  Decentralized Finance enables many novel applications that were impossible in
traditional finances. However, it also introduces new types of vulnerabilities,
such as composability bugs. The composability bugs refer to issues that lead to
erroneous behaviors when multiple smart contracts operate together. One typical
example of composability bugs is those between token contracts and Constant
Product Market Makers (CPMM), the most widely used model for Decentralized
Exchanges. Since 2022, 23 exploits of such kind have resulted in a total loss
of 2.2M USD. BlockSec, a smart contract auditing company, once reported that
138 exploits of such kind occurred just in February 2023. We propose
CPMM-Exploiter, which automatically detects and generates end-to-end exploits
for CPMM composability bugs. Generating such end-to-end exploits is challenging
due to the large search space of multiple contracts and various fees involved
with financial services. To tackle this, we investigated real-world exploits
regarding these vulnerabilities and identified that they arise due to violating
two safety invariants. Based on this observation, we implemented
CPMM-Exploiter, a new grammar-based fuzzer targeting the detection of these
bugs. CPMM-Exploiter uses fuzzing to find transactions that break the
invariants. It then refines these transactions to make them profitable for the
attacker. We evaluated CPMM-Exploiter on two real-world exploit datasets.
CPMM-Exploiter obtained recalls of 0.91 and 0.89, respectively, while five
baselines achieved maximum recalls of 0.36 and 0.58, respectively. We further
evaluated CPMM-Exploiter by running it on the latest blocks of the Ethereum and
Binance networks. It successfully generated 18 new exploits, which can result
in 12.9K USD profit in total.
