TxRay：活区块链攻击的代理事后分析
TxRay: Agentic Postmortem of Live Blockchain Attacks
AI总结：
TxRay通过代理系统利用LLM和工具调用，从有限证据中重建活区块链攻击，生成可执行的PoC并验证根本原因，提升攻击分析效率和覆盖范围。
摘要：
去中心化金融（DeFi）已将区块链转变为金融基础设施，允许任何人进行交易、借贷和构建协议，而无需中介，但这种开放性暴露了由代码控制的价值池。在五年内，DeFi生态系统已因报告的漏洞损失超过157.5亿美元。许多漏洞源于无许可的机会，任何参与者仅通过公共状态和标准接口即可触发，我们称之为“任何人可取”（ACT）机会。尽管链上透明度，事后分析仍缓慢且手动：调查从有限的证据开始，有时仅一个交易哈希，必须通过恢复相关交易、合同代码和状态依赖性来重建漏洞生命周期。我们提出了TxRay，一种利用工具调用重建活ACT攻击的大型语言模型（LLM）代理事后分析系统。从一个或多个种子交易开始，TxRay恢复漏洞生命周期，推导出证据支持的根本原因，并生成可运行的、自包含的可证明概念（PoC），以确定性重现事件。TxRay通过将事件特定的语义或acles编码为可执行断言进行自我检查。为了评估PoC的正确性和质量，我们开发了PoCEvaluator，一个独立的代理执行和审查评估器。在114个DeFiHackLabs事件上，TxRay为105个事件生成了专家对齐的根本原因和可执行的PoC，实现了92.11%的端到端重现。在PoCEvaluator下，98.1%的TxRay PoC避免硬编码攻击者地址，比DeFiHackLabs提高了22.9个百分点。在实时部署中，TxRay在中位延迟下40分钟内提供验证的根本原因，59分钟内生成PoC。TxRay的oracle验证的PoC使攻击模仿得以实现，覆盖范围比STING和APE分别提高了15.6%和65.5%。
英文摘要：
Decentralized Finance (DeFi) has turned blockchains into financial infrastructure, allowing anyone to trade, lend, and build protocols without intermediaries, but this openness exposes pools of value controlled by code. Within five years, the DeFi ecosystem has lost over 15.75B USD to reported exploits. Many exploits arise from permissionless opportunities that any participant can trigger using only public state and standard interfaces, which we call Anyone-Can-Take (ACT) opportunities. Despite on-chain transparency, postmortem analysis remains slow and manual: investigations start from limited evidence, sometimes only a single transaction hash, and must reconstruct the exploit lifecycle by recovering related transactions, contract code, and state dependencies. We present TxRay, a Large Language Model (LLM) agentic postmortem system that uses tool calls to reconstruct live ACT attacks from limited evidence. Starting from one or more seed transactions, TxRay recovers the exploit lifecycle, derives an evidence-backed root cause, and generates a runnable, self-contained Proof of Concept (PoC) that deterministically reproduces the incident. TxRay self-checks postmortems by encoding incident-specific semantic oracles as executable assertions. To evaluate PoC correctness and quality, we develop PoCEvaluator, an independent agentic execution-and-review evaluator. On 114 incidents from DeFiHackLabs, TxRay produces an expert-aligned root cause and an executable PoC for 105 incidents, achieving 92.11% end-to-end reproduction. Under PoCEvaluator, 98.1% of TxRay PoCs avoid hard-coding attacker addresses, a +22.9pp lift over DeFiHackLabs. In a live deployment, TxRay delivers validated root causes in 40 minutes and PoCs in 59 minutes at median latency. TxRay's oracle-validated PoCs enable attack imitation, improving coverage by 15.6% and 65.5% over STING and APE.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
