Smart contract reentrant vulnerability detection method and device, storage medium and related equipment

Abstract

The smart contract re-entrant vulnerability detection method, device, storage medium and related equipment provided by the application can first construct an abstract syntax tree corresponding to the smart contract source code to be detected when detecting whether the smart contract source code contains a re-entrant vulnerability, and then determine the original control flow information and the original data flow information of the abstract syntax tree. Since the original control flow information and the original data flow information are determined on the basis of the abstract syntax tree, the relationship between the control flow and the data flow across functions is considered, so that the false detection result caused by the cross-function information can be avoided. Further, the application can also use the pre-constructed re-entrant vulnerability keyword library to filter the original control flow information and the original data flow information, so that the key control flow information and the key data flow information obtained by filtering contain multiple types of functions. In this way, the detection method of the application can be applied to the re-entrant vulnerability detection of any smart contract.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vulnerability detection, and in particular to a smart contract re-entrant vulnerability detection method and device, a storage medium and related equipment. BACKGROUND

[0002] At present, as an important part of blockchain 2.0, smart contracts provide basic conditions for the application landing of blockchain in various fields. On this basis, a new smart contract language Solidity is proposed by a virtual transaction platform to meet the asset transfer demand between accounts in the blockchain scenario and the execution demand in the decentralized scenario. These two demands have given birth to a series of unique new features of Solidity, such as transfer mechanism, gas mechanism, etc. However, new features often come with new security risks, and there are new security vulnerabilities, especially in the blockchain scenario. If the smart contract has security vulnerabilities, unexpected behaviors will occur, which will cause significant economic losses.

[0003] In order to avoid the path explosion problem, the existing re-entrant vulnerability detection tool only detects based on a single function in the smart contract, and it is difficult to analyze the cross-function control flow data flow information, which may lead to errors in the detection results. Moreover, the existing re-entrant vulnerability detection tool mainly relies on the keyword call.value()(), which makes it difficult to adapt to the latest vulnerability development mode. SUMMARY

[0004] The present application aims to at least solve one of the above technical defects, in particular, the technical defects that the existing re-entrant vulnerability detection tool is difficult to analyze the cross-function control flow data flow information and difficult to adapt to the latest vulnerability development mode.

[0005] The present application provides a smart contract re-entrant vulnerability detection method, which comprises:

[0006] An abstract syntax tree corresponding to the source code of the smart contract to be detected is constructed, and the original control flow information and the original data flow information of the abstract syntax tree are determined;

[0007] The original control flow information and the original data flow information are screened by using a pre-constructed re-entrant vulnerability keyword library to obtain key control flow information and key data flow information;

[0008] According to the key control flow information and the key data flow information, key control flow edges and key data flow edges are added to the abstract syntax tree to form a code attribute graph;

[0009] The code attribute graph is input into a pre-configured reentrancy vulnerability detection model to obtain the detection result output by the reentrancy vulnerability detection model. Based on the detection result, it is determined whether the smart contract source code contains a reentrancy vulnerability.

[0010] Optionally, before inputting the code attribute graph into the pre-configured reentrancy vulnerability detection model, the method further includes:

[0011] The code attribute graph is compressed to obtain a compressed code attribute graph; wherein, the number of smart contract function nodes in the compressed code attribute graph is less than the number of smart contract function nodes in the uncompressed code attribute graph.

[0012] Optionally, compressing the code attribute map to obtain a compressed code attribute map includes:

[0013] The code attribute graph is divided according to the granularity of smart contract functions to obtain a divided code attribute graph, which consists of multiple isolated function nodes that do not contain any edges.

[0014] Based on the starting function node and pointing function node of the key control flow edge and the key data flow edge, edges are added to the isolated function nodes in the partitioned code attribute graph to obtain the code attribute graph with added edges.

[0015] Calculate the connected components of the code attribute graph after adding edges, and determine the compressed code attribute graph based on the largest connected component among the calculated connected components.

[0016] Optionally, adding edges to isolated function nodes in the partitioned code attribute graph based on the starting function nodes and pointing function nodes of the key control flow edges and the key data flow edges includes:

[0017] Based on the key control flow edge and the key data flow edge, multiple starting function nodes and multiple pointing function nodes are determined;

[0018] For each starting function node, connect the isolated function nodes in the partitioned code attribute graph that are the same as the starting function node and the pointing function nodes associated with the starting function node to form edges representing the relationships between the isolated function nodes.

[0019] Optionally, determining the original control flow information and original data flow information of the abstract syntax tree includes:

[0020] The abstract syntax tree is traversed to determine the function names and function call information defined in the abstract syntax tree, as well as the variable names and variable call and assignment information;

[0021] Based on the function names and function call information defined in the abstract syntax tree, determine the original control flow information of the abstract syntax tree;

[0022] Based on the variable names and variable call and assignment information defined in the abstract syntax tree, the original data flow information of the abstract syntax tree is determined.

[0023] Optionally, the step of filtering the original control flow information and the original data flow information using a pre-built reentrancy vulnerability keyword library to obtain key control flow information and key data flow information includes:

[0024] Each keyword in the pre-built reentrancy vulnerability keyword library is compared with the function name in the original control flow information and the variable name in the original data flow information.

[0025] The original control flow information corresponding to the function name that overlaps with the keyword is taken as the key control flow information, and the original data flow information corresponding to the variable name that overlaps with the keyword is taken as the key data flow information.

[0026] Optionally, the step of adding key control flow edges and key data flow edges to the abstract syntax tree based on the key control flow information and the key data flow information to form a code attribute graph includes:

[0027] Determine the starting function node and the pointing function node in the key control flow information, and add key control flow edges to the abstract syntax tree according to the starting function node and the pointing function node in the key control flow information;

[0028] Determine the starting function node and the pointing function node in the key data flow information, and add key data flow edges to the abstract syntax tree based on the starting function node and the pointing function node in the key data flow information;

[0029] A code property graph is formed based on the abstract syntax tree after adding key control flow edges and key data flow edges.

[0030] This application also provides a smart contract reentrancy vulnerability detection device, including:

[0031] The original information determination module is used to construct an abstract syntax tree corresponding to the source code of the smart contract to be detected, and to determine the original control flow information and original data flow information of the abstract syntax tree;

[0032] The key information determination module is used to filter the original control flow information and the original data flow information using a pre-built reentrancy vulnerability keyword library to obtain key control flow information and key data flow information;

[0033] The code attribute graph construction module is used to add key control flow edges and key data flow edges to the abstract syntax tree based on the key control flow information and the key data flow information to form a code attribute graph.

[0034] The reentrancy vulnerability detection module is used to input the code attribute graph into a pre-configured reentrancy vulnerability detection model, obtain the detection result output by the reentrancy vulnerability detection model, and determine whether the smart contract source code contains a reentrancy vulnerability based on the detection result.

[0035] This application also provides a storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the smart contract reentrancy vulnerability detection method as described in any of the above embodiments.

[0036] This application also provides a computer device, including: one or more processors, and memory;

[0037] The memory stores computer-readable instructions, which, when executed by the one or more processors, perform the steps of the smart contract reentrancy vulnerability detection method as described in any of the above embodiments.

[0038] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0039] The smart contract reentrancy vulnerability detection method, apparatus, storage medium, and related devices provided in this application, when detecting whether a smart contract source code contains a reentrancy vulnerability, can first construct an abstract syntax tree corresponding to the source code of the smart contract to be detected, and then determine the original control flow information and original data flow information of the abstract syntax tree. Since the original control flow information and original data flow information are determined based on the abstract syntax tree, the relationship between control flow and data flow across functions is considered, thus avoiding erroneous detection results caused by cross-function information. Furthermore, before performing reentrancy vulnerability detection, this application can also use a pre-constructed reentrancy vulnerability keyword library to filter the original control flow information and original data flow information, so that the filtered key control flow information and key data flow information contain multiple types of functions, rather than relying on the traditional single keyword pattern. This allows the detection method of this application to be applied to the reentrancy vulnerability detection of any smart contract. In addition, this application can also form a code attribute graph based on the key control flow information and key data flow information, and use a reentrancy vulnerability detection model to detect the code attribute graph. The detection results are used to determine whether the smart contract source code contains a reentrancy vulnerability, thus obtaining more accurate detection results. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A flowchart illustrating a smart contract reentrancy vulnerability detection method provided in this application embodiment;

[0042] Figure 2 A schematic diagram of the abstract syntax tree provided in the embodiments of this application;

[0043] Figure 3 A schematic diagram of the structure of the maximum connected component provided in the embodiments of this application;

[0044] Figure 4 This is a schematic diagram of the code attribute graph formed after adding key control flow edges and key data flow edges, as provided in an embodiment of this application.

[0045] Figure 5 This is a schematic diagram of the structure of a smart contract reentrancy vulnerability detection device provided in an embodiment of this application;

[0046] Figure 6 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0047] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] To avoid path explosion, existing reentrancy vulnerability detection tools only perform detection based on a single function within a smart contract, making it difficult to parse control flow and data flow information across functions. This can easily lead to erroneous detection results. Furthermore, existing reentrancy vulnerability detection tools mainly rely on the keyword `call.value()`, making it difficult to adapt to the latest vulnerability development patterns.

[0049] Based on this, this application proposes the following technical solution, as detailed below:

[0050] In one embodiment, such as Figure 1 As shown, Figure 1This application provides a flowchart illustrating a smart contract reentrancy vulnerability detection method according to an embodiment of the present application. The present application provides a smart contract reentrancy vulnerability detection method, which may include:

[0051] S110: Construct an abstract syntax tree corresponding to the source code of the smart contract to be tested, and determine the original control flow information and original data flow information of the abstract syntax tree.

[0052] In this step, when detecting smart contract reentrancy vulnerabilities, the source code of the smart contract to be tested can be obtained first, and an abstract syntax tree corresponding to the source code of the smart contract can be constructed. Then, the original control flow information and original data flow information of the abstract syntax tree can be determined.

[0053] Understandably, an Abstract Syntax Tree (AST) is an abstract representation of the syntax structure of source code. It represents the syntax structure of a programming language in a tree-like form, with each node in the tree representing a structure in the source code.

[0054] Indicatively, such as Figure 2 As shown, Figure 2 This is a schematic diagram of the abstract syntax tree structure provided in an embodiment of this application. When constructing the abstract syntax tree based on the source code of the smart contract to be detected, this application can use the Solidity compiler (solc) to compile the smart contract source code and generate an abstract syntax tree corresponding to the smart contract source code, such as... Figure 2 As shown, each node in the generated abstract syntax tree consists of a node name and a node type. For example, the node type corresponding to the function definition node is "function definition", and the node type corresponding to the variable definition node is "variable definition".

[0055] Once the abstract syntax tree is generated, it can be traversed, and the function names and function call information defined in the smart contract, as well as the variable names, variable calls and assignment information, can be recorded during the traversal process. This will form the original control flow information and original data flow information of the abstract syntax tree.

[0056] The original control flow information can include intra-function control flow information and cross-function control flow information. Intra-function control flow information represents the semantic information related to the control logic within a function in a smart contract, while cross-function control flow information represents the semantic information related to the control logic between different functions in a smart contract. For example, a call from function B to function A, as well as other functions called within the body of function A, together constitute a cross-function control flow edge from A to B.

[0057] The raw data flow information can also include intra-function data flow information and cross-function data flow information. Intra-function data flow information represents the semantic information of how variables are used within a function in a smart contract, such as a data flow edge connecting two nodes containing the same variable along the function execution direction. Cross-function data flow information represents the semantic information of how variables are used between different functions in a smart contract. That is, in a smart contract, function A defines a global variable x, and function B modifies that global variable x, which constitutes a cross-function data flow edge from A to B.

[0058] S120: Use a pre-built reentrancy vulnerability keyword library to filter the original control flow information and original data flow information to obtain key control flow information and key data flow information.

[0059] In this step, an abstract syntax tree corresponding to the source code of the smart contract to be tested is constructed through S110. After determining the original control flow information and original data flow information of the abstract syntax tree, the original control flow information and original data flow information can be filtered using a pre-built reentrancy vulnerability keyword library to obtain key control flow information and key data flow information.

[0060] Understandably, existing reentrancy detection tools primarily rely on the keyword `call.value()()`, a cryptocurrency transfer function. For example, when smart contract A calls `B.call.value(amount)()`, it can transfer a certain amount of cryptocurrency to smart contract B. However, with the increasing popularity of token contracts, many reentrancy vulnerabilities occur in token transfers. Token transfers do not rely on the `call.value()()` function, so detection based on the `call.value()()` keyword will fail to detect reentrancy vulnerabilities in token transfers.

[0061] Therefore, based on the characteristics of smart contract reentrancy vulnerabilities, this application pre-constructs a keyword library. This keyword library can contain keywords related to transfers, balances, etc., specifically including {balance, value, transfer, send, token, etc.}. Then, it can traverse the abstract syntax tree to obtain the function names and variable names in the smart contract. Then, it can use the keywords in the keyword library to filter out the key functions and key variables whose names contain these keywords, and extract the control flow and data flow information involving the key functions and key variables to obtain key control flow information and key data flow information.

[0062] S130: Based on the key control flow information and key data flow information, add key control flow edges and key data flow edges to the abstract syntax tree to form a code attribute graph.

[0063] In this step, after obtaining the key control flow information and key data flow information through S120, key control flow edges and key data flow edges can be added to the abstract syntax tree based on the key control flow information and key data flow information to obtain the code attribute graph.

[0064] Specifically, after obtaining the key control flow information, since this information can contain both intra-function control flow information and cross-function control flow information, and since intra-function control flow information can be used to obtain intra-function control flow edges, and cross-function control flow information can be used to obtain cross-function control flow edges, this application can obtain both intra-function and cross-function control flow edges through the key control flow information, and the intra-function and cross-function control flow edges together constitute the key control flow edges.

[0065] Similarly, since the key data flow information can contain both data flow information within a function and data flow information across functions, this application can obtain both data flow edges within a function and data flow edges across functions through the key data flow information, and the control flow edges within a function and the data flow edges across functions together constitute the key data flow edges.

[0066] Once the key control flow edges and key data flow edges are obtained, this application can add different key control flow edges and key data flow edges to different positions in the abstract syntax tree to obtain the final code property graph.

[0067] It is understandable that a code property graph is defined as a graph formed by adding control flow edges and data flow edges to an abstract syntax tree. Therefore, according to the above process, after adding key control flow and key data flow edges to the abstract syntax tree, a code property graph is naturally formed.

[0068] S140: Input the code attribute graph into the pre-configured reentrancy vulnerability detection model, obtain the detection results output by the reentrancy vulnerability detection model, and determine whether the smart contract source code contains a reentrancy vulnerability based on the detection results.

[0069] In this step, after obtaining the code attribute graph through S130, the code attribute graph can be input into the pre-configured reentrancy vulnerability detection model, and the code attribute graph can be detected by the reentrancy vulnerability detection model to obtain the detection result output by the reentrancy vulnerability detection model. Then, this application can determine whether the smart contract source code contains a reentrancy vulnerability based on the detection result.

[0070] Before detecting the code attribute graph, this application can select a graph convolutional neural network or a graph attention mechanism network as the initial reentrancy vulnerability detection model, and use the code attribute graph corresponding to the smart contract source code as training samples. After labeling whether the smart contract source code contains reentrancy vulnerabilities, sample labels are formed to train the initial reentrancy vulnerability detection model. When the training conditions are met, the final reentrancy vulnerability detection model can be obtained. This reentrancy vulnerability detection model can detect whether the smart contract source code corresponding to the input code attribute graph contains reentrancy vulnerabilities and obtain the detection results.

[0071] For example, this application can input the code attribute graph into the reentrancy vulnerability detection model to obtain the detection result. If the detection result is 1, the smart contract source code is considered to contain a reentrancy vulnerability; if the detection result is 0, the smart contract source code is considered not to contain a reentrancy vulnerability.

[0072] In the above embodiments, when detecting whether a smart contract source code contains a reentrancy vulnerability, an abstract syntax tree corresponding to the source code of the smart contract to be detected can be constructed first. Then, the original control flow information and original data flow information of the abstract syntax tree are determined. Since the original control flow information and original data flow information are determined based on the abstract syntax tree, the relationship between control flow and data flow across functions is considered, thus avoiding erroneous detection results caused by cross-function information. Furthermore, before performing reentrancy vulnerability detection, this application can also use a pre-built reentrancy vulnerability keyword library to filter the original control flow information and original data flow information, so that the filtered key control flow information and key data flow information contain multiple types of functions, rather than relying on the traditional single keyword pattern. This allows the detection method of this application to be applied to the reentrancy vulnerability detection of any smart contract. In addition, this application can also form a code attribute graph based on the key control flow information and key data flow information, and use a reentrancy vulnerability detection model to detect the code attribute graph. Based on the detection results, it can determine whether the smart contract source code contains a reentrancy vulnerability, thus obtaining more accurate detection results.

[0073] In one embodiment, before inputting the code attribute graph into the pre-configured reentrancy vulnerability detection model in S140, the following may also be included:

[0074] S310: Compress the code attribute graph to obtain a compressed code attribute graph; wherein the number of smart contract function nodes in the compressed code attribute graph is less than the number of smart contract function nodes in the uncompressed code attribute graph.

[0075] In this embodiment, the code attribute graph can be compressed before being input into the reentrancy vulnerability detection model. The compressed code attribute graph contains fewer smart contract function nodes than the uncompressed code attribute graph.

[0076] Understandably, since the length of smart contract source code is not fixed, some smart contracts may have thousands of lines of code, resulting in a very large abstract syntax tree, which in turn makes the final constructed code attribute graph very large and difficult to use directly. Therefore, this application can optimize the code attribute graph based on the key control flow edges and key data flow edges obtained in the previous step, so as to reduce the complexity of the code attribute graph and improve the detection efficiency of the reentrancy vulnerability detection model.

[0077] In one embodiment, compressing the code attribute map in step S310 to obtain a compressed code attribute map may include:

[0078] S311: Divide the code attribute graph according to the granularity of smart contract functions to obtain a divided code attribute graph, wherein the divided code attribute graph consists of multiple isolated function nodes that do not contain any edges.

[0079] S312: Based on the starting function node and pointing function node of the key control flow edge and the key data flow edge, add edges to the isolated function nodes in the partitioned code attribute graph to obtain the code attribute graph with added edges.

[0080] S313: Calculate the connected components of the code attribute graph after adding edges, and determine the compressed code attribute graph based on the largest connected component among the calculated connected components.

[0081] In this embodiment, when compressing the code attribute graph G1, it can be divided according to the granularity of smart contract functions, resulting in a tree composed of subtrees at the function level. Each subtree corresponds to a function in the smart contract source code, which can be denoted as f1, f2, f3, etc. Then, these subtrees can be used as nodes to construct a new code attribute graph G2. This new code attribute graph G2 is a graph containing only isolated function nodes and no edges, i.e., V = (f1, f2, f3…), E = (empty). Therefore, this application can add edges to the isolated function nodes in the divided code attribute graph, i.e., code attribute graph G2, based on the starting function nodes and pointing function nodes of the key control flow edges and key data flow edges, to obtain a code attribute graph with added edges.

[0082] Once the code attribute graph with added edges is obtained, its connected components can be calculated using algorithms such as djikstra's algorithm. Furthermore, since multiple connected components may exist, this application can select the largest connected component to determine the compressed code attribute graph.

[0083] Indicatively, such as Figure 3 As shown, Figure 3 A schematic diagram of the structure of the maximum connected component provided in the embodiments of this application; Figure 3 The connected components in the graph consist of two sets: one set composed of nodes A, B, and C, and the other set composed of nodes D and E. Comparison shows that the connected component composed of nodes A, B, and C is the maximum connected component. After obtaining the maximum connected component, this application can segment and trim the code attribute graph G1 based on it. Nodes in G1 that are not involved in the maximum connected component are removed, and the nodes in the maximum connected component are retained, thus obtaining a compressed code attribute graph. Using the compressed code attribute graph for smart contract reentrancy vulnerability detection can effectively improve the detection efficiency of the reentrancy vulnerability detection model.

[0084] In one embodiment, adding edges to isolated function nodes in the partitioned code attribute graph based on the starting function nodes and pointing function nodes of the key control flow edges and the key data flow edges in step S312 may include:

[0085] S3121: Determine multiple starting function nodes and multiple pointing function nodes based on the key control flow edge and the key data flow edge.

[0086] S3122: For each starting function node, connect the isolated function nodes in the partitioned code attribute graph that are the same as the starting function node and the pointing function nodes associated with the starting function node to form edges representing the association between the isolated function nodes.

[0087] In this embodiment, when adding edges to isolated function nodes in the partitioned code attribute graph, multiple starting function nodes and multiple pointing function nodes can be determined based on key control flow edges and key data flow edges. Then, isolated function nodes in the partitioned code attribute graph that are the same as each starting function node and the pointing function node associated with that starting function node can be connected to form edges representing the association between isolated function nodes.

[0088] For example, when the starting function node of the critical control flow edge and the critical data flow edge is f1 and the pointing function node is f2, an edge (f1, f2) can be added to the compressed code attribute graph to add edges to the compressed code attribute graph.

[0089] In one embodiment, determining the raw control flow information and raw data flow information of the abstract syntax tree in S110 may include:

[0090] S111: Traverse the abstract syntax tree to determine the function names and function call information defined in the abstract syntax tree, as well as the variable names and variable call and assignment information.

[0091] S112: Determine the original control flow information of the abstract syntax tree based on the function names and function call information defined in the abstract syntax tree.

[0092] S113: Determine the original data flow information of the abstract syntax tree based on the variable names and variable call and assignment information defined in the abstract syntax tree.

[0093] In this embodiment, when determining the original control flow information and original data flow information of the abstract syntax tree, the abstract syntax tree can be traversed first, and two lists can be maintained during the traversal: one is the function names defined in the smart contract, and the other is the variable names defined in the smart contract. For example, a smart contract has the following function definitions:

[0094] Contract{

[0095] int var = 0

[0096] function foo(){var=1}

[0097] function bar(){foo()}

[0098] }

[0099] At this point, we can use a list [foo, bar] to record the functions foo and bar defined in the smart contract, and a list [var] to record the variables var defined in the smart contract.

[0100] Since nodes in the Abstract Syntax Tree (ABST) are composed of (node ​​name, node type), such as a function call corresponding to a node of type "function call", when traversing the ABST, if a function call node is encountered, the corresponding function name and function call information, i.e., the original control flow information, can be found. This allows the construction of an original control flow edge, where the starting node is the corresponding (function name, function definition) node, and the ending node is the same (function name, function call) node. Therefore, the original control flow edge only involves the function definition and call nodes, and is unrelated to variable nodes. Furthermore, since a smart contract may contain multiple calls to a function, a single function definition can correspond to multiple original control flow edges.

[0101] Furthermore, in this application, the original data flow information is mainly determined by the variable names and variable call and assignment information defined in the abstract syntax tree. In addition, for the construction of the original data flow edges, similar to the original control flow edges of function calls, this application can construct the edges in the AST corresponding to the (variable name, variable definition) node to the (variable name, variable assignment) node to obtain the original data flow edges.

[0102] In one embodiment, step S120 involves filtering the original control flow information and the original data flow information using a pre-built reentrancy vulnerability keyword library to obtain key control flow information and key data flow information, which may include:

[0103] S121: Compare each keyword in the pre-built reentrancy vulnerability keyword library with the function names in the original control flow information and the variable names in the original data flow information.

[0104] S122: The original control flow information corresponding to the function name that overlaps with the keyword is taken as the key control flow information, and the original data flow information corresponding to the variable name that overlaps with the keyword is taken as the key data flow information.

[0105] In this embodiment, when filtering the original control flow information and original data flow information, a pre-built reentrancy vulnerability keyword library can be used. Specifically, this application can pre-construct a keyword library based on the characteristics of smart contract reentrancy vulnerabilities. This keyword library can contain keywords related to transfers, balances, etc., specifically including {balance, value, transfer, send, token…}. Then, the abstract syntax tree can be traversed to obtain the function names and variable names in the smart contract. Each keyword in the keyword library is then compared with the function names in the original control flow information and the variable names in the original data flow information. The keywords in the keyword library are used to filter out key functions and key variables whose names contain these keywords, and the control flow and data flow information involving key functions and key variables are extracted to obtain key control flow information and key data flow information.

[0106] In one embodiment, S130, based on the key control flow information and the key data flow information, adds key control flow edges and key data flow edges to the abstract syntax tree to form a code attribute graph, which may include:

[0107] S131: Determine the starting function node and the pointing function node in the key control flow information, and add key control flow edges on the abstract syntax tree according to the starting function node and the pointing function node in the key control flow information.

[0108] S132: Determine the starting function node and the pointing function node in the key data flow information, and add key data flow edges on the abstract syntax tree according to the starting function node and the pointing function node in the key data flow information.

[0109] S133: Form a code property graph based on the abstract syntax tree after adding key control flow edges and key data flow edges.

[0110] In this embodiment, during the process of adding key control flow edges and key data flow edges to the abstract syntax tree and forming a code attribute graph, this application can simultaneously or sequentially determine the starting function node and the pointing function node in the key control flow information, as well as the starting function node and the pointing function node in the key data flow information, and add key control flow edges and key data flow edges to the abstract syntax tree based on the starting function node and the pointing function node, thereby forming a code attribute graph.

[0111] Indicatively, such as Figure 4 As shown, Figure 4 This is a schematic diagram of the code attribute graph formed after adding key control flow edges and key data flow edges, as provided in an embodiment of this application. Figure 4In the key control flow information, the starting function node is FuncDef:transferIn, and the pointing function node is FuncCall:transferIn. Thus, a key control flow edge from FuncDef:transferIn to FuncCall:transferIn can be constructed. In the key data flow information, the starting function node is Decl:balance, and the pointing function node is Asset:balance. Thus, a key data flow edge from Decl:balance to Asset:balance can be constructed, and a code attribute graph is formed on this basis.

[0112] The smart contract reentrancy vulnerability detection device provided in the embodiments of this application is described below. The smart contract reentrancy vulnerability detection device described below and the smart contract reentrancy vulnerability detection method described above can be referred to in correspondence with each other.

[0113] In one embodiment, such as Figure 5 As shown, Figure 5 This application provides a schematic diagram of the structure of a smart contract reentrancy vulnerability detection device according to an embodiment of the present application; the present application also provides a smart contract reentrancy vulnerability detection device, which may include:

[0114] The original information determination module 210 is used to construct an abstract syntax tree corresponding to the source code of the smart contract to be detected, and to determine the original control flow information and original data flow information of the abstract syntax tree.

[0115] The key information determination module 220 is used to filter the original control flow information and the original data flow information using a pre-built reentrancy vulnerability keyword library to obtain key control flow information and key data flow information.

[0116] The code attribute graph construction module 230 is used to add key control flow edges and key data flow edges to the abstract syntax tree based on the key control flow information and the key data flow information to form a code attribute graph.

[0117] The reentrancy vulnerability detection module 240 is used to input the code attribute graph into a pre-configured reentrancy vulnerability detection model, obtain the detection result output by the reentrancy vulnerability detection model, and determine whether the smart contract source code contains a reentrancy vulnerability based on the detection result.

[0118] In the above embodiments, when detecting whether a smart contract source code contains a reentrancy vulnerability, an abstract syntax tree corresponding to the source code of the smart contract to be detected can be constructed first. Then, the original control flow information and original data flow information of the abstract syntax tree are determined. Since the original control flow information and original data flow information are determined based on the abstract syntax tree, the relationship between control flow and data flow across functions is considered, thus avoiding erroneous detection results caused by cross-function information. Furthermore, before performing reentrancy vulnerability detection, this application can also use a pre-built reentrancy vulnerability keyword library to filter the original control flow information and original data flow information, so that the filtered key control flow information and key data flow information contain multiple types of functions, rather than relying on the traditional single keyword pattern. This allows the detection method of this application to be applied to the reentrancy vulnerability detection of any smart contract. In addition, this application can also form a code attribute graph based on the key control flow information and key data flow information, and use a reentrancy vulnerability detection model to detect the code attribute graph. Based on the detection results, it can determine whether the smart contract source code contains a reentrancy vulnerability, thus obtaining more accurate detection results.

[0119] In one embodiment, this application also provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the smart contract reentrancy vulnerability detection method as described in any of the above embodiments.

[0120] In one embodiment, this application also provides a computer device, including: one or more processors, and memory.

[0121] The memory stores computer-readable instructions, which, when executed by the one or more processors, perform the steps of the smart contract reentrancy vulnerability detection method as described in any of the above embodiments.

[0122] Indicatively, such as Figure 6 As shown, Figure 6 This is a schematic diagram of the internal structure of a computer device 300 provided in an embodiment of this application. The computer device 300 can be provided as a server. (Refer to...) Figure 6 The computer device 300 includes a processing component 302, which further includes one or more processors, and memory resources represented by memory 301 for storing instructions, such as applications, that can be executed by the processing component 302. The applications stored in memory 301 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 302 is configured to execute instructions to perform the smart contract reentrancy vulnerability detection method of any of the above embodiments.

[0123] The computer device 300 may also include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate on an operating system stored in memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or similar.

[0124] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0125] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0126] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0127] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting smart contract reentrancy vulnerabilities, characterized in that, The method comprises: constructing an abstract syntax tree corresponding to the smart contract source code to be detected, and determining original control flow information and original data flow information of the abstract syntax tree; wherein the original control flow information comprises function internal control flow information and cross-function control flow information, and the original data flow information comprises function internal data flow information and cross-function data flow information; screening the original control flow information and the original data flow information by using a pre-constructed reentrant vulnerability keyword library to obtain key control flow information and key data flow information; adding key control flow edges and key data flow edges on the abstract syntax tree according to the key control flow information and the key data flow information to form a code property graph; inputting the code property graph into a pre-configured reentrant vulnerability detection model to obtain a detection result output by the reentrant vulnerability detection model, and determining whether the smart contract source code contains a reentrant vulnerability according to the detection result; the screening of the original control flow information and the original data flow information by using the pre-constructed reentrant vulnerability keyword library to obtain the key control flow information and the key data flow information comprises: comparing each keyword in the pre-constructed reentrant vulnerability keyword library with function names in the original control flow information and variable names in the original data flow information, respectively; taking the original control flow information corresponding to the function names coinciding with the keywords as the key control flow information, and taking the original data flow information corresponding to the variable names coinciding with the keywords as the key data flow information.

2. The method of claim 1, wherein, Before the inputting of the code property graph into the pre-configured reentrant vulnerability detection model, the method further comprises: compressing the code property graph to obtain a compressed code property graph; wherein the number of smart contract function nodes in the compressed code property graph is less than that in the code property graph before compression.

3. The method of claim 2, wherein, the compression of the code property graph to obtain the compressed code property graph comprises: dividing the code property graph according to smart contract function granularity to obtain a divided code property graph, wherein the divided code property graph is a plurality of isolated function nodes without any edge; adding edges to the isolated function nodes in the divided code property graph according to the starting function nodes and the pointing function nodes of the key control flow edges and the key data flow edges to obtain an edge-added code property graph; calculating connected components of the edge-added code property graph, and determining the compressed code property graph according to the largest connected component in the calculated connected components.

4. The method of claim 3, wherein, the adding of edges to the isolated function nodes in the divided code property graph according to the starting function nodes and the pointing function nodes of the key control flow edges and the key data flow edges comprises: determining a plurality of starting function nodes and a plurality of pointing function nodes according to the key control flow edges and the key data flow edges; For each start function node, connect the same isolated function nodes in the divided code attribute graph as the start function node and the function nodes associated with the start function node to form edges representing the association between the isolated function nodes.

5. The method according to any one of claims 1-4, characterized in that, The determining of the original control flow information and the original data flow information of the abstract syntax tree comprises: traversing the abstract syntax tree to determine the function name and function call information defined in the abstract syntax tree, and the variable name and variable call and assignment information; determining the original control flow information of the abstract syntax tree according to the function name and function call information defined in the abstract syntax tree; determining the original data flow information of the abstract syntax tree according to the variable name and variable call and assignment information defined in the abstract syntax tree.

6. The method according to any one of claims 1-4, characterized in that, The adding of the key control flow edges and the key data flow edges on the abstract syntax tree according to the key control flow information and the key data flow information to form a code attribute graph comprises: determining the start function node and the function node in the key control flow information, and adding key control flow edges on the abstract syntax tree according to the start function node and the function node in the key control flow information; determining the start function node and the function node in the key data flow information, and adding key data flow edges on the abstract syntax tree according to the start function node and the function node in the key data flow information; forming a code attribute graph according to the abstract syntax tree after adding the key control flow edges and the key data flow edges. 7.A smart contract re-entrancy vulnerability detection apparatus characterized by comprising: Comprise: An original information determination module is configured to construct an abstract syntax tree corresponding to the smart contract source code to be detected, and determine original control flow information and original data flow information of the abstract syntax tree; wherein the original control flow information comprises function internal control flow information and cross-function control flow information, and the original data flow information comprises function internal data flow information and cross-function data flow information; A key information determination module is configured to filter the original control flow information and the original data flow information by using a pre-constructed reentrant vulnerability keyword library to obtain key control flow information and key data flow information; A code attribute graph construction module is configured to add key control flow edges and key data flow edges on the abstract syntax tree according to the key control flow information and the key data flow information to form a code attribute graph; A reentrant vulnerability detection module is configured to input the code attribute graph into a pre-configured reentrant vulnerability detection model to obtain a detection result output by the reentrant vulnerability detection model, and determine whether the smart contract source code contains a reentrant vulnerability according to the detection result. The key information determination module comprises: Each keyword in the pre-constructed reentrant vulnerability keyword library is compared with the function name in the original control flow information and the variable name in the original data flow information, respectively; The original control flow information corresponding to the function name coinciding with the keyword is taken as the key control flow information, and the original data flow information corresponding to the variable name coinciding with the keyword is taken as the key data flow information.

8. A storage medium characterized by: The storage medium has computer readable instructions stored therein, which, when executed by one or more processors, cause the one or more processors to perform the steps of the smart contract re-entrant vulnerability detection method of any one of claims 1 to 6.

9. A computer device, comprising: Comprise: one or more processors, and a memory; The memory has computer readable instructions stored therein, which, when executed by the one or more processors, perform the steps of the smart contract re-entrant vulnerability detection method of any one of claims 1 to 6.

Images