用大模型分析代码和交易数据，精准识别各类DeFi价格操纵行为
Detecting Various DeFi Price Manipulations with LLM Reasoning
- 基于大模型抽象智能合约中的价格计算逻辑，结合合成数据微调提升识别能力
- 在真实攻击中召回率达80%，可疑交易精确率达96%，无误报
- 适用于标准与自定义价格模型，适合区块链安全团队与审计机构使用
去中心化金融（DeFi）是当前加密货币与智能合约的重要应用，链上锁定资产规模达数百亿美元，但仍易受价格操纵攻击。尽管已有先进系统如DeFiRanger和DeFort，我们发现它们对自定义协议中的非标准价格模型效果较差，这类攻击占过去三年报告的95起攻击中的44.2%。本文提出首个基于大语言模型（LLM）的检测方法DeFiScope，可识别标准与自定义价格模型下的多种价格操纵行为。核心思路是利用LLM从智能合约源码中抽象价格计算机制，并基于提取的价格模型推断代币价格趋势。为增强模型能力，我们使用Foundry生成链上数据并微调专用于DeFi价格的LLM。结合低层交易数据恢复的高层操作，DeFiScope通过系统挖掘模式实现检测。实验表明，其在真实攻击中达到80%召回率、96%精确率，且对正常交易零误报，显著优于现有方法。此外，我们评估了成本效益，验证其实用性：帮助产业合作伙伴确认147起真实攻击，包括发现81起此前未知的历史事件。
原文摘要 · Abstract (English)
DeFi (Decentralized Finance) is one of the most important applications of today's cryptocurrencies and smart contracts. It manages hundreds of billions in Total Value Locked (TVL) on-chain, yet it remains susceptible to common DeFi price manipulation attacks. Despite state-of-the-art (SOTA) systems like DeFiRanger and DeFort, we found that they are less effective to non-standard price models in custom DeFi protocols, which account for 44.2% of the 95 DeFi price manipulation attacks reported over the past three years. In this paper, we introduce the first LLM-based approach, DeFiScope, for detecting DeFi price manipulation attacks in both standard and custom price models. Our insight is that large language models (LLMs) have certain intelligence to abstract price calculation from smart contract source code and infer the trend of token price changes based on the extracted price models. To further strengthen LLMs in this aspect, we leverage Foundry to synthesize on-chain data and use it to fine-tune a DeFi price-specific LLM. Together with the high-level DeFi operations recovered from low-level transaction data, DeFiScope detects various DeFi price manipulations according to systematically mined patterns. Experimental results show that DeFiScope achieves a high recall of 80% on real-world attacks, a precision of 96% on suspicious transactions, and zero false alarms on benign transactions, significantly outperforming SOTA approaches. Moreover, we evaluate DeFiScope's cost-effectiveness and demonstrate its practicality by helping our industry partner confirm 147 real-world price manipulation attacks, including discovering 81 previously unknown historical incidents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。