PriceSleuth: Detecting DeFi Price Manipulation Attacks in Smart Contracts Using LLM and Static Analysis
An increasing number of DeFi protocols are gaining popularity, facilitating transactions among multiple anonymous users. Price Manipulation (PM) is one of the notorious attacks in DeFi smart contracts, whereby attackers exploit token price volatility to obtain illicit profits. In this paper, we propose PriceSleuth, a novel method that leverages the Large Language Model (LLM) and static analysis to detect PM attacks proactively. PriceSleuth firstly identifies core logic function related to price calculation in DeFi contracts. Then it guides LLM to locate the price calculation code statements. Secondly, PriceSleuth performs backward dependency analysis of price variables, instructing LLM in detecting potential price manipulation. Finally, PriceSleuth utilizes propagation analysis of price variables to assist LLM in detecting whether these variables are maliciously exploited. We presented preliminary experimental results to substantiate the effectiveness of PriceSleuth. And we outline future research directions for PriceSleuth.
Sat 21 JunDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
14:00 - 15:30 | Session5: Software Vulnerability and Security IINew Idea Track / Research Track at Cosmos 3A Chair(s): Chuanyi Li Nanjing University | ||
14:00 15mTalk | Devmp: A Virtual Instruction Extraction Method for Commercial Code Virtualization Obfuscators Research Track Shenqianqian Zhang Key Laboratory of Cyberspace Security, Ministry of Education, Weiyu Dong Information Engineering University, Jian Lin Information Engineering University | ||
14:15 15mTalk | Line-level Semantic Structure Learning for Code Vulnerability Detection Research Track Ziliang Wang Peking University, Ge Li Peking University, Jia Li Tsinghua University, Yihong Dong Peking University, Yingfei Xiong Peking University, Zhi Jin Peking University | ||
14:30 15mTalk | SLVHound: Static Detection of Session Lingering Vulnerabilities in Modern Java Web Applications Research Track Haining Meng SKLP, Institute of Computing Technology, CAS, China; University of Chinese Academy of Sciences, China, Jie Lu SKLP, Institute of Computing Technology, CAS, China; University of Chinese Academy of Sciences, China, Yongheng Huang Institute of Computing Technology at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Lian Li Institute of Computing Technology at Chinese Academy of Sciences; University of Chinese Academy of Sciences | ||
14:45 15mTalk | Def-VAE: Identifying Adversarial Inputs with Robust Latent Representations Research Track Chengye Li Institute of Software, Chinese Academy of Sciences, Changshun Wu Université Grenoble Alpes, Rongjie Yan Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences | ||
15:00 15mTalk | Fuzzing for Stateful Protocol Programs Based on Constraints between States and Message Types Research Track Kunpeng Jian Institute of Information Engineering, Chinese Academy of Sciences, Yanyan Zou Institute of Information Engineering, Chinese Academy of Sciences, Menghao Li Institute of Information Engineering, Chinese Academy of Sciences, Wei Huo Institute of Information Engineering at Chinese Academy of Sciences | ||
15:15 10mTalk | PriceSleuth: Detecting DeFi Price Manipulation Attacks in Smart Contracts Using LLM and Static Analysis New Idea Track Hao Wu Xi'an JiaoTong University, Haijun Wang Xi'an Jiaotong University, Shangwang Li Xi'an Jiaotong University, Yin Wu Xi'an Jiaotong University, Ming Fan Xi'an Jiaotong University, Yitao Zhao Yunnan Power Grid Co., Ltd, Ting Liu Xi'an Jiaotong University Pre-print | ||
Cosmos 3A is the first room in the Cosmos 3 wing.
When facing the main Cosmos Hall, access to the Cosmos 3 wing is on the left, close to the stairs. The area is accessed through a large door with the number “3”, which will stay open during the event.