Method and application of smart contract vulnerability detection based on abstract syntax tree

Abstract

The present invention discloses a method and application of smart contract vulnerability detection based on an abstract syntax tree, the method comprising: performing lexical analysis and syntax analysis on the source code of the smart contract to construct an abstract syntax tree of the source code; traversing the abstract syntax tree to supplement the node information of the abstract syntax tree, and extracting the control flow graph and read-write variable information of the smart contract from the supplemented abstract syntax tree; obtaining the execution path set of the smart contract according to the control flow graph, and obtaining the data flow analysis result of the smart contract according to the read-write variable information; customizing a vulnerability detector according to the data flow analysis result and the abstract syntax tree, and applying the vulnerability detector to each path of the execution path set; traversing the abstract syntax tree to obtain the detection result of the vulnerability detector, and inputting the detection result into a JSON file. The method can discover vulnerabilities in smart contracts and ensure the security of smart contract development.

Description

Technical Field

[0001] The present invention relates to the field of vulnerability detection, and in particular to a method and application of smart contract vulnerability detection based on an abstract syntax tree. Background Art

[0002] A smart contract is an automated processing program of a traditional contract implemented in the form of computer instructions, which is designed to disseminate, verify or execute the computer protocol of the contract in an information-based manner. The overall goal of smart contract design is to meet the contract conditions and minimize the reliance on trusted intermediaries. In recent years, a number of smart contract platforms represented by Ethereum have developed rapidly. As the most popular smart contract platform, Ethereum has more than 100 million addresses and a total market value of more than 100 billion US dollars by the end of 2020. In addition to opening up a new digital economic business model, smart contracts have been applied in many fields such as digital identity, Internet of Things, supply chain, etc., and also support a wide range of decentralized applications, such as wallets, prediction markets, instant messaging, blogs, crowdfunding, etc., and have broad prospects.

[0003] Smart contracts, like traditional software programs, may also have vulnerabilities in their codes. Due to the huge amount of digital assets associated with smart contracts and their irreversibility, vulnerabilities in their codes are easy to be attacked, which will cause varying degrees of digital asset losses and may have catastrophic consequences.

[0004] With the development of smart contract technology and the increase in its application fields, more and more security vulnerabilities have been discovered and exploited by attackers, giving rise to a number of studies on the ecological security of smart contracts, including security vulnerability review, design patterns, verification methods and tools, formal specifications and modeling technology, and smart contract platforms and development languages. In order to prevent malicious attackers from exploiting smart contract vulnerabilities, researchers have tried various methods to perform surface analysis on the source code of Ethereum smart contracts and EVM bytecode. The traditional method of program vulnerability detection uses feature matching, that is, extracting and abstracting some malicious codes, and detecting static source code through matching modules.

[0005] The information disclosed in this background technology section is only intended to enhance the understanding of the overall background of the invention and should not be regarded as an acknowledgment or any form of suggestion that the information constitutes the prior art already known to a person skilled in the art. Summary of the invention

[0006] The purpose of the present invention is to provide a method and application for detecting smart contract vulnerabilities based on an abstract syntax tree, so as to solve the problem of code vulnerabilities in smart contracts during the development, testing and maintenance of smart contracts.

[0007] To achieve the above objectives, an embodiment of the present invention provides a method for detecting smart contract vulnerabilities based on an abstract syntax tree.

[0008] In one or more embodiments of the present invention, the method includes: performing lexical analysis and syntax analysis on the source code of the smart contract to construct an abstract syntax tree of the source code; traversing the abstract syntax tree to supplement the node information of the abstract syntax tree, and extracting the control flow graph and read-write variable information of the smart contract from the supplemented abstract syntax tree; obtaining the execution path set of the smart contract according to the control flow graph, and obtaining the data flow analysis result of the smart contract according to the read-write variable information; customizing a vulnerability detector according to the data flow analysis result and the abstract syntax tree, and applying the vulnerability detector to each path of the execution path set; and traversing the abstract syntax tree to obtain the detection result of the vulnerability detector, and inputting the detection result into a JSON file.

[0009] In one or more embodiments of the present invention, the lexical analysis and syntactic analysis of the source code of the smart contract to construct an abstract syntax tree of the source code includes: converting the source code into a character token sequence, wherein the character token sequence includes keywords, identifiers, symbols, and operators; and applying the grammatical rules of the source code to the character token sequence to construct an abstract syntax tree.

[0010] In one or more embodiments of the present invention, traversing the abstract syntax tree to supplement the node information of the abstract syntax tree includes: traversing the abstract syntax tree and saving the node information of the parent node in the abstract syntax tree to the corresponding child node.

[0011] In one or more embodiments of the present invention, an execution path set of the smart contract is obtained according to the control flow graph, and a data flow analysis result of the smart contract is obtained according to the read-write variable information, including: performing a depth-first search on a non-loop version of the control flow graph to obtain all execution paths of the smart contract; performing fixed value arrival and activity analysis on the smart contract according to the read-write variable information to obtain a data flow analysis result; and abstracting the data flow analysis result into a data structure to analyze the complex semantic features of the smart contract.

[0012] In one or more embodiments of the present invention, the formula for reaching the fixed value is: IN n =∪ p∈pred(n) OUT p ,OUT n =GEN n ∪(IN n -KILL n ), where INn and OUT n Respectively represent the inflow and outflow information flows of the current statement of the smart contract, GEN n and KILL n They represent the generation information and killing information of the current statement of the smart contract respectively, and p represents the previous statement of the current statement; and the formula of the activity analysis is: OUT n =∪ s∈suc(n) IN s , IN n =USE n ∪(OUT n -DEF n ), where IN n and OUT n Respectively represent the inflow and outflow information flow of the current statement of the smart contract, USE n and DEF n They represent the variables used and defined in the current statement of the smart contract, and s represents the next statement of the current statement.

[0013] In one or more embodiments of the present invention, the method further includes: when an exception or operation error occurs during the detection process, the log system generates a warning, wherein the warning includes: the exception type, the code line where the exception is caught, the operation information, and the cause of the error.

[0014] In one or more embodiments of the present invention, the detection result includes: the total number of vulnerabilities, the name of the vulnerable contract, the type of vulnerability, and the location of the vulnerability code.

[0015] In another aspect of the present invention, a device for detecting smart contract vulnerabilities based on an abstract syntax tree is provided, which includes a data preprocessing module, an information extraction and analysis module, and a vulnerability detection module.

[0016] A data preprocessing module, used to perform lexical analysis and grammatical analysis on the source code of the smart contract to construct an abstract syntax tree of the source code;

[0017] An information extraction and analysis module, used to traverse the abstract syntax tree to supplement the node information of the abstract syntax tree, and extract the control flow graph and read-write variable information of the smart contract from the supplemented abstract syntax tree; obtain the execution path set of the smart contract according to the control flow graph, and obtain the data flow analysis result of the smart contract according to the read-write variable information; and

[0018] A vulnerability detection module is used to customize a vulnerability detector according to the data flow analysis result and the abstract syntax tree, and apply the vulnerability detector to each path of the execution path set; traverse the abstract syntax tree to obtain the detection result of the vulnerability detector, and input the detection result into a JSON file.

[0019] In one or more embodiments of the present invention, the data preprocessing module is further used to: convert the source code into a character token sequence, wherein the character token sequence includes keywords, identifiers, symbols and operators; and apply the grammatical rules of the source code to the character token sequence to construct an abstract syntax tree.

[0020] In one or more embodiments of the present invention, the information extraction and analysis module is further used to: traverse the abstract syntax tree, and save the node information of the parent node in the abstract syntax tree to the corresponding child node.

[0021] In one or more embodiments of the present invention, the information extraction and analysis module is also used to: perform a depth-first search on the non-loop version of the control flow graph to obtain all execution paths of the smart contract; perform fixed value arrival and activity analysis on the smart contract based on the read-write variable information to obtain data flow analysis results; and abstract the data flow analysis results into a data structure to analyze the complex semantic features of the smart contract.

[0022] In one or more embodiments of the present invention, the information extraction and analysis module is further used to: set the value to: IN n =∪ p∈pred(n) OUT p ,OUT n =GEN n ∪(IN n -KILL n ), where IN n and OUT n Respectively represent the inflow and outflow information flows of the current statement of the smart contract, GEN n and KILL n They represent the generation information and killing information of the current statement of the smart contract respectively, and p represents the previous statement of the current statement; the activity analysis is: OUT n =∪ s∈suc(n) IN s , IN n =USE n ∪(OUT n -DEF n ), where IN n and OUT nRespectively represent the inflow and outflow information flow of the current statement of the smart contract, USE n and DEF n They represent the variables used and defined in the current statement of the smart contract, and s represents the next statement of the current statement.

[0023] In one or more embodiments of the present invention, the vulnerability detection module is also used to: when an exception or operation error occurs during the detection process, the log system generates a warning, wherein the warning includes: the exception type, the code line where the exception is captured, the operation information, and the cause of the error.

[0024] In one or more embodiments of the present invention, the detection result includes: the total number of vulnerabilities, the name of the vulnerable contract, the type of vulnerability, and the location of the vulnerability code.

[0025] In another aspect of the present invention, an electronic device is provided, comprising: at least one processor; and a memory, wherein the memory stores instructions, and when the instructions are executed by the at least one processor, the at least one processor executes the method for smart contract vulnerability detection based on an abstract syntax tree as described above.

[0026] In another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for detecting smart contract vulnerabilities based on an abstract syntax tree are implemented.

[0027] Compared with the prior art, the method and application of smart contract vulnerability detection based on the abstract syntax tree according to the embodiment of the present invention can construct a vulnerability detector with various uses by taking the source code of the smart contract as the starting point and relying on the analysis results of the information extracted from the abstract syntax tree, so as to discover the vulnerabilities in the smart contract, ensure the security of the smart contract development process, and avoid the vulnerability code and the losses caused by it in the development process.

[0028] The method and application of smart contract vulnerability detection based on abstract syntax tree according to the implementation mode of the present invention can also be used for code auditing and optimization to ensure the efficiency and security of the smart contract development process; the method also has high versatility and scalability, and can customize vulnerability detectors based on deep semantic information in the code. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 is a flow chart of a method for detecting smart contract vulnerabilities based on an abstract syntax tree according to an embodiment of the present invention;

[0030] Figure 2is a schematic diagram of a method for detecting smart contract vulnerabilities based on an abstract syntax tree according to an embodiment of the present invention;

[0031] Figure 3 is a structural diagram of a device for detecting smart contract vulnerabilities based on an abstract syntax tree according to an embodiment of the present invention;

[0032] Figure 4 It is a hardware structure diagram of a computing device for smart contract vulnerability detection based on an abstract syntax tree according to one embodiment of the present invention. DETAILED DESCRIPTION

[0033] The specific implementation modes of the present invention are described in detail below in conjunction with the accompanying drawings, but it should be understood that the protection scope of the present invention is not limited by the specific implementation modes.

[0034] Unless explicitly stated otherwise, throughout the specification and claims, the term “comprise” or variations such as “include” or “comprising”, etc., will be understood to include the stated elements or components but not to exclude other elements or components.

[0035] The technical solutions provided by various embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0036] Example 1

[0037] like Figure 1 to Figure 2 As shown, a method for detecting smart contract vulnerabilities based on an abstract syntax tree in an embodiment of the present invention is introduced, and the method includes the following steps.

[0038] In step S101, lexical analysis and grammatical analysis are performed on the source code of the smart contract to construct an abstract syntax tree of the source code.

[0039] Specifically, the source code is converted into a character token sequence, wherein the character token sequence includes keywords, identifiers, symbols and operators; and the grammar rules of the source code are applied to the character token sequence to construct an abstract syntax tree.

[0040] The structure of each node in the abstract syntax tree is (nodeType, nodeInfo, nodeLoc), where nodeType represents the type of the node, nodeInfo represents the child nodes contained in the node and the information of the node, and nodeLoc represents the location of the node in the source code.

[0041] In step S102, the abstract syntax tree is traversed to supplement the node information of the abstract syntax tree, and the control flow graph and read-write variable information of the smart contract are extracted from the supplemented abstract syntax tree.

[0042] By applying different routes on the abstract syntax tree, the required information can be extracted or enriched on the abstract syntax tree. Specifically, the abstract syntax tree is traversed once, and the node information of the parent node in the abstract syntax tree is saved to the corresponding child node, thereby enriching the node information contained in the nodeInfo in the original abstract syntax tree. At the same time, by traversing the abstract syntax tree once, the control flow graph and read-write variable information of the smart contract are also extracted. The control flow graph is an abstract representation of a process or program. It is an abstract data structure used in the compiler, which is maintained internally by the compiler and represents all the paths that will be traversed during the execution of a program. It represents the possible flow of execution of all basic blocks in a process in the form of a graph, and can also reflect the real-time execution process of a process.

[0043] By traversing the abstract syntax tree, the control flow graph and read-write variable information of the extracted smart contract can also be expanded to enhance the analysis ability and flexibility of the abstract syntax tree. The above process of enriching node information, extracting the control flow graph and read-write variable information of the smart contract, and expanding the control flow graph and read-write variable information of the extracted smart contract can be achieved by traversing the abstract syntax tree only once.

[0044] In step S103, the execution path set of the smart contract is obtained according to the control flow graph, and the data flow analysis result of the smart contract is obtained according to the read and write variable information.

[0045] By performing a depth-first search on the non-loop version of the control flow graph, all execution paths of the smart contract are obtained. According to the read-write variable information, the smart contract is analyzed for fixed value arrival and activity to obtain the data flow analysis results; and the data flow analysis results are abstracted into multiple data structures to analyze the complex semantic features of the smart contract.

[0046] The formula for reaching the set value is: IN n =∪ p∈pred(n) OUT p ,OUT n =GEN n ∪(IN n -KILL n ), where IN n and OUT n Respectively represent the inflow and outflow information flow of the current statement of the smart contract, GEN n and KILL n They represent the information generated and killed by the current statement of the smart contract respectively, and p represents the previous statement of the current statement of the smart contract.

[0047] The formula for activity analysis is: OUT n =∪ s∈suc(n) IN s , IN n=USE n ∪(OUT n -DEF n ), where IN n and OUT n Respectively represent the inflow and outflow information flow of the current statement of the smart contract, USE n and DEF n They represent the variables used and defined in the current statement of the smart contract, and s represents the next statement of the current statement of the smart contract.

[0048] In step S104, a vulnerability detector is customized according to the data flow analysis result and the abstract syntax tree, and the vulnerability detector is applied to each path in the execution path set.

[0049] A vulnerability detector is customized based on the data flow analysis results and the information provided by the abstract syntax tree to detect abnormal behavior in smart contracts. The constructed multiple vulnerability detectors are applied to each path in the smart contract execution path set. The vulnerability detector can be constructed based on the three levels of operators, statements, and functions of the abstract syntax tree, or it can be constructed with the help of the results of fixed value arrival and activity analysis. Finally, the vulnerability detector set will be applied to each path in the program execution path set. This embodiment eliminates the false positive problem caused by unreachable paths in the sequence statements of the smart contract by traversing each path in the execution path set, rather than detecting on the sequence statements of the smart contract.

[0050] In step S105, the abstract syntax tree is traversed to obtain the detection result of the vulnerability detector, and the detection result is input into a JSON file.

[0051] By traversing the abstract syntax tree once, the detection results of all vulnerability detectors can be obtained and input into a JSON file. The detection results include but are not limited to: the total number of vulnerabilities, the name of the vulnerable contract, the type of vulnerability, and the location of the vulnerability code.

[0052] In addition, exceptions and errors that occur during the operation of the vulnerability detector will also be recorded in a timely manner. If the vulnerability detector encounters a corresponding exception or runtime error during the detection process, the log system will generate a warning. The warning content includes but is not limited to: the type name of the exception, the line of code where the exception is caught, the operation information, and the cause of the SolChecker error. This warning can facilitate exception investigation, smart contract debugging, and framework optimization.

[0053] like Figure 3 As shown, a device for detecting smart contract vulnerabilities based on an abstract syntax tree according to a specific embodiment of the present invention is introduced.

[0054] In an embodiment of the present invention, the device for smart contract vulnerability detection based on abstract syntax tree includes a data preprocessing module 301, an information extraction and analysis module 302 and a vulnerability detection module 303.

[0055] The data preprocessing module 301 is used to perform lexical analysis and grammatical analysis on the source code of the smart contract to construct an abstract syntax tree of the source code.

[0056] The information extraction and analysis module 302 is used to traverse the abstract syntax tree to supplement the node information of the abstract syntax tree, and extract the control flow graph and read-write variable information of the smart contract from the supplemented abstract syntax tree; obtain the execution path set of the smart contract according to the control flow graph, and obtain the data flow analysis result of the smart contract according to the read-write variable information.

[0057] The vulnerability detection module 303 is used to customize the vulnerability detector according to the data flow analysis results and the abstract syntax tree, and apply the vulnerability detector to each path in the execution path set; traverse the abstract syntax tree to obtain the detection results of the vulnerability detector, and input the detection results into a JSON file.

[0058] The data preprocessing module 301 is further used to: convert the source code into a character token sequence, wherein the character token sequence includes keywords, identifiers, symbols and operators; and apply the grammar rules of the source code to the character token sequence to construct an abstract syntax tree.

[0059] The information extraction and analysis module 302 is further used to traverse the abstract syntax tree and save the node information of the parent node in the abstract syntax tree to the corresponding child node.

[0060] The information extraction and analysis module 302 is also used to: perform a depth-first search on the non-loop version of the control flow graph to obtain all execution paths of the smart contract; perform fixed value arrival and activity analysis on the smart contract based on the read and write variable information to obtain data flow analysis results; and abstract the data flow analysis results into a data structure to analyze the complex semantic features of the smart contract.

[0061] The information extraction and analysis module 302 is also used to: set the value to: IN n =∪ p∈pred(n) OUT p ,OUT n =GEN n ∪(IN n -KILL n ), where IN n and OUT n Respectively represent the inflow and outflow information flow of the current statement of the smart contract, GEN n and KILL nThey represent the generation and killing information of the current statement of the smart contract respectively, and p represents the previous statement of the current statement; the activity analysis is: OUT n =∪ s∈suc(n) IN s , IN n =USE n ∪(OUT n -DEF n ), where IN n and OUT n Respectively represent the inflow and outflow information flow of the current statement of the smart contract, USE n and DEF n They represent the variables used and defined in the current statement of the smart contract, and s represents the next statement of the current statement.

[0062] The vulnerability detection module 303 is also used to generate a warning in the log system when an exception or operation error occurs during the detection process, wherein the warning includes: the exception type, the code line where the exception is caught, the operation information, and the cause of the error.

[0063] In this embodiment, the detection results include: the total number of vulnerabilities, the name of the vulnerable contract, the type of vulnerability, and the location of the vulnerability code.

[0064] Figure 4 FIG. 4 shows a hardware structure diagram of a computing device 40 for detecting smart contract vulnerabilities based on an abstract syntax tree according to an embodiment of the present specification. Figure 4 As shown, the computing device 40 may include at least one processor 401, a memory 402 (e.g., a non-volatile memory), a memory 403, and a communication interface 404, and the at least one processor 401, the memory 402, the memory 403, and the communication interface 404 are connected together via a bus 405. At least one processor 401 executes at least one computer-readable instruction stored or encoded in the memory 402.

[0065] It should be understood that the computer executable instructions stored in the memory 402, when executed, cause at least one processor 401 to perform the above combined operations in various embodiments of the present specification. Figure 1-4 Describes the various operations and functions.

[0066] In the embodiments of the present specification, the computing device 40 may include, but is not limited to, a personal computer, a server computer, a workstation, a desktop computer, a laptop computer, a notebook computer, a mobile computing device, a smart phone, a tablet computer, a cellular phone, a personal digital assistant (PDA), a handheld device, a messaging device, a wearable computing device, a consumer electronic device, and the like.

[0067] According to one embodiment, a program product such as a machine-readable medium is provided. The machine-readable medium may have instructions (i.e., the above-mentioned elements implemented in the form of software), which, when executed by a machine, causes the machine to perform the above-mentioned combination of various embodiments of this specification. Figure 1-4 Specifically, a system or device equipped with a readable storage medium may be provided, on which a software program code implementing the functions of any of the above-mentioned embodiments is stored, and a computer or processor of the system or device reads and executes the instructions stored in the readable storage medium.

[0068] According to the method and application of smart contract vulnerability detection based on abstract syntax tree according to the embodiment of the present invention, it can construct a vulnerability detector with various uses by taking the source code of the smart contract as the starting point and relying on the analysis results of the information extracted from the abstract syntax tree, so as to discover the vulnerabilities in the smart contract, ensure the security of the smart contract development process, and avoid the vulnerability code and the losses caused by it in the development process.

[0069] The method and application of smart contract vulnerability detection based on abstract syntax tree according to the implementation mode of the present invention can also be used for code auditing and optimization to ensure the efficiency and security of the smart contract development process; the method also has high versatility and scalability, and can customize vulnerability detectors based on deep semantic information in the code.

[0070] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0071] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0072] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0073] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0074] The foregoing description of specific exemplary embodiments of the present invention is for the purpose of illustration and demonstration. These descriptions are not intended to limit the present invention to the precise form disclosed, and it is clear that many changes and variations can be made based on the above teachings. The purpose of selecting and describing the exemplary embodiments is to explain the specific principles of the present invention and its practical application, so that those skilled in the art can realize and utilize various different exemplary embodiments of the present invention and various different selections and changes. The scope of the present invention is intended to be limited by the claims and their equivalents.

Claims

1. A method for detecting smart contract vulnerabilities based on an abstract syntax tree, characterized in that: The method comprises: Performing lexical analysis and grammatical analysis on the source code of the smart contract to construct an abstract syntax tree of the source code; Traversing the abstract syntax tree to supplement the node information of the abstract syntax tree, and extracting the control flow graph and read-write variable information of the smart contract from the supplemented abstract syntax tree; Acquire an execution path set of the smart contract according to the control flow graph, and acquire a data flow analysis result of the smart contract according to the read-write variable information; customizing a vulnerability detector according to the data flow analysis result and the abstract syntax tree, and applying the vulnerability detector to each path in the execution path set; and Traversing the abstract syntax tree to obtain detection results of the vulnerability detector, and inputting the detection results into a JSON file; Acquiring an execution path set of the smart contract according to the control flow graph, and acquiring a data flow analysis result of the smart contract according to the read-write variable information, including: performing a depth-first search on a non-loop version of the control flow graph to obtain all execution paths of the smart contract; performing a fixed value arrival and activity analysis on the smart contract according to the read-write variable information to obtain a data flow analysis result; and abstracting the data flow analysis result into a data structure to analyze the complex semantic features of the smart contract; The formula for reaching the set value is: IN n =∪ p∈pred(n) OUT p ,OUT n =GEN n ∪(IN n -KILL n ), where IN n and OUT n Respectively represent the inflow and outflow information flows of the current statement of the smart contract, GEN n and KILL n Respectively represent the generation information and killing information of the current statement of the smart contract, and p represents the previous statement of the current statement; and The formula for the activity analysis is: OUT n =∪ s∈suc(n) IN s , IN n =USE n ∪(OUT n -DEF n ), where IN n and OUT n Respectively represent the inflow and outflow information flow of the current statement of the smart contract, USE n and DEF n They represent the variables used and defined in the current statement of the smart contract, and s represents the next statement of the current statement.

2. The method for detecting smart contract vulnerabilities based on an abstract syntax tree as claimed in claim 1, characterized in that: The lexical analysis and grammatical analysis of the source code of the smart contract to construct an abstract syntax tree of the source code includes: converting the source code into a sequence of character tokens, wherein the sequence of character tokens includes keywords, identifiers, symbols, and operators; and The grammar rules of the source code are applied to the character token sequence to construct an abstract syntax tree.

3. The method for detecting smart contract vulnerabilities based on an abstract syntax tree as claimed in claim 1, characterized in that: Traversing the abstract syntax tree to supplement node information of the abstract syntax tree includes: The abstract syntax tree is traversed, and node information of a parent node in the abstract syntax tree is saved in a corresponding child node.

4. The method for detecting smart contract vulnerabilities based on an abstract syntax tree as claimed in claim 1, characterized in that: The method further comprises: When an exception or a running error occurs during the detection process, the log system generates a warning, wherein the warning includes: the exception type, the line of code where the exception is caught, the running information, and the cause of the error.

5. The method for detecting smart contract vulnerabilities based on an abstract syntax tree as claimed in claim 1, characterized in that: The detection results include: the total number of vulnerabilities, the name of the vulnerable contract, the type of vulnerability, and the location of the vulnerability code.

6. A device for detecting smart contract vulnerabilities based on an abstract syntax tree, characterized in that: The device comprises: A data preprocessing module, used to perform lexical analysis and grammatical analysis on the source code of the smart contract to construct an abstract syntax tree of the source code; An information extraction and analysis module, used to traverse the abstract syntax tree to supplement the node information of the abstract syntax tree, and extract the control flow graph and read-write variable information of the smart contract from the supplemented abstract syntax tree; obtain the execution path set of the smart contract according to the control flow graph, and obtain the data flow analysis result of the smart contract according to the read-write variable information; and A vulnerability detection module, configured to customize a vulnerability detector according to the data flow analysis result and the abstract syntax tree, and apply the vulnerability detector to each path of the execution path set; traverse the abstract syntax tree to obtain a detection result of the vulnerability detector, and input the detection result into a JSON file; The step of obtaining the execution path set of the smart contract according to the control flow graph and obtaining the data flow analysis result of the smart contract according to the read-write variable information includes: performing a depth-first search on the non-loop version of the control flow graph to obtain all execution paths of the smart contract; performing fixed value arrival and activity analysis on the smart contract according to the read-write variable information to obtain a data flow analysis result; and abstracting the data flow analysis result into a data structure to analyze the complex semantic features of the smart contract. The formula for reaching the set value is: IN n =∪ p∈pred(n) OUT p ,OUT n =GEN n ∪(IN n -KILL n ), where IN n and OUT n Respectively represent the inflow and outflow information flows of the current statement of the smart contract, GEN n and KILL n Respectively represent the generation information and killing information of the current statement of the smart contract, and p represents the previous statement of the current statement; and The formula for the activity analysis is: OUT n =U s∈suc(n) IN s , IN n =USE n ∪(OUT n -DEF n ), where IN n and OUT n Respectively represent the inflow and outflow information flow of the current statement of the smart contract, USE n and DEF n They represent the variables used and defined in the current statement of the smart contract, and s represents the next statement of the current statement.

7. An electronic device, characterized in that: include: at least one processor; as well as A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute the method for detecting smart contract vulnerabilities based on an abstract syntax tree as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the method for detecting smart contract vulnerabilities based on an abstract syntax tree as described in any one of claims 1 to 5 are implemented.

Images