On-Chain Decentralized Learning and Cost-Effective Inference for DeFi Attack Mitigation

Despite different root causes, several runtime-level patterns are consistent across attacks:

• $\mathrm{■}$

  Atomicity: 71.2% of exploits execute within a single transaction with no prior on-chain activity.

• $\mathrm{■}$

  Benign interface misuse: 67.5% invoke functions like withdraw(), approve(), or sweep() with malicious arguments.

• $\mathrm{■}$

  Cross-chain replication: Identical bytecode deployments (9.7%) are exploited across chains [35] (e.g., Hedgey [1]).

These patterns further support the view that exploitability is determined by transaction behavior rather than only static code.

In this tier, the model parameters and execution logic are stored fully on-chain. However, the actual inference computation is performed off-chain by calling view functions, which are executed by any EVM client. This tier incurs zero gas cost for DeFi users or protocols while ensuring that the decision logic is derived directly from verifiable on-chain bytecode and model state. Since every node executes the same bytecode deterministically, outcomes are consistent and tamper-resistant. This design is ideal for platforms seeking lightweight classification with full code transparency and no execution fees.

Here, the inference is executed entirely on-chain as part of a state-modifying transaction, typically one that interacts with a DeFi protocol. The input is passed to the smart contract, which executes the classifier internally and enforces the classification result. This enables end-to-end verifiability and enforces decisions during transaction execution (e.g., rejecting or allowing access to protocol funds). While this incurs gas costs, our optimized design allows even moderately complex models, such as 10-layer CNNs with quantized integer arithmetic, to execute efficiently within Ethereum’s gas limits. This tier is suited for scenarios like high TVL or security-critical DeFi functions, where classification must be verified on-chain without relying on off-chain entities to interpret results, as the outcome is enforced by on-chain consensus.

Upon acceptance of a training update (yielding new parameters ${\theta }^{\prime }$) by the PoIm protocol on L2, the contract computes a cryptographic hash modelHash = keccak256(abi.encodePacked(${\theta }^{\prime }$)). This hash serves as a tamper-proof commitment to the new model.

The L2 contract sends this modelHash to L1 via the native L2-to-L1 bridge (e.g., Optimism’s L2ToL1MessagePasser). The hash is recorded by the L1 contract that manages model updates.

In a subsequent transaction, the full model parameters ${\theta }^{\prime }$ are transmitted. The L1 contract recomputes the hash and verifies it against the prior commitment. A mismatch results in the rejection of the update [59].

For every multiply-accumulate (MAC) $a\leftarrow a+\frac{w\cdot x}{S}$ inside classify, the EVM executes (1) SLOAD($w$) = $G_S=100$ gas (warm), (2) CALLDATALOAD($x$) = $G_C=3$ gas, (3) MUL = $G_M=5$ gas, (4) DIV = $G_D=5$ gas, (5) ADD = $G_A=3$ gas, (6) loop/stack bookkeeping $\approx G_L=8$ gas.¹¹1Berlin fee schedule [21].

Hence, the cost per MAC is $g_{\text{MAC}}=G_S+G_C+G_M+G_D+G_A+G_L=124$ gas. ReLU adds $G_R=5$ gas per activation, and bias initialization costs $G_S+G_A=103$ gas.

A linear model with $d$ inputs executes one MAC per feature and adds a bias. Hence, $\boxed{G_{\mathrm{LIN}}(d)=124d+103}$

For logistic regression, we approximate $\sigma (z)$ by a threshold on the logit, therefore no extra exponentiation is incurred; the cost matches SVM. With $d=3$ (example feature set) the bound gives $G_{\mathrm{LIN}}(3)=124\times 3+103=475\text{gas}$, which is three orders of magnitude below the deep models and negligible at call-sites.

For an input of length $d$, kernel size $K$, and $F$ filters, the convolution yields $o=d-K+1$ positions and evaluates $FoK$ MACs; the fully connected read-out contributes a further $Fo$ MACs. Thus, $\boxed{G_{\mathrm{CNN}}(d,K,F)=g_{\text{MAC}}Fo(K+1)+G_{R}Fo+103F}$ (1).

Let $U$ be the hidden-state size, $T$ the number of time steps, and $d_{\text{in}}=d/T$ the per-step input width. A gated update performs $U(d_{\text{in}}+U)$ MAC operations per time step. The total cost is $\boxed{G_{\mathrm{RNN}}(d,U,T)=g_{\text{MAC}}TU(d_{\text{in}}+U+1)+15TU}$ (2). We fix the total input dimensionality $d=3$ for both architectures. Table 3 shows the resulting gas bounds for several example CNN and RNN configurations.

Let $f_{\theta }$ denote the deployed classifier with an immutable architecture and on-chain weights $\theta$ (see Table 4 for notations). The core of our PoIm mechanism relies on ${𝒟}_{\text{test}}={\{(x_i,y_i)\}}_{i=1}^n$, a canonical evaluation dataset stored directly on-chain. This dataset is intentionally curated to be compact, yet it is representative of critical attack vectors and desired model behaviors rather than being an exhaustive list of all historical transactions. Its manageable size is crucial for enabling efficient on-chain evaluation of proposed model updates within gas limits. Furthermore, to maintain its relevance and resist ossification, ${𝒟}_{\text{test}}$ itself is governed by a decentralized peer-based mechanism (e.g., DAO voting), allowing for agreed-upon additions, modifications, or removals of test samples over time (see Figure 5). Let ${\theta }^{\prime }$ represent a submitted update. We define the classifier (i.e., linear) as $f_{\theta }(x)=\mathrm{sign}(\frac{1}{S}{\sum }_{i=1}^d{\theta }_i{x}_i+b)\in \{0,1\}.$ We define the evaluation function as $\mathrm{Eval}(f_{\theta },{𝒟}_{\text{test}})\to (\mathrm{Acc},\mathrm{F1},\mathrm{Prec},\mathrm{Rec})$, where all metrics are computed deterministically using Solidity logic and can be challenged.

Users can propose a new model update by submitting a new training sample directly to the PoIm contract, which yields a change (if accepted) in new model weights ${\theta }^{\prime }$ and biases $b^{\prime }$, and staking a minimum amount of tokens (or, e.g., any ERC20 token). Each submission must submit a stake, e.g., $s>0$. The staked ERC20 serves as collateral for the proposal. If accepted, the contributor receives: $R=s+{\sum }_{k\in \{\mathrm{Acc},\mathrm{F1},\mathrm{Prec},\mathrm{Rec}\}}{\alpha }_k(M_k^{\prime }-M_k).$ Each coefficient ${\alpha }_i\ge 0$ reflects the vault’s value weighting for each metric improvement. For instance, if the vault has accumulated 1 ETH from failed update attempts, the payout $R$ is proportionally distributed based on the magnitude of improvement across the four metrics.

An update ${\theta }^{\prime }$ is accepted if it improves at least one core metric (accuracy, precision, recall, or F1-score) without degrading any of the other core metrics compared to the current model, based on on-chain evaluation over ${𝒟}_{\text{test}}$. The contract enforces this by ensuring that any accepted model update demonstrates improvement in at least one core metric without degrading others, thereby preventing overfitting a single target (e.g., maximizing recall while degrading precision). This improvement is verified on-chain on ${𝒟}_{\text{test}}$, which ensures that the proposed model performs better than the current one.

We integrate an on-chain DAO mechanism that allows stakers (e.g, DeFi platforms) to collectively manage both model rollbacks and ${𝒟}_{\text{test}}$ test set updates. In our design, participants stake tokens to gain voting rights to propose and vote on critical actions such as adding or modifying test samples and reverting model weights (to previously committed L1 update) if suspicious behavior is observed (e.g., malicious training sample). In the case of a challenged update (i.e., one that introduces a loophole but still satisfies the acceptance criteria), a revealed update can be rolled back within a fixed period (e.g., <7 days). If the new model weights worsen in any performance metric compared to the previous metrics, the proposer loses their collateral and the proposal is discarded.

A significant challenge in evaluating DeFi exploit detection systems is the general absence of comprehensive, publicly available, raw transaction datasets suitable for behavioral modeling. While some prior work has focused on smart contract code analysis [69, 64, 66], readily usable transactional datasets for exploit detection are scarce. To address this, we undertook a meticulous manual collection and multi-stage verification process to construct a robust dataset for this study, covering attacks from 2020 to 2025. Our initial identification of potential exploits involved a broad survey of diverse sources, including industry security news (e.g., Rekt News [18]), detailed analyses on technical blogs, discussions on social media platforms (e.g., X), and curated public incident databases such as the DeFi Rekt Database [18] and DeFiLlama Exploits Dashboard [19]. Incidents and leads gathered from these channels, often further indexed or summarized by resources like DeFiHackLabs [58], guided our targeted retrieval of the specific transactions that executed each confirmed attack.

These transactions are primarily identified by their hashes on public blockchain explorers (e.g., Etherscan [22], Polygonscan [53]). All transactional records were independently retrieved and subsequently verified through direct blockchain queries via Web3 RPCs [14] to ensure authenticity and completeness of call data, receipts, and traces. The primary features extracted for model input include: gas (gas limit provided by sender), block.timestamp, func_selector_encoded (a label-encoded representation of the first four bytes of msg.data), chain ID (label-encoded), msg.sender (label-encoded), tx.origin (label-encoded), and msg.to (label-encoded), as shown in Figure 6. Numerical features were standardized, and categorical features were label-encoded. Features such as block.timestamp may overfit if the same timestamp is found in both training and testing. To mitigate this risk, we implemented a strict temporal train-test split. Training is exclusively on historical data, and testing is on future (unseen attacks). Therefore, the model generalizes better based on transaction behaviors rather than memorizing temporal artifacts. Transaction traces and contract interactions were analyzed to produce contextual annotations, including attack_name, links to exploited contract source files, incident report URLs, dates, identified root causes, and financial loss in USD (normalized to the time of exploit). This process was applied to transactions across multiple EVM-compatible blockchains, including Ethereum, Binance Smart Chain (BSC), Polygon, Avalanche, Arbitrum, Fantom, Moonriver, and Base. Table 5 presents an illustrative subset of these attributes.

We observed that an attack can manifest in a single atomic transaction (approximately 71% of the attacks in our dataset) or across multiple transactions. For multi-transaction attacks, all constituent transactions were grouped and assigned entirely to either the training or testing set to prevent data leakage and maintain the integrity of the attack sequence. The combined dataset of normal and attack transactions was then sorted chronologically by block.timestamp. Table 6 summarizes the distribution of the unique exploits that informed the construction of our dataset.

The resulting transaction data captures fine-grained, executable-level behaviors and intricate attacker-victim dynamics. This detailed resolution enables precise detection and classification of exploits and provides a foundation for exploring potential attack discovery. The final curated dataset of 298 unique attack vectors, corresponding to confirmed financial losses exceeding $3.74 billion (as per Table 6), combined with temporally aligned normal transactions, offers a rich and unique foundation for evaluating real-time defense mechanisms and rigorously training on-chain classifiers.

Our framework was evaluated with diverse model architectures, including Multi-Layer Perceptrons (MLPs), Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), and standard classifiers like Logistic Regression (LogReg), Support Vector Machines (SVM), and Decision Trees (DTs). All models utilized the 7 processed input features detailed previously. These features are observable by smart contracts during execution, enabling real-time attack detection. All models were evaluated with fixed-point parameters (scale ${10}^1$ to ${10}^{18}$).

Each instance starts from baseline parameters and their performance metrics (Accuracy, F1-score, Precision, Recall) on a fixed test set (${𝒟}_{\text{test}}$). An update is accepted only if it improves at least one metric without degrading others. Approved parameters are then eligible for propagation to L1 for inference.

The performance of our framework was evaluated across three key dimensions: on-chain inference efficiency (gas costs, bytecode size, throughput, and prediction consistency), attack detection performance (accuracy, precision, recall, F1-score, and false positive rate), and model update mechanism costs (PoIm L2 update gas and L2-L1 propagation cost).

The on-chain footprint of simpler models like Logistic Regression (LogReg), Support Vector Machines (SVM), Decision Trees (DT), and a Multi-Layer Perceptron (MLP) showcases varying efficiencies. L2 PoIm contract deployment gas ranged from approximately 0.88M for the DT to 2.14M for the MLP, while their corresponding L1 inference contracts were lighter. Notably, L1 inference gas for LogReg, SVM, and DT was very low (33k–58k gas). The evaluated MLP required approximately 138k gas for L1 inference, still well within practical limits for on-chain execution.

Convolutional Neural Network (CNN) variants demonstrated a clear trend where both L2/L1 deployment gas and L1 inference gas scaled with architectural complexity, primarily driven by the number of filters (F) and kernel size (K). For instance, L2 deployment gas ranged from approximately 1.72M for CNN(F2, K1) up to 4.61M for larger configurations like CNN(F16, K1). Similarly, L1 inference gas for these CNNs varied from around 144k (CNN(F2, K1)) to over 969k (CNN(F16, K4)). Bytecode sizes for CNN L1 inference contracts were observed to be consistent for models sharing the same kernel size, as changes in filter count primarily affect the parameter size of the subsequent fully connected layer rather than the convolutional logic structure itself.

For the Recurrent Neural Network (RNN) models evaluated (both with U=8 units), the T=1 configuration (processing all 7 features in a single timestep) incurred higher L2 deployment gas (3.52M) compared to the T=7 configuration (processing 1 feature per 7 timesteps, 2.44M L2 gas). This difference is likely attributable to the larger input-to-hidden weight matrix ($W_{xh}$) in the RNN(U=8, T=1) model. Conversely, L1 inference gas was substantially higher for RNN(U=8, T=7) (1.13M gas) than for RNN(U=8, T=1) (0.56M gas), reflecting the increased number of recurrent steps executed on-chain for the sequence-based input.

The gas cost for transferring updated model parameters from an L2 PoIm contract to its L1 inference counterpart varied across model types. For SVM and DT, this L2-L1 update was relatively efficient (96k–231k gas). However, the LogReg and the dynamically trained MLP exhibited higher transfer costs (5.2M–5.7M gas, respectively), likely due to the encoding or size of their complete parameter sets being transferred. For the more complex CNN and RNN models, this L2-L1 parameter transfer for their (typically output layer) updates also showed significant gas consumption, ranging from 2.8M to over 22M gas, underscoring the cost implications of updating larger or more intricate models across layers.

We evaluate empirically how fixed-point quantization affects on-chain inference consistency under varying scaling factors from ${10}^1$ to ${10}^{18}$, using MLP, logistic regression (LogReg), SVM, CNN, and RNN models (Figure 7). Precision loss diminishes rapidly as the scale increases, and full recovery (zero bitwise loss across all weights) is achieved at or above ${10}^{12}$ for all models. This confirms that fixed-point quantization, when aligned with sufficiently large scaling factors, can reliably preserve inference semantics on-chain across diverse architectures, which was also evaluated in terms of the models’ performance.

We present PoIm resistance against malicious updates via stress testing. We consider bootstrapping the decentralized model with 50 real training samples from both classes, and injecting 50% of the training data size as malicious or fabricated updates. These malicious updates either flip the class label or inject feature-noise. The 50 real samples are randomly selected from the original attack and normal transaction data to quantify how PoIm reacts when training samples degrade one or more metrics, and whether such poisoning affects performance. At each new training step, the update is re-evaluated on the full test set. If accepted by PoIm, the model is updated; otherwise, the current model is retained. We note that the bootstrapping phase influences how PoIm responds to subsequent updates. Overall, PoIm maintains more stable performance than the original (unfiltered) training process across all metrics on the same test data, as shown in Figure 8. Green vertical bands indicate accepted training samples, while reddish bands denote rejected ones. Notably, original linear models (e.g., logistic regression, SVM) suffer severe degradation without PoIm filtering.

To evaluate real-time classification capability for the zero-cost eth_call tier, we measured inference throughput using our 10-layer CNN. Table 8 details these findings, which were obtained by sequentially querying a local Ethereum node. A single transaction is classified in approximately 68ms. While the average per-sample processing time for batches of 5 to 50 transactions stabilizes around 88-91ms, this performance enables a throughput of approximately 11 classifications per second by an off-chain monitoring entity. Such capacity is comparable to Ethereum’s current average TPS ($\approx 15$), suitable for timely analysis.