[Paper Review] SoK: Comprehensive Analysis of Rug Pull Causes, Datasets, and Detection Tools in DeFi

Dianxiang Sun, Wei Ma+2 more|arXiv (Cornell University)|Mar 24, 2024

Nuclear Materials and PropertiesMaterials Science3 citations

TL;DR

This paper proposes a comprehensive taxonomy of 34 rug pull causes in DeFi, evaluates existing datasets and detection tools, and introduces an expanded dataset covering 54% of root causes. It reveals that current detection tools miss 26.5% of rug pull types, exposing critical gaps in research and practice.

ABSTRACT

Rug pulls pose a grave threat to the cryptocurrency ecosystem, leading to substantial financial loss and undermining trust in decentralized finance (DeFi) projects. With the emergence of new rug pull patterns, research on rug pull is out of state. To fill this gap, we first conducted an extensive analysis of the literature review, encompassing both scholarly and industry sources. By examining existing academic articles and industrial discussions on rug pull projects, we present a taxonomy inclusive of 34 root causes, introducing six new categories inspired by industry sources: burn, hidden owner, ownership transfer, unverified contract, external call, and fake LP lock. Based on the developed taxonomy, we evaluated current rug pull datasets and explored the effectiveness and limitations of existing detection mechanisms. Our evaluation indicates that the existing datasets, which document 2,448 instances, address only 7 of the 34 root causes, amounting to a mere 20% coverage. It indicates that existing open-source datasets need to be improved to study rug pulls. In response, we have constructed a more comprehensive dataset containing 2,360 instances, expanding the coverage to 54% with the best effort. In addition, the examination of 14 detection tools showed that they can identify 25 of the 34 root causes, achieving a coverage of 73.5%. There are nine root causes (Fake LP Lock, Hidden Fee, and Destroy Token, Fake Money Transfer, Ownership Transfer, Liquidity Pool Block, Freeze Account, Wash-Trading, Hedge) that the existing tools cannot cover. Our work indicates that there is a significant gap between current research and detection tools, and the actual situation of rug pulls.

Motivation & Objective

• Address the growing disconnect between academic research and real-world DeFi rug pull patterns by integrating industry insights with scholarly literature.
• Identify and classify 34 root causes of rug pulls, including six novel categories derived from industry reports such as 'burn', 'hidden owner', and 'fake LP lock'.
• Evaluate the coverage of existing public rug pull datasets against the proposed taxonomy to expose representativeness and completeness limitations.
• Assess the effectiveness of 14 existing detection tools in identifying the full spectrum of rug pull causes, revealing significant blind spots.
• Reconstruct a more comprehensive dataset with 2,360 instances to improve research reproducibility and support future detection tool development.

Proposed method

• Conducted a systematic literature review across seven databases (Google Scholar, IEEE Xplore, Scopus, ACM DL, arXiv, Google Search, Twitter) to collect 661 academic and industrial sources.
• Developed a structured taxonomy of 34 root causes grouped into six high-level categories, informed by expert analysis and validation from both academic and industry sources.
• Evaluated three existing public rug pull datasets against the taxonomy to measure coverage, revealing only 20% coverage of root causes.
• Reconstructed a new, more comprehensive dataset by integrating 90 real-world rug pull instances into existing datasets, increasing coverage to 54%.
• Systematically evaluated 14 open-source rug pull detection tools using the reconstructed dataset to measure detection coverage across all 34 root causes.
• Applied a multi-phase analytical framework (RPAF) combining literature synthesis, taxonomy construction, dataset critique, and tool assessment to ensure methodological rigor.

Experimental results

Research questions

• RQ1 What are the complete and up-to-date root causes of rug pulls in DeFi, and how do they differ from previously documented patterns?
• RQ2 To what extent do existing public rug pull datasets cover the full spectrum of identified root causes?
• RQ3 How effective are current detection tools in identifying the diverse range of rug pull mechanisms, and where do they fall short?
• RQ4 What are the key limitations in current research and tooling that hinder robust detection of emerging and hybrid rug pull strategies?

Key findings

• The study identifies 34 distinct root causes of rug pulls, including six novel categories not previously recognized in academic literature: burn, hidden owner, ownership transfer, unverified contract, external call, and fake LP lock.
• Existing public datasets cover only 20% of the 34 root causes, with 2,448 instances documented across three major datasets, indicating severe representational gaps.
• The reconstructed dataset increases coverage to 54% (2,360 instances), significantly improving diversity and completeness for future research.
• Among 14 evaluated detection tools, only 25 of the 34 root causes (73.5%) are detectable, leaving nine critical causes—such as fake LP lock, wash-trading, and hedge strategies—undetected.
• The study reveals that current detection tools fail to address hybrid and evolving rug pull tactics, particularly those involving social engineering or complex contract logic.
• The research demonstrates a critical misalignment between current detection capabilities and the actual complexity of modern rug pull schemes, underscoring the urgent need for next-generation detection frameworks.