4,224 Malicious Contracts Phished $3.5M via Simulated Transfers

Researchers have identified 4,224 malicious smart contracts that used transaction-simulation tricks to steal roughly $3.48 million from 5,742 victim addresses across Ethereum, BNB Smart Chain, Avalanche and Polygon, according to a July 30 arXiv preprint.

The authors built SimGuard, a contract-bytecode detector, to find the contracts. They linked the contracts to 6,223 victim transactions. Ethereum accounted for 91.5% of the losses. About 83% of the cross-chain total came from the largest inferred cluster of attackers.

The findings have not been peer reviewed. The paper also gives inconsistent figures for its Avalanche contract count and conflicting endpoints for the observation period, leaving its per-chain breakdown and exact time window unresolved.

Transaction simulation takes a pre-signing snapshot of what a transaction is expected to do. The contracts described in the paper contain branches that can produce one result during that check and another when the transaction executes on-chain.

In a storage-control example, the simulation returns the user's deposit plus a tiny reward. An attacker can then change the contract's state, such as by blacklisting the user's address, before the transaction lands. The executed branch sends the deposit to an attacker-controlled address instead.

Timestamp-based contracts can exploit the later block time. Gas-control contracts can behave differently when the simulator and final transaction use different gas limits. Not every variant requires an attacker to alter stored on-chain data after the preview.