想防智能合约陷阱？这篇论文把隐蔽代币合约的六类套路全解剖了，用三种大模型验证，精确率81.8%，比现有工具强一截。
论文系统化分析了ERC-20代币合约中隐蔽陷阱的分类，提出基于代币功能生命周期的分类法。TrapHunter框架结合抽象行为树（ABT）与增强路径图（APG）统一语义表示，利用LLM推理行为意图偏差，并通过分叉动态验证确认可攻击性。在269份真实合约上使用DeepSeek、GPT和Gemini三种LLM进行测试，平均精确率81.8%，召回率85.4%，显著优于现有工具。
TrapHunter: Exposing Covert Pathways in Trap Token Contracts
Standardized token contracts (e.g., ERC-20) form the foundation of digital assets. However, attackers increasingly abuse this standardization to disguise malicious trap tokens. Unlike obvious violations, these contracts employ a strategy of "deceptive adherence": they strictly adhere to standard protocols to evade detection while embedding covert logic to defraud users. To address this, we first systematize the trap landscape by proposing a novel taxonomy derived from the intrinsic functional lifecycle of tokens (Generation, Circulation, Persistence, and Observation). We then propose TrapHunter, a framework designed to identify these traps and expose covert pathways within these deceptive contracts via intent deviation analysis. Specifically, TrapHunter introduces a unified semantic representation combining Abstract Behavior Trees (ABTs) and Augmented Path Graphs (APGs) to normalize intra-procedural syntax and reveal hidden execution paths driven by inter-procedural state dependencies. Crucially, it bridges the semantic gap by leveraging LLMs to reason about the behavioral intent of deviations from reference implementations, followed by fork-based dynamic validation to confirm exploitability. Experimental evaluation on 269 real-world contracts with three LLMs (DeepSeek, GPT, and Gemini) demonstrates that TrapHunter effectively detects all six categories of traps, achieving an average precision of 81.8% and recall of 85.4%, significantly outperforming state-of-the-art tools.