TL;DR
GenDetect is a system that rapidly generalizes detection rules for DeFi attacks by analyzing transaction semantics and logic, significantly improving detection speed and accuracy.
Contribution
It introduces a novel approach combining semantic classification and contract labeling to automate and accelerate reactive DeFi attack detection.
Findings
Achieves 98% accuracy, 1% FPR, 3% FNR in attack detection.
Discovers 56 previously unknown attacks from the past three years.
Effectively generalizes detection rules from single attack instances.
Abstract
As blockchain ecosystems grow, financially motivated attackers increasingly exploit decentralized finance (DeFi) protocols, causing frequent and severe losses. Unlike conventional cyberattacks, DeFi exploits propagate rapidly due to the transparent and composable nature of smart contracts. We identify a critical pattern, Imitative Attack Cascade: an initial successful exploit is quickly followed by mimicking transactions that reuse attack logic with minor modifications or parameter changes. Our empirical analysis shows that over 69% of DeFi attacks exhibit strong behavioral similarity to earlier incidents, often within hours or days of the initial attack. This exposes a fundamental limitation in current reactive detection. Initial attacks are typically flagged via heuristic alerts (Tornado Cash traces, anomalous nonce usage, exploiter labels), but turning these signals into detection…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
