DeFiTrace: Event-Enriched Detection of Price Oracle Manipulation Across DeFi Transactions

The rapid growth of Decentralized Finance (DeFi) has been accompanied by increasingly sophisticated security threats. Price Oracle Manipulation Attacks (POMA), a critical vulnerability, have evolved beyond simple economic exploits to include complex, multi-transaction attacks that exploit smart contract logic, causing hundreds of millions in losses. State-of-the-art detection methods, however, often focus on single-transaction, economic manipulations and typically fail to identify these emerging attack vectors, particularly when smart contract source code is unavailable. This paper introduces a novel, EVM-compatible detection pipeline that addresses this gap. By combining transaction event logs and execution traces, we engineer a rich set of semantic and structural features that capture the underlying behavior of on-chain operations. We train a regularized autoencoder exclusively on the features of benign transactions to learn a deep representation of normal activity, flagging significant deviations as malicious. Our evaluation demonstrates the effectiveness of this approach, achieving 100% recall on a comprehensive dataset of single-transaction attacks and 98.25% event-level recall on a new, manually collected dataset of real-world multi-transaction exploits, with an overall precision of 97.15%. We present a robust, learning-based model capable of identifying both known and unseen POMA variants without relying on source code. Furthermore, we contribute a new dataset of multi-transaction attacks to foster further research, providing a more generalizable and resilient approach to securing the DeFi ecosystem.