Ethereum smart contracts have recently drawn a considerable amount of
attention from the media, the financial industry and academia. With the
increase in popularity, malicious users found new opportunities to profit by
deceiving newcomers. Consequently, attackers started luring other attackers
into contracts that seem to have exploitable flaws, but that actually contain a
complex hidden trap that in the end benefits the contract creator. In the
blockchain community, these contracts are known as honeypots. A recent study
presented a tool called HONEYBADGER that uses symbolic execution to detect
honeypots by analyzing contract bytecode. In this paper, we present a data
science detection approach based foremost on the contract transaction behavior.
We create a partition of all the possible cases of fund movements between the
contract creator, the contract, the transaction sender and other participants.
To this end, we add transaction aggregated features, such as the number of
transactions and the corresponding mean value and other contract features, for
example compilation information and source code length. We find that all
aforementioned categories of features contain useful information for the
detection of honeypots. Moreover, our approach allows us to detect new,
previously undetected honeypots of already known techniques. We furthermore
employ our method to test the detection of unknown honeypot techniques by
sequentially removing one technique from the training set. We show that our
method is capable of discovering the removed honeypot techniques. Finally, we
discovered two new techniques that were previously not known.