A method for automatically generating an Ethereum EIP proposal risk assessment dimension library

Abstract

The application provides a method for automatically generating an Ethereum EIP proposal risk assessment dimension library, and belongs to the technical field of blockchains, and specifically comprises the following steps: extracting an Ethereum EIP proposal and automatically extracting information of all interfaces in the proposal, including information of standards, protocols, parameters, return values, visibility and function modifiers; constructing a risk matrix library of the EIP proposal by taking an interface as one dimension and taking parameters, return values, visibility and function modifiers as another dimension; and performing risk assessment on the Ethereum EIP proposal according to an EIP proposal standard and element definition standards in the proposal standard, so that the problem of large extraction errors and low efficiency caused by relying on manual extraction is solved, the method has good extraction speed and accuracy, and the evaluation result can be stored.

Description

Technical Field

[0001] This invention belongs to the field of blockchain technology, specifically relating to a method for automatically generating a risk assessment dimension library for Ethereum EIP proposals. Background Technology

[0002] Ethereum Improvement Proposals (EIPs) are standards proposed by developers to define the development of Ethereum software (including client software, smart contracts, etc.). Once a proposal is reviewed and approved by the Ethereum core team, it becomes a standard that Ethereum developers worldwide are encouraged to follow. Currently, key Ethereum development and deployment are driven by a series of Ethereum EIP proposals. When a proposal is approved, Ethereum application developers, when developing according to the proposal, need to examine the standards, protocols, parameters, return values, visibility, and function modifiers defined in the proposal, analyze what attacks the code implemented according to the proposal might encounter, what security vulnerabilities might exist, and how to prevent these attacks and plug these security vulnerabilities in the specific implementation.

[0003] Furthermore, since smart contracts running on Ethereum cannot be modified or revoked once deployed, developers of smart contract applications, in order to ensure successful deployment and, especially, to ensure the contract is as secure as possible (i.e., free from or with minimal security vulnerabilities and risks), will have their code reviewed by a third-party code auditing company before deployment to identify and eliminate vulnerabilities and security risks. Therefore, contract auditing plays a crucial role in Ethereum contract development. When auditors review smart contract code, they need to compare the code with the proposal, checking whether the code implements the standards, protocols, parameters, return values, visibility, and function modifiers defined in the proposal, and whether the code has implemented relevant security measures for all these elements to prevent potential risks and vulnerabilities.

[0004] For a complex application involving a large number of Ethereum proposals, both developers and auditors need to thoroughly review and analyze all relevant proposal standards in the code, examining each element of each standard. Currently, this work is mainly done manually, searching and querying each proposal standard one by one. This is not only inefficient, but also inevitably introduces some flaws and lowers the accuracy rate because it is impossible for humans to be completely familiar with all the proposal standards.

[0005] To address the aforementioned technical problems, this invention provides a method for automatically generating a risk assessment dimension library for Ethereum EIP proposals. Summary of the Invention

[0006] To achieve the objectives of this invention, the following technical solution is adopted:

[0007] According to one aspect of the present invention, a method for automatically generating a risk assessment dimension library for Ethereum EIP proposals is provided.

[0008] A method for automatically generating a risk assessment dimension library for Ethereum EIP proposals, characterized by specifically including:

[0009] S1: Extract Ethereum EIP proposals and automatically extract information about all interfaces in the proposals, including information about standards, protocols, parameters, return values, visibility, and function modifiers;

[0010] S2: Construct a risk matrix library for EIP proposals with interfaces as one dimension and parameters, return values, visibility, and function modifiers as another dimension. Conduct risk assessments on Ethereum EIP proposals according to the EIP proposal standards and the element definition standards in the proposal standards.

[0011] First, Ethereum EIP proposals are extracted. All interface information involved in the Ethereum EIP proposals, including standards, protocols, parameters, return values, visibility, and function modifiers, is extracted. A risk matrix library of EIP proposals is constructed with interfaces as one dimension and parameters, return values, visibility, and function modifiers as another dimension. According to pre-set relevant standards, a multi-dimensional risk assessment is performed on them, so that the current risk situation can be automatically and accurately determined.

[0012] By employing an automated extraction method, all interface information involved in Ethereum EIP proposals, including standards, protocols, parameters, return values, visibility, and function modifiers, is extracted. Following standard requirements, a risk matrix library for EIP proposals is constructed, using interfaces as one dimension and parameters, return values, visibility, and function modifiers as another. This approach improves upon the previous manual retrieval method, which was time-consuming, inefficient, and prone to missing crucial proposal standards and defined elements, neglecting necessary security measures. This allows for faster and more accurate risk assessment of Ethereum EIP proposals.

[0013] A further technical solution is that it can automatically extract any one or more of the information from the standard, protocol, parameters, return value, visibility and function modifier in the proposal, and perform a risk assessment on any one or more of them according to the corresponding standard requirements.

[0014] When assessing the risks of an Ethereum EIP proposal from only a few or any one of its aspects, it is sufficient to extract those aspects and assess their risks accordingly. This makes the risk assessment strategy more controllable and diversified, allowing for a more comprehensive technical solution when a full risk assessment is not required.

[0015] A further technical solution involves the following specific steps for extracting Ethereum EIP proposals:

[0016] S11: Access the Ethereum EIP library URL;

[0017] S12: Extract an EIP proposal link;

[0018] S13: Extract Ethereum EIP proposals via the link.

[0019] Since Ethereum EIP proposals are currently mostly displayed on servers via web pages, retrieving Ethereum EIP proposals through EIP proposal links allows for convenient data extraction, enabling complete and accurate retrieval of the proposals.

[0020] A further technical solution is that all interface information in the proposal is extracted by locating the paragraph corresponding to the keyword "specification". When the keyword of the paragraph containing the information changes, the information is extracted according to the paragraph corresponding to the changed keyword.

[0021] Generally, when all interface information in a proposal is stored on a webpage, it is stored in the paragraph corresponding to the keyword "specification". When the keyword definition changes later, the paragraph is adjusted and extracted according to the changed keyword, thereby achieving accurate location and extraction of the information.

[0022] A further technical solution is that the information of all interfaces is located by their corresponding "function" keyword, and the data between the "(" symbol and ")" symbol in the location is extracted. The visibility keyword and function modifier keyword of the definition after the ")" symbol are extracted. When the definition method or information storage method of all interface information changes later, the information is extracted according to the new definition method.

[0023] Generally, all interface information is stored by starting with the corresponding "function" keyword, with data stored in parentheses and commas, and visibility keywords and function modifier keywords stored after the commas. When the definition method changes, the automatic extraction method will extract the information according to the new definition method.

[0024] A further technical solution involves storing the extracted data, visibility keywords, and function modifiers as elements in a row vector M. i In the context of M, i represents the i-th interface. i =[a i1 ,a i2 ,……a ij ], where a ij This is represented as the j-th element of the i-th interface. There are a total of j elements. When the number of data, visibility keywords, and function modifiers corresponding to all interfaces is less than j elements, the remaining elements are supplemented as empty elements.

[0025] By storing the extracted data, visibility keywords, and function modifiers in row vectors, the final structure becomes more consistent, which greatly facilitates the determination of information for all interfaces.

[0026] A further technical solution involves storing the row vectors of all the interfaces in the form of a matrix.

[0027] A further technical solution is that the elements in the matrix are stored using a structure data type.

[0028] On the other hand, this application provides a computer-readable storage medium storing a computer program that, when executed in a computer, causes the computer to execute the aforementioned method for automatically generating a risk assessment dimension library for Ethereum EIP proposals.

[0029] On the other hand, this application provides a computer program product, characterized in that the computer program product stores instructions, which, when executed by a computer, cause the computer to implement the above-described method for automatically generating an Ethereum EIP proposal risk assessment dimension library. Attached Figure Description

[0030] The above and other features and advantages of the present invention will become more apparent from a detailed description of exemplary embodiments thereof with reference to the accompanying drawings.

[0031] Figure 1 This is a flowchart of a method for automatically generating a risk assessment dimension library for Ethereum EIP proposals according to Embodiment 1.

[0032] Figure 2 This is a flowchart illustrating the specific steps involved in extracting an Ethereum EIP proposal in Example 1.

[0033] Figure 3 This is a structural diagram of a computer-readable storage medium according to Embodiment 2. Detailed Implementation

[0034] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that the invention will be thorough and complete, and the concept of the exemplary embodiments will be fully conveyed to those skilled in the art. The same reference numerals in the drawings denote the same or similar structures, and therefore their detailed description will be omitted.

[0035] The terms “a,” “one,” “the,” and “the” are used to indicate the existence of one or more elements / components / etc.; the terms “including” and “having” are used to indicate an open-ended meaning of inclusion and that other elements / components / etc. may exist in addition to the listed elements / components / etc.

[0036] Ethereum Improvement Proposals (EIPs) are standards proposed by developers to define the development of Ethereum software (including client software, smart contracts, etc.). Once a proposal is reviewed and approved by the Ethereum core team, it becomes a standard that Ethereum developers worldwide are encouraged to follow. Currently, key Ethereum development and deployment are driven by a series of Ethereum EIP proposals. When a proposal is approved, Ethereum application developers, when developing according to the proposal, need to examine the standards, protocols, parameters, return values, visibility, and function modifiers defined in the proposal, analyze what attacks the code implemented according to the proposal might encounter, what security vulnerabilities might exist, and how to prevent these attacks and plug these security vulnerabilities in the specific implementation.

[0037] Furthermore, since smart contracts running on Ethereum cannot be modified or revoked once deployed, developers of smart contract applications, in order to ensure successful deployment and, especially, to ensure the contract is as secure as possible (i.e., free from or with minimal security vulnerabilities and risks), will have their code reviewed by a third-party code auditing company before deployment to identify and eliminate vulnerabilities and security risks. Therefore, contract auditing plays a crucial role in Ethereum contract development. When auditors review smart contract code, they need to compare the code with the proposal, checking whether the code implements the standards, protocols, parameters, return values, visibility, and function modifiers defined in the proposal, and whether the code has implemented relevant security measures for all these elements to prevent potential risks and vulnerabilities.

[0038] For a complex application involving a large number of Ethereum proposals, both developers and auditors need to thoroughly review and analyze all relevant proposal standards in the code, examining each element of each standard. Currently, this work is mainly done manually, searching and querying each proposal standard one by one. This is not only inefficient, but also inevitably introduces some flaws and lowers the accuracy rate because it is impossible for humans to be completely familiar with all the proposal standards.

[0039] Example 1

[0040] like Figure 1 As shown, according to one aspect of the present invention, a method for automatically generating a risk assessment dimension library for Ethereum EIP proposals is provided.

[0041] A method for automatically generating a risk assessment dimension library for Ethereum EIP proposals, characterized by specifically including:

[0042] S1: Extract Ethereum EIP proposals and automatically extract information about all interfaces in the proposals, including information about standards, protocols, parameters, return values, visibility, and function modifiers;

[0043] S2: Construct a risk matrix library for EIP proposals with interfaces as one dimension and parameters, return values, visibility, and function modifiers as another dimension. Conduct risk assessments on Ethereum EIP proposals according to the EIP proposal standards and the element definition standards in the proposal standards.

[0044] First, Ethereum EIP proposals are extracted. All interface information involved in the Ethereum EIP proposals, including standards, protocols, parameters, return values, visibility, and function modifiers, is extracted. A risk matrix library of EIP proposals is constructed with interfaces as one dimension and parameters, return values, visibility, and function modifiers as another dimension. According to pre-set relevant standards, a multi-dimensional risk assessment is performed on them, so that the current risk situation can be automatically and accurately determined.

[0045] By employing an automated extraction method, all interface information involved in Ethereum EIP proposals, including standards, protocols, parameters, return values, visibility, and function modifiers, is extracted. Following standard requirements, a risk matrix library for EIP proposals is constructed, using interfaces as one dimension and parameters, return values, visibility, and function modifiers as another. This approach improves upon the previous manual retrieval method, which was time-consuming, inefficient, and prone to missing crucial proposal standards and defined elements, neglecting necessary security measures. This allows for faster and more accurate risk assessment of Ethereum EIP proposals.

[0046] In another possible embodiment, any one or more of the information on standards, protocols, parameters, return values, visibility, and function modifiers in the interface data of the proposal can be automatically extracted, and a risk assessment can be performed on any one or more of them according to the corresponding standard requirements.

[0047] When assessing the risks of an Ethereum EIP proposal from only a few or any one of its aspects, it is sufficient to extract those aspects and assess their risks accordingly. This makes the risk assessment strategy more controllable and diversified, allowing for a more comprehensive technical solution when a full risk assessment is not required.

[0048] In another possible embodiment, the specific steps for extracting Ethereum EIP proposals are as follows:

[0049] S11: Access the Ethereum EIP library URL;

[0050] S12: Extract an EIP proposal link;

[0051] S13: Extract Ethereum EIP proposals via the link.

[0052] Since Ethereum EIP proposals are currently mostly displayed on servers via web pages, retrieving Ethereum EIP proposals through EIP proposal links allows for convenient data extraction, enabling complete and accurate retrieval of the proposals.

[0053] In another possible embodiment, the information of all interfaces in the proposal is extracted by locating the paragraph corresponding to the keyword "specification". When the keyword of the paragraph containing the information changes, the information is extracted according to the paragraph corresponding to the changed keyword.

[0054] Generally, when all interface information in a proposal is stored on a webpage, it is stored in the paragraph corresponding to the keyword "specification". When the keyword definition changes later, the paragraph is adjusted and extracted according to the changed keyword, thereby achieving accurate location and extraction of the information.

[0055] In another possible embodiment, the information of all interfaces is located by their corresponding "function" keyword, and the data between the "(" symbol and ")" symbol in the location is extracted. The visibility keyword and function modifier keyword of the definition after the ")" symbol are extracted. When the definition method or information storage method of all interface information changes later, the information is extracted according to the new definition method.

[0056] Generally, all interface information is stored by starting with the corresponding "function" keyword, with data stored in parentheses and commas, and visibility keywords and function modifier keywords stored after the commas. When the definition method changes, the automatic extraction method will extract the information according to the new definition method.

[0057] In another possible embodiment, the extracted data, the visibility keywords, and the function modifiers are stored as elements in a row vector M. i In the context of M, i represents the i-th interface. i =[a i1 ,a i2 ,……a ij ], where a ij This is represented as the j-th element of the i-th interface. There are a total of j elements. When the number of data, visibility keywords, and function modifiers corresponding to all interfaces is less than j elements, the remaining elements are supplemented as empty elements.

[0058] By storing the extracted data, visibility keywords, and function modifiers in row vectors, the final structure becomes more consistent, which greatly facilitates the determination of information for all interfaces.

[0059] In another possible embodiment, the row vectors of all the interfaces are stored in the form of a matrix.

[0060] In another possible embodiment, the elements in the matrix are stored using a structure data type.

[0061] Example 2

[0062] like Figure 3 As shown, on the other hand, this application provides a computer-readable storage medium storing a computer program thereon, which, when executed in a computer, causes the computer to execute the above-described method for automatically generating an Ethereum EIP proposal risk assessment dimension library.

[0063] Example 3

[0064] On the other hand, this application provides a computer program product, characterized in that the computer program product stores instructions, which, when executed by a computer, cause the computer to implement the above-described method for automatically generating an Ethereum EIP proposal risk assessment dimension library.

[0065] In this embodiment of the invention, the term "multiple" refers to two or more, unless otherwise explicitly defined. The terms "install," "connect," and "fix" should be interpreted broadly. For example, "connect" can mean a fixed connection, a detachable connection, or an integral connection. Those skilled in the art can understand the specific meaning of the above terms in this embodiment of the invention based on the specific circumstances.

[0066] In the description of the embodiments of the present invention, it should be understood that the terms "upper" and "lower" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the embodiments of the present invention and simplifying the description, and do not indicate or imply that the device or unit referred to must have a specific orientation or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the embodiments of the present invention.

[0067] In the description of this specification, the terms "an embodiment," "a preferred embodiment," etc., refer to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0068] The above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of the present invention should be included within the protection scope of the embodiments of the present invention.

Claims

1. A method for automatically generating a risk assessment dimension library for Ethereum EIP proposals, characterized in that, Specifically, it includes: S1: Extract Ethereum EIP proposals and automatically extract information about all interfaces in the proposals, including information about standards, protocols, parameters, return values, visibility, and function modifiers; S2: Construct a risk matrix library for EIP proposals, using the interface as one dimension and parameters, return values, visibility, and function modifiers as another dimension. Assess the risks of Ethereum EIP proposals according to the EIP proposal standards and the element definitions within those standards. All interface information in the proposal is extracted by locating the paragraph corresponding to the keyword "specification". When the keyword of the paragraph containing the information changes, the information is extracted according to the paragraph corresponding to the changed keyword. Information about all interfaces is located using their corresponding "function" keyword. Data between the "(" and "")" symbols is extracted, along with the visibility keywords and function modifier keywords following the "")" symbol. If the definition or storage method of any interface information changes later, the information is extracted according to the new definition method. The extracted data, visibility keywords, and function modifiers are stored as elements in row vector M. i In the context of M, i represents the i-th interface. i =[a i1 ,a i2 , ……a ij ], where a ij This is represented as the j-th element of the i-th interface. There are a total of j elements. When the number of data, visibility keywords, and function modifiers corresponding to all interfaces is less than j elements, the remaining elements are supplemented as empty elements.

2. The method for automatically generating an Ethereum EIP proposal risk assessment dimension library as described in claim 1, characterized in that, Automatically extract one or more of the following information from the interface information in the proposal: standard, protocol, parameters, return value, visibility, and function modifiers. Based on the corresponding standard requirements, perform a risk assessment on one or more of these information.

3. The method for automatically generating an Ethereum EIP proposal risk assessment dimension library as described in claim 1, characterized in that, The specific steps for extracting Ethereum EIP proposals are as follows: S11: Access the Ethereum EIP library URL; S12: Extract an EIP proposal link; S13: Extract Ethereum EIP proposals via the link provided.

4. The method for automatically generating an Ethereum EIP proposal risk assessment dimension library as described in claim 1, characterized in that, Store the row vectors of all interfaces in the form of a matrix.

5. The method for automatically generating an Ethereum EIP proposal risk assessment dimension library as described in claim 4, characterized in that, The elements in the matrix are stored using a structure data type.

6. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method for automatically generating a risk assessment dimension library for Ethereum EIP proposals as described in any one of claims 1-5.

7. A computer program product, characterized in that, The computer program product stores instructions that, when executed by a computer, cause the computer to implement the method for automatically generating a risk assessment dimension library for Ethereum EIP proposals as described in any one of claims 1-5.

Images