CRPWarner: Warning the Risk of Contract-related Rug Pull in DeFi Smart Contracts

Abstract: In recent years, Decentralized Finance (DeFi) grows rapidly due to the development of blockchain technology and smart contracts. As of March 2023, the estimated global cryptocurrency market cap has reached approximately $949 billion. However, security incidents continue to plague the DeFi ecosystem, and one of the most notorious examples is the ``Rug Pull" scam. This type of cryptocurrency scam occurs when the developer of a particular token project intentionally abandons the project and disappears with investors' funds. Despite it only emerging in recent years, Rug Pull events have already caused significant financial losses. In this work, we manually collected and analyzed 103 real-world rug pull events, categorizing them based on their scam methods. Two primary categories were identified: Contract-related Rug Pull (through malicious functions in smart contracts) and Transaction-related Rug Pull (through cryptocurrency trading without utilizing malicious functions). Based on the analysis of rug pull events, we propose CRPWarner (short for Contract-related Rug Pull Risk Warner) to identify malicious functions in smart contracts and issue warnings regarding potential rug pulls. We evaluated CRPWarner on 69 open-source smart contracts related to rug pull events and achieved a 91.8% precision, 85.9% recall and 88.7% F1-score. Additionally, when evaluating CRPWarner on 13,484 real token contracts on Ethereum, it successfully detected 4168 smart contracts with malicious functions, including zero-day examples. The precision of large-scale experiment reach 84.9%.

• The paper introduces CRPWarner, a novel static analysis tool that identifies contract-related rug pull risks through decompilation and information flow analysis.
• It analyzes 103 real-world rug pull events and uses datalog rules to detect malicious patterns such as hidden mint, limiting sell order, and leaking token functions.
• Evaluation on open-source and large-scale datasets demonstrated high precision and recall, underscoring CRPWarner’s effectiveness in enhancing DeFi security.

CRPWarner: Assessing Rug Pull Risks in DeFi Smart Contracts

The paper "CRPWarner: Warning the Risk of Contract-related Rug Pull in DeFi Smart Contracts" (2403.01425) introduces a novel approach to proactively identify and mitigate the risk of contract-related rug pulls in Decentralized Finance (DeFi) smart contracts. By analyzing real-world rug pull events, the authors developed CRPWarner, a tool designed to detect malicious functions within smart contracts that could lead to investor fund losses. The tool employs static analysis techniques on EVM bytecode, providing early warnings and enabling developers to eliminate high-risk functions, thus enhancing the security and trustworthiness of DeFi projects.

Analysis of Rug Pull Events

The authors conducted a thorough manual analysis of 103 real-world rug pull events, categorizing them based on their scam methods. This analysis identified two primary categories: Contract-related Rug Pull and Transaction-related Rug Pull. Contract-related rug pulls involve the exploitation of malicious functions embedded within smart contracts, while Transaction-related rug pulls are executed through cryptocurrency trading strategies without relying on malicious code.

The Contract-related Rug Pulls are further classified into three types:

• Hidden Mint Function: Enables developers to generate arbitrary tokens, leading to market manipulation.
• Limiting Sell Order: Restricts users from selling tokens, allowing developers to control the market.
• Leaking Token: Permits unauthorized token transfers, leading to fund theft.

The Transaction-related Rug Pulls are further classified into three types:

• Dumping Cryptocurrency: Developers sell off a large number of tokens, causing a price crash.
• Withdrawing Liquidity: Developers remove liquidity from the pool, leaving investors with worthless tokens.
• Abandoning Project after Funding Completion: Developers abandon the project after raising funds.

The identified patterns serve as critical indicators of risk, alerting users to potential threats and aiding developers in avoiding the inadvertent inclusion of such patterns.

Figure 1: Example of a card of Rug Pull Events.

CRPWarner Framework

The CRPWarner framework is designed to analyze smart contracts and identify potential risks associated with Contract-related Rug Pulls. It focuses on smart contracts written in Solidity and analyzes EVM bytecode, enabling comprehensive warnings even when source code is unavailable.

Figure 2: The Framework of CRPWarner.

The framework consists of three layers of analysis:

1. Decompilation: Converts smart contract bytecode into a control flow graph (CFG) and generates basic data structures and relations.
2. Information Flow Analysis: Examines variables and functions associated with rug pulls, focusing on data structures and operations.
3. Malicious Function Identification: Detects malicious functions based on known patterns and generates an analysis report.

The datalog analysis incorporates information flow analysis and malicious function identification to pinpoint potential rug pull risks. Key components include identifying storage variables, analyzing data flow dependencies, and determining whether functions can be invoked by external accounts.

Datalog Rules for Malicious Function Identification

The paper defines specific datalog rules for identifying each type of malicious function. These rules capture critical features and enable the tool to flag potentially dangerous contracts.

• Hidden Mint Function: Identified by the presence of logic that increases token balances without checks and can only be invoked by the contract owner.
• Limiting Sell Order: Identified by a storage variable that restricts token transfers and a function controlled by the contract owner to modify this variable.
• Leaking Token: Identified by a function that allows unauthorized token transfers and can only be invoked by the contract owner.

The datalog rules are based on features extracted through information flow analysis, including token balance management, variable types, function characteristics, and function features.

Evaluation and Results

The effectiveness of CRPWarner was evaluated through two primary experiments. The tool was tested on a dataset of 69 open-source smart contracts associated with real-world rug pull events and on a large-scale dataset of 13,484 real-world ERC token contracts.

The evaluation on open-source contracts demonstrated high accuracy, with precision, recall, and F1-score values of 91.8%, 85.9%, and 88.7%, respectively. The large-scale analysis identified 4,168 smart contracts with malicious functions, indicating the prevalence of potential rug pull risks in the Ethereum ecosystem. The precision of the large-scale experiment reached 84.9%.

Figure 3: The count of smart contracts containing varying numbers of malicious function types.

The tool also discovered a zero-day example: a token project with a malicious function that had not been previously reported. This highlights the practical utility of CRPWarner in uncovering hidden risks in deployed smart contracts.

Implications and Future Directions

The findings of this paper have significant implications for the security and trustworthiness of DeFi projects. By providing a tool to proactively identify and warn about potential rug pull risks, CRPWarner can help protect investors from financial losses. The tool also empowers smart contract developers to detect and eliminate high-risk functions, thereby enhancing the security of their projects.

Future research directions include enhancing the tool's ability to analyze proxy contracts, predicting new types of Contract-related Rug Pull, and addressing the limitations related to pre-defined patterns. These improvements will further enhance the effectiveness and applicability of CRPWarner in the evolving landscape of DeFi security.

Conclusion

The paper presents a practical and effective approach for mitigating the risk of contract-related rug pulls in DeFi smart contracts. CRPWarner, a static analysis tool based on datalog rules and information flow analysis, demonstrates high accuracy in detecting malicious functions. The tool's ability to identify potential rug pull risks and empower developers to enhance smart contract security contributes to the overall stability and trustworthiness of the DeFi ecosystem.