TrapHunter: Exposing Covert Pathways in Trap Token Contracts

2026-07-21

AI Summary

This work addresses the challenge of deceptive compliance fraud in malicious tokens that exploit standard interfaces like ERC-20 to evade existing detection mechanisms. To this end, the authors propose TrapHunter, a novel framework that introduces the first trap taxonomy grounded in the functional lifecycle of tokens. TrapHunter employs Abstract Behavior Trees (ABTs) and Augmented Path Graphs (APGs) to achieve a unified semantic representation of token behavior and innovatively leverages large language models (e.g., GPT, Gemini) for behavioral intent reasoning. By analyzing deviations between declared and inferred intents, it uncovers concealed malicious logic, which is subsequently validated through fork-based dynamic analysis to confirm exploitability. Evaluated on 269 real-world contracts, TrapHunter achieves an average precision of 81.8% and recall of 85.4% across six trap categories, significantly outperforming state-of-the-art tools.

Abstract

Standardized token contracts (e.g., ERC-20) form the foundation of digital assets. However, attackers increasingly abuse this standardization to disguise malicious trap tokens. Unlike obvious violations, these contracts employ a strategy of "deceptive adherence": they strictly adhere to standard protocols to evade detection while embedding covert logic to defraud users. To address this, we first systematize the trap landscape by proposing a novel taxonomy derived from the intrinsic functional lifecycle of tokens (Generation, Circulation, Persistence, and Observation). We then propose TrapHunter, a framework designed to identify these traps and expose covert pathways within these deceptive contracts via intent deviation analysis. Specifically, TrapHunter introduces a unified semantic representation combining Abstract Behavior Trees (ABTs) and Augmented Path Graphs (APGs) to normalize intra-procedural syntax and reveal hidden execution paths driven by inter-procedural state dependencies. Crucially, it bridges the semantic gap by leveraging LLMs to reason about the behavioral intent of deviations from reference implementations, followed by fork-based dynamic validation to confirm exploitability. Experimental evaluation on 269 real-world contracts with three LLMs (DeepSeek, GPT, and Gemini) demonstrates that TrapHunter effectively detects all six categories of traps, achieving an average precision of 81.8% and recall of 85.4%, significantly outperforming state-of-the-art tools.

Problem

• trap tokens
• deceptive adherence
• covert pathways
• smart contract security
• intent deviation

Innovation

• Trap Token
• Intent Deviation Analysis
• Abstract Behavior Tree
• Augmented Path Graph
• LLM-based Semantic Reasoning