[论文解读] DeFiRanger: Detecting Price Manipulation Attacks on DeFi Applications

Siwei Wu, Dabao Wang+6 more|arXiv (Cornell University)|Apr 30, 2021

Blockchain Technology Applications and Security参考文献 36被引用 30

一句话总结

DeFiRanger 从以太坊交易中通过现金流树和语义提升提取高层次的 DeFi 语义，检测直接和间接价格操纵攻击，评估在超过 $350M$ 交易中并发现 432 起真实世界攻击。

ABSTRACT

The rapid growth of Decentralized Finance (DeFi) boosts the Ethereum ecosystem. At the same time, attacks towards DeFi applications (apps) are increasing. However, to the best of our knowledge, existing smart contract vulnerability detection tools cannot be directly used to detect DeFi attacks. That's because they lack the capability to recover and understand high-level DeFi semantics, e.g., a user trades a token pair X and Y in a Decentralized EXchange (DEX). In this work, we focus on the detection of two types of new attacks on DeFi apps, including direct and indirect price manipulation attacks. The former one means that an attacker directly manipulates the token price in DEX by performing an unwanted trade in the same DEX by attacking the vulnerable DeFi app. The latter one means that an attacker indirectly manipulates the token price of the vulnerable DeFi app (e.g., a lending app). To this end, we propose a platform-independent way to recover high-level DeFi semantics by first constructing the cash flow tree from raw Ethereum transactions and then lifting the low-level semantics to high-level ones, including token trade, liquidity mining, and liquidity cancel. Finally, we detect price manipulation attacks using the patterns expressed with the recovered DeFi semantics. We have implemented a prototype named ool{} and applied it to more than 350 million transactions. It successfully detected 432 real-world attacks in the wild. We confirm that they belong to four known security incidents and five zero-day ones. We reported our findings. Two CVEs have been assigned. We further performed an attack analysis to reveal the root cause of the vulnerability, the attack footprint, and the impact of the attack. Our work urges the need to secure the DeFi ecosystem.

研究动机与目标

• 激发需要在检测 DeFi 价格操纵攻击方面超越代码漏洞检测的必要性。
• 开发一种与平台无关的方法，从原始以太坊交易中恢复高层次的 DeFi 语义。
• 提出一个实用系统(DeFiRanger)，以规模化方式检测直接和间接的价格操纵攻击。
• 在大规模交易数据上评估语义恢复的准确性和真实世界攻击检测。
• 提供攻击分析，以了解根本原因及对易受攻击的 DeFi 应用的影响。

提出的方法

• 从原始以太坊交易构建现金流树（CFT），以表示代币转移和跨合约交互。
• 修剪不必要的内部交易，聚焦于相关的代币转移动作（以代币转移为原语）。
• 执行语义提升，从 CFT 还原高层次的 DeFi 操作，如流动性挖掘、流动性取消和交易。
• 定义 DeFi 操作，并使用基于模式的规则从恢复的语义中检测价格操纵攻击（直接和间接）。
• 部署一个修改过的以太坊节点，以收集内部状态和执行顺序数据，以实现准确的 CFT 构建。
• 将语义恢复与 Etherscan 进行对比评估，并对数亿级交易执行大规模攻击检测。

实验结果

研究问题

• RQ1 如何从低级别的以太坊交易中恢复高层次的 DeFi 语义，以实现对 DeFi 攻击的防御？
• RQ2 一种平台无关的语义提升方法是否能够检测 DeFi 应用中的直接和间接价格操纵攻击？
• RQ3 DeFiRanger 在野外大规模检测真实世界攻击和零日攻击方面有多有效？
• RQ4 检测到的价格操纵事件的共同根本原因和攻击足迹是什么？

主要发现

• DeFiRanger 在野外从超过 $350,823,625$ 笔交易中检测到432起真实世界的价格操纵攻击。
• 这些攻击属于四起已知安全事件和五起零日事件，总损失约为 $39M$ USD。
• 语义提升识别的 DeFi 语义比 Etherscan 更多，假阴性率更低，表明对 DeFi 动作的覆盖有所提升。
• 在报告结果后分配了两项 CVE，显示实际的安全影响。
• 攻击分析揭示根本原因包括接口访问控制不足和价格依赖性不安全，攻击者表现出成熟且可追踪的策略。