Defi project vulnerability detection method, device and equipment and readable storage medium

Abstract

The application discloses a DeFi project vulnerability detection method, device and equipment and a readable storage medium. The method comprises the following steps: firstly, determining the source code of a target DeFi project to be detected according to a target address, and then determining a pollution convergence point of the source code; if the target DeFi project needs to call a price query function of a third-party DeFi project, the price query function of the third-party DeFi project is taken as a pollution source; and it is judged whether a pollution source variable related to the pollution source can be transmitted from the pollution source to the pollution convergence point; if yes, the target address, the pollution convergence point, the pollution source and the pollution source variable are taken as vulnerability data of the target DeFi project and are output. Obviously, the application judges whether a vulnerability risk will be caused according to whether the DeFi project needs to call the price query function of the third-party DeFi project, realizes detection of the vulnerability before an attack, thereby avoiding losses, and compared with the prior art, the application can further avoid further expansion of the losses caused by the attack after the attack, and has more practical significance.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, and more specifically, to a method, apparatus, device, and readable storage medium for detecting vulnerabilities in DeFi projects. Background Technology

[0002] Decentralized finance (DeFi) is a type of virtual currency financial service implemented through smart contracts written on a blockchain.

[0003] With the development of decentralized finance (DeFi), attacks on DeFi projects have become increasingly profitable. The uncollateralized nature of flash loans means that using them as attack funds is costless, leading to a surge in flash loan attacks on DeFi projects, with each attack resulting in increasingly severe losses. Flash loan attacks often exploit the dependence of some DeFi projects on insecure price lookup services provided by other DeFi projects. By manipulating the price lookup services provided by these projects, they distort the cryptocurrency trading prices of certain DeFi projects, thereby engaging in malicious arbitrage and ultimately achieving their attack goals. Current technology typically detects and analyzes flash loan attacks after they have occurred, but lacks preventative detection methods to prevent attacks from happening in the first place.

[0004] Therefore, how to conduct comprehensive and effective preventative testing of DeFi projects before they are attacked, eliminate vulnerabilities, and thus avoid losses is a problem worth studying. Summary of the Invention

[0005] In view of this, this application provides a method, apparatus, device and readable storage medium for detecting vulnerabilities in DeFi projects, which can be used to conduct comprehensive and effective preventive detection of DeFi projects before they are attacked, eliminate vulnerabilities and avoid losses.

[0006] To achieve the above objectives, the proposed solution is as follows:

[0007] A method for detecting vulnerabilities in DeFi projects, including:

[0008] Obtain the target address of the target DeFi project to be detected and determine the taint convergence point of the target address;

[0009] Obtain the target source code of the target DeFi project at the target address from a pre-established source code repository, which contains the addresses and source code of pre-entered DeFi projects.

[0010] Determine whether the target source code needs to call the price query function of a third-party DeFi project;

[0011] If so, the price query function of the third-party DeFi project will be identified as the source of contamination.

[0012] Determine whether the pollution source variable introduced by the pollution source can propagate to the pollution convergence point;

[0013] If possible, the target address, the taint aggregation point, the taint source, and the taint source variable will be used as the vulnerability data of the target DeFi project, and the vulnerability data will be output.

[0014] Preferably, it further includes:

[0015] The third-party DeFi project is used as the new target DeFi project, the address of the third-party DeFi project is used as the new target address, and the taint convergence point of the new target address is determined.

[0016] Perform the step of obtaining the target source code of the target DeFi project from the pre-established source code repository.

[0017] Preferably, determining the taint convergence point of the target address includes:

[0018] The currency settlement function of the target DeFi project is determined as the taint convergence point of the target address.

[0019] Preferably, determining the taint convergence point of the new target address includes:

[0020] The price query function of the third-party DeFi project is determined as the taint convergence point of the new target address.

[0021] Preferably, the process of establishing the source code library includes:

[0022] Obtain the addresses and source code of multiple DeFi projects from the smart contract open-source library;

[0023] For each DeFi project, a source code repository is created, using the project's address as an index and its source code as an index value.

[0024] Preferably, before obtaining the target source code of the target DeFi project from the pre-established source code repository, the method further includes:

[0025] If the target source code of the target DeFi project at the target address is not found in the source code repository, the target source code is obtained from the smart contract open source library and updated to the source code repository.

[0026] Preferably, determining whether the pollution source variable introduced by the pollution source can propagate to the confluence point of the contamination includes:

[0027] Identify suspected variables related to the pollution source variables;

[0028] Determine whether the pollution source variable and the suspected variable can propagate to the pollution convergence point.

[0029] A DeFi project vulnerability detection device, comprising:

[0030] The target data determination unit is used to obtain the target address of the target DeFi project to be detected and determine the taint convergence point of the target address;

[0031] The source code acquisition unit is used to acquire the target source code of the target DeFi project at the target address from a pre-established source code library, wherein the source code library contains the addresses and source code of pre-entered DeFi projects.

[0032] The judgment unit is invoked to determine whether the target source code needs to call the price query function of a third-party DeFi project;

[0033] The pollution source determination unit is used to determine the price query function of the third-party DeFi project as a pollution source if the target source code needs to call the price query function of the third-party DeFi project.

[0034] A propagation determination unit is used to determine whether the pollution source variable introduced by the pollution source can propagate to the pollution convergence point;

[0035] The vulnerability output unit is used to output the vulnerability data as the target address, the taint aggregation point, the pollution source, and the pollution source variable as vulnerability data of the target DeFi project if the pollution source variable related to the pollution source can propagate from the pollution source to the taint aggregation point.

[0036] A DeFi project vulnerability detection device, including a memory and a processor;

[0037] The memory is used to store programs;

[0038] The processor is used to execute the program to implement the various steps of the above-mentioned DeFi project vulnerability detection method.

[0039] A readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the various steps of the aforementioned DeFi project vulnerability detection method.

[0040] As can be seen from the above scheme, the DeFi project vulnerability detection method provided in this application is a preventive detection method. It can first determine the source code of the target DeFi project to be detected based on the target address, and then determine the taint aggregation point of the source code. If the target DeFi project needs to call the price query function of a third-party DeFi project, the price query function of the third-party DeFi project can be used as the taint source. It can also be determined whether the taint source variable related to the taint source can propagate from the taint source to the taint aggregation point. If so, the target address, taint aggregation point, taint source and taint source variable can be output as the vulnerability data of the target DeFi project.

[0041] Clearly, this application can determine whether a vulnerability risk will arise based on whether the DeFi project needs to call the price query function of a third-party DeFi project. It achieves vulnerability detection before an attack, thereby avoiding losses. Compared with existing technologies that detect vulnerabilities after an attack occurs and can only prevent the further expansion of losses caused by the attack, this is more practical. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0043] Figure 1 A flowchart illustrating a DeFi project vulnerability detection method provided in this application embodiment;

[0044] Figure 2 A flowchart illustrating another DeFi project vulnerability detection method provided in this application embodiment;

[0045] Figure 3 This is a schematic diagram of the structure of a DeFi project vulnerability detection device disclosed in an embodiment of this application;

[0046] Figure 4 This is a hardware structure block diagram of a DeFi project vulnerability detection device disclosed in an embodiment of this application. Detailed Implementation

[0047] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] The following section provides a detailed description of the DeFi project vulnerability detection methods described in this application. Please refer to [link / reference]. Figure 1 , Figure 1 This is a flowchart illustrating a DeFi project vulnerability detection method provided in this application embodiment. The method includes:

[0049] Step S100: Obtain the target address of the target DeFi project to be detected and determine the taint convergence point of the target address.

[0050] Specifically, decentralized finance (DeFi) projects are a type of financial service project implemented through smart contract coding on blockchain systems such as Ethereum. In essence, they are smart contracts, which can contain addresses and source code.

[0051] Therefore, to detect vulnerabilities in DeFi projects, the target address of the target DeFi project can be obtained, and the taints at that target address can be identified. These taints can be the pathways or aggregation points of data generated by vulnerabilities in the target DeFi project.

[0052] In the embodiments of this application, the taint aggregation point of the target DeFi project can be the currency settlement function of the target DeFi project, which can be a function called by the target DeFi project when settling currency transactions.

[0053] Step S110: Obtain the target source code of the target DeFi project at the target address from the pre-established source code library, which contains the addresses and source code of pre-entered DeFi projects.

[0054] Specifically, the pre-established source code repository can contain the source code of multiple DeFi projects. Therefore, the target source code of the target DeFi project can be obtained from the source code repository for subsequent vulnerability analysis.

[0055] Step S120: Determine whether the target source code needs to call the price query function of a third-party DeFi project. If so, proceed to step S130.

[0056] Specifically, the target source code is the concrete implementation logic of the target DeFi project. It is necessary to determine whether the target source code needs to call the price query function of the third-party DeFi project, and whether the target DeFi project needs to rely on the price query function of the third-party DeFi project in its implementation process.

[0057] Among them, the price query function can be a function used by the target DeFi project to query the exchange rate relationship between different currencies when conducting currency settlement transactions.

[0058] Furthermore, since there may be payment risks when calling the price query function of a third-party DeFi project, step S130 can be executed for the target DeFi project that calls the price query function of the third-party DeFi project.

[0059] Furthermore, if the target DeFi project does not require calling the price query function of a third-party DeFi project, it indicates that the target DeFi project does not have a vulnerability, and the vulnerability detection can be terminated at this point.

[0060] Step S130: Identify the price query function of the third-party DeFi project as the source of pollution.

[0061] Specifically, the source of contamination can be the root cause of vulnerabilities in a target DeFi project. Therefore, the price query function of a third-party DeFi project with payment risks can be identified as the source of contamination.

[0062] Step S140: Determine whether the pollution source variable introduced by the pollution source can propagate to the pollution convergence point. If it can, proceed to step S150.

[0063] Specifically, the program variables generated by the price query function of the third-party DeFi project can be used as pollution source variables introduced by the pollution source. Then, it can be determined whether the pollution source variables can be propagated to the pollution source convergence point based on whether the pollution source variables that have not been harmlessly treated are used during the operation of the pollution source convergence point. If so, step S150 can be executed.

[0064] Among them, the pollutant source variables after harmless treatment can avoid causing vulnerability risks to the target DeFi project.

[0065] Step S150: Use the target address, the taint aggregation point, the taint source, and the taint source variable as vulnerability data for the target DeFi project, and output the vulnerability data.

[0066] Specifically, if the source of contamination variables can propagate to the taint aggregation point, it indicates that the target DeFi project has vulnerabilities, such as payment risks or transaction risks. Therefore, the target address, taint aggregation point, source of contamination, and source of contamination variables can be used as vulnerability data of the target DeFi project, and then the vulnerability data can be output.

[0067] Each target DeFi project may have multiple sources of contamination, and the vulnerability caused by each source of contamination can be stored as a vulnerability data entry, with explanations provided for each vulnerability data entry.

[0068] Assuming the specific value of the target address can be defined as The specific value of the blemish convergence point can be defined as follows: The specific value of the pollution source can be defined as The specific value of the pollution source can be defined as Therefore, the explanations and descriptions above can include: In In DeFi projects, the price of insecure cryptocurrencies In the spread At that time, It was used for dangerous operations.

[0069] As can be seen from the above scheme, this application can determine whether the target DeFi project will cause vulnerability risks based on whether the DeFi project needs to call the price query function of the third-party DeFi project and whether the pollution source variable introduced by the price query function of the third-party DeFi project can propagate to the taint convergence point. This achieves vulnerability detection before attack, thereby avoiding losses.

[0070] Considering that third-party DeFi projects may also need to call price query functions of other DeFi projects, and this process may also contain vulnerabilities, this application embodiment can also add a process to detect whether calling other DeFi projects may contain vulnerabilities. For details, please refer to... Figure 2 .

[0071] Specifically, after determining that the target source code needs to call the price query function of a third-party DeFi project, the following steps can be added:

[0072] Step S160: Take the third-party DeFi project as the new target DeFi project, take the address of the third-party DeFi project as the new target address, and determine the taint convergence point of the new target address.

[0073] Specifically, third-party DeFi projects can be used as new target DeFi projects to be detected, and the addresses of third-party DeFi projects can be used as new target addresses.

[0074] Since the vulnerability arises because third-party DeFi projects call the price query functions of other DeFi projects, the price query functions of other DeFi projects can be identified as taint points for new target addresses.

[0075] After executing step S160, step S110 and subsequent steps can be executed. Step S110 and subsequent steps can be referred to the description in the foregoing embodiments, and will not be repeated here.

[0076] As can be seen from the above scheme, the embodiments of this application can expand the scope of detection and recursively detect all other DeFi projects that have insecure dependencies with the target DeFi project. Compared with the existing technology, which can only detect insecure dependencies that have been exploited and cannot detect undiscovered vulnerabilities, the embodiments of this application have a wider and more comprehensive detection scope, which greatly improves the reliability of vulnerability detection results.

[0077] In some embodiments of this application, step S110, the process of obtaining the target source code of the target DeFi project of the target address from a pre-established source code library, is described. The process of establishing the source code library will be described next.

[0078] Specifically, the process of building a source code repository may include the following steps:

[0079] S1. Obtain the addresses and source code of multiple DeFi projects from the smart contract open source library.

[0080] Specifically, you can obtain the source code of all open-source DeFi projects' smart contracts and their corresponding deployment addresses from open-source smart contract libraries. These open-source smart contract libraries can be Ethereum's block explorer and data platform, Etherscan, or other source code libraries containing open-source DeFi projects.

[0081] S2. For each DeFi project, create a source code library using the DeFi project's address as the index and the DeFi project's source code as the index value.

[0082] Specifically, an index relationship can be established for each DeFi project, using the project's address as the index and its source code as the index value. All DeFi projects can then be stored in the source code repository.

[0083] Considering that the source code library may not store the target source code corresponding to the target address in a timely manner, this application embodiment can also add a process of updating the source code library.

[0084] Specifically, the process may include the following steps:

[0085] If the target source code of the target DeFi project at the target address is not found in the source code repository, the target source code is obtained from the smart contract open source library and updated to the source code repository.

[0086] Specifically, the target source code can be obtained from the smart contract open source library, and the target address can be used as the index, with the obtained target source code as the index value. An index relationship can be established in the source code library, and the target source code can be stored in the source code library.

[0087] As can be seen from the above solutions, establishing a source code repository can quickly obtain the target source code after determining the target address, without having to search for or download the target source code from other channels. This can improve the efficiency of vulnerability detection in DeFi projects and standardize the management of the source code of various DeFi projects.

[0088] In some embodiments of this application, the above step S140, which determines whether the pollution source variable introduced by the pollution source can propagate to the pollution convergence point, is described. The process will be further explained below.

[0089] Specifically, the process may include the following steps:

[0090] S1. Identify the suspected variables related to the pollution source variables.

[0091] Specifically, suspected variables can be generated directly or indirectly from pollution source variables. Suspected variables may include: program variables obtained by direct assignment of pollution source variables, program variables obtained by a function call relationship related to pollution source variables, or program variables obtained according to the pointer propagation relationship of pollution source variables.

[0092] S2. Determine whether the pollution source variable and the suspected variable can propagate to the pollution convergence point.

[0093] Specifically, it can be determined whether pollutant source variables and suspected variables can be propagated to the pollutant convergence point based on whether the pollutant source variables and / or suspected variables are used without harmless treatment during the operation of the pollutant convergence point.

[0094] As can be seen from the above scheme, judging whether the pollution source variables and the suspected variables related to the pollution source variables will propagate to the taint convergence point can comprehensively detect the impact caused by the pollution source variables, thereby determining whether the pollution source variables will cause vulnerability risks.

[0095] The following describes the DeFi project vulnerability detection device provided in the embodiments of this application. The DeFi project vulnerability detection device described below can be referred to in correspondence with the DeFi project vulnerability detection method described above.

[0096] First, combined Figure 3 This section introduces vulnerability detection devices for DeFi projects, such as... Figure 3 As shown, the vulnerability detection device for this DeFi project may include:

[0097] The target data determination unit 100 is used to obtain the target address of the target DeFi project to be detected and determine the taint convergence point of the target address;

[0098] The source code acquisition unit 110 is used to acquire the target source code of the target DeFi project at the target address from a pre-established source code library, wherein the source code library contains the addresses and source code of pre-entered DeFi projects.

[0099] The judgment unit 120 is invoked to determine whether the target source code needs to call the price query function of a third-party DeFi project;

[0100] The pollution source determination unit 130 is used to determine the price query function of the third-party DeFi project as a pollution source if the target source code needs to call the price query function of the third-party DeFi project.

[0101] The propagation judgment unit 140 is used to determine whether the pollution source variable introduced by the pollution source can propagate to the pollution point convergence point;

[0102] The vulnerability output unit 150 is used to output the vulnerability data as the target address, the taint aggregation point, the pollution source, and the pollution source variable as vulnerability data of the target DeFi project if the pollution source variable related to the pollution source can propagate from the pollution source to the taint aggregation point.

[0103] Optionally, the DeFi project vulnerability detection device may further include:

[0104] Other target data determination units are used to take the third-party DeFi project as a new target DeFi project, take the address of the third-party DeFi project as a new target address, and determine the taint convergence point of the new target address;

[0105] The source code acquisition and re-execution unit is used to execute the step of acquiring the target source code of the target DeFi project from the pre-established source code library.

[0106] Optionally, the target data determining unit may include:

[0107] The first taint aggregation point determination unit is used to determine the currency settlement function of the target DeFi project as the taint aggregation point of the target address.

[0108] Optionally, the other target data determination unit may include:

[0109] The second taint aggregation point determination unit is used to determine the price query function of the third-party DeFi project as the taint aggregation point of the new target address.

[0110] Optionally, the DeFi project vulnerability detection device may further include:

[0111] The target project acquisition unit is used to obtain the addresses and source code of multiple DeFi projects from the smart contract open source library;

[0112] The source code repository creation unit is used to create a source code repository for each DeFi project, using the DeFi project's address as the index and the DeFi project's source code as the index value.

[0113] Optionally, the DeFi project vulnerability detection device may further include:

[0114] The source code library update unit is used to, before obtaining the target source code of the target DeFi project at the target address from the pre-established source code library, if the target source code of the target DeFi project at the target address does not exist in the source code library, obtain the target source code from the smart contract open source library and update the source code to the source code library.

[0115] Optionally, the propagation determination unit may include:

[0116] A suspected variable determination unit is used to determine suspected variables related to the pollution source variables;

[0117] The pollution propagation judgment unit is used to determine whether the pollution source variable and the suspected variable can propagate to the pollution convergence point.

[0118] The DeFi project vulnerability detection device provided in this application embodiment can be applied to DeFi project vulnerability detection equipment. Figure 4 The diagram shows the hardware structure of a DeFi project vulnerability detection device. Figure 4 The hardware structure of a DeFi project vulnerability detection device may include: at least one processor 1, at least one communication interface 2, at least one memory 3, and at least one communication bus 4;

[0119] In this embodiment of the application, the number of processor 1, communication interface 2, memory 3, and communication bus 4 is at least one, and processor 1, communication interface 2, and memory 3 communicate with each other through communication bus 4;

[0120] Processor 1 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention.

[0121] Memory 3 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device;

[0122] The memory stores a program, which the processor can call. The program is used for:

[0123] Obtain the target address of the target DeFi project to be detected and determine the taint convergence point of the target address;

[0124] Obtain the target source code of the target DeFi project at the target address from a pre-established source code repository, which contains the addresses and source code of pre-entered DeFi projects.

[0125] Determine whether the target source code needs to call the price query function of a third-party DeFi project;

[0126] If so, the price query function of the third-party DeFi project will be identified as the source of contamination.

[0127] Determine whether the pollution source variable introduced by the pollution source can propagate to the pollution convergence point;

[0128] If possible, the target address, the taint aggregation point, the taint source, and the taint source variable will be used as the vulnerability data of the target DeFi project, and the vulnerability data will be output.

[0129] Optionally, the refined and extended functions of the program can be found in the description above.

[0130] This application embodiment also provides a storage medium that can store a program suitable for execution by a processor, the program being used for:

[0131] Obtain the target address of the target DeFi project to be detected and determine the taint convergence point of the target address;

[0132] Obtain the target source code of the target DeFi project at the target address from a pre-established source code repository, which contains the addresses and source code of pre-entered DeFi projects.

[0133] Determine whether the target source code needs to call the price query function of a third-party DeFi project;

[0134] If so, the price query function of the third-party DeFi project will be identified as the source of contamination.

[0135] Determine whether the pollution source variable introduced by the pollution source can propagate to the pollution convergence point;

[0136] If possible, the target address, the taint aggregation point, the taint source, and the taint source variable will be used as the vulnerability data of the target DeFi project, and the vulnerability data will be output.

[0137] Optionally, the refined and extended functions of the program can be found in the description above.

[0138] Finally, it should be noted that in this document, relational terms such as "objective" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0139] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0140] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting vulnerabilities in DeFi projects, characterized in that, include: Obtain the target address of the target DeFi project to be detected and determine the taint convergence point of the target address; Obtain the target source code of the target DeFi project at the target address from a pre-established source code repository, which contains the addresses and source code of pre-entered DeFi projects. Determine whether the target source code needs to call the price query function of a third-party DeFi project; If so, the price query function of the third-party DeFi project will be identified as the source of contamination. Based on whether the pollution source variable introduced by the pollution source and not rendered harmless is used during the operation of the pollution convergence point, it is determined whether the pollution source variable can be propagated to the pollution convergence point. If possible, the target address, the taint aggregation point, the taint source, and the taint source variable will be used as the vulnerability data of the target DeFi project, and the vulnerability data will be output.

2. The method according to claim 1, characterized in that, Also includes: The third-party DeFi project is used as the new target DeFi project, the address of the third-party DeFi project is used as the new target address, and the taint convergence point of the new target address is determined. Perform the step of obtaining the target source code of the target DeFi project from the pre-established source code repository.

3. The method according to claim 1, characterized in that, Determining the taint convergence point of the target address includes: The currency settlement function of the target DeFi project is determined as the taint convergence point of the target address.

4. The method according to claim 2, characterized in that, Determining the taint convergence point of the new target address includes: The price query function of the third-party DeFi project is determined as the taint convergence point of the new target address.

5. The method according to claim 1, characterized in that, The process of establishing the source code repository includes: Obtain the addresses and source code of multiple DeFi projects from the smart contract open-source library; For each DeFi project, a source code repository is created, using the project's address as an index and its source code as an index value.

6. The method according to claim 1, characterized in that, Before obtaining the target source code of the target DeFi project from the pre-established source code repository, the method further includes: If the target source code of the target DeFi project at the target address is not found in the source code repository, the target source code is obtained from the smart contract open source library and updated to the source code repository.

7. The method according to any one of claims 1-6, characterized in that, The step of determining whether a pollution source variable can propagate to the pollution convergence point based on whether the pollution source variable, introduced by the pollution source and not subjected to harmless treatment, is used during the operation of the pollution convergence point includes: Identify suspected variables related to the pollution source variables; Determine whether the pollution source variable and the suspected variable can propagate to the pollution convergence point.

8. A DeFi project vulnerability detection device, characterized in that, include: The target data determination unit is used to obtain the target address of the target DeFi project to be detected and determine the taint convergence point of the target address; The source code acquisition unit is used to acquire the target source code of the target DeFi project at the target address from a pre-established source code library, wherein the source code library contains the addresses and source code of pre-entered DeFi projects. The judgment unit is invoked to determine whether the target source code needs to call the price query function of a third-party DeFi project; The pollution source determination unit is used to determine the price query function of the third-party DeFi project as a pollution source if the target source code needs to call the price query function of the third-party DeFi project. The propagation determination unit is used to determine whether the pollution source variable can propagate to the pollution source convergence point based on whether the pollution source variable introduced by the pollution source and not subjected to harmless treatment is used during the operation of the pollution convergence point. The vulnerability output unit is used to output the vulnerability data as the target address, the taint aggregation point, the pollution source, and the pollution source variable as vulnerability data of the target DeFi project if the pollution source variable related to the pollution source can propagate from the pollution source to the taint aggregation point.

9. A DeFi project vulnerability detection device, characterized in that, Including memory and processor; The memory is used to store programs; The processor is used to execute the program to implement the various steps of the DeFi project vulnerability detection method as described in any one of claims 1-7.

10. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the DeFi project vulnerability detection method as described in any one of claims 1-7.

Images