GenDetect: Generalizing Reactive Detection for Resilience Against Imitative DeFi Attack Cascade

As blockchain ecosystems grow, financially motivated attackers have increasingly exploited vulnerabilities in decentralized finance (DeFi) protocols, resulting in frequent and severe losses. Unlike conventional cyberattacks, DeFi exploits propagate rapidly due to the transparent and composable nature of smart contracts. In this setting, we identify a critical behavioral pattern: Imitative Attack Cascade, where an initial successful exploit is quickly followed by a flurry of mimicking transactions that reuse attack logic with minor modifications or parameter changes. Our empirical analysis shows that over 69% of DeFi attacks exhibit strong behavioral similarity to earlier incidents, often occurring within hours or days of the initial attack.

This phenomenon highlights a fundamental limitation in current reactive detection workflows. While the initial attacks are often flagged through heuristic alerts, such as Tornado Cash traces, anomalous nonce usage, or known exploiter labels, these signals require manual validation and the construction of handcrafted detection rules through trace analysis. This process is labor-intensive and slow, resulting in unacceptable latency while follow-up attacks continue to spread. Motivated by this gap, our research goal is to ensure that once an attack has been observed, even a single instance, it can be rapidly abstracted into an actionable and generalizable detection rule, enabling scalable protection against imitative attacks.

We decompose the problem into two core challenges: (I) abstracting the semantics of diverse, obscure function signatures, and (II) matching transaction logic in noisy, evasive traces. To address these, we leverage two key insights: (i) the open-source nature of most DeFi protocols enables high-fidelity semantic classification of function signatures; (ii) contract labels allow us to isolate essential logic by filtering irrelevant calls and classifying attack intent. Based on these, we develop a reactive detection framework, GenDetect, which achieves strong benchmark performance (ACC: 98%, FPR: 1%, FNR: 3%) and, critically, discovers 56 previously unrevealed attacks from