We reveal six zero-day social engineering attacks in Ethereum, and subdivide them into two classes: Address Manipulation and Homograph. We demonstrate the attacks by embedding them in source codes of five popular smart contracts with combined market capitalization of over \$29 billion, and show that the attacks have the ability to remain dormant during the testing phase and activate only after production deployment. We analyze 85,656 open source smart contracts and find 1,027 contracts that can be directly used for performing social engineering attacks. For responsible disclosure, we contact seven smart contract security firms. In the spirit of open research, we make the source codes of the attack benchmark, tools, and datasets available to the public.

翻译：我们在Etheum披露了六起零天的社会工程袭击,并将其分为两类:处理操作和智商学。我们通过将这五份受欢迎的智能合同的源代码中嵌入超过290亿美元的合并市场资本化来证明这些袭击,并表明这些袭击能够在测试阶段保持休眠,并且只能在生产部署后启动。我们分析了85,656份开放源智能合同,并找到了可直接用于进行社会工程袭击的1,027份合同。为了负责的披露,我们联系了七家智能合同安全公司。本着公开研究的精神,我们向公众提供了袭击基准、工具和数据集的来源代码。