Understanding Trapdoor Tokens in Cryptocurrency
Learn about Trapdoor tokens and the risks they pose to investors.
― 6 min read
Table of Contents
- What Are Trapdoor Tokens?
- How Trapdoor Tokens Work
- Differences Between Trapdoor and Other Scams
- The Impact of Trapdoor Tokens
- Building a Dataset of Trapdoor Tokens
- Techniques Used in Trapdoor Tokens
- Analyzing Trapdoor Techniques
- The Dangers of Trapdoor Tokens
- Preventing Trapdoor Token Scams
- Conclusion
- Original Source
- Reference Links
In recent years, the rise of cryptocurrencies has led to the emergence of various scams, particularly on decentralized exchanges (DEXs) like Uniswap. One of the most alarming forms of these scams is known as Trapdoor tokens. These tokens have caused significant financial losses for many investors, amounting to hundreds of millions of dollars from 2020 to 2023.
Trapdoor tokens are designed to allow users to buy them easily but block them from selling. This is accomplished by embedding logical bugs or specific features in the smart contract code, making it difficult for users to receive their money back after investing. In this article, we will explore the characteristics of Trapdoor tokens, how they function, and the risks they pose to investors.
What Are Trapdoor Tokens?
Trapdoor tokens are digital tokens that give the impression of being profitable investments. They entice users into buying them with the promise of high returns. However, once an investor has purchased a Trapdoor token, they soon find that they cannot sell it back to recover their funds. This is due to the malicious coding within the token's smart contract, which prevents any selling activities.
The scam works as follows: investors buy the token using a well-known and valuable cryptocurrency. Once the investment is made, the scammer can withdraw all the valuable tokens from the Liquidity Pool, leaving investors with worthless Trapdoor tokens.
How Trapdoor Tokens Work
The operation of Trapdoor tokens involves several steps:
Deployment: A scammer creates a Trapdoor token and launches it on the blockchain, along with a liquidity pool that pairs the Trapdoor token with a high-value token.
Purchasing: Investors are encouraged to buy the Trapdoor token by transferring the high-value token into the liquidity pool. Often, the buying fee is set low to attract more investors.
Rising Value: As more investors buy into the Trapdoor token, its value seems to increase. However, the investors are unable to sell their tokens as intended.
Withdrawal: The scammer then removes all the high-value tokens from the liquidity pool, disappearing with the investors' money.
Differences Between Trapdoor and Other Scams
Trapdoor scams are often confused with similar scams, such as Honeypots or Rug-pull scams. Here's how they differ:
Honeypots: These scams lure in more experienced investors by showing a vulnerability in the smart contract that looks exploitable. When investors try to take advantage of this vulnerability, they find it was a trap.
Rug-pull scams: These are broader scams where scammers lure investors into buying tokens, then vanish with the funds. In contrast, Trapdoor tokens specifically prevent investors from selling the tokens.
The Impact of Trapdoor Tokens
The financial impact of Trapdoor tokens is significant. Research has shown that over 50,000 unique investors have lost money due to these scams. Some of the losses are staggering, with the top three scams alone accumulating more than 6,992 ETH in losses.
Building a Dataset of Trapdoor Tokens
To better understand Trapdoor tokens, a team of researchers developed a dataset containing 1,859 verified Trapdoor tokens from Uniswap. The process of building this dataset involved:
Data Collection: Researchers gathered all token addresses from Uniswap, examining over 131,000 unique tokens.
Filtering: Tokens were filtered based on specific criteria, such as the absence of selling transactions and a high percentage of buying to selling activity.
Verification: Each token was manually assessed through simulated buying and selling to confirm its Trapdoor nature.
Analysis: The collected tokens were analyzed to identify common characteristics and techniques used by scammers.
Techniques Used in Trapdoor Tokens
Trapdoor tokens employ several coding techniques to trap investors. These can be classified into three main categories:
Conditional Assertions: These techniques involve coding conditions that must be met for a sell transaction to succeed. If a user doesn't meet the conditions, the transaction fails.
Trading Fee Manipulation: In this method, scammers set excessively high fees for selling the tokens. This effectively drains users' funds each time they try to sell.
Numerical Exceptions: Scammers induce errors that prevent transactions from completing, often by manipulating values in the contract. These errors can result from incorrect calculations, which block users from successfully selling their tokens.
Analyzing Trapdoor Techniques
Scammers create traps in various ways, often making them difficult to detect. Some of the common mechanisms employed include:
Using Flags: Scammers may implement boolean variables that can be toggled to activate or deactivate sell privileges.
Setting Limits: Restrictions on the number of tokens that can be sold at a time can also be employed, blocking users from liquidating their assets.
Blacklists and Whitelists: Scammers may maintain lists of addresses that are allowed or denied the ability to trade tokens, controlling who can sell and who cannot.
Misleading Code: The use of dummy functions and vague error messages can help obscure the true intentions of the smart contract, leaving investors confused about why their transactions fail.
The Dangers of Trapdoor Tokens
The dangers of Trapdoor tokens extend beyond individual investors. These scams erode trust in the cryptocurrency market as a whole and can deter potential investors from participating in decentralized finance. The lack of regulatory oversight in the DEX space creates an environment ripe for exploitation, allowing scammers to thrive while investors remain vulnerable.
Preventing Trapdoor Token Scams
Investors can take several steps to protect themselves from Trapdoor tokens and similar scams:
Research: Before investing in a token, conduct thorough research on its creator, project, and code.
Check Token Transactions: Look for warning signs, such as an unusual lack of selling transactions or excessive fees.
Use Verification Tools: Leverage available tools and platforms that analyze Smart Contracts for potential risks.
Stay Informed: Keep up with trends and news about cryptocurrency scams to stay ahead of new tactics employed by scammers.
Conclusion
Trapdoor tokens represent a serious threat to investors in the cryptocurrency space. By understanding how they work, the techniques employed by scammers, and the risks involved, investors can better safeguard their assets. The combination of awareness and caution is crucial for navigating the ever-evolving landscape of decentralized finance. While the allure of potential profits in the crypto market is strong, it's essential to remain vigilant against scams designed to exploit the unwary investor.
Title: From Programming Bugs to Multimillion-Dollar Scams: An Analysis of Trapdoor Tokens on Uniswap
Abstract: We investigate in this work a recently emerged type of scam ERC-20 token called Trapdoor, which has cost investors billions of US dollars on Uniswap, the largest decentralised exchange on Ethereum, from 2020 to 2023. In essence, Trapdoor tokens allow users to buy but preventing them from selling by embedding logical bugs and/or owner-only features in their smart contracts. By manually inspecting a number of Trapdoor samples, we established the first systematic classification of Trapdoor tokens and a comprehensive list of techniques that scammers used to embed and conceal malicious codes, accompanied by a detailed analysis of representative scam contracts. In particular, we developed TrapdoorAnalyser, a fine-grained detection tool that generates and crosschecks the error-log of a buy-and-sell test and the list of embedded Trapdoor indicators from a contract-semantic check to reliably identify a Trapdoor token. TrapdoorAnalyser not only outperforms the state-of-the-art commercial tool GoPlus in accuracy, but also provides traces of malicious code with a full explanation, which most of the existing tools lack. Using TrapdoorAnalyser, we constructed the very first dataset of about 30,000 Trapdoor and non-Trapdoor tokens on UniswapV2, which allows us to train several machine learning algorithms that can detect with very high accuracy even Trapdoor tokens with no available Solidity source codes.
Authors: Phuong Duy Huynh, Thisal De Silva, Son Hoang Dau, Xiaodong Li, Iqbal Gondal, Emanuele Viterbo
Last Update: 2024-12-19 00:00:00
Language: English
Source URL: https://arxiv.org/abs/2309.04700
Source PDF: https://arxiv.org/pdf/2309.04700
Licence: https://creativecommons.org/licenses/by/4.0/
Changes: This summary was created with assistance from AI and may have inaccuracies. For accurate information, please refer to the original source documents linked here.
Thank you to arxiv for use of its open access interoperability.
Reference Links
- https://www.springer.com/gp/computer-science/lncs
- https://www.springer.com/lncaaaaaaaaaaaaaaaaaaaaaaaaaaaaaas
- https://honeypot.is/ethereum?address=0x14ad9e887758d2e16919d86962bd464a9d3b54a0
- https://github.com/bsdp2023/trapdoor_reports
- https://github.com/bsdp2023/trapdoor_data
- https://github.com/bsdp2023/trapdoor_tool
- https://github.com/Uniswap/v2-core/blob/master/contracts/UniswapV2Factory.sol
- https://github.com/Uniswap/v2-core/blob/master/contracts/UniswapV2Pair.sol
- https://github.com/Uniswap/v2-periphery/blob/master/contracts/UniswapV2Router02.sol
- https://etherscan.io/address/0x5c69bee701ef814a2b6a3edd4b1652cb9cc5aa6f
- https://etherscan.io/address/0x8da2d78da8266a27bc8ffd170fccf64616e6b90d
- https://coinmarketcap.com/currencies/bone-shibaswap/
- https://etherscan.io/address/0xc51a16e0573c796a445bfda2ec33d9ab9151dfbd
- https://etherscan.io/address/0x3E19C4D8E826b2a35158Cbd1eBA15c5B4A8F34d9
- https://etherscan.io/address/0xc67979670b43b38c0242624258268c2d66e2ca57
- https://etherscan.io/tx/0x647d5425f86809d3c54d96fc34cbe2b0bff82ad036815d3112bffbfc7a607569
- https://etherscan.io/address/0xF49C17470eCC377A59De71EaB8dcB5e78B5cB670
- https://etherscan.io/tx/0xb61b83676396791d4edc4243fb8ae6d6725efd8578809d41efe25f8354c77b60
- https://etherscan.io/address/0xe053Cf2Bc6Dd5e3e773f23606846859EDdFE4925
- https://etherscan.io/tx/0x034963d54d10c801d9674224ab41c305111214f708983c37c8ce60c2c0837548
- https://etherscan.io/address/0x9314e4e2647c76160aa860b1329cd00031e49804
- https://etherscan.io/tx/0xc11c3a8183bad5af71bbc2c81dd27ac13ec9ce6e72b02b877b35efccb0491ccb
- https://etherscan.io/tx/0xe6ed2a587efbaddc15e50f2856200e40ee27f391562fe2d05f8433e038ea00a0
- https://etherscan.io/address/0x42a4123c90df459f8098fd76a3be946920b49a43
- https://etherscan.io/address/0x950247e6697d3e62b80cb49ffd5cb78a1cab7233
- https://etherscan.io/address/0xFD6A7390c424A2c2c3cb06433B7D29926FfAf09F
- https://etherscan.io/address/0x579aA9419741eb4842A4Bc2439176A34260A259f
- https://etherscan.io/address/0x93fe5eabd054524fdaaeae7913a90bf73889ebf9
- https://etherscan.io/address/0xDcbdA615b422eCaCe7242058EB2C321949290ff6
- https://etherscan.io/address/0x5a8003ee9cae173c8c2dcb7e8b6e897c3021ba8a
- https://etherscan.io/address/0x03ed890912679A0796C759e0224F32E1A3b2F0B7
- https://etherscan.io/address/0xa027eb7d1f17a6f888a504c5fb32fe42e0d07d8e
- https://etherscan.io/address/0x348bb716bc4378560cd269f4a039aba957e24d1b
- https://oko.palkeo.com/0xe20EC16A3B574Fd6399ecC29c6886bf3f5A0Ccc7/code/
- https://etherscan.io/address/0x8196464fb1319b4dad2f4d5690895554c78e17b3
- https://etherscan.io/address/0xb6e11ef3ed33577a1ce9948a9e594b882b6e2778
- https://etherscan.io/address/0x7deb87a7e3f8f42bfdfd9f8f48b6702118154f68
- https://etherscan.io/address/0x457A0677d206970A20212f95f35378Cfc68eaA0C
- https://etherscan.io/address/0xf69A9B73a45e8CE7Fd75BC0e7773824C585f6F35
- https://etherscan.io/address/0x0dbce1083e55d34a7763558e5eedef04e4d93d85
- https://etherscan.io/address/0xed28ef42af3a742c9ccbc897210c61f6d468a439
- https://etherscan.io/address/0xeac8976401037b0f1a706d915285d442423b9b3c
- https://etherscan.io/address/0xba839bc49dd509d15df940bc5fdb0f4cab6ae5fe
- https://github.com/bsdp2023/trapdoor