[Paper Review] DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications

Siwei Wu, Dabao Wang+6 more|arXiv (Cornell University)|Apr 30, 2021

Blockchain Technology Applications and Security36 references30 citations

TL;DR

DeFiRanger recovers high-level DeFi semantics from Ethereum transactions via a cash flow tree and semantic lifting to detect direct and indirect price manipulation attacks on DeFi apps, evaluating on over $350M$ transactions and finding 432 real-world attacks.

ABSTRACT

The rapid growth of Decentralized Finance (DeFi) boosts the Ethereum ecosystem. At the same time, attacks towards DeFi applications (apps) are increasing. However, to the best of our knowledge, existing smart contract vulnerability detection tools cannot be directly used to detect DeFi attacks. That's because they lack the capability to recover and understand high-level DeFi semantics, e.g., a user trades a token pair X and Y in a Decentralized EXchange (DEX). In this work, we focus on the detection of two types of new attacks on DeFi apps, including direct and indirect price manipulation attacks. The former one means that an attacker directly manipulates the token price in DEX by performing an unwanted trade in the same DEX by attacking the vulnerable DeFi app. The latter one means that an attacker indirectly manipulates the token price of the vulnerable DeFi app (e.g., a lending app). To this end, we propose a platform-independent way to recover high-level DeFi semantics by first constructing the cash flow tree from raw Ethereum transactions and then lifting the low-level semantics to high-level ones, including token trade, liquidity mining, and liquidity cancel. Finally, we detect price manipulation attacks using the patterns expressed with the recovered DeFi semantics. We have implemented a prototype named ool{} and applied it to more than 350 million transactions. It successfully detected 432 real-world attacks in the wild. We confirm that they belong to four known security incidents and five zero-day ones. We reported our findings. Two CVEs have been assigned. We further performed an attack analysis to reveal the root cause of the vulnerability, the attack footprint, and the impact of the attack. Our work urges the need to secure the DeFi ecosystem.

Motivation & Objective

• Motivate the need to detect DeFi price manipulation attacks beyond code vulnerability detection.
• Develop a platform-independent method to recover high-level DeFi semantics from raw Ethereum transactions.
• Propose a practical system (DeFiRanger) to detect direct and indirect price manipulation attacks at scale.
• Evaluate semantics recovery accuracy and real-world attack detection on large transaction data.
• Provide attack analysis to understand root causes and impact on vulnerable DeFi apps.

Proposed method

• Construct a cash flow tree (CFT) from raw Ethereum transactions to represent token transfers and inter-contract interactions.
• Prune unnecessary internal transactions to focus on relevant token transfer actions (token transfer as primitive).
• Perform semantic lifting to recover high-level DeFi actions such as liquidity mining, liquidity cancel, and trades from the CFT.
• Define DeFi actions and use pattern-based rules to detect price manipulation attacks (direct and indirect) from recovered semantics.
• Deploy a modified Ethereum node to collect internal state and execution order data for accurate CFT construction.
• Evaluate semantic recovery against Etherscan and perform large-scale attack detection on hundreds of millions of transactions.

Experimental results

Research questions

• RQ1 How can high-level DeFi semantics be recovered from low-level Ethereum transactions to enable defense against DeFi attacks?
• RQ2 Can a platform-independent semantic lifting approach detect both direct and indirect price manipulation attacks in DeFi apps?
• RQ3 How effective is DeFiRanger at large-scale detection of real-world and zero-day attacks in the wild?
• RQ4 What are the common root causes and attack footprints of detected price manipulation incidents?

Key findings

• DeFiRanger detected 432 real-world price manipulation attacks in the wild from over $350,823,625$ transactions.
• The attacks belong to four known security incidents and five zero-day incidents, with total losses around $39M$ USD.
• Semantic lifting identifies more DeFi semantics than Etherscan, with a lower false negative rate, indicating improved coverage of DeFi actions.
• Two CVEs were assigned after reporting findings, demonstrating practical security impact.
• Attack analysis reveals root causes include insufficient access control of interfaces and insecure price dependence, and attackers exhibit mature, traceable strategies.