Search papers, labs, and topics across Lattice.
This paper introduces TrapHunter, a novel framework designed to identify and expose covert pathways in trap token contracts that adhere to standard protocols while embedding malicious logic. By systematizing the trap landscape through a new taxonomy based on the functional lifecycle of tokens, the authors leverage a combination of Abstract Behavior Trees and Augmented Path Graphs to analyze intent deviations and validate exploitability dynamically. Experimental results on 269 real-world contracts show TrapHunter achieves an average precision of 81.8% and recall of 85.4%, outperforming existing detection tools significantly.
TrapHunter uncovers hidden malicious pathways in token contracts that masquerade as compliant, achieving remarkable detection rates against sophisticated traps.
Standardized token contracts (e.g., ERC-20) form the foundation of digital assets. However, attackers increasingly abuse this standardization to disguise malicious trap tokens. Unlike obvious violations, these contracts employ a strategy of"deceptive adherence": they strictly adhere to standard protocols to evade detection while embedding covert logic to defraud users. To address this, we first systematize the trap landscape by proposing a novel taxonomy derived from the intrinsic functional lifecycle of tokens (Generation, Circulation, Persistence, and Observation). We then propose TrapHunter, a framework designed to identify these traps and expose covert pathways within these deceptive contracts via intent deviation analysis. Specifically, TrapHunter introduces a unified semantic representation combining Abstract Behavior Trees (ABTs) and Augmented Path Graphs (APGs) to normalize intra-procedural syntax and reveal hidden execution paths driven by inter-procedural state dependencies. Crucially, it bridges the semantic gap by leveraging LLMs to reason about the behavioral intent of deviations from reference implementations, followed by fork-based dynamic validation to confirm exploitability. Experimental evaluation on 269 real-world contracts with three LLMs (DeepSeek, GPT, and Gemini) demonstrates that TrapHunter effectively detects all six categories of traps, achieving an average precision of 81.8% and recall of 85.4%, significantly outperforming state-of-the-art tools.
