SPSYN: Synthesizing DeFi Price-Manipulation Exploits via Semantic Recovery and State-Guided Search

Abstract

Price manipulation is one of the most damaging vulnerability classes in decentralized finance (DeFi) protocols. Existing approaches mainly stop at warning generation or rely on rigid attack templates, and therefore struggle to determine whether a victim protocol is profitably exploitable under a concrete chain state. This problem is challenging because the attack-relevant victim-side steps are highly protocol-specific, while successful exploitation further depends on brittle runtime conditions such as reserve states, token-specific guards, and narrow numeric ratios. In this paper, we present SPSYN, a DeFi price-manipulation exploit synthesizer that combines semantic recovery with state-guided search. SPSYN first extracts structured cross-contract contexts and uses an LLM to recover attack-relevant victim-side function roles. It then organizes the recovered functions into stage-consistent candidates and scenario-guided initial seeds. Finally, it synthesizes exploit witnesses on a concrete chain snapshot through state-guided search under a semantic-aware state machine. Runtime observations reveal whether the transformed sequence has established a meaningful anomaly, whether it should continue to be expanded, and how later mutations should be refined. In this design, semantic recovery narrows the search to the right victim-side actions, while exploitability is validated through actual execution on the target snapshot. On 29 historical incidents, SPSYN synthesizes profitable exploit witnesses for 27 cases (93.1%), outperforming ItyFuzz (11/29), CPMMX (19/29), and FlashSyn (7/29), with a median time-to-first witness of 114 seconds on successful cases. During on-chain deployment across Ethereum and Binance Smart Chain, SPSYN further discovers 9 previously unreported profitable vulnerabilities with a cumulative potential profit of $35.1K.