A vulnerability detection method and related device for smart contract code snippets

Abstract

This application discloses a vulnerability detection method and related device for smart contract code snippets. The method includes: obtaining a code snippet of the smart contract to be detected; converting the data in the code snippet into an abstract syntax tree; comparing the abstract syntax tree with a local tree in a code contract library to obtain multiple target trees similar to the abstract syntax tree; and obtaining vulnerability detection results for the code snippet based on the vulnerability results of the target trees. This method solves the technical problem that existing vulnerability detection methods can only detect vulnerabilities in complete smart contracts that can generate bytecode, but cannot detect vulnerabilities in local code snippets.

Description

Technical Field

[0001] The present application relates to the field of blockchain, and in particular to a vulnerability detection method and related device for smart contract code fragments. Background Art

[0002] With the rise of blockchain, smart contracts, as scripts running on blockchains, have attracted widespread attention. Smart contracts are distributed, tamper-resistant programs that run on blockchains. Because they can be flexibly embedded in various digital assets to enable secure and efficient information exchange and value transfer, they have found widespread application in areas such as supply chains, smart homes, e-commerce, and asset management.

[0003] Smart contracts involve transactions of blockchain tokens and are therefore vulnerable to attacks, necessitating vulnerability detection for these contracts. Existing vulnerability detection methods can only detect vulnerabilities in complete smart contracts that can generate bytecode, but are unable to detect vulnerabilities in local code fragments.

[0004] Therefore, providing a vulnerability detection method for smart contract code snippets is a technical problem that needs to be solved urgently by those skilled in the art. Summary of the Invention

[0005] The present application provides a vulnerability detection method and related device for smart contract code fragments, which solves the technical problem that existing vulnerability detection methods can only detect vulnerabilities in complete smart contracts that can generate bytecodes, but cannot detect vulnerabilities in local code fragments.

[0006] In view of this, the first aspect of this application provides a vulnerability detection method for smart contract code snippets, comprising:

[0007] Get the code snippet of the smart contract to be tested;

[0008] Converting the data in the code snippet into an abstract syntax tree;

[0009] Comparing the abstract syntax tree with a local tree in a code contract library to obtain multiple target trees similar to the abstract syntax tree;

[0010] Based on the vulnerability result of the target tree, a vulnerability detection result of the code fragment is obtained.

[0011] Optionally, obtaining a vulnerability detection result of the code snippet based on the vulnerability result of the target tree specifically includes:

[0012] Comparing the complete code of each target tree with the code snippet to obtain a target complete code that matches the code snippet;

[0013] The vulnerability result of the target complete code is used as the vulnerability detection result of the code fragment.

[0014] Optionally, comparing the complete code of each target tree with the code snippet to obtain a target complete code that matches the code snippet specifically includes:

[0015] Comparing the complete code of each target tree with the code fragment to obtain a matching degree corresponding to each complete code;

[0016] A target complete code is selected from the complete codes according to all the matching degrees.

[0017] Optionally, selecting a target complete code from the complete codes according to all the matching degrees specifically includes:

[0018] The complete code corresponding to the largest matching degree is used as the target complete code.

[0019] Optionally, obtaining a vulnerability detection result of the code snippet based on the vulnerability result of the target tree specifically includes:

[0020] Mapping each vulnerability of each target tree to the code snippet, and obtaining a mapping result corresponding to each vulnerability;

[0021] According to all the mapping results, a vulnerability detection result of the code snippet is determined.

[0022] Optionally, mapping each vulnerability of each target tree to the code snippet to obtain a mapping result corresponding to each vulnerability specifically includes:

[0023] Obtaining location information corresponding to each vulnerability in the target tree;

[0024] Based on the position information corresponding to each vulnerability, the vulnerability is mapped to the code snippet. When the vulnerability exists in a certain line of the code snippet and the vulnerability appears in the vulnerability queues of all the target trees, the mapping result of the vulnerability is determined to be a successful mapping.

[0025] Optionally, determining a vulnerability detection result of the code snippet based on all the mapping results specifically includes:

[0026] The vulnerability that is successfully mapped in the mapping result is used as the vulnerability of the code fragment, and a vulnerability detection result corresponding to the code fragment is obtained.

[0027] Optionally, converting the data in the code snippet into an abstract syntax tree specifically includes:

[0028] Convert the function data in the code snippet into a function abstract syntax tree, and convert the contract data in the code snippet into a contract abstract syntax tree;

[0029] Comparing the abstract syntax tree with the local tree in the code contract library to obtain a target tree similar to the abstract syntax tree, specifically including:

[0030] The function abstract syntax tree and the contract abstract syntax tree are compared with local trees in a code contract library to obtain multiple target trees similar to the function abstract syntax tree and the contract abstract syntax tree.

[0031] Optionally, the abstract syntax tree is compared with a local tree in a code contract library to obtain multiple target trees similar to the abstract syntax tree, specifically including:

[0032] Compare the abstract syntax tree with each local tree in the code contract library to obtain the similarity corresponding to each local tree;

[0033] A target tree is selected from the local trees according to all the similarities.

[0034] Optionally, selecting a target tree from the local trees based on all the similarities specifically includes:

[0035] The N local trees with the largest similarity are used as the target tree, where N is a natural number greater than 2.

[0036] A second aspect of the present application provides a vulnerability detection device for a smart contract code snippet, comprising:

[0037] The acquisition unit is used to obtain the code snippet of the smart contract to be tested;

[0038] a conversion unit, configured to convert the data in the code snippet into an abstract syntax tree;

[0039] A comparison unit, configured to compare the abstract syntax tree with a local tree in a code contract library to obtain a plurality of target trees similar to the abstract syntax tree;

[0040] The detection unit is configured to obtain a vulnerability detection result of the code snippet based on the vulnerability result of the target tree.

[0041] The third invention of the present application provides a vulnerability detection device for a smart contract code fragment, the device comprising a processor and a memory;

[0042] The memory is used to store program code and transmit the program code to the processor;

[0043] The processor is used to execute the vulnerability detection method for the smart contract code fragment as described in the first aspect according to the instructions in the program code.

[0044] In a fourth aspect, the present application provides a storage medium for storing program code, which is used to execute the vulnerability detection method for the smart contract code fragment as described in the first aspect.

[0045] It can be seen from the above technical solutions that this application has the following advantages:

[0046] The present application provides a vulnerability detection method for smart contract code snippets. The method first obtains the code snippet of the smart contract to be detected, then converts the data in the code snippet into an abstract syntax tree, and then compares the abstract syntax tree with the local tree in the code contract library to obtain multiple target trees similar to the abstract syntax tree. Then, based on the vulnerability results of the target trees, the vulnerability detection results of the code snippet are obtained. In the present application, a target tree similar to the code snippet is determined in the code contract library, and then the vulnerability detection results of the code snippet can be determined based on the vulnerability results of the target tree, thereby realizing vulnerability detection of the code snippet. This solves the technical problem that the existing vulnerability detection method can only detect vulnerabilities in complete smart contracts that can generate bytecode, but cannot perform vulnerability detection on local code snippets. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0048] Figure 1 This is a flow chart of Example 1 of a vulnerability detection method for a smart contract code snippet in an embodiment of the present application;

[0049] Figure 2 This is a flow chart of Example 2 of a vulnerability detection method for a smart contract code snippet in an embodiment of the present application;

[0050] Figure 3 This is a structural diagram of an embodiment of a vulnerability detection device for a smart contract code fragment in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The embodiments of the present application provide a vulnerability detection method and related device for smart contract code fragments, which solves the technical problem that existing vulnerability detection methods can only detect vulnerabilities in complete smart contracts that can generate bytecodes, but cannot detect vulnerabilities in local code fragments.

[0052] In order to help those skilled in the art better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0053] See also Figure 1 , a flow chart of embodiment 1 of a vulnerability detection method for a smart contract code fragment in an embodiment of the present application.

[0054] A vulnerability detection method for a smart contract code snippet in this embodiment includes:

[0055] Step 101: Obtain the code snippet of the smart contract to be tested.

[0056] A code snippet is a section of code that contains a function or dependencies without context. It often appears in tutorials or Q&A websites. It can quickly and visually point out a solution or highlight flaws in other code. It is generally used for reading and does not produce output during compilation. While this data cannot be semantically analyzed during compilation, it can be parsed to generate an abstract syntax tree containing grammatical information.

[0057] Step 102: Convert the data in the code snippet into an abstract syntax tree.

[0058] Specifically, the data in the code snippet is converted into an abstract syntax tree by a syntax tree abstraction tool. It is understandable that there may be many syntax tree abstraction tools, such as Esprima, UglifyJS2, Traceur, etc., which are not specifically limited in this embodiment.

[0059] Step 103: Compare the abstract syntax tree with the local tree in the code contract library to obtain multiple target trees similar to the abstract syntax tree.

[0060] The data in the code contract library also exists in the form of an "abstract syntax tree." Therefore, in this embodiment, the abstract syntax tree corresponding to the code snippet is compared with the local tree in the code contract library. The local tree in the code contract library that has a high similarity to the abstract syntax tree is used as the target tree. Specifically, a high similarity can be achieved by using a similarity threshold, for example, where the similarity between the local tree and the abstract syntax tree is greater than a preset similarity threshold.

[0061] Specifically, the comparison principle when comparing the local tree and the abstract syntax tree is: consistent grammatical structure and similar semantic structure (ie, the similarity of the semantic structures of the two is greater than the semantic structure similarity threshold).

[0062] It is understandable that the configuration process of the code contract library can be carried out in the following way:

[0063] We obtained all Ethereum transaction records between 2018 and 2020, including the address information of the transaction contracts. Furthermore, we obtained all complete smart contracts from this time period. We used the oyente and mythril tools to obtain vulnerability detection results for these smart contracts. These vulnerability detection results were categorized into nine types: reentrancy, access control, arithmetic errors, unconfirmed return values, denial of service, poor randomness, front-running, time manipulation, and short addresses. If both tools identified the same vulnerability, and it was of the same type, we considered it a valid vulnerability.

[0064] Because the two tools use different detection methods, they generally don't produce the same results. However, they can be broadly categorized into the nine types of vulnerabilities described above based on their causes and logic. Reentrancy attacks, access control errors, arithmetic errors, unconfirmed return values, and denial of service are language-level issues caused by code logic. Poor randomness, front-running, and time manipulation are issues that arise when smart contracts are deployed on the blockchain. Miners who package blocks on the blockchain can maliciously manipulate the smart contract's dependent values to launch vulnerability attacks. Short addresses are a potential issue at the smart contract compiler level. If the compiler incorrectly accepts an address that is too short, it can cause errors.

[0065] Step 104: Based on the vulnerability results of the target tree, obtain the vulnerability detection results of the code fragment.

[0066] It can be understood that a target tree corresponds to the complete code of a complete smart contract. Therefore, in this embodiment, after obtaining multiple complete codes similar to the code snippet, the vulnerability result of the code snippet can be determined, that is, the corresponding vulnerability detection result.

[0067] In this embodiment, the code snippet of the smart contract to be tested is first obtained, and then the data in the code snippet is converted into an abstract syntax tree. The abstract syntax tree is then compared with the local tree in the code contract library to obtain multiple target trees similar to the abstract syntax tree. Then, based on the vulnerability results of the target trees, the vulnerability detection results of the code snippet are obtained. In this application, a target tree similar to the code snippet is determined in the code contract library, and then the vulnerability detection results of the code snippet can be determined based on the vulnerability results of the target tree, thereby realizing vulnerability detection of the code snippet, thereby solving the technical problem that existing vulnerability detection methods can only detect vulnerabilities in complete smart contracts that can generate bytecode, but cannot perform vulnerability detection on local code snippets.

[0068] The above is Example 1 of a vulnerability detection method for a smart contract code snippet provided in an embodiment of the present application. The following is Example 2 of a vulnerability detection method for a smart contract code snippet provided in an embodiment of the present application.

[0069] See also Figure 2 , a flow chart of embodiment 2 of a vulnerability detection method for a smart contract code fragment in an embodiment of the present application.

[0070] In this embodiment, a vulnerability detection method for a smart contract code snippet includes:

[0071] Step 201: Obtain a code snippet of the smart contract to be tested.

[0072] It is understandable that the code snippets in the embodiments appear in the form of functions and contracts. For code snippets in the form of contracts, they are often in a complete program containing multiple sub-contracts. Therefore, they have dependencies on other contracts and are code snippets.

[0073] Step 202: Convert the function data in the code snippet into a function abstract syntax tree, and convert the contract data in the code snippet into a contract abstract syntax tree.

[0074] Specifically, when using a syntax tree abstraction tool to abstract the syntax tree, the tool's recognition data is generally contract data. Therefore, the syntax tree abstraction tool can directly abstract the contract data. For function data, the contract data framework is added based on the function data, so that the function data becomes "function data" that can be recognized by the syntax tree abstraction tool.

[0075] Step 203: Compare the function abstract syntax tree, the contract abstract syntax tree, and each local tree in the code contract library to obtain the similarity corresponding to each local tree.

[0076] When comparing the function abstract syntax tree with the contract abstract syntax tree, each function abstract syntax tree is compared with the local tree in the code contract library to obtain the similarity between the local tree and the function abstract syntax tree. At the same time, each contract abstract syntax tree is also compared with the local tree to obtain the similarity between the local tree and the contract abstract syntax tree.

[0077] Step 204: Select a target tree from the local trees based on all similarities.

[0078] In a specific embodiment, selecting a target tree from local trees based on all similarities includes:

[0079] The N local trees with the greatest similarity are used as target trees, where N is a natural number greater than 2.

[0080] It is understandable that those skilled in the art can select the setting of the value N as needed, and no specific limitation is made in this embodiment.

[0081] Step 205: Based on the vulnerability results of the target tree, obtain the vulnerability detection results of the code fragment.

[0082] It is understood that, in one embodiment, the vulnerability determination of a code snippet can be performed by mapping the code snippet in a target tree, and after determining the target complete code, determining the vulnerability detection result. That is, after first determining the complete code corresponding to the code snippet, the vulnerability corresponding to the complete code is used as the vulnerability of the code snippet to obtain the vulnerability detection result. It is understood that the specific implementation steps of the above process include:

[0083] Based on the vulnerability results of the target tree, the vulnerability detection results of the code fragment are obtained, including:

[0084] Compare the complete code and code snippet of each target tree to obtain the target complete code that matches the code snippet;

[0085] The vulnerability results of the target complete code are used as the vulnerability detection results of the code fragment.

[0086] Specifically, the complete code and code snippet of each target tree are compared to obtain the target complete code that matches the code snippet, including:

[0087] Compare the complete code and code snippets of each target tree to obtain the matching degree of each complete code;

[0088] According to all matching degrees, the target complete code is selected from the complete codes.

[0089] Specifically, based on all matching degrees, a target complete code is selected from the complete codes, including:

[0090] The complete code corresponding to the maximum matching degree is taken as the target complete code.

[0091] A complete code corresponds to a complete contract. A complete contract is a program that can be successfully compiled and may contain multiple sub-contracts. The concept of smart contracts is similar to the concept of classes in other languages. Therefore, a complete contract may be a multi-contract file containing multiple sub-contracts that cannot be directly compiled.

[0092] It is understood that in another embodiment, the vulnerability determination of the code snippet can be performed by mapping the vulnerabilities of the target tree in the code snippet, and determining the vulnerability detection result of the code snippet based on the mapping result of the vulnerabilities in the target tree. It is understood that the specific implementation steps of the above process include:

[0093] Map each vulnerability of each target tree to a code snippet, and obtain the mapping result corresponding to each vulnerability;

[0094] Based on all mapping results, the vulnerability detection results of the code snippet are determined.

[0095] Map each vulnerability in each target tree to a code snippet and obtain the mapping results corresponding to each vulnerability, including:

[0096] Get the location information of each vulnerability in the target tree;

[0097] Based on the location information corresponding to each vulnerability, the vulnerability is mapped to the code snippet. When the vulnerability exists in a certain line of the code snippet and appears in the vulnerability queues of all target trees, the mapping result of the vulnerability is determined to be successful.

[0098] It is understandable that the above comparison process between the local tree and the complete code can also be performed in the following way:

[0099] The abstract syntax tree formed by the code snippets only contains syntax information but not semantic information. Therefore, this embodiment uses the following method to process and match all abstract syntax trees.

[0100] ①. Each node of the abstract syntax tree contains word information and name information. The abstract syntax tree is traversed in pre-order and the word information is hashed to obtain a pre-order hash sequence of the abstract syntax tree.

[0101] ②. For the name information of the abstract syntax tree, use pre-order traversal to obtain the pre-order name sequence.

[0102] ③. Since the code contract library has already extracted the abstract syntax tree at the contract and function levels, the same processing is performed on this part of the abstract syntax tree to generate a hash sequence and a name sequence.

[0103] ④ Now, let's map the code snippet to the complete contract. Using contracts as an example, the matching process at the function level is the same. For a contract derived from a code snippet and a contract derived from a complete contract, assuming their hash sequences are identical, we perform a BELU similarity calculation on the name sequences of both parties, sorting them from highest to lowest. It should be noted that BELU is a text matching method; in this application, name sequences are treated as text strings for similarity matching.

[0104] ⑤. Based on the sorting results, take 0.8 as the BELU threshold, extract the matching pairs with BELU greater than 0.8 (that is, determine the target tree corresponding to the contract), and return them to the matching queue for comparison between developers and code snippets.

[0105] ⑥. Vulnerability Mapping. A matching queue represents a group of vulnerable contracts from complete contracts that match the input code snippet. To address the instability caused by the lack of semantic information, vulnerability mapping is further performed based on the vulnerability location information of this group of contracts using a pre-set principle. The pre-set principle states that if a vulnerability exists in a certain line and belongs to a certain vulnerability type, it must appear in the vulnerability queue corresponding to every complete code in the matching sequence in order to be mapped to the input code snippet. This means that the vulnerability is considered a vulnerability in the code snippet.

[0106] In this embodiment, the code snippet of the smart contract to be tested is first obtained, and then the data in the code snippet is converted into an abstract syntax tree. The abstract syntax tree is then compared with the local tree in the code contract library to obtain multiple target trees similar to the abstract syntax tree. Then, based on the vulnerability results of the target trees, the vulnerability detection results of the code snippet are obtained. In this application, a target tree similar to the code snippet is determined in the code contract library, and then the vulnerability detection results of the code snippet can be determined based on the vulnerability results of the target tree, thereby realizing vulnerability detection of the code snippet, thereby solving the technical problem that existing vulnerability detection methods can only detect vulnerabilities in complete smart contracts that can generate bytecode, but cannot perform vulnerability detection on local code snippets.

[0107] The above is Example 2 of a vulnerability detection method for a smart contract code fragment provided in an embodiment of the present application. The following is an embodiment of a vulnerability detection device for a smart contract code fragment provided in an embodiment of the present application.

[0108] See also Figure 3 , a structural diagram of an embodiment of a vulnerability detection device for a smart contract code fragment in an embodiment of the present application.

[0109] In this embodiment, a vulnerability detection device for a smart contract code snippet includes:

[0110] The acquisition unit is used to obtain the code snippet of the smart contract to be tested;

[0111] A conversion unit, used to convert the data in the code snippet into an abstract syntax tree;

[0112] The comparison unit is used to compare the abstract syntax tree with the local tree in the code contract library to obtain multiple target trees similar to the abstract syntax tree;

[0113] The detection unit is used to obtain vulnerability detection results of the code fragment based on the vulnerability results of the target tree.

[0114] Optionally, based on the vulnerability results of the target tree, vulnerability detection results for the code snippet are obtained, specifically including:

[0115] Compare the complete code and code snippet of each target tree to obtain the target complete code that matches the code snippet;

[0116] The vulnerability results of the target complete code are used as the vulnerability detection results of the code fragment.

[0117] Specifically, the complete code and code snippet of each target tree are compared to obtain the target complete code that matches the code snippet, including:

[0118] Compare the complete code and code snippets of each target tree to obtain the matching degree of each complete code;

[0119] According to all matching degrees, the target complete code is selected from the complete codes.

[0120] Specifically, based on all matching degrees, a target complete code is selected from the complete codes, including:

[0121] The complete code corresponding to the maximum matching degree is taken as the target complete code.

[0122] Optionally, based on the vulnerability results of the target tree, vulnerability detection results for the code snippet are obtained, specifically including:

[0123] Map each vulnerability of each target tree to a code snippet, and obtain the mapping result corresponding to each vulnerability;

[0124] Based on all mapping results, the vulnerability detection results of the code snippet are determined.

[0125] Specifically, each vulnerability in each target tree is mapped to a code snippet, and the mapping results corresponding to each vulnerability are obtained, including:

[0126] Get the location information of each vulnerability in the target tree;

[0127] Based on the location information corresponding to each vulnerability, the vulnerability is mapped to the code snippet. When the vulnerability exists in a certain line of the code snippet and appears in the vulnerability queues of all target trees, the mapping result of the vulnerability is determined to be successful.

[0128] Specifically, based on all mapping results, the vulnerability detection results of the code snippet are determined, including:

[0129] The vulnerability that is successfully mapped in the mapping result is used as the vulnerability of the code snippet, and the vulnerability detection result corresponding to the code snippet is obtained.

[0130] Optionally, the conversion unit is specifically used to convert the function data in the code snippet into a function abstract syntax tree, and convert the contract data in the code snippet into a contract abstract syntax tree.

[0131] In this embodiment, the code snippet of the smart contract to be tested is first obtained, and then the data in the code snippet is converted into an abstract syntax tree. The abstract syntax tree is then compared with the local tree in the code contract library to obtain multiple target trees similar to the abstract syntax tree. Then, based on the vulnerability results of the target trees, the vulnerability detection results of the code snippet are obtained. In this application, a target tree similar to the code snippet is determined in the code contract library, and then the vulnerability detection results of the code snippet can be determined based on the vulnerability results of the target tree, thereby realizing vulnerability detection of the code snippet, thereby solving the technical problem that existing vulnerability detection methods can only detect vulnerabilities in complete smart contracts that can generate bytecode, but cannot perform vulnerability detection on local code snippets.

[0132] An embodiment of the present application also provides an embodiment of a vulnerability detection device for a smart contract code fragment. The vulnerability detection device for a smart contract code fragment in this embodiment includes a processor and a memory; the memory is used to store program code and transmit the program code to the processor; the processor is used to execute the vulnerability detection method for a smart contract code fragment such as Example 1 or Example 2 according to instructions in the program code.

[0133] An embodiment of the present application also provides an embodiment of a storage medium, wherein the storage medium in this embodiment is used to store program code, and the program code is used to execute the vulnerability detection method of the smart contract code fragment such as Example 1 or Example 2.

[0134] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0135] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division, and there may be other division methods during implementation, such as multiple units or components can be combined or integrated into another power grid network to be installed, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0136] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected as needed to achieve the purpose of this embodiment.

[0137] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0138] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0139] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A vulnerability detection method for smart contract code snippets, characterized in that: include: Get the code snippet of the smart contract to be tested; Converting the data in the code snippet into an abstract syntax tree; Comparing the abstract syntax tree with a local tree in a code contract library to obtain multiple target trees similar to the abstract syntax tree; Comparing the complete code of each target tree with the code snippet to obtain a target complete code that matches the code snippet; The vulnerability result of the target complete code is used as the vulnerability detection result of the code fragment.

2. The vulnerability detection method for smart contract code snippets according to claim 1, characterized in that: Comparing the complete code of each target tree with the code snippet to obtain a target complete code that matches the code snippet specifically includes: Comparing the complete code of each target tree with the code fragment to obtain a matching degree corresponding to each complete code; A target complete code is selected from the complete codes according to all the matching degrees.

3. The vulnerability detection method for smart contract code snippets according to claim 2, characterized in that: Selecting a target complete code from the complete codes based on all the matching degrees specifically includes: The complete code corresponding to the largest matching degree is used as the target complete code.

4. The vulnerability detection method for smart contract code snippets according to claim 1, characterized in that: Based on the vulnerability results of the target tree, the vulnerability detection results of the code snippet are obtained, specifically including: Mapping each vulnerability of each target tree to the code snippet, and obtaining a mapping result corresponding to each vulnerability; According to all the mapping results, a vulnerability detection result of the code snippet is determined.

5. The vulnerability detection method for smart contract code snippets according to claim 4 is characterized in that: Mapping each vulnerability of each target tree to the code snippet to obtain a mapping result corresponding to each vulnerability, specifically including: Obtaining location information corresponding to each vulnerability in the target tree; Based on the position information corresponding to each vulnerability, the vulnerability is mapped to the code snippet. When the vulnerability exists in a certain line of the code snippet and the vulnerability appears in the vulnerability queues of all the target trees, the mapping result of the vulnerability is determined to be a successful mapping.

6. The vulnerability detection method for smart contract code snippets according to claim 5, characterized in that: Determining vulnerability detection results for the code snippet based on all the mapping results, specifically including: The vulnerability that is successfully mapped in the mapping result is used as the vulnerability of the code fragment, and a vulnerability detection result corresponding to the code fragment is obtained.

7. A vulnerability detection device for smart contract code snippets, characterized in that: include: The acquisition unit is used to obtain the code snippet of the smart contract to be tested; a conversion unit, configured to convert the data in the code snippet into an abstract syntax tree; A comparison unit, configured to compare the abstract syntax tree with a local tree in a code contract library to obtain a plurality of target trees similar to the abstract syntax tree; a detection unit, configured to compare the complete code of each target tree with the code snippet to obtain a target complete code that matches the code snippet; The vulnerability result of the target complete code is used as the vulnerability detection result of the code fragment.

8. A vulnerability detection device for smart contract code snippets, characterized in that: The device includes a processor and a memory; The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute a vulnerability detection method for a smart contract code snippet according to any one of claims 1 to 6 according to instructions in the program code.

9. A storage medium, characterized in that: The storage medium is used to store program code, and the program code is used to execute the vulnerability detection method for the smart contract code fragment according to any one of claims 1 to 6.

Images