OctopusGuard: K-Line Enhanced Token Scam Detector Powered by Multimodal LLMs

Token scams in Decentralized Finance (DeFi) have become more sophisticated, shifting from simple contract exploits to behavior-driven fraud involving obfuscated code, abnormal fund flows, and deceptive market activity. While recent works leverage large language models (LLMs) for vulnerability detection, existing methods still depend on predefined patterns and lack deep semantic reasoning, limiting their ability to detect novel scams.

In this paper, we present OctopusGuard, a unified multimodal detector for token scams, which includes three key contributions: (i) K-line information is, for the first time, introduced to token scam detection. A RAG-based knowledge base is constructed by combining K-line images from both benign and scam tokens to enhance training and reasoning. (ii) A novel, structured tool-augmented data chain-of-thought (structured CoT) is designed to integrate code, transaction data, and K-line images into a unified reasoning process. (iii) A multimodal fine-tuning pipeline that jointly trains on structured CoT to learn cross-modal correlations and enhance generalization across diverse scam strategies.

We also construct a newly collected, labeled multimodal dataset of 1,495 recent token contracts and conduct extensive experiments. Results demonstrate that OctopusGuard significantly outperforms existing detectors and LLMs in detecting token scams, achieving an F1-score of 0.96.