ICSE 2024
Fri 12 - Sun 21 April 2024 Lisbon, Portugal
Fri 19 Apr 2024 12:00 - 12:15 at Fernando Pessoa - Testing: various bug types 2 Chair(s): João F. Ferreira

In decentralized finance (DeFi), lenders can offer flash loans to borrowers, i.e., loans that are only valid within a blockchain transaction and must be repaid with fees by the end of that transaction. Unlike normal loans, flash loans allow borrowers to borrow large assets without upfront collaterals deposits. Malicious adversaries use flash loans to gather large assets to exploit vulnerable DeFi protocols.

In this paper, we introduce a new framework for automated synthesis of adversarial transactions that exploit DeFi protocols using flash loans. To bypass the complexity of a DeFi protocol, we propose a new technique to approximate the DeFi protocol functional behaviors using numerical methods (polynomial linear regression and nearest-neighbor interpolation). We then construct an optimization query using the approximated functions of the DeFi protocol to find an adversarial attack constituted of a sequence of functions invocations with optimal parameters that gives the maximum profit. To improve the accuracy of the approximation, we propose a novel counterexample-driven approximation refinement technique. We implement our framework in a tool named FlashSyn. We evaluate FlashSyn on 16 DeFi protocols that were victims to flash loan attacks and 2 DeFi protocols from Damn Vulnerable DeFi challenges. FlashSyn automatically synthesizes an adversarial attack for 16 of the 18 benchmark cases.

Fri 19 Apr

Displayed time zone: Lisbon change

11:00 - 12:30
Testing: various bug types 2Research Track / Software Engineering in Practice at Fernando Pessoa
Chair(s): João F. Ferreira INESC-ID and IST, University of Lisbon
11:00
15m
Talk
Towards Finding Accounting Errors in Smart ContractsACM SIGSOFT Distinguished Paper Award
Research Track
Brian Zhang Purdue University
11:15
15m
Talk
MultiTest: Physical-Aware Object Insertion for Testing Multi-sensor Fusion Perception Systems
Research Track
Xinyu Gao , Zhijie Wang University of Alberta, Yang Feng Nanjing University, Lei Ma The University of Tokyo & University of Alberta, Zhenyu Chen Nanjing University, Baowen Xu Nanjing University
Pre-print
11:30
15m
Talk
JLeaks: A Featured Resource Leak Repository Collected From Hundreds of Open-Source Java Projects
Research Track
Tianyang Liu Beijing Institute of Technology, Weixing Ji Beijing Institute of Technology, Xiaohui Dong Beijing Institute of Technology, Wuhuang Yao Beijing Institute of Technology, Yizhuo Wang Beijing Institute of Technology, Hui Liu Beijing Institute of Technology, Haiyang Peng Beijing Institute of Technology, Yuxuan Wang Beijing Institute of Technology
11:45
15m
Talk
S3C: Spatial Semantic Scene Coverage for Autonomous Vehicles
Research Track
Trey Woodlief University of Virginia, Felipe Toledo , Sebastian Elbaum University of Virginia, Matthew B Dwyer University of Virginia
Pre-print
12:00
15m
Talk
FlashSyn: Flash Loan Attack Synthesis via Counter Example Driven Approximation
Research Track
Zhiyang Chen University of Toronto, Sidi Mohamed Beillahi University of Toronto, Fan Long University of Toronto
Pre-print
12:15
15m
Talk
Hawkeye: Change-targeted Testing for Android Apps based on Deep Reinforcement Learning
Software Engineering in Practice
Chao Peng ByteDance, China, Zhengwei Lv ByteDance, Jiarong Fu ByteDance, Jiayuan Liang ByteDance, Zhao Zhang Bytedance Network Technology, Ajitha Rajan University of Edinburgh, Ping Yang Bytedance Network Technology