# Detecting Rug-Pull: Analyzing Smart Contract Backdoor Codes in Ethereum
## 1 Introduction  
Blockchain technology connects blocks in a chain using hash algorithms and stores multiple nodes in a distributed manner, making it impossible to falsify or alter the data within a block. This ensures safe transactions and data processing even in the absence of a dependable certification authority [1]. The Ethereum network, which combines blockchain technology with the Ethereum Virtual Machine (EVM), allows for the automatic execution of contracts between individuals without a certification authority [2]. The emergence of Decentralized Applications (DApps) that utilize these smart contracts enables users to easily use smart contracts and execute contracts with low fees [3]. However, the absence of such certification authorities increases the risk and potential damage from fraud. Specifically, \"Rug-pull\" is a form of fraud in which project developers hide backdoor codes in smart contracts and perform abnormal operations to steal funds under certain conditions, causing significant damage to users [4]. A typical example is the SQUID GAME TOKEN, which concealed backdoor codes allowing only the developer to sell the tokens, forcing users who invested in the tokens to lose all their investments [5]. Even when such frauds occur, it is difficult for a central authority to control or regulatethem due to the freedom of programming and the decentralization of the blockchain on the Ethereum network. Currently, to reduce the damages caused by Rug-pull, DApp developers are creating Rug-pull lists to notify users of the risks and discourage them from making investments [6,7]. However, these lists are provided only after damage has occurred, making it challenging to prevent damage in advance. Additionally, there is a limitation in that it takes time to evaluate a project before it can be added to the list [8]. Consequently, DApp developers are encouraging users to investigate projects themselves before making investments [9]. Users determine the risk of Rug-pull by reviewing the project's content and the security of the smart contract's source code. However, among the 68,268,300 smart contracts deployed on Ethereum, only 705,010 smart contracts disclose their source code, which is approximately 1% [10]. Due to this low disclosure rate, it is difficult to analyze smart contracts to assess their risks. Therefore, users rely on commercial services such as GoPlus to test the security level of smart contracts and detect backdoor codes [11]. These commercial services detect backdoor codes based on previously known code patterns. However, they cannot detect backdoor codes that have altered the location of the operator conducting the actual backdoor operation through modifications to existing patterns or backdoor codes hidden in atypical parts. Consequently, smart contracts equipped with such backdoor codes continue to create new victims on the Ethereum network [12]. To address these problems, this paper proposes a balance-tracking-based backdoor code detection model. The proposed model extracts functions from Ethereum bytecode and inspects the extracted functions to detect the presence of backdoor code. It achieves this by tracking the balance changes that occur within each function, enabling the detection of backdoor code encapsulation. The model identifies six types of backdoor codes based on these balance changes: token generation, token destruction, transfer limitation, funds manipulation, transfer fee, and proxy. This model detects backdoor codes that can cause direct financial loss through these mechanisms. This study aims to analyze 989 smart contracts for each attack type and measure accuracy, recall, and precision, thereby verifying the effectiveness of this model. Section 2 explains the backdoor code types in Ethereum smart contracts and Rug-pull projects, as well as existing backdoor code detection models. Section 3 details the structure and operational methodology of the proposed backdoor code detection model, highlighting improvements over existing limitations.