  The prosperity of the cryptocurrency ecosystem drives the need for digital
asset trading platforms. Beyond centralized exchanges (CEXs), decentralized
exchanges (DEXs) are introduced to allow users to trade cryptocurrency without
transferring the custody of their digital assets to the middlemen, thus
eliminating the security and privacy issues of traditional CEX. Uniswap, as the
most prominent cryptocurrency DEX, is continuing to attract scammers, with
fraudulent cryptocurrencies flooding in the ecosystem. In this paper, we take
the first step to detect and characterize scam tokens on Uniswap. We first
collect all the transactions related to Uniswap V2 exchange and investigate the
landscape of cryptocurrency trading on Uniswap from different perspectives.
Then, we propose an accurate approach for flagging scam tokens on Uniswap based
on a guilt-by-association heuristic and a machine-learning powered technique.
We have identified over 10K scam tokens listed on Uniswap, which suggests that
roughly 50% of the tokens listed on Uniswap are scam tokens. All the scam
tokens and liquidity pools are created specialized for the "rug pull" scams,
and some scam tokens have embedded tricks and backdoors in the smart contracts.
We further observe that thousands of collusion addresses help carry out the
scams in league with the scam token/pool creators. The scammers have gained a
profit of at least \$16 million from 39,762 potential victims. Our observations
in this paper suggest the urgency to identify and stop scams in the
decentralized finance ecosystem, and our approach can act as a whistleblower
that identifies scam tokens at their early stages.
