXs), decentralized exchanges (DEXs) are introduced to allow users to trade cryptocurrency without transferring the custody of their digital assets to the middlemen, thus eliminating the security and privacy issues of CEX. Uniswap, as the most prominent cryptocurrency DEX, is continuing to attract scammers, with fraudulent cryptocurrencies flooding in the ecosystem. In this paper, we take the first step to detect and characterize scam tokens on Uniswap. We first collect all the transactions related to Uniswap exchanges and investigate the landscape of cryptocurrency trading on Uniswap from different perspectives. Then, we propose an accurate approach for flagging scam tokens on Uniswap based on a guilt-by-association heuristic and a machine-learning powered technique. We have identified over 10K scam tokens listed on Uniswap, which suggests that roughly 50% of the tokens listed on Uniswap are scam tokens. All the scam tokens and liquidity pools are created specialized for the "rug pull" scams, and some scam tokens have embedded tricks and backdoors in the smart contracts. We further observe that thousands of collusion addresses help carry out the scams in league with the scam token/pool creators. The scammers have gained a profit of at least $16 million from 40,165 potential victims. Our observations in this paper suggest the urgency to identify and stop scams in the decentralized finance ecosystem.

show abstract

“…However, private transactions have not attracted much attention from the research community. There are several works that have analyzed the Ethereum blockchain and DeFi platforms, but they mainly focus on 1) detecting bugs from smart contracts [37], [46], [47], [55], [58], [72], [73], [76], 2) measuring Ethereum networks and transactions [4], [14], [49], [52], [67], [86], [88], and 3) analyzing transactions to uncover attacks [63], [66], [83], [87].…”

Section: Introductionmentioning

confidence: 99%

An Empirical Study on Ethereum Private Transactions and the Security Implications

Lyu¹,

Zhang²,

Zhang³

et al. 2022

Preprint

View full text Add to dashboard Cite

Recently, Decentralized Finance (DeFi) platforms on Ethereum are booming, and numerous traders are trying to capitalize on the opportunity for maximizing their benefits by launching front-running attacks and extracting Miner Extractable Values (MEVs) based on information in the public mempool. To protect end users from being harmed and hide transactions from the mempool, private transactions, a special type of transactions that are sent directly to miners, were invented. Private transactions have a high probability of being packed to the front positions of a block and being added to the blockchain by the target miner, without going through the public mempool, thus reducing the risk of being attacked by malicious entities.Despite the good intention of inventing private transactions, due to their stealthy nature, private transactions have also been used by attackers to launch attacks, which has a negative impact on the Ethereum ecosystem. However, existing works only touch upon private transactions as by-products when studying MEV, while a systematic study on private transactions is still missing. To fill this gap and paint a complete picture of private transactions, we take the first step towards investigating the private transactions on Ethereum. In particular, we collect largescale private transaction datasets and perform analysis on their characteristics, transaction costs and miner profits, as well as security impacts. This work provides deep insights on different aspects of private transactions.

show abstract

DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications

Cited by 3 publications

References 24 publications

A Survey of DeFi Security: Challenges and Opportunities

A Survey of DeFi Security: Challenges and Opportunities

Trade or Trick? Detecting and Characterizing Scam Tokens on Uniswap Decentralized Exchange

An Empirical Study on Ethereum Private Transactions and the Security Implications

Contact Info

Product

Resources

About