May 13-17, 2024 | Wenkai Li, Xiaoqi Li, Yuqing Zhang, Zongwei Li
DeFiTail is a novel framework that uses deep learning to detect access control and flash loan exploits in DeFi protocols. The framework addresses three key challenges in DeFi protocol inspection: learning invocation patterns, unifying external and internal paths, and validating data path feasibility. To tackle these challenges, DeFiTail employs sequence and graph learning techniques to extract features from data paths, unifies external and internal paths using function signatures, and validates data paths using symbolic execution stacks. The framework also integrates a heterogeneous graph to learn structural features and uses a combination of sequence learning and graph convolutional networks (GCN) for classification. Experimental results show that DeFiTail achieves high accuracy in detecting access control (98.39%) and flash loan exploits (97.43%), outperforming state-of-the-art tools. Additionally, DeFiTail demonstrates strong capability in detecting malicious contracts, achieving 86.67% accuracy on the CVE dataset. The framework is open-sourced and has been evaluated on real-world DeFi vulnerabilities, showing its effectiveness in identifying security issues. The study highlights the importance of path selection and CFG connection in detecting DeFi protocol vulnerabilities.DeFiTail is a novel framework that uses deep learning to detect access control and flash loan exploits in DeFi protocols. The framework addresses three key challenges in DeFi protocol inspection: learning invocation patterns, unifying external and internal paths, and validating data path feasibility. To tackle these challenges, DeFiTail employs sequence and graph learning techniques to extract features from data paths, unifies external and internal paths using function signatures, and validates data paths using symbolic execution stacks. The framework also integrates a heterogeneous graph to learn structural features and uses a combination of sequence learning and graph convolutional networks (GCN) for classification. Experimental results show that DeFiTail achieves high accuracy in detecting access control (98.39%) and flash loan exploits (97.43%), outperforming state-of-the-art tools. Additionally, DeFiTail demonstrates strong capability in detecting malicious contracts, achieving 86.67% accuracy on the CVE dataset. The framework is open-sourced and has been evaluated on real-world DeFi vulnerabilities, showing its effectiveness in identifying security issues. The study highlights the importance of path selection and CFG connection in detecting DeFi protocol vulnerabilities.