查寻对链链的解Fi攻击 (BLOCKEYE: Hunting For DeFi Attacks on Blockchain)

Decentralized finance, i.e., DeFi, has become the most popular type of application on many public blockchains (e.g., Ethereum) in recent years. Compared to the traditional finance, DeFi allows customers to flexibly participate in diverse blockchain financial services (e.g., lending, borrowing, collateralizing, exchanging etc.) via smart contracts at a relatively low cost of trust. However, the open nature of DeFi inevitably introduces a large attack surface, which is a severe threat to the security of participants funds. In this paper, we proposed BLOCKEYE, a real-time attack detection system for DeFi projects on the Ethereum blockchain. Key capabilities provided by BLOCKEYE are twofold: (1) Potentially vulnerable DeFi projects are identified based on an automatic security analysis process, which performs symbolic reasoning on the data flow of important service states, e.g., asset price, and checks whether they can be externally manipulated. (2) Then, a transaction monitor is installed offchain for a vulnerable DeFi project. Transactions sent not only to that project but other associated projects as well are collected for further security analysis. A potential attack is flagged if a violation is detected on a critical invariant configured in BLOCKEYE, e.g., Benefit is achieved within a very short time and way much bigger than the cost. We applied BLOCKEYE in several popular DeFi projects and managed to discover potential security attacks that are unreported before. A video of BLOCKEYE is available at https://youtu.be/7DjsWBLdlQU.

翻译：与传统金融相比, DeFi 允许客户以相对较低的信任成本通过智能合同灵活地参与多种链式金融服务(例如借贷、借贷、抵押、交换等),但是, DeFi 的开放性不可避免地带来一个巨大的攻击面,对参与者资金的安全构成严重威胁。在本文中,我们提议BLOCKEYE,这是Eceepum 区链上DeFi项目的实时攻击探测系统。BLOCKEE提供的关键能力是双重的:(1) 根据自动安全分析程序确定潜在脆弱的 DeFi 项目,对重要服务状态的数据流进行象征性推理,例如资产价格,并检查它们是否可以被外部操纵。随后,我们为一个脆弱的 DeFi 项目安装了一个通向外端的交易监测器。交易不仅向该项目发送了,而且还在EFE 区链链链中收集了其他相关项目,用于进一步的安全攻击。如果在EFOFL e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e e leveloplevelyl level level lection lection suction suction sub la la la la la la la la la la sub la la la la la la la la la la la la la la la la la la la la la la la la la la la la la la la la le le le le le le le le le le la la le lection la le le le le le le le le la la la le le le le le le le le le le le le le la la le le le le le le le le le le