| Decentralized Finance(DeFi)applications based on blockchain provide investors and traders with more open,transparent,and efficient financial services.However,at the same time,the scam DeFi applications that inject malicious code into the front-end and smart contracts are becoming rampant and posing a serious threat to the on-chain asset security of users.However,current researches on blockchain security mainly focus on transaction behavior and smart contract levels.Because of ignoring the semantics of front-end and business background,these methods are hard to effectively detect and identify scam DeFi applications mentioned above.To address these problems,the thesis proposes a detection and identification method for scam DeFi applications based on transaction state consistency,and implements the automated testing and scam detection framework called Scam Hunter.Since scam can be operated in both the front-end and smart contract,resulting in inconsistencies among different transaction states(like expected transaction,real transaction,and execution result),detecting such inconsistencies can identify scam behaviors in DeFi applications.The thesis deeply studies the key technologies for implementing scam detection,including the construction of blockchain and Web3 testing environments,methods for recognizing critical transaction page based on HTML matching rules and image,automated testing method driven by user intention,and methods for extracting different transaction states.Finally,to evaluate the detection effectiveness of Scam Hunter,the thesis tested the88 collected DeFi applications,and accurately identified 35 scam applications.The thesis also tested the performance in real-world scenarios.By monitoring the Cert Stream certificate transparency service,Scam Hunter could detect and identify the newest DeFi applications.Within one week,it detected 3 DeFi applications with suspicious scam out of 86 eligible DeFi applications.Furthermore,the thesis evaluated the search effectiveness of critical transaction page and the manual cost required for automated testing.The experiment found that Scam Hunter achieved a completeness degree of 86.7% in critical transaction page searches.And compared to the advanced DApp automated testing tool Kaya,Scam Hunter reduced at least 50% of the interaction rules during the automated testing stage targeted to a large number of DeFi applications. |
