LookAhead: Preventing DeFi Attacks via Unveiling Adversarial Contracts

• DOI: 10.48550/arxiv.2401.07261
• Publication Date: 2024-01-01
• Authors: Ren, Shoupeng; He, Lipeng; Tu, Tianyu; Wu, Di; Liu, Jian; Ren, Kui; Chen, Chun
• Keywords: FOS: Computer and information sciences; Computer Science - Cryptography and Security; 68-04; Cryptography and Security (cs.CR); D.2.11

The exploitation of smart contract vulnerabilities in Decentralized Finance (DeFi) has resulted in financial losses exceeding 3 billion US dollars. Existing defense mechanisms primarily focus on detecting and reacting to adversarial transactions executed by attackers that target victim contracts. However, with the emergence of private transaction pools where transactions are sent directly to miners without first appearing in public mempools, current detection tools face significant challenges in identifying attack activities effectively. Based on the fact that most attack logic rely on deploying intermediate smart contracts as supporting components to the exploitation of victim contracts, novel detection methods have been proposed that focus on identifying these adversarial contracts instead of adversarial transactions. However, previous state-of-the-art approaches in this direction have failed to produce results satisfactory enough for real-world deployment. In this paper, we propose LookAhead, a new framework for detecting DeFi attacks via unveiling adversarial contracts. LookAhead leverages common attack patterns, code semantics and intrinsic characteristics found in adversarial smart contracts to train Machine Learning (ML)-based classifiers that can effectively distinguish adversarial contracts from benign ones and make timely predictions of different types of potential attacks. Experiments on our labeled datasets show that LookAhead achieves an F1-score as high as 0.8966, which represents an improvement of over 44.4% compared to the previous state-of-the-art solution, with a False Positive Rate (FPR) at only 0.16%.<br/>23 pages, 7 figures; Accepted to FSE 2025, to be published in The Proceedings of the ACM on Software Engineering (PACMSE)<br/>