安全与密码学2022arxiv.org
不要 rug 我：零维骗局检测
Do not rug on me: Zero-dimensional Scam Detection
进阶 · 约 45 分钟读完前置知识：DeFi 基础、Uniswap 与自动做市商机制、智能合约基础
导读
这篇论文研究 Uniswap 等去中心化交易所上的“rug pull”（卷款跑路）骗局代币的自动检测问题。作者提出一种“零维度”方法，即无需人工标注特征、仅依据链上数据即可识别诈骗代币，并声称发现了大量此类骗局代币。
HN 关注点：HN 读者围绕“Uniswap 上数万个骗局代币”这一数字展开讨论：有人认为这暴露了无需许可上币的风险，也有人反驳这些代币只是无人交易的垃圾信息，并不代表真实市场状况。
HN 评论精选
这几条评论里：质疑 2 补充 2
补充为 Uniswap 的无许可上币 + TokenList 白名单机制辩护，认为它兼顾开放性与用户安全
需要指出的是，Uniswap 是去中心化的，任何人无需申请或审核即可上架任何代币交易，因此现在有数千个代币，未来可能有数百万个。但用户默认看不到这些代币：Uniswap 采用 TokenList 标准，默认只显示 CoinGecko 前 100 等主流代币，Aave、Gemini 等可信机构维护的列表覆盖了用户想交易的项目，同时不让终端用户接触骗局代币。我认为这是套好系统：任何上架审核流程甚至 DAO 都会引入主观性、给坏人留下可乘之机。开放上架加 TokenList 标准让 Uniswap 成为真正的公共品，能长期提供任意资产间无条件兑换的保障。
Sargos查看英文原文
It's important to note that Uniswap is decentralized and anyone can "list" anything for trading without asking anyone or going through any process. This means there are thousands of tokens, probably millions in the future, available to trade. Users do not see these tokens unless they actively search them out. Uniswap uses the TokenList standard (https://tokenlists.org/) and by default users only see tokens such as the top 100 projects on CoinGecko. There are many lists created by reputable players such as Aave and Gemini which cover the entire gamut of projects users want to trade without exposing end users to scam tokens. I believe this is a good system and has worked well as having any kind of listing process or even a DAO introduces subjectivity and provides points of capture for bad actors. With an open listing process and standards like TokenLists we can say that Uniswap is truly a public good and will be around as long as we need it which provides a guaranteed way to swap any asset for any other asset no matter who created it or how controversial it is which is a good primitive for humanity to be able to rely on.
质疑质疑论文结论：这些代币只是无人交易的垃圾信息，骗局交易量占比远低于 1%，不能反映市场真实状况
报告的数字可能没错，但相关讨论中的术语和结论往往不对。没有任何真人交易过这 2.6 万个代币；创建流动性池不应算作“上线”，因为你还得说服别人来买，实际上什么都没“发布”。这些交易对更像垃圾信息，目的是出现在别处的搜索结果里（并不会出现在 Uniswap 上）。其他研究发现骗局代币的交易量远低于总交易量的 1%。只看这个数字并不能反映市场的真实健康状况或 Uniswap 已有的防控措施。我们也不会把假伟哥广告邮件称为 rug pull，尽管它显然是想骗你的钱。
miohtama查看英文原文
Some comments: While the report findings might be correct on the number, the terminology and conclusion in related discussion are often not. No real person ever traded these 26k tokens. The creation of liquidity pool should not be considered a launch, as you still somehow need to convince other people to buy it from you. Nothing was "launched". These trading pairs are more akin to spam, to show up in the search results (somewhere else, do not show up on Uniswap). Other research find the scam volume is way less than 1% of the total trading volume. Only looking this number does not reflect the true health of the market or the controls Uniswap has in place to prevent trading these tokens. We also do not call fake Viagram advertising email rug pull, even if it is clearly intended to steal your money without making your dick hard.
补充类比建网站：上架代币成本极低，代币数量多不代表被实际使用
当然，因为任何人都可以在 Uniswap 上创建并上架代币，唯一成本是 gas 费。但这不代表这些代币有真实流动性或有人使用。就像任何人都能建个网站挂到网上，成本只是主机费，但这不意味着会有访客。
mudrockbestgirl查看英文原文
Sure, because anyone can create and list a token on Uniswap. The only cost are the gas fees. That doesn't mean those tokens have any real liquidity or are being used. Just like anyone can create a website and put it online. The only cost are the hosting fees. That doesn't mean it'll get any visitors.
质疑质疑论文对“骗局”的定义过于宽泛，主动粘贴地址交易不算平台缺陷
不喜欢加密货币的理由有很多，但“你可以手动粘贴地址到 Uniswap 界面，把表现好的代币换成表现差的代币”（即本文对骗局的定义）绝对不算其中之一。
lvass查看英文原文
There's a lot of reasons to dislike cryptocurrencies but the fact you can manually paste an address to the uniswap interface and trade a well-performing token to a poor-performing one (the definition of scam used here) is definitely not one of them.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2022Hacker News 讨论帖267 分 · 154 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选