# Detecting Rug-Pull: Analyzing Smart Contract Backdoor Codes in Ethereum
## 2 Related Work
### Types of Backdoor Attacks  
A smart contract backdoor attack refers to an attack technique that allows developers to exploit the system through malicious code or intentionally inserted vulnerabilities. These backdoor attacks can be categorized into the following types: token generation, token destruction, transfer limitation, funds manipulation, transfer fee, and proxy [23; 24; 25; 26; 27]. * Token generation  
Token generation backdoor code is a function that allows developers to issue additional new tokens after the initial issuance. If additional tokens are issued, it may devalue the tokens held by existing users. Examining the transfer function in Algorithm 1, it operates normally under standard conditions. However, if the specific condition in line 6 is triggered by a developer's call, the code in line 7 executes to generate new tokens. By using this backdoor, developers can issue and sell additional tokens to gain unfair profits. * Destroy token  
Destroy token is a function that allows developers to arbitrarily destroy tokens from a specific balance. The developer can call the function to destroy tokens from any user's balance. In the second line of Algorithm 2, the function checks if the caller is the owner, ensuring that only the developer has the authority to execute this action. Then, in the third line, it verifies that the target account has a sufficient balance to burn the specified amount  
Figure 2: Process of Uniswap on the Ethereum Network. of tokens. If these conditions are met, the function proceeds to the fourth line, where it deducts the amount from the user's balance. This backdoor destroys users' tokens by force, removes tokens from the market, and inflates the value of the developer's own tokens, allowing the developer to gain unfair profits. \begin{tabular}{r l} \hline \hline
1 & function burnFrom(address from, uint256 amount) public { \\
2 & require(msg.sender)==owner, \"Permission denied(Owner only)\"); \\
3 & require(balance[from] >= amount, \"Insufficient balance\"); \\
4 & balance[from] \(-\)= amount; \\
5 & ] \\ \hline \hline \end{tabular}   
* Transfer limitation  
The transfer limitation backdoor is a function that allows developers to block users from transferring tokens under certain conditions. Users can still hold their tokens, but they cannot trade or transfer them, which means that users cannot use their tokens. This includes the authority to generate tokens or destroy them arbitrarily, arbitrary transfer, funds manipulation, transfer fee, and indirect control through proxy contracts, as well as transfer limitation as in the above example. First, the developer can set the frozen account state to True using the account freezing function as in the third line of Algorithm 3. Then, when a transfer from the account is attempted, the transfer becomes impossible due to the inspection of the frozen state in the eighth line. This backdoor, similar to the destroy token backdoor, removes tokens from the market and inflates the value of the developer's own tokens, allowing the developer to gain unfair profits. \begin{tabular}{r l} \hline \hline
1 & function setFrozen(address account) public { \\
2 & require(msg.sender==owner, \"Permission denied(Owner only)\"); \\
3 & frozen[account]= True; \\
4 & ] \\
5 & ] \\
6 & ] \\
7 & ] \\
8 & ] \\
9 & ] \\
10 & ] \\
11 & ] \\ \hline \hline \end{tabular}   
* Funds manipulation  
The funds manipulation backdoor is a function that allows developers to arbitrarily transfer users' tokens to other addresses. As shown in Algorithm 4, the developer can initiate the transfer of tokens from any user's account by calling the function. In line 4, the function deducts the specified amount from the user's balance, and in line 5, it adds the same amount to the recipient's balance. In this case, users lose tokens without their own consent, and developers can steal users' tokens, allowing the developer to gain unfair profits. * Transfer fee  
Transfer fee is a function that allows the developer to charge additional fees when transferring tokens.