Types d’arnaques
Arbitrage-bot scams
Copied code promises automatic profit from price differences.
Les enquêtes et les fiches de référence sont publiées en anglais. La navigation est disponible en sept langues.
Dans cet article
The tutorial is part of the sales pitch
An arbitrage-bot scam presents code as a way to collect automatic profits from price differences. The victim is asked to deploy a contract, fund it and call a function described as starting the bot. The decisive question is where the funded assets can move. A tutorial showing a compiler, a block explorer and a successful deployment does not establish that any profitable trading strategy exists.
Real price differences do not imply guaranteed profit. Transaction costs, the executable size of the opportunity and changes before execution all affect the result. A promotional example that compares 2 displayed prices without showing the trades, costs and settlement has not demonstrated a completed arbitrage. An ordinary balance increase is also insufficient if it came from another deposit rather than trading.
Follow the fund-moving paths
One version of this scam routes deposits to an attacker through concealed contract logic. A technical review should inspect deployment parameters, recipient addresses and every function that can move native assets or tokens. Function names and comments describe what the author wants the reader to believe; they do not constrain what execution actually does. A function called “withdraw profits” can send the balance somewhere other than the caller.
For a hypothetical review, suppose a contract accepts deposits and exposes a start function. If that function forwards the contract’s entire balance to an externally controlled address without executing the advertised swaps, the relevant evidence is that transfer path. A screen recording of the tutorial is useful context, but the finding should connect the promoted action to the deployed behaviour. Testing should use a controlled local environment with no real funds at risk.
Check what “verified” actually means
Source-code verification on an explorer is not a review of the business model or a guarantee of safe behaviour. Readable source can faithfully describe a contract that transfers money to its author. Similarly, a deployment transaction proves that a contract was created; it does not prove that it monitors markets or can trade profitably.
Ethereum’s security guidance emphasises access controls, testing and independent review, while cautioning that an audit does not catch every issue. Those checks address actual behaviour and authority. They cannot be replaced by a tutorial’s popularity, a reassuring contract name or comments claiming that hidden code is an optimisation. Ethereum: smart contract security practices.
Preserve the version the victim received
Save the original tutorial URL, copied source, compiler settings, constructor inputs, deployed address and relevant transaction IDs. If the code was updated later, preserve both versions and explain the difference. A report should distinguish a suspicious snippet, a demonstrated transfer path and a completed victim loss. They support different conclusions and should not be collapsed into an invented estimate of total theft.