# Detecting Rug-Pull: Analyzing Smart Contract Backdoor Codes in Ethereum
## 3 Balance-Tracking-Based Backdoor Detection Model
### Backdoor Code Inspector  
The backdoor code inspector analyzes balance changes and conditional statements of the candidate function generated in the balance tracker and classifies them as backdoor codes. To this end, it analyzes the balance change pattern of the candidate function and identifies the cause and characteristics of the balance change through conditional statements to determine the existence of a backdoor. The type of backdoor code is classified into the six attack types outlined in Section 2.2: token generation, destroy token, transaction limitation, funds manipulation, fee, and proxy.  
Token generation causes the result of balance tracking to lead to an increase in the balance. To detect this, the balance tracking results of the candidate function are analyzed as shown in Figure 4, and if a new balance is generated without decreasing the balance or if a larger amount of balance is increased compared to the existing one, it is classified as a token generation backdoor.  
Destroy token causes the result of balance tracking to lead to a decrease in someone else's balance. To detect this, the balance tracking result of the candidate function is analyzed as shown in Figure 5 to inspect whether there is only a decrease in the balance or whether there is a decrease in the balance that is greater than the input value. Then,  
Figure 4: Token Generation Classification Process.  
whether the address, in which the decrease occurs, is the message sender is inspected, and if it is not the message sender, it is classified as a destroy token backdoor.  
Transaction limitation restricts balance transfers through a conditional statement before the balance transfer. To detect this, candidate functions are analyzed as shown in Figure 6, and conditional statements of the function with the balance transfer are analyzed to see if there is an additional conditional statement. The additional conditional statement is not a general conditional statement that inspects balance or overflow, but a conditional statement that allows or prohibits the transfer, depending on a variable or an account. If an additional conditional statement is found as a result of the analysis, it is classified as a transaction limitation backdoor.  
Funds manipulation causes the balance transfer after a call from an unauthorized user. To detect this, whether the message sender's balance decreases and the balance of the input address increases in the candidate function is inspected, as shown in Figure 7. This confirms whether the balance of another account decreases, or whether the recipient's balance increases normally. Then, the conditional statements of the function approval are inspected, and if they do not match the approval process, it is classified as a funds manipulation backdoor.  
Transfer fee causes a decrease in the resulting value of the transfer by the amount of the fee. To detect this, the calculation of the fee is analyzed regarding the balance change in the candidate function, as shown in Figure 8. If a small value is sent or if there is a fee transfer, it is classified as a transfer fee backdoor.  
Figure 5: Destroy Token Classification Process.  
Figure 6: Transaction limitation Classification Process.  
Figure 7: Funds Manipulation Classification Process.  
Proxy can execute backdoor code by calling the functions of other addresses. To detect this, the method of calling other functions is confirmed in the candidate function, as shown in Figure 9. In the case of DELEGATECALL, it is classified as a proxy backdoor since it can directly execute backdoor code in the present contract. Additionally, in the case of CALL and STATICCALL, if there is a balance change or state change after the call, it is classified as a proxy backdoor.  
Whether backdoor code is detected for each function is determined based on the final classified results. Through this process, users can determine whether a specific function has a potential security risk.