CRPWarner：预警 DeFi 智能合约中与合约相关的 Rug Pull 风险
CRPWarner: Warning the Risk of Contract-related Rug Pull in DeFi Smart Contracts
AI总结：
本文分析103起真实 Rug Pull 事件并区分合约相关与交易相关骗局，提出 CRPWarner 检测智能合约恶意函数，在历史合约和 Ethereum 大规模合约上均取得良好风险预警效果。
摘要：
近年来，由于区块链技术和智能合约的发展，去中心化金融（DeFi）迅速增长。截至2023年3月，全球加密货币市值估计已达到约9490亿美元。然而，安全事件持续困扰着 DeFi 生态系统，其中最臭名昭著的例子之一是“Rug Pull”骗局。当某个代币项目的开发者故意放弃项目并带着投资者的资金消失时，就会发生这种加密货币骗局。尽管 Rug Pull 事件是近年来才出现的，但已经造成了重大的财务损失。在本工作中，我们手动收集并分析了103个真实世界中的 rug pull 事件，并根据其诈骗方法对它们进行分类。我们识别出两个主要类别：与合约相关的 Rug Pull（通过智能合约中的恶意函数实现）和与交易相关的 Rug Pull（通过不使用恶意函数的加密货币交易实现）。基于对 rug pull 事件的分析，我们提出了 CRPWarner（Contract-related Rug Pull Risk Warner 的缩写），用于识别智能合约中的恶意函数，并针对潜在的 rug pull 发出警告。我们在69个与 rug pull 事件相关的开源智能合约上评估了 CRPWarner，取得了91.8%的精确率、85.9%的召回率和88.7%的 F1 分数。此外，在 Ethereum 上的13,484个真实代币合约上评估 CRPWarner 时，它成功检测到4168个包含恶意函数的智能合约，其中包括零日样本。大规模实验的精确率达到84.9%。
英文摘要：
In recent years, Decentralized Finance (DeFi) grows rapidly due to the development of blockchain technology and smart contracts. As of March 2023, the estimated global cryptocurrency market cap has reached approximately $949 billion. However, security incidents continue to plague the DeFi ecosystem, and one of the most notorious examples is the ``Rug Pull" scam. This type of cryptocurrency scam occurs when the developer of a particular token project intentionally abandons the project and disappears with investors' funds. Despite it only emerging in recent years, Rug Pull events have already caused significant financial losses. In this work, we manually collected and analyzed 103 real-world rug pull events, categorizing them based on their scam methods. Two primary categories were identified: Contract-related Rug Pull (through malicious functions in smart contracts) and Transaction-related Rug Pull (through cryptocurrency trading without utilizing malicious functions). Based on the analysis of rug pull events, we propose CRPWarner (short for Contract-related Rug Pull Risk Warner) to identify malicious functions in smart contracts and issue warnings regarding potential rug pulls. We evaluated CRPWarner on 69 open-source smart contracts related to rug pull events and achieved a 91.8% precision, 85.9% recall and 88.7% F1-score. Additionally, when evaluating CRPWarner on 13,484 real token contracts on Ethereum, it successfully detected 4168 smart contracts with malicious functions, including zero-day examples. The precision of large-scale experiment reach 84.9%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
