POMABuster: Detecting Price Oracle Manipulation Attacks in Decentralized Finance

POMABuster: Detecting Price Oracle Manipulation Attacks in Decentralized Finance

Speakers: Rui Xi; Zehua Wang; Karthik Pattabiraman

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=u5Cit9sgQEc

Overview

This article delves into POMABuster, a novel detection system for Price Oracle Manipulation Attacks (POMAs) in Decentralized Finance (DeFi). Presented by Rui Xi, a PhD student from the University of British Columbia, alongside his advisor Karthik Pattabiraman and collaborator Zehua Wang, this work addresses a critical vulnerability in the rapidly evolving DeFi ecosystem. The talk highlights the significant financial incentives driving these attacks and the limitations of existing detection methods.

POMABuster distinguishes itself by moving beyond pattern-based detection to employ "first principal rules" derived from traditional stock market manipulation regulations. This approach allows it to identify a broader spectrum of POMAs with superior accuracy and efficiency. The research not only quantifies the scale of these attacks, revealing a staggering $77 billion USD in potential profit over two and a half years, but also offers actionable insights for regulatory bodies and blockchain developers seeking to secure the DeFi landscape.

The importance of POMABuster cannot be overstated given the volatile nature of DeFi. With market capacities reaching hundreds of billions of dollars, and attack losses consistently in the hundreds of millions monthly, robust security solutions are paramount. By providing a method for real-time detection and even prevention, POMABuster aims to foster a more secure and trustworthy blockchain ecosystem, crucial for the mainstream adoption and stability of decentralized financial applications.

Background

▶ Watch: Introduction to Poma Buster and DeFi security (0:00)

The decentralized finance (DeFi) market has experienced meteoric growth, with the total market capacity of Ethereum, a key indicator, peaking at over $500 billion USD by the end of 2021. However, this burgeoning sector remains plagued by persistent security threats, with losses reaching up to $700 million USD in a single month. These attacks span the entire blockchain stack, from the fundamental network layer to the application layer, driven by high financial incentives. The focus of POMABuster is specifically on application layer attacks, which exploit business logic flaws between blockchain applications and constituted over one-third of all attacks in 2022.

Among these, Price Oracle Manipulation Attacks (POMAs) are particularly infamous, accounting for more than 15% of total attacks in 2022. A typical POMA involves three stages, often orchestrated across multiple blockchain applications (dApps). Consider a minimal example with an Oracle (acting as a bank providing price feeds) and a DeFi app (where users can buy shares).

1. Buying Stage: An attacker initially buys a certain asset, for instance, 100 shares from a DeFi app at a unit price of $1,000 per share, totaling $100,000 USD. The Oracle supplies this initial price feed to the DeFi app.
2. Manipulation Stage: The core of the attack. The attacker deposits a large sum, such as $1 million USD, into the Oracle's bank. This artificial influx of capital pumps the price of the share, for example, from $1,000 to $1,500 per share.
3. Selling and Arbitrage Stage: The attacker then sells the previously bought 100 shares back to the DeFi app. Since the price oracle has been manipulated, the DeFi app now uses the inflated price ($1,500 per share) for the sale. The attacker receives $150,000 USD, realizing a $50,000 USD profit, while the DeFi app suffers an equivalent loss.

A crucial enabler for these attacks is the Flash Loan feature prevalent in DeFi. Flash loans allow users to borrow vast sums of money without collateral, provided the loan is repaid within the same blockchain transaction. This eliminates the need for attackers to possess large initial capital, making virtually any DeFi application susceptible to POMAs.

Previous attempts to detect POMAs, such as the DeFi Ranger project, primarily relied on pattern-based solutions. A simplified DeFi Ranger approach might classify a transaction as a POMA if it contains a sequence of "buy," "deposit," and "sell" actions initiated by the same attacker address. However, this method is significantly limited and easily evaded. Attackers can employ various obfuscation techniques:

• Multiple Addresses: An attacker can use one address to buy and sell shares, and a separate address to manipulate the price oracle. Since the pattern expects actions from a single address, it fails.
• Split Transactions: The attack can be broken down into several individual transactions, each containing only one interaction (e.g., one transaction for buying, another for depositing, a third for selling). No single transaction would then fit the predefined multi-stage pattern.
• Ever-Evolving dApp Interactions: The DeFi landscape is dynamic, with new dApps and interaction types (e.g., adding/removing liquidity, lending/borrowing) constantly emerging. Pattern-based detectors require constant updates for every new interaction, rendering them quickly outdated and unreliable.

These challenges highlight the need for a more robust and adaptive detection mechanism, one that can identify the fundamental characteristics of POMAs regardless of specific interaction patterns or attacker obfuscation tactics.

Key Findings

▶ Watch: Flash loans make Poma attacks accessible (4:20)

POMABuster's core innovation lies in its departure from brittle pattern-based detection to a more fundamental, first principal rules approach. The researchers observed that regardless of the specific dApp interactions, the manipulation stage of a POMA consistently involves an abnormal influx of capital into an oracle. This insight led them to draw parallels with traditional stock market manipulation, adopting regulations from the US Securities and Exchange Commission (US SEC) to define quantitative rules for DeFi.

Two key behaviors, adapted from stock market regulations, are identified as indicators of manipulation in DeFi:

1. Market Domination: This occurs when an attacker's trading volume in a given transaction significantly exceeds a certain percentage of the total supply of the asset. For example, if the total supply of a token is $1 billion, and a predefined threshold is 0.1%, then a deposit exceeding $1 million USD in a single transaction would be flagged as market domination and, consequently, a manipulation.
2. Wash Trading: Although mentioned, the talk focuses more on market domination. Wash trading typically involves numerous small transactions that collectively accumulate to a significant amount, creating artificial trading volume to influence prices.

To make the detection process efficient and scalable across the vast number of blockchain transactions, POMABuster incorporates two crucial optimizations:

1. Focus on High-Value Cryptocurrencies: Attackers are primarily motivated by profit, making high-value cryptocurrencies their preferred targets. By filtering out low-value or zero-value cryptocurrencies, POMABuster significantly reduces the search space without compromising detection efficacy.
2. Short Time Window for Arbitrage: Attackers typically execute the arbitrage stage very quickly after manipulating the price. This is due to competition from legitimate third-party arbitragers who are also constantly monitoring for such opportunities. By limiting the search for arbitrage transactions to a short time window immediately following a detected manipulation, POMABuster drastically improves efficiency.

The experimental validation of POMABuster yielded compelling results when compared against a best-effort implementation of DeFi Ranger:

• Detection Volume: POMABuster identified over 16,000 POMAs in the wild over a 2.5-year period, a figure three times higher than the 4,000 detected by DeFi Ranger.
• Efficiency: POMABuster processed the transaction data 20% faster than DeFi Ranger.
• Accuracy (False Positives): Using a ground truth based on a 2.5% price deviation (a commonly accepted threshold in DeFi), POMABuster demonstrated zero false positives among 835 sampled detections. In contrast, DeFi Ranger exhibited a false positive rate of over 20% among its 294 sampled detections.
• Accuracy (False Negatives): When tested against a dataset of 27 human-labeled POMAs from Code Arena, POMABuster successfully captured all 27, resulting in zero false negatives. DeFi Ranger, however, only detected 7 of these 27, yielding a false negative rate of over 70%.

Beyond the statistical performance, the research uncovered several intriguing findings:

• Potential Profit: The detected POMAs represented a staggering $77 billion USD in potential profit for the attackers over the 2.5-year period. While it's noted that third-party arbitragers might sometimes seize these opportunities, the sheer scale underscores the financial incentive.
• Attacker Behavior: Over 95% of the addresses involved in POMAs showed active transaction histories (more than five transactions). Critically, less than 2% of these addresses utilized coin mixers like Tornado Cash. This low adoption of mixers suggests a potential avenue for regulatory agencies to trace the real identities behind these attacker addresses.

These findings collectively demonstrate POMABuster's superior capability in accurately and efficiently identifying a wide range of POMAs, providing invaluable data and insights into the landscape of DeFi security threats.

Technical Deep Dive

▶ Watch: Why pattern-based detection fails Poma attacks (5:00)

The technical foundation of POMABuster is built upon a paradigm shift from reactive pattern matching to proactive, first principal rule-based detection. This approach is crucial because the dynamic nature of DeFi, with its constantly evolving dApps and interaction types, renders static patterns quickly obsolete. Instead, POMABuster seeks to identify the inherent characteristics of manipulation, drawing inspiration from established financial market regulations.

The core intuition is that any successful price oracle manipulation fundamentally involves an abnormal capital flow designed to artificially inflate or deflate an asset's price. This led the researchers to look at the manipulation stage of an attack and formalize rules based on principles similar to those governing traditional stock markets. Specifically, they adapted concepts from the US Securities and Exchange Commission (US SEC) regulations regarding market manipulation.

The primary rule detailed in the talk is for Market Domination. While the full mathematical representation is complex and available in the paper, the speaker provided a clear conceptual framework: a transaction is flagged for market domination if its trading volume exceeds a predefined percentage of the total supply of the asset in question.

For example, if an asset's total supply in the market is $1 billion USD, and the detection threshold is set at 0.1%, then any single transaction that involves a capital movement (e.g., a deposit into an oracle) exceeding $1 million USD (0.1% of $1 billion) would be identified as a potential market domination event. This quantitative definition allows for an objective and context-aware assessment of whether a capital influx is truly abnormal and indicative of manipulation, rather than just large.

Although Wash Trading is mentioned as another form of manipulation recognized by the US SEC, the specific formalization for its detection in POMABuster is not detailed in the transcript to the same extent as market domination. However, the inclusion of this concept suggests a broader framework that could encompass various manipulative tactics.

Connecting the detected manipulation to the subsequent arbitrage opportunity is another critical technical challenge, given the sheer volume of daily Ethereum transactions (over 1 million). To address this, POMABuster employs two strategic observations as filtering mechanisms:

1. High-Value Cryptocurrency Focus: Attackers primarily target high-value cryptocurrencies because these offer the greatest potential for profit. By analyzing only transactions involving such assets, POMABuster significantly prunes the search space, discarding irrelevant low-value or zero-value asset transactions. This heuristic is based on rational attacker behavior and enhances efficiency.
2. Short Time Window for Arbitrage: The window of opportunity for arbitrage following a price manipulation is typically very brief. This is because third-party arbitragers (often bots) are constantly monitoring the market for price discrepancies, and if an attacker does not seize the opportunity almost immediately, another party will. POMABuster leverages this by only searching for arbitrage transactions that occur within a short time window directly after a detected manipulation event. This drastically reduces the number of transactions that need to be analyzed to link manipulation with profit-taking.

The implementation of POMABuster was done in Python. For experimental validation, two main datasets were utilized:

• Transaction Data Set: Comprising over 800 million transaction logs collected over a 2.5-year period, this extensive dataset allowed for large-scale "in the wild" detection and performance evaluation.
• Code Arena Data Set: This smaller, but high-quality dataset contained human-labeled unit POMAs identified by third-party auditors recruited by Code Arena. This served as a crucial ground truth for evaluating the accuracy (false positives and false negatives) of POMABuster against known attacks.

For comparison, a best-effort implementation of DeFi Ranger was also developed in Python, as the original code was not publicly released. This ensured a fair comparative analysis of POMABuster's performance against the prior state-of-the-art pattern-based method across various metrics including the number of detected POMAs, execution time, false positive rates, and false negative rates. The technical rigor in defining manipulation, coupled with intelligent optimizations and thorough experimental validation, underpins POMABuster's effectiveness.

Demo / Proof of Concept

▶ Watch: Applying stock market manipulation concepts to DeFi (8:50)

While the presentation did not include a live, interactive demonstration of POMABuster in action, the researchers provided a robust proof of concept through extensive experimental validation using real-world and curated datasets. This empirical approach served to demonstrate the tool's capabilities and effectiveness in a controlled, measurable environment.

The experimental setup was designed to rigorously test POMABuster against existing methods, primarily DeFi Ranger. The key elements of this proof of concept included:

1. Data Acquisition:

• An immense transaction data set comprising over 800 million transaction logs spanning 2.5 years was collected. This dataset provided a realistic and large-scale environment to discover previously undetected POMAs.
• A smaller, high-quality Code Arena data set was used for ground truth validation. This dataset contained 27 human-labeled, confirmed POMAs, which were crucial for accurately assessing false positives and false negatives.

1. Tool Implementation:

• Both POMABuster and a best-effort re-implementation of DeFi Ranger were developed in Python. This ensured a consistent environment for performance comparison. The re-implementation of DeFi Ranger was necessary as its code was not publicly available, emphasizing the effort to conduct a fair comparison.

1. Detection and Performance Metrics:

• Scale of Detection: POMABuster's ability to identify over 16,000 POMAs from the 800 million transactions, compared to DeFi Ranger's 4,000, served as a primary indicator of its superior coverage.
• Efficiency: The tool's speed was measured, showing POMABuster to be 20% faster than DeFi Ranger, indicating its practical applicability for large-scale data processing.

1. Accuracy Validation:

• False Positive Rate: To validate false positives, a sampling strategy was applied to both tools' detections. From POMABuster's 16k detections, 835 were sampled, and from DeFi Ranger's 4k, 294 were sampled. A standard 2.5% price deviation was used as the threshold to confirm if a detected anomaly truly constituted a POMA. Crucially, POMABuster recorded zero false positives in its sample, whereas DeFi Ranger showed a false positive rate exceeding 20%. This highlights POMABuster's precision.
• False Negative Rate: The 27 human-labeled POMAs from the Code Arena dataset were fed into both tools. POMABuster successfully detected all 27, resulting in zero false negatives. In stark contrast, DeFi Ranger only managed to detect 7 of the 27, yielding a false negative rate of over 70%. This demonstrates POMABuster's comprehensiveness in identifying known attacks.

This comprehensive experimental validation, leveraging both broad real-world data and targeted ground truth, effectively served as a robust proof of concept, demonstrating POMABuster's significant advancements in detecting price oracle manipulation attacks with high accuracy and efficiency.

Defensive Implications

▶ Watch: Quantifying market domination for Poma detection (9:50)

The findings and capabilities of POMABuster offer significant defensive implications for various stakeholders within the Decentralized Finance ecosystem, ranging from regulatory bodies to individual blockchain nodes. The tool's ability to accurately and efficiently detect POMAs, particularly in real-time, provides a powerful new layer of security.

1. Real-time Monitoring for Regulatory Agencies:

• POMABuster is designed to be an efficient tool for monitoring committed transactions in real-time. This capability is invaluable for regulatory agencies like the US Securities and Exchange Commission (US SEC), who are increasingly looking to apply traditional financial market regulations to the burgeoning DeFi space.
• By flagging potential POMA transactions as they occur, regulators can gain unprecedented visibility into manipulative activities. This allows for proactive intervention, investigation, and the potential imposition of penalties, pushing the DeFi market towards greater transparency and accountability, similar to regulated stock markets. This could help establish a more mature and trustworthy environment for investors.

1. On-Chain Prevention at Blockchain Nodes:

• Perhaps the most impactful defensive implication is the potential to deploy POMABuster directly onto blockchain nodes. If integrated into the transaction validation process, POMABuster could identify and prevent POMA transactions from being committed to the blockchain network altogether.
• This "pre-crime" capability would stop attacks before they cause financial damage, fundamentally altering the risk profile of DeFi applications. By rejecting malicious transactions, the integrity of price oracles would be significantly enhanced, protecting users and dApps from financial losses. This requires a consensus mechanism to incorporate such a detection step, which would be a significant architectural shift but offers maximum protection.

1. Enhanced Attacker Tracing and Accountability:

• The research revealed that over 95% of POMA operators use addresses with significant transaction histories, and less than 2% utilize coin mixers like Tornado Cash. This observation is a crucial defensive insight.
• The low adoption of mixers suggests that POMA operators are often less sophisticated in their operational security compared to other types of blockchain attackers who prioritize anonymity. This opens a significant possibility for tracing their real identities behind their pseudonymous addresses. Regulatory bodies and law enforcement could leverage POMABuster's detections, combined with blockchain analytics, to build stronger cases and hold attackers accountable, thereby deterring future manipulations.

1. Improved dApp Security and Oracle Resilience:

• DeFi application developers can use the insights from POMABuster to design more resilient oracles and dApps. Understanding the "first principal rules" of manipulation can guide the development of more robust price feeds and financial logic that are inherently less susceptible to large capital influxes or other forms of market domination.
• Auditors can integrate POMABuster's methodology into their security assessments to proactively identify potential vulnerabilities in oracle designs or dApp interactions that could be exploited by POMAs.

In essence, POMABuster empowers the DeFi ecosystem to move from a reactive stance, where attacks are analyzed post-mortem, to a proactive one, where manipulations can be detected, prevented, and their perpetrators identified, fostering a more secure and stable financial landscape.

Key Takeaways

• Significant Threat Identified: POMABuster detected over 16,000 Price Oracle Manipulation Attacks (POMAs) over 2.5 years, representing a staggering $77 billion USD in potential profit for attackers, underscoring the severe financial risk to DeFi.
• Superior Detection Methodology: By employing "first principal rules" derived from traditional stock market manipulation concepts (e.g., market domination) rather than pattern-based methods, POMABuster achieves significantly higher accuracy and efficiency.
• High Accuracy and Efficiency: POMABuster demonstrated zero false positives and zero false negatives against human-labeled ground truth, while also being 20% faster and detecting three times more attacks than prior methods like DeFi Ranger.
• Actionable Insights for Defenders: The tool's real-time detection capabilities enable regulatory agencies (like the US SEC) to monitor and regulate DeFi markets, and offer the potential for direct deployment on blockchain nodes to prevent malicious transactions from being committed.
• Attacker Behavior Analysis: The finding that less than 2% of POMA operators use coin mixers suggests a strong possibility for tracing their real identities, offering a powerful avenue for accountability and deterrence.
• Towards a More Secure DeFi: POMABuster contributes to creating a more secure blockchain ecosystem by providing a robust, scalable solution for identifying and potentially preventing a prevalent and costly form of DeFi attack.

About the Speaker(s)

Rui Xi is a PhD student at the University of British Columbia, specializing in decentralized finance security. His research focuses on identifying and mitigating critical vulnerabilities within the DeFi ecosystem, as exemplified by his work on POMABuster.

Karthik Pattabiraman is an advisor at the University of British Columbia and a collaborator on the POMABuster project. His expertise contributes to guiding research in areas of system reliability and security, including the complex domain of blockchain and decentralized applications.