| The tokens in Ethereum are digital assets that can be traded and stored on the Ethereum network,with various use cases such as insurance,supply chain management,and digital signature for artworks,among others.Tokens have economic value and are a significant target for attackers who may attempt to obtain them through various means,with one im-portant way being Miner Extractable Value(MEV)attacks.MEV attackers leverage the privilege of miners’ positions to gain additional profits by manipulating transaction orders or modifying transaction content when packing blocks.MEV attacks were first proposed in 2020,and since then,multiple studies have been conducted to analyze and model historical blocks for detecting attacks based on Ethereum’s transaction and event data.However,these methods mainly rely on statistical and analytical analysis of historical blocks and cannot detect MEV attacks in real-time.Real-time MEV attack detection can help maintain transaction and Ethereum stability for the community and users.Therefore,real-time detection of MEV attacks is an important problem to solve,but it poses two challenges: obtaining real-time transaction information during the transparent execution process of the Ethereum virtual machine,and performing complex analysis of multiple transactions.To address the above issues,this thesis proposes a real-time MEV attack detection and analysis method based on symbolic analysis of the Ethereum virtual machine.This method defines the properties of suspected attack transaction groups and performs real-time analysis of smart contracts being executed in the Ethereum virtual machine based on these properties,to identify transactions with suspected attack behavior.To reduce the false-positive problem caused by storage collision detection,this thesis improves existing methods by using event information to verify suspected attack transac-tion groups.Event verification detects events triggered by transactions and confirms MEV attack behavior from an event perspective,thereby reducing false positives.A prototype system is built to implement the MEV attack detection and analysis method based on symbolic analysis.Through the prototype system,this thesis discovered1,020,266 MEV attack behaviors in the first 14 million blocks of Ethereum,including1,020,113 ERC-20 token attacks and 153 ERC-721 token attacks.The results of compar-ison with related work showed that this thesis’ s method detected two types of attacks and 4,600 more attack behaviors. |
