BLOCKEYE：寻找对区块链的DeFi攻击
BLOCKEYE: Hunting For DeFi Attacks on Blockchain
摘要：
分散式融资，即，DeFi已经成为许多公共区块链上最受欢迎的应用程序类型（例如，Ethereum）近年来。与传统金融相比，DeFi允许客户灵活参与多样化的区块链金融服务（例如，贷款、借款、抵押、交换等）通过智能合约，以相对较低的信任成本。然而，DeFi的开放性不可避免地引入了较大的攻击面，这对参与者的资金安全构成了严重威胁。在本文中，我们提出了BLOCKEYE，这是一个针对以太坊区块链上DeFi项目的实时攻击检测系统。BLOCKEYE提供的关键能力有两个方面：（1）基于自动安全分析流程识别潜在易受攻击的DeFi项目，该流程对重要服务状态的数据流进行符号推理，例如，资产价格，并检查它们是否可以被外部操纵。(2)然后，在链下为易受攻击的DeFi项目安装事务监视器。不仅发送到该项目的交易，而且还收集其他相关项目的交易，以进行进一步的安全分析。如果在BLOCKEYE中配置的关键不变式上检测到违规，则标记潜在攻击，例如，收益在很短的时间内就能实现，而且远远大于成本。我们在几个流行的DeFi项目中应用了BLOCKEYE，并成功发现了之前未报告的潜在安全攻击。BLOCKEYE的视频可在https://youtu.be/7DjsWBLdlQU上获得。
英文摘要：
Decentralized finance, i.e., DeFi, has become the most popular type of application on many public blockchains (e.g., Ethereum) in recent years. Compared to the traditional finance, DeFi allows customers to flexibly participate in diverse blockchain financial services (e.g., lending, borrowing, collateralizing, exchanging etc.) via smart contracts at a relatively low cost of trust. However, the open nature of DeFi inevitably introduces a large attack surface, which is a severe threat to the security of participants funds. In this paper, we proposed BLOCKEYE, a real-time attack detection system for DeFi projects on the Ethereum blockchain. Key capabilities provided by BLOCKEYE are twofold: (1) Potentially vulnerable DeFi projects are identified based on an automatic security analysis process, which performs symbolic reasoning on the data flow of important service states, e.g., asset price, and checks whether they can be externally manipulated. (2) Then, a transaction monitor is installed offchain for a vulnerable DeFi project. Transactions sent not only to that project but other associated projects as well are collected for further security analysis. A potential attack is flagged if a violation is detected on a critical invariant configured in BLOCKEYE, e.g., Benefit is achieved within a very short time and way much bigger than the cost. We applied BLOCKEYE in several popular DeFi projects and managed to discover potential security attacks that are unreported before. A video of BLOCKEYE is available at https://youtu.be/7DjsWBLdlQU.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
