DeFi protocols are programs that manage high-value digital assets on blockchain. The price manipulation vulnerability is one of the common vulnerabilities in DeFi protocols, which allows attackers to gain excessive profits by manipulating token prices. In this paper, we propose DeFiTainter, an inter-contract taint analysis framework for detecting price manipulation vulnerabilities. DeFiTainter features two innovative mechanisms to ensure its effectiveness. The first mechanism is to construct a call graph for inter-contract taint analysis by restoring call information, not only from code constants but also from contract storage and function parameters. The second mechanism is a high-level semantic induction tailored for detecting price manipulation vulnerabilities, which accurately identifies taint sources and sinks and tracks taint data across contracts. Extensive evaluation of real-world incidents and high-value DeFi protocols shows that DeFiTainter outperforms existing approaches and achieves state-of-the-art performance with a precision of 96% and a recall of 91.3% in detecting price manipulation vulnerabilities. Furthermore, DeFiTainter uncovers three previously undisclosed price manipulation vulnerabilities.

Blockchain has attracted wide attention. A smart contract is a program that runs on the blockchain, and there is evidence that most of the smart contracts on the Ethereum are highly similar, as they share lots of repetitive code. In this study, we empirically study the repetitiveness of the smart contracts via cluster analysis and try to extract the differentiated code from the similar contracts. Differentiated code is defined as the source code except the repeated ones in two similar smart contracts, which usually illustrates how a software feature is implemented or a programming issue is solved. Then, differentiated code might be used to guide the update of a smart contract in its next version. In this paper, to support the update of a target smart contract, we apply syntax and semantic similarities to discover its similar smart contracts from more than 120,000 smart contracts, and recommend the differentiated code to the target smart contract. The promising experimental results demonstrated the differentiated code can effectively support smart contract update.