Method for implementing path search depth self-adaptive adjustment based on abstract syntax tree

Abstract

The present application belongs to the field of path search method, especially the method for realizing path search depth self-adaptive adjustment based on abstract syntax tree, aiming at the problem that the existing contract with large number of code lines has deep function call and the symbolic execution cannot cover, the contract faced by the symbolic execution is basically the low version smart contract with not more than 200 lines, ignoring the problem that the symbolic execution is difficult to cover part of path in long / complex contract, the present application proposes the following scheme, which comprises the following steps: S1: input: the open source contract on EtherScan or the smart contract source code written by the developer is taken as the program input; S2: compilation: the smart contract is compiled through the Solidity compiler, the AST information and the smart contract bytecode generated in the compilation process are collected, the present application is based on the symbolic execution technology, combines the AST information which can reflect the semantics of the smart contract source code, and adaptively adjusts the path search depth in the symbolic execution process, so as to avoid the problem that the vulnerability position cannot be detected and the coverage is low in the long contract.

Description

Technical Field

[0001] This invention relates to the field of path search method technology, and in particular to a method for adaptively adjusting the path search depth based on an abstract syntax tree. Background Technology

[0002] Currently, research similar to this invention mainly includes the following approaches:

[0003] Option 1: Research [1] proposed Oyente, a static analysis technology for smart contracts based on symbolic execution, to detect classic problems such as reentrancy, access control, integer overflow and timestamp dependency in smart contracts. This option is the first to propose a symbolic execution tool for smart contracts, model the EVM opcode of smart contracts, and realize the vulnerability detection function by modeling the constraint solution of different vulnerability types.

[0004] Option 2: Research [2] proposed VerX, which is a tool for detecting the security attributes of smart contract projects. It detects smart contracts through symbolic execution technology. By obtaining the data types in the AST, it can predict the data values ​​in the detection process, which is convenient for subsequent attribute checks.

[0005] Oyente, as an early symbolic execution tool, only targets classic smart contract vulnerabilities and primarily focuses on older contracts with relatively few lines of code. Furthermore, its search path depth cannot be dynamically adjusted, preventing it from detecting deep paths with complex function calls in the current version of the contract. This reduces code coverage and symbolic execution efficiency, making it ineffective for code detection. While VerX utilizes symbolic execution technology and the AST (Abstract Syntax Tree) information of smart contracts, it does not solve the problem of not being able to cover deep paths in complex function call scenarios within contracts. Its use of AST aims to predict abstract variable values, facilitating the verification of contract attributes.

[0006] Therefore, a method for adaptively adjusting the path search depth based on an abstract syntax tree is needed to solve the problems mentioned above. Summary of the Invention

[0007] To address the aforementioned issues, this invention proposes a method for adaptively adjusting path search depth based on an abstract syntax tree (AST). This method aims to solve the critical problem of deep function calls in contracts with large lines of code that symbolic execution cannot cover. Currently, many symbolic execution tools are designed for low-version smart contracts with fewer than 200 lines of code, neglecting the issue of symbolic execution failing to cover certain paths in long / complex contracts. This invention, based on symbolic execution technology and incorporating AST information that reflects the semantics of the smart contract source code, adaptively adjusts the path search depth during symbolic execution, avoiding the problems of undetectable vulnerability locations and low coverage in long contracts.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] The method for adaptively adjusting the path search depth based on abstract syntax trees includes the following steps:

[0010] S1: Input: Use the source code of open-source contracts or smart contracts written by developers on EtherScan as program input;

[0011] S2: Compilation: Compiles smart contracts using the Solidity compiler, and collects the AST information and smart contract bytecode generated during the compilation process;

[0012] S3: Use the AST information extraction module to obtain the AST information in S2 and perform adaptive path search depth adjustment. The AST information extraction module includes two parts: AST traversal search and call graph construction.

[0013] S4: Path search depth adjustment: Based on the call graph obtained in S3, before symbolic execution, the path search depth of symbolic execution is adaptively adjusted according to the analysis of the extracted contract complexity. The path search depth of symbolic execution is an important parameter that determines whether as much program code as possible can be covered and program vulnerabilities can be detected.

[0014] S5: Select the path search depth adjustment factor K to adaptively adjust the parameters of the symbolic execution path search depth, so as to improve the code coverage and vulnerability detection capabilities of symbolic execution for complex contracts, and obtain the latest adaptively adjusted path search depth m;

[0015] S6: Perform symbolic execution: Based on the smart contract bytecode and pre-designed execution opcodes, model and memory model, and combined with the adaptive path search depth m in S5, search and solve the constraints in the program, and analyze the vulnerabilities in the contract through the preset constraint solution and parameters.

[0016] S7: Output Results: Based on the analysis results of the symbol execution, output the vulnerability detection results.

[0017] Preferably, in S1, EtherScan is a blockchain explorer for the Ethereum network, which can search for transactions, blocks, wallet addresses, smart contracts, and other on-chain data.

[0018] Preferably, in S2, the smart contract is the result of compiling the open-source contract on EtherScan in S1 or the contract source code written by the developer. The path search depth in the subsequent symbolic execution process is adaptively adjusted through AST information and a path search depth adjustment strategy. The AST information is used as the basis for the adaptive adjustment of the path search depth in the subsequent symbolic execution, while the smart contract bytecode is the main body of symbolic execution. The symbolic execution process will be based on the disassembled opcode of the smart contract bytecode.

[0019] Preferably, in step S2, the Solidity compiler's role is to convert the smart contract code written by the developers into Ethereum Virtual Machine (EVM) instruction code. This EVM instruction code is uploaded to Ethereum through transaction packaging and is ultimately parsed and executed by the EVM.

[0020] Preferably, in S3, the AST traversal search is performed: the AST information of the smart contract can be obtained through the ast instruction of the Solidity compiler. The AST information is a structured JSON data format. All information in the source code will be displayed in the JSON data structure in the form of key-value pairs. For the content in the source code, the AST of the contract has key-value pairs with nodeType as the key, which are used to mark the intent and category of the source code statements. All source code statements will be represented in the nodes key-value pairs of the AST in the form of nodes.

[0021] Preferably, in step S3, a call graph at the contract function level can be constructed based on the set of key-value pairs obtained by AST traversal search. Unlike the traditional contract control flow graph constructed based on smart contract bytecode, the function call information extracted from the source code AST information can be clearly obtained, and the entire graph structure does not need to be dynamically generated and improved during execution. In addition, the contract call graph is different from the control graph. Each node in the call graph represents a function, and the connection between nodes represents the call relationship between functions.

[0022] Preferably, in step S4, in order to address the issue that symbolic execution cannot adaptively adjust the search strategy for the analyzed contract during the process, the analysis results of the contract need to be applied to the strategy adjustment before symbolic execution.

[0023] Preferably, in step S5, the formula for calculating K is: Among them, Dmax This represents the longest call path in the call flow graph obtained in step 3, which contains n nodes N1 to N2. n The out-degree of the i-th node is O. i θ is a scaling factor, calculated by scaling D max The calculation of the out-degree sum from the 2nd node to the (n-1)th node yields the call complexity on the longest path. Finally, θ is used for adjustment to obtain the final path search depth adjustment factor K, which is then calculated using the formula:

[0024] m = n + K

[0025] Finally, the latest adaptively adjusted path search depth m is obtained by adding the value of K to the original path search depth parameter n.

[0026] Preferably, in step S5, a symbolic execution module is used during symbolic execution. The execution opcode modeling and memory modeling are pre-designed before the input step and compilation step. The symbolic execution module, combined with the adaptive path search depth m in step S5, searches for paths and solves constraints in the program. Based on the preset constraint solution and parameter analysis, vulnerabilities in the contract are identified.

[0027] Compared with the prior art, the beneficial effects of the present invention are:

[0028] 1. This invention proposes for the first time a strategy for dynamically adjusting the path search depth of contracts with a long number of lines of code based on the contract abstract syntax tree information, which can solve the problems that a fixed search depth cannot detect the location of contract vulnerabilities and the low coverage of symbol execution.

[0029] 2. This invention makes full use of the semantic information of smart contract source code, which can guide symbolic execution based on smart contract bytecode without affecting the efficiency of symbolic execution, making the vulnerability detection and symbolic execution process more efficient;

[0030] 3. This invention proposes a method for adaptive adjustment of path search depth based on abstract syntax trees, which focuses on the current smart contract scenarios with complex and diverse logic and long lines of code. It solves the problem that traditional smart contract symbolic execution technology cannot solve the problem of deep path detection, which leads to low coverage and undetectable vulnerabilities, and provides more comprehensive security for smart contracts. Attached Figure Description

[0031] Figure 1 This is a block diagram of the method for adaptive adjustment of path search depth based on abstract syntax tree proposed in this invention. Detailed Implementation

[0032] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0033] Example

[0034] Reference Figure 1 The method for adaptively adjusting the path search depth based on an abstract syntax tree includes the following steps:

[0035] S1: Input: Use the source code of open-source contracts or smart contracts written by developers on EtherScan as program input;

[0036] S2: Compilation: Compiles smart contracts using the Solidity compiler, and collects the AST information and smart contract bytecode generated during the compilation process;

[0037] S3: Use the AST information extraction module to obtain the AST information in S2 and perform adaptive path search depth adjustment. The AST information extraction module includes two parts: AST traversal search and call graph construction.

[0038] S4: Path search depth adjustment: Based on the call graph obtained in S3, before symbolic execution, the path search depth of symbolic execution is adaptively adjusted according to the analysis of the extracted contract complexity. The path search depth of symbolic execution is an important parameter that determines whether as much program code as possible can be covered and program vulnerabilities can be detected.

[0039] S5: Select the path search depth adjustment factor K to adaptively adjust the parameters of the symbolic execution path search depth, so as to improve the code coverage and vulnerability detection capabilities of symbolic execution for complex contracts, and obtain the latest adaptively adjusted path search depth m;

[0040] S6: Perform symbolic execution: Based on the smart contract bytecode and pre-designed execution opcodes, model and memory model, and combined with the adaptive path search depth m in S5, search and solve the constraints in the program, and analyze the vulnerabilities in the contract through the preset constraint solution and parameters.

[0041] S7: Output Results: Based on the analysis results of the symbol execution, output the vulnerability detection results.

[0042] In this embodiment, in S1, EtherScan is the blockchain explorer of the Ethereum network. EtherScan can search for transactions, blocks, wallet addresses, smart contracts, and other on-chain data. In S2, the smart contract is the compilation result of the open-source contract on EtherScan in S1 or the contract source code written by the developer. Through the AST information and the path search depth adjustment strategy, the path search depth in the subsequent symbol execution process is adaptively adjusted. The AST information is used as the basis for the adaptive adjustment of the path search depth in the subsequent symbol execution. The smart contract bytecode is the main body of symbol execution, and the symbol execution process is based on the disassembled opcodes of the smart contract bytecode. In S2, the Solidity compiler's role is to convert the smart contract code written by the developer into Ethereum Virtual Machine (EVM) instruction code. These EVM instruction codes are uploaded to Ethereum through transaction packaging and are finally parsed and executed by the EVM. In S3, AST traversal search: the AST information of the smart contract can be obtained through the AST instruction of the Solidity compiler. The AST information is in a structured JSON data format. All information in the source code is displayed in key-value pairs within the JSON data structure. For content in the source code, the contract's AST contains key-value pairs with `nodeType` as the key, used to annotate the intent and category of source code statements. All source code statements are represented as nodes in the `nodes` key-value pairs of the AST. For example, if the first line of the contract declares the Solidity compiler version, then in the AST, the `nodeType` of this statement is "Pragmadirective". The `nodeType` of statements declaring variables in the contract is "VariableDeclaration", and the `nodeType` of statements declaring functions is "FunctionDefinition", etc. This AST information extraction mainly focuses on nodes with `nodeType` of "FunctionCall". This type of node contains a call to another function. Based on the search and information extraction of this type of node in the AST, we obtain...<function_id,functioncall_ref_id> In S3, based on the set of key-value pairs obtained through AST traversal, a call graph at the contract function level can be constructed. Unlike traditional contract control flow graphs constructed based on smart contract bytecode, the function call information extracted from the source code AST is clearly obtainable, without needing to dynamically generate and complete the entire graph structure during execution. Furthermore, unlike control graphs, each node in a contract's call graph represents a function, and the connections between nodes represent the call relationships between functions. Specifically, for key-value pairs <1, 2>, <2, 3>, and <3, None>, ...We can see that the function with id 1 calls the function with id 2, and the function with id 2 calls the function with id 3. The function with id 3 does not call any other functions. For the entire call graph constructed based on the AST information, the nodes are function_id, i.e., 1, 2, and 3 in the example above. The connections in the graph are generated based on function_ref_id. By traversing all key-value pairs, for the first value (function id) of each key-value pair, the function node is connected to the function node pointed to by the second value (function_ref_id). By constructing the call flow graph, the call path and distance starting from a certain function can be clearly obtained. For example, in the example above, the distance from function 1 to function 3 is 2, and the call path includes 1->2 and 2->3. In S4, to address the issue that symbolic execution cannot adaptively adjust the search strategy for the analyzed contract during the process, the analysis results of the contract need to be applied to the strategy adjustment before symbolic execution. In S5, the formula for calculating K is: Among them, D max This represents the longest call path in the call flow graph obtained in step 3, which contains n nodes N1 to N2. n The out-degree of the i-th node is O. i θ is a scaling factor, calculated by scaling D max The calculation of the out-degree sum from the 2nd node to the (n-1)th node yields the call complexity on the longest path. Finally, θ is used for adjustment to obtain the final path search depth adjustment factor K, which is then calculated using the formula:

[0043] m = n + K

[0044] Finally, based on the original path search depth parameter value n, the latest adaptively adjusted path search depth m is obtained by adding the value of K. In S5, the symbolic execution module is used during symbolic execution. The execution opcode modeling and memory modeling are pre-designed before the input step and compilation step. The symbolic execution module, combined with the adaptive path search depth m in S5, searches for paths and solves constraints in the program. Based on the preset constraint solution and parameter analysis, it analyzes the vulnerabilities in the contract.

[0045] This invention proposes a method for adaptively adjusting the path search depth based on an abstract syntax tree. It focuses on smart contract scenarios with complex and diverse logic and long lines of code. It solves the problem that traditional smart contract symbolic execution technology cannot detect deep paths, resulting in low coverage and undetectable vulnerabilities, and provides more comprehensive security for smart contracts.

[0046] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for implementing path search depth self-adaptive adjustment based on an abstract syntax tree, characterized in that, Comprising the following steps: S1: input: open source contract on EtherScan or smart contract source code written by the developer as program input; S2: compile: compile the smart contract through the Solidity compiler, collect the AST information and smart contract bytecode produced during the compilation process; S3: use the AST information extraction module to obtain the AST information in S2 for adaptive path search depth adjustment, the AST information extraction module includes AST traversal search and call graph construction, AST traversal search: the AST information of the smart contract can be obtained through the ast instruction of the Solidity compiler, the AST information is in structured json data format, all information in the source code will be displayed in the form of key-value in the json data structure, for the content in the source code, the AST of the contract has a key-value pair with nodeType as the key, which marks the intention and category of the source code statement, all source code statements will be displayed in the form of node in the AST nodes key-value pair; S4: path search depth adjustment: according to the call graph obtained in S3, before symbolic execution, according to the analysis of the complexity of the contract extracted, the path search depth of symbolic execution is adaptively adjusted, and the path search depth of symbolic execution is an important parameter to determine whether as much program code as possible can be covered and program vulnerabilities can be detected; S5: Select the path search depth adjustment factor K to adaptively adjust the parameters of the symbolic execution path search depth, so as to improve the code coverage ability and vulnerability detection ability of the symbolic execution for complex contracts, and obtain the latest adaptively adjusted path search depth m, the calculation formula of K is: Wherein, D max represents the longest calling path in the calling flow graph obtained in step 3, which contains n nodes N1 to N n , the out-degree of the i-th node is O i , and θ is a scaling factor. By calculating the sum of the out-degrees of the 2nd node to the n-1th node in D max , the complexity of the calls existing in the longest path can be obtained, and finally the path search depth adjustment factor K is obtained by adjusting θ. Then, the formula is used to obtain the final path search depth adjustment factor K. m = n + K Finally, according to the original set path search depth parameter value n, plus K value to get the latest adaptive adjustment path search depth m; S6: symbolic execution: according to the smart contract bytecode of the smart contract and the pre-designed execution opcode modeling and memory modeling, combined with the adaptive path search depth m in S5, search and constraint solving for the path in the program, analyze the vulnerabilities in the contract through the pre-set constraint solving conditions and parameters; S7: output result: according to the analysis result of the completion of the symbolic execution, output the vulnerability detection result.

2. The method for implementing path search depth self-adaptive adjustment based on abstract syntax tree according to claim 1, characterized in that, In S1, EtherScan is a blockchain browser of Ethereum network, EtherScan can search transactions, blocks, wallet addresses, smart contracts, and other on-chain data.

3. The method of claim 1, wherein, In S2, the smart contract is the compilation result of the open source contract on EtherScan or the contract source code written by the developer in S1, through the strategy of AST information and path search depth adjustment, the path search depth in the subsequent symbolic execution process is adaptively adjusted, wherein the AST information is used for adaptive adjustment of the path search depth of the subsequent symbolic execution, and the smart contract bytecode is the main body of the symbolic execution, and the process of the symbolic execution will be based on the disassembled operation code of the smart contract bytecode.

4. The method of claim 1, wherein, In S2, the role of the Solidity compiler is to convert the smart contract code written by the developer into Ethereum virtual machine EVM instruction code, these EVM instruction codes are packaged through transactions and uploaded to Ethereum, and finally executed through EVM.

5. The method of claim 1, wherein, In the S3, the key-value pair set obtained by the AST traversal search, and the AST information of the smart contract are obtained by the ast instruction of the Solidity compiler, and a contract function level call graph is constructed. Unlike the contract control flow graph constructed based on the smart contract bytecode, the function-to-function call information extracted from the source code AST information can be clearly obtained, and the entire graph structure does not need to be dynamically generated and improved during the execution process. In addition, the contract call graph and the control graph are different, each node represents a function, and the connection between the nodes represents the call relationship between the functions.

6. The method of claim 1, wherein, In the S4, in order to cope with the fact that the symbolic execution cannot adaptively adjust the search strategy of the analyzed contract during the process, the analysis result of the contract needs to be applied to the strategy adjustment before the symbolic execution.

7. The method of claim 1, wherein, In the S5, the symbolic execution module is used during the symbolic execution, and the operation code modeling and the memory modeling are designed in advance before the input step and the compilation step. The symbolic execution module combines the adaptive path search depth m in the S5 to search and constraint solve the paths in the program, and analyzes the vulnerabilities existing in the contract through the preset constraint solving condition and parameter.

Images