Function Name Is All You Need to Detect Blockchain Application Attacks
TxLucent detects blockchain dApp attacks from transaction function-name sequences using a transformer, achieving 1.56% false negatives without source code.
Researchers propose TxLucent, which maps transaction call traces to function name sequences and uses a transformer to detect blockchain application attacks without source code or handcrafted rules. Evaluated on 424 real-world incidents with 14,611 attack transactions, it achieves a 1.56% false negative rate and an estimated 0.0017% false positive rate across over 500 million Ethereum transactions. Average analysis time of 24.90 milliseconds supports real-time detection on popular blockchains.
- TxLucent uses function name sequences instead of source code or handcrafted rules
- 1.56% false negative rate on 424 incidents with 14,611 attack transactions
- Estimated 0.0017% false positive rate across 500M+ Ethereum transactions
- 24.90 ms average analysis time supports real-time detection
Full article227 words · extracted from arxiv.org · click to collapse
Blockchain application attacks, targeting business logic bugs in decentralized applications (dApps), have been an increasing concern to their developers and users, causing significant financial loss. Existing attack detectors either rely on handcrafted rules for detection, or need difficult-to-obtain smart contract source code to analyze attack transactions. This makes them brittle and inapplicable in practice. In this paper, we argue that function name sequences suffice to capture the high-level semantics of a transaction, and hence can be used to detect blockchain application attacks. Our empirical study on transactions from 424 real-world attack incidents shows that 98.46% of call traces can be resolved to function names, whereas only 74.78% invoke contracts with available source code. Based on this observation, we propose TxLucent (pronounced "translucent"), an automated framework to detect blockchain application attacks by extracting application semantics from transaction call traces. TxLucent maps call traces to function name sequences and uses a transformer to learn semantics from such sequences. Consequently, TxLucent can detect attacks without relying on hand-coded patterns or source code. Our results show that TxLucent achieves a 1.56% false negative rate on 424 known incidents with 14,611 attack transactions, and an estimated 0.0017% false positive rate for benign transactions from over 500 million transactions on the Ethereum blockchain. Finally, TxLucent takes an average of 24.90 milliseconds to analyze a transaction, thus supporting real-time attack detection on popular blockchains.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.12315