  DeFi incidents stemming from various smart contract vulnerabilities have
culminated in financial damages exceeding 3 billion USD. The attacks causing
such incidents commonly commence with the deployment of adversarial contracts,
subsequently leveraging these contracts to execute adversarial transactions
that exploit vulnerabilities in victim contracts. Existing defense mechanisms
leverage heuristic or machine learning algorithms to detect adversarial
transactions, but they face significant challenges in detecting private
adversarial transactions. Namely, attackers can send adversarial transactions
directly to miners, evading visibility within the blockchain network and
effectively bypassing the detection. In this paper, we propose a new direction
for detecting DeFi attacks, i.e., detecting adversarial contracts instead of
adversarial transactions, allowing us to proactively identify potential attack
intentions, even if they employ private adversarial transactions. Specifically,
we observe that most adversarial contracts follow a similar pattern, e.g.,
anonymous fund source, closed-source, frequent token-related function calls.
Based on this observation, we build a machine learning classifier that can
effectively distinguish adversarial contracts from benign ones. We build a
dataset consists of features extracted from 269 adversarial contracts and
13,000 benign contracts. Based on this dataset, we evaluate different
classifiers, the results of which show that our method for identifying DeFi
adversarial contracts performs exceptionally well. For example, the F1-Score
for LightGBM-based classifier is 0.9541, with a remarkably low false positive
rate of only 0.15%.
