[Paper Review] The Art of The Scam: Demystifying Honeypots in Ethereum Smart Contracts

Christof Ferreira Torres, Mathis Steichen+1 more|arXiv (Cornell University)|Feb 19, 2019

Blockchain Technology Applications and SecurityComputer Science31 references51 citations

TL;DR

This paper systematically analyzes honeypot scams in Ethereum, develops HoneyBadger to detect them via symbolic execution and heuristics, and reports large-scale findings on prevalence, techniques, and profitability.

ABSTRACT

Modern blockchains, such as Ethereum, enable the execution of so-called smart contracts - programs that are executed across a decentralised network of nodes. As smart contracts become more popular and carry more value, they become more of an interesting target for attackers. In the past few years, several smart contracts have been exploited by attackers. However, a new trend towards a more proactive approach seems to be on the rise, where attackers do not search for vulnerable contracts anymore. Instead, they try to lure their victims into traps by deploying seemingly vulnerable contracts that contain hidden traps. This new type of contracts is commonly referred to as honeypots. In this paper, we present the first systematic analysis of honeypot smart contracts, by investigating their prevalence, behaviour and impact on the Ethereum blockchain. We develop a taxonomy of honeypot techniques and use this to build HoneyBadger - a tool that employs symbolic execution and well defined heuristics to expose honeypots. We perform a large-scale analysis on more than 2 million smart contracts and show that our tool not only achieves high precision, but is also highly efficient. We identify 690 honeypot smart contracts as well as 240 victims in the wild, with an accumulated profit of more than $90,000 for the honeypot creators. Our manual validation shows that 87% of the reported contracts are indeed honeypots.

Motivation & Objective

• Define honeypots in Ethereum smart contracts and motivate their risk to users and the ecosystem.
• Develop a taxonomy of honeypot techniques highlighting SMT-based detection challenges.
• Create HoneyBadger, a tool combining symbolic execution and heuristics to detect honeypot contracts.
• Perform large-scale analysis on Ethereum bytecode to quantify honeypot prevalence and impact.

Proposed method

• Build a taxonomy of honeypot techniques categorized by the operating level: Ethereum Virtual Machine, Solidity compiler, and Etherscan explorer.
• Develop HoneyBadger, a Python-based tool using symbolic execution (CFG via bytecode) and the Z3 SMT solver to analyze paths and detect fund flows.
• Perform cash-flow analysis to determine if a contract can receive and transfer funds.
• Implement honeypot detectors as heuristics linked to each taxonomy technique (e.g., Balance Disorder, Inheritance Disorder, Skip Empty String Literal, etc.).
• Evaluate HoneyBadger on a dataset of Ethereum contracts to assess precision and scalability.

Experimental results

Research questions

• RQ1 What are the common techniques used by honeypots in Ethereum smart contracts?
• RQ2 How prevalent are honeypot contracts on the Ethereum blockchain?
• RQ3 Can a tool automatically detect honeypot patterns with high precision and efficiency?
• RQ4 What is the potential profitability and impact of deployed honeypots?

Key findings

• Identified 690 unique honeypot contracts and 240 victims in the wild.
• Accumulated profit from honeypots exceeds $90,000.
• Manual validation showed 87% of reported contracts are honeypots.
• Analyzed over 2 million smart contracts to assess prevalence and characteristics.
• HoneyBadger achieved high precision and efficient large-scale analysis.
• Presented a taxonomy and a tooling approach enabling automated honeypot detection.