Smart contract functional vulnerability detection method and system based on large language model

Abstract

This paper proposes a method and system for detecting functional vulnerabilities in smart contracts based on a large language model. The method includes the following steps: defining the mainstream functional vulnerability categories of the smart contracts to be detected; inputting the source code of the smart contract project; filtering the input source code at the contract level and the function level to extract the core function code related to the business; using a large language model agent based on the auditor's perspective to detect and analyze the core function code one by one; using a large language model agent based on the attacker's perspective to detect and analyze the core function code one by one; establishing a fusion model of the two-perspective agents, fusing the outputs of the two agents, and outputting the final functional vulnerability detection results. This method and system have strong understanding, analysis, and reasoning capabilities, and can achieve efficient and reliable functional vulnerability detection in smart contracts.

Description

Technical Field

[0001] The present invention relates to the technical field of smart contract vulnerability detection, and in particular to a method and system for detecting functional vulnerabilities in smart contracts based on a large language model. Background Art

[0002] The development of blockchain technology has profoundly impacted human life and production, particularly in the financial sector. Smart contracts are a fundamental pillar of blockchain, managing vast amounts of on-chain assets and playing a crucial role in facilitating various commercial transactions. However, if exploitable vulnerabilities exist within the smart contract code, they can cause irreparable economic losses.

[0003] To prevent these smart contract vulnerabilities from impacting normal on-chain transactions, a wide range of existing technologies have been applied to address the security of smart contract code, such as static and dynamic code analysis. These technologies often employ heuristic rules to detect vulnerabilities in the code, often only detecting common vulnerabilities in smart contracts similar to traditional software vulnerabilities, such as integer overflows and reentrancy vulnerabilities. However, the primary vulnerabilities in smart contracts are often not these common vulnerabilities; most are functional vulnerabilities. Functional vulnerabilities are primarily related to the high-level business logic of smart contracts. Because these vulnerabilities rely heavily on understanding the code implementation, traditional detection technologies struggle to detect them using fixed rules.

[0004] Based on this, the development teams of the majority of smart contract projects urgently need a reliable smart contract functional vulnerability detection method and system, which is of great significance for ensuring the security of smart contracts. Summary of the Invention

[0005] In view of the above background, the present invention aims to provide a method and system for detecting functional vulnerabilities in smart contracts based on a large language model. This method and system have strong understanding, analysis, and reasoning capabilities, and can realize efficient and reliable functional vulnerability detection of smart contracts.

[0006] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions:

[0007] The present invention proposes a method for detecting functional vulnerabilities in smart contracts based on a large language model, comprising the following steps:

[0008] S1, defines the categories of smart contract functional vulnerabilities to be detected, including primary categories and secondary categories belonging to each primary category;

[0009] S2, input the source code of the smart contract project to be analyzed;

[0010] S3 performs contract-level filtering on the input source code to extract core contracts related to the business.

[0011] S4, performing a function-level filtering operation on the core contract to extract the core function code related to the business;

[0012] S5: Use a large language model agent based on the auditor's perspective to detect and analyze the core function codes one by one, and obtain the secondary categories to which the potential functional vulnerabilities in each core function code belong;

[0013] S6: Use a large language model agent based on the attacker's perspective to detect and analyze the core function codes one by one, and obtain the first-level category to which the potential functional vulnerabilities in each core function code belong;

[0014] S7, establish a dual-perspective agent fusion model, through which the secondary categories and primary categories output by the large language model agent based on the auditor's perspective and the large language model agent based on the attacker's perspective are fused to output the final functional vulnerability detection results.

[0015] As a preferred solution, in step S5, the use of a large language model agent based on the auditor's perspective to perform a one-by-one detection and analysis of the core function codes specifically includes the following steps:

[0016] S501: Build a fine-tuning dataset based on historical smart contract projects to enhance the auditing capabilities of large language models;

[0017] S502: Build a large language model agent based on the auditor's perspective, and fine-tune the agent using a fine-tuning dataset designed to enhance the auditing capabilities of the large language model;

[0018] S503: Based on a multi-round query strategy based on business scenarios and implementation forms, a fine-tuned large language model agent is used to perform security analysis of the core function codes one by one.

[0019] S504: Determine potential functional vulnerabilities in the core function code of the smart contract based on the analysis results of the large language model agent, and at the same time determine the secondary category of the functional vulnerabilities based on the analysis results of the large language model agent.

[0020] As a further preferred solution, in step S503, the multi-round inquiry strategy based on the business scenario and implementation form includes the following three rounds, as follows:

[0021] The first round defines the agent as the auditor role, and the agent does not need to answer;

[0022] In the second round, the agent is fed the core function code to be analyzed and asked questions related to smart contract business scenarios to determine whether any of the pre-set business scenarios exist in the core function code. The format of the question related to the smart contract business scenario is "Does the code contain a certain business scenario?" If the agent answers "yes" in this round, the business scenario in the core function code is obtained and the third round of inquiries is executed. Otherwise, the inquiry ends.

[0023] The third round involves inputting the core function code to be analyzed into the large language model and asking the model questions related to the implementation form of the smart contract code. The format of the questions related to the implementation form of the smart contract is "Is there a certain business scenario in the code and does the code meet a certain form in business implementation?" If the agent answers "yes", the business implementation form of the core function code is obtained.

[0024] As a further preferred solution, step S504 is specifically as follows: if the three rounds of the multi-round query strategy based on the business scenario and implementation form are all executed and the answer of the intelligent agent in the third round is "yes", then it is judged that the input smart contract function code contains potential functional vulnerabilities, and based on the business scenario judged in the second round and the code implementation form judged in this round, the secondary category to which the potential functional vulnerability in the core function code belongs is judged; otherwise, there is no functional vulnerability in the core function code.

[0025] As a preferred solution, in step S6, the use of a large language model agent based on the attacker's perspective to perform detection and analysis on the core function codes one by one specifically includes the following steps:

[0026] S601: Construct a fine-tuning dataset based on historical smart contract attack events to enhance the vulnerability exploitation capabilities of large language models;

[0027] S602: Build a large language model agent based on the attacker's perspective and fine-tune the agent using a fine-tuning dataset designed to enhance the vulnerability exploitation capabilities of the large language model;

[0028] S603: Based on the multi-round query strategy based on vulnerability characteristics and attack exploitation, the fine-tuned intelligent agent performs security analysis on the core function code of the smart contract;

[0029] S604: Determine potential functional vulnerabilities in the core function code of the smart contract based on the analysis results of the large language model agent, and at the same time determine the first-level category to which the functional vulnerability belongs based on the analysis results of the large language model agent.

[0030] As a further preferred solution, in step S603, the multi-round query strategy based on vulnerability characteristics and attack exploitation includes the following three rounds, as follows:

[0031] In the first round, the agent is defined as the attacker and does not need to answer.

[0032] In the second round, the agent is asked questions related to the smart contract's core function code and vulnerability characteristics. The format of the question is "Is there any unsafe logic implementation in the code?" If the agent answers "yes" in this round, the unsafe logic in the core function code is determined and the third round of inquiry is executed. Otherwise, the inquiry ends.

[0033] The third round is to input the core function code of the smart contract and the unsafe logic obtained in the second round into the large language model, and ask the intelligent agent questions related to the analysis of smart contract attack exploitation; the format of the question is "Introduce the characteristics and attack process of a certain type of attack method, and ask whether it is possible to use this type of attack to exploit the related unsafe logic in the code"; if the intelligent agent answers "yes", the core function code is at risk of attack, and its attack method is determined.

[0034] As a further preferred solution, step S604 is specifically as follows: if all three rounds are completed and the answer of the intelligent agent in the third round is "yes", then it is determined that the input smart contract function code contains potential functional vulnerabilities, and based on the attack method determined in the query, the first-level category to which the potential functional vulnerability belongs is determined; otherwise, there is no functional vulnerability in the core function code.

[0035] The present invention also proposes a smart contract functional vulnerability detection system based on a large language model, which is used to implement the above-mentioned smart contract functional vulnerability detection method.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] (1) The present invention proposes a method and system for detecting functional vulnerabilities in smart contracts based on a large language model. The method and system proposed in the present invention do not rely on fixed detection rules, have strong understanding and analysis capabilities, and reasoning capabilities, and solve the technical problem of the difficulty in detecting functional vulnerabilities in smart contracts.

[0038] (2) The present invention provides a multi-perspective smart contract vulnerability analysis method, which innovatively combines the analysis results of the auditor and the attacker and performs a reasonable fusion analysis to achieve the goal of "maximizing the removal of false positives and maximizing the retention of potential vulnerabilities", thus making up for the shortcomings of the single-perspective intelligent agent in vulnerability analysis.

[0039] (3) This invention proposes a method for stimulating the emergence capability of a large language model from the perspective of smart contract auditing through fine-tuning, and a method for stimulating the emergence capability of a large language model from the perspective of smart contract vulnerability exploitation through fine-tuning. This method innovatively guides the large language model to deeply learn representative audit reports and historical attack events, focusing on learning the annotated and extracted vulnerability features, impacts, and exploitation methods. This improves the emergence capability of the large language model in contract vulnerability auditing and contract vulnerability exploitation, and better plays a positive role in the process of functional vulnerability detection.

[0040] (4) The present invention proposes a multi-round inquiry strategy that combines the auditor's thinking characteristics and a multi-round inquiry strategy that combines the attacker's thinking characteristics. This innovatively guides the large language model to analyze the smart contract code according to the audit thinking mode of "identifying scenarios" and "checking code implementation" and the attack thinking mode of "identifying vulnerability characteristics" and "exploiting vulnerability characteristics". This makes the large model's reasoning and judgment of vulnerabilities more reliable, and improves the accuracy of the identification results of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flow chart of the detection method for functional vulnerabilities in smart contracts based on a large language model;

[0042] Figure 2 Construct a flowchart for a large language model agent based on the auditor's perspective;

[0043] Figure 3 Construct a flowchart for a large language model agent based on the attacker's perspective;

[0044] Figure 4 This is the overall design diagram of the smart contract functional vulnerability detection system based on the large language model. DETAILED DESCRIPTION

[0045] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be noted that the following examples are intended to facilitate understanding of the present invention and do not have any limiting effect on the present invention.

[0046] The present invention provides a method for detecting functional vulnerabilities in smart contracts based on a large language model. The specific process is as follows: Figure 1 As shown, the specific implementation of each step is as follows:

[0047] Step 0: Define the mainstream functional vulnerability categories of smart contracts that the present invention intends to detect, including primary and secondary categories.

[0048] Specifically, there is a subordinate relationship between the first-level category and the second-level category. A first-level category can include multiple second-level categories, and a second-level category can only belong to one first-level category.

[0049] Specifically, the first-level categories of smart contract functional vulnerabilities in the present invention include: contract token value manipulation vulnerabilities, contract token transfer authorization missing vulnerabilities, calculation logic error vulnerabilities and control logic error vulnerabilities.

[0050] Specifically, the contract token value manipulation vulnerability in the present invention includes two secondary categories, namely: contract token manipulation vulnerability caused by automatic exchange and contract token value operation vulnerability caused by non-automatic exchange.

[0051] Specifically, the contract token transfer authorization missing vulnerability in the present invention includes two secondary categories, namely the contract token unauthorized transfer vulnerability and the contract token authorization mechanism logic error vulnerability.

[0052] Specifically, the computational logic error vulnerabilities in the present invention include three secondary categories, namely, checkpoint saving order error vulnerabilities, contract token update computation order error vulnerabilities, and contract token allocation computation mechanism error vulnerabilities.

[0053] Specifically, the control logic error vulnerabilities in the present invention include three secondary categories, namely voting mechanism manipulation vulnerabilities, contract token illegal locking vulnerabilities and locking control mechanism error vulnerabilities.

[0054] The vulnerability categories included in the above-mentioned primary and secondary categories can also be designed according to the needs of those skilled in the art.

[0055] Step 1: Enter the entire source code of the smart contract project.

[0056] Step 2: Perform contract-level analysis and filtering on the input smart contract project source code, extract the core contracts related to the business, and input them into the next step.

[0057] Specifically, the smart contract code analysis and filtering operation based on the contract level refers to the use of heuristic rules to remove contract files that are irrelevant to vulnerability detection, including general library files, interface files, etc., and output a core file set. The general library files refer to library files that are commonly used in other smart contracts, such as SafeMath library files, Address library files, and SafeERC20 library files.

[0058] Step 3: Analyze and filter the core contracts at the function level, extract the core functions related to the business and input them into the next step.

[0059] Specifically, function-level smart contract code analysis and filtering involves using heuristic rules to match function names, parameters, and basic function content, outputting a set of functions that contain actual business functionality. Specifically, this set of functions that contain actual business functionality excludes basic computational and interaction functions, which play a core role in implementing the smart contract project's functionality.

[0060] Specifically, the heuristic rules refer to abstract rules proposed based on the summary of manual function analysis experience, which can be automatically implemented using computer programs to execute batch processing tasks.

[0061] Step 4: Use a large language model agent based on the auditor's perspective to detect and analyze the core function codes one by one.

[0062] Specifically, this step includes the following sub-steps: Figure 2 As shown:

[0063] Sub-step 401 involves collecting source code and audit reports from representative smart contract projects. The audit report is a review and analysis of the source code for the smart contract project, including an analysis of the business operations implemented by the code, whether the code implementation is legal and compliant, the precise location of various vulnerabilities in the code, the types of vulnerabilities present and their severity, and the necessity and methods for remediating each vulnerability. The representative smart contract project is preferably a large-scale historical smart contract project that contains functional vulnerabilities.

[0064] Sub-step 402 structures the data collected in sub-step 401 to construct a fine-tuning dataset for enhancing the audit capabilities of the large language model. Specifically, this sub-step processes the source code and audit reports into a format suitable for large language model training. Each set of data includes: "Vulnerability code content," "Specific business description in the vulnerability code," "Type of functional vulnerability covered," and "Description of the impact caused by the vulnerability."

[0065] Sub-step 403 involves building a large language model agent based on the auditor's perspective and fine-tuning the model using a dataset designed to enhance the auditing capabilities of the large language model. Specifically, fine-tuning involves using a relevant fine-tuning dataset to fine-tune the large language model for specific task scenarios, thereby improving the large language model's ability to perform certain tasks and thereby stimulating its capabilities in performing these tasks.

[0066] Sub-step 404 proposes a multi-round query strategy based on business scenarios and implementation forms to achieve security analysis of the core code of the smart contract. Specifically, the multi-round query strategy in this sub-step includes three rounds of queries to stimulate the emergence of the large language model. The principles of question design follow the audit thinking method of "identifying scenarios" and "checking code implementation", as follows:

[0067] (1) The first round is to issue task instructions to the agent, requiring the agent to play the role of auditor. This round is the task instruction issuance stage, and the agent does not need to answer.

[0068] (2) The second round is to input the smart contract code that needs to be analyzed to the agent, and ask the agent questions related to the smart contract business scenario; the format of the question is "Is there a certain business scenario in the code?", where "a certain business scenario" needs to be replaced with a preset smart contract business scenario, and the basic format of the large language model's answer is "yes" or "no"; if the agent's answer in this round is "yes", the subsequent third round will continue, otherwise the inquiry will end. This round of inquiry will ask the agent multiple questions according to the question format, replacing the "certain business scenario" in the format, and verifying whether there is any of the preset business scenarios in the core function code. Specifically, the preset smart contract business scenario is, for example: the function of this code segment is to transfer the contract token from address 1 to the business function of address 2.

[0069] (3) The third round is to input the smart contract code that needs to be analyzed into the large language model, and ask the large language model questions related to the implementation form of the smart contract; the format of the question is "Is there a certain business scenario in the code and whether the code satisfies a certain form in the business implementation", where "a certain business scenario" needs to be replaced with the business scenario obtained in the second round, and "a certain form" needs to be replaced with the preset smart contract business implementation form. The basic format of the large language model's answer is "yes" or "no". This round of inquiry will also ask the intelligent agent multiple times according to the question format, changing the "a certain form" in the format. Specifically, the preset smart contract code implementation form is, for example: before the code of the contract token sending operation, this section of code lacks the code statement for judging the legality of the authorized transfer quantity of tokens in this round.

[0070] In sub-step 405, the large language model agent outputs the results based on the auditor's perspective. Specifically, the agent determines the existence of a functional vulnerability based on the following criteria: completion of all three rounds and a "yes" answer in the third round. In the query strategy, the third round of queries is a deepening of the second round of queries. The second and third rounds of queries have a one-to-one relationship, and the questions in the second and third rounds are both based on the second-level vulnerability classification. Therefore, the vulnerability classification granularity of the agent's final output is the second-level category of smart contract functional vulnerabilities.

[0071] Step 5: Use a large language model agent based on the attacker's perspective to detect and analyze the core function codes one by one.

[0072] Specifically, this step includes the following sub-steps: Figure 3 As shown:

[0073] Sub-step 501: Collect historical smart contract attack events and analysis reports. The analysis report is an analysis of historical attack events, including a brief introduction to the current attack, analysis of the attacker's attack process, analysis of the vulnerable code of the attacked party, the impact of the current attack, and vulnerability repair methods and defense measures.

[0074] Sub-step 502 structures the data collected in sub-step 501 to construct a fine-tuning dataset for enhancing the vulnerability exploitation capabilities of the large language model. Specifically, this sub-step processes attack events and analysis reports into a format suitable for large-scale model training. Each set of data includes: "attacked code content," "covered functional vulnerability types," "specific vulnerability exploitation methods used in this attack," and "the impact of this attack."

[0075] In sub-step 503, a large language model agent is built from the attacker's perspective, and the model is fine-tuned using a dataset designed to enhance the large language model's vulnerability exploitation capabilities. The fine-tuning training method is the same as that of sub-step 403.

[0076] Sub-step 504 proposes a multi-round query strategy based on vulnerability characteristics and attack exploitation to achieve security analysis of the core code of the smart contract. Specifically, the multi-round query strategy in this sub-step includes three rounds of queries to stimulate the emergence of the large language model. The principle of question design follows the attack thinking method of "identifying vulnerability characteristics" and "exploiting vulnerability characteristics", as follows:

[0077] (1) The first round is to issue task instructions to the large language model, requiring the large language model to play the role of an attacker. This round is the task instruction issuance stage, and the large language model does not need to answer.

[0078] (2) The second round is to input the smart contract code that needs to be analyzed into the large language model and ask the large language model questions related to the characteristics of smart contract vulnerabilities; the format of the question is "Is there any unsafe logical implementation in the code?", and the basic format of the large language model's answer is "yes" or "no"; if the answer of the intelligent agent in this round is "yes", the subsequent third round will continue, otherwise the inquiry will end.

[0079] Unsafe logic, for example: This code fails to determine the identity of the token sender during contract token transfer.

[0080] (3) The third round is to input the smart contract code that needs to be analyzed into the large language model, and ask the large language model questions related to the analysis of smart contract attack exploitation; the format of the question is "Introduce a certain type of attack method with characteristics and attack process, can this type of attack be used to exploit the relevant vulnerabilities in the code?" The basic format of the large language model's answer is "yes" or "no".

[0081] For example, questions in the third round of inquiries are: There is an attack method that can bypass security checks through parameter passing, modify the address of the token sender, and then illegally transfer the victim's contract token to the attacker's address. Can such an attack method be used to exploit the unsafe logic in this code?

[0082] Sub-step 505: The large language model agent outputs the results based on the attacker's perspective. Specifically, the agent determines the existence of a functional vulnerability based on the following criteria: all three rounds are completed and the answer to the third round is "yes", and the vulnerability classification granularity ultimately output by the agent is the first-level category of smart contract functional vulnerabilities. In the inquiry strategy, the third round of inquiries is an in-depth study of the second round of inquiries. The second and third rounds of inquiries have a many-to-one relationship. The second round of inquiries are all based on the second-level category of vulnerability classification in terms of question design, and the third round of inquiries are all based on the first-level category of vulnerability classification in terms of question design. Therefore, the vulnerability classification granularity ultimately output by the agent is the first-level category of smart contract functional vulnerabilities.

[0083] Step 6: Establish a dual-perspective agent fusion model, fuse the output results of the large language model agent based on the auditor's perspective and the large language model agent based on the attacker's perspective, and output the final functional vulnerability detection results.

[0084] Specifically, the dual-perspective agent fusion model defines the following symbolic representation:

[0085] Symbol (1) is the first-level classification of smart contract functional vulnerabilities, denoted as: T.

[0086] Symbol (2) represents the secondary classification of smart contract functional vulnerabilities, denoted as: t.

[0087] Specifically, the dual-perspective agent fusion model defines the following fusion rules, which include five fusion rules:

[0088] Rule (1) If t belongs to T, then add t to the candidate category set.

[0089] Rule (2): If t belongs to T, then t is added to the candidate category set, and other secondary categories belonging to T are also added to the candidate category set.

[0090] Rule (3) If t does not belong to T, skip it.

[0091] Rule (4) If T is empty and only t exists, skip it.

[0092] Rule (5) If t is empty and only T exists, skip it.

[0093] It should be noted that the number t is empty or T is empty, which means that the current core function code has no functional vulnerabilities for the large language model agent based on the auditor's perspective or for the large language model agent based on the attacker's perspective.

[0094] According to the characteristics of different vulnerabilities and their differences, the present invention adopts different fusion rules for vulnerabilities of different first-level categories to achieve the purpose of "maximizing the removal of false positives and maximizing the retention of potential vulnerabilities". For the first-level categories of token price manipulation vulnerabilities and token transfer authorization missing vulnerabilities, the fusion model of the dual-perspective intelligent agent selects fusion rules (2)(3)(4)(5); in other cases, the fusion model of the dual-perspective intelligent agent selects fusion rules (1)(3)(4)(5). The candidate category set obtained after fusion is the output functional vulnerability detection result, and the vulnerability classification granularity is the second-level category of smart contract functional vulnerabilities.

[0095] Based on the same inventive concept, this embodiment also provides a smart contract functional vulnerability detection system based on a large language model, such as Figure 4 As shown, it specifically includes the following modules:

[0096] Input module: This module is used to read the source code of the smart contract project to be analyzed.

[0097] Data preprocessing module: This module is used to analyze and filter the input smart contract project source code based on the contract level and function level, and extract the core function code related to the business.

[0098] Large model agent module based on the auditor's perspective: This module uses the fine-tuned large language model agent based on the auditor's perspective to execute multi-round query strategies based on business scenarios and implementation forms to achieve security analysis of the core code of the smart contract.

[0099] Large model agent module based on the attacker's perspective: This module uses a fine-tuned large language model agent based on the attacker's perspective to execute a multi-round query strategy based on vulnerability features and attack exploits to achieve security analysis of the core code of the smart contract.

[0100] Fusion analysis module: This module is used to fuse the output results of the large language model agent based on the auditor's perspective and the large language model agent based on the attacker's perspective, and output the final vulnerability detection results.

[0101] Furthermore, the system also includes the following modules:

[0102] Training data collection module: This module is used to collect source code and audit reports of representative smart contract projects, real smart contract attack incidents and analysis reports that have occurred in history, and construct two fine-tuning datasets to enhance the auditing and vulnerability exploitation capabilities of large language models.

[0103] Model fine-tuning training module: This module is used to fine-tune the training of the large language model agent based on the auditor's perspective and the large language model agent based on the attacker's perspective.

[0104] As for the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can be referred to the partial description of the method embodiment, and the implementation methods of the remaining modules will not be repeated here. The system embodiment described above is only illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of the present invention. Ordinary technicians in this field can understand and implement it without paying any creative work.

[0105] Embodiments of the system of the present invention can be applied to any device with data processing capabilities, such as a computer or other device. System embodiments can be implemented through software, hardware, or a combination of software and hardware. For example, a software implementation, as a logical device, is implemented by a processor of any device with data processing capabilities, reading corresponding computer program instructions from non-volatile memory into internal memory and executing them.

[0106] The embodiments described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting functional vulnerabilities in smart contracts based on a large language model, characterized in that: The following steps are involved: S1, defines the categories of smart contract functional vulnerabilities to be detected, including primary categories and secondary categories belonging to each primary category; The first-level categories include: contract token value manipulation vulnerabilities, contract token transfer authorization missing vulnerabilities, calculation logic error vulnerabilities, and control logic error vulnerabilities; S2, input the source code of the smart contract project to be analyzed; S3 performs contract-level filtering on the input source code to extract core contracts related to the business. S4, performing a function-level filtering operation on the core contract to extract the core function code related to the business; S5: Use a large language model agent based on the auditor's perspective to detect and analyze the core function codes one by one, and obtain the secondary categories to which potential functional vulnerabilities in each core function code belong; S6: Use a large language model agent based on the attacker's perspective to detect and analyze the core function codes one by one, and obtain the first-level category to which the potential functional vulnerabilities in each core function code belong; S7: Establish a fusion model of the dual-perspective large language model agent. This fusion model fuses the secondary and primary categories output by the large language model agent based on the auditor's perspective and the large language model agent based on the attacker's perspective, and outputs the final functional vulnerability detection results, including: Initialize the candidate category set. For each core function code, the dual-perspective large language model agent fusion model adopts different fusion rules according to different first-level categories. The first-level category of the functional vulnerability obtained in step S6 and the second-level category of the functional vulnerability obtained in step S5 are categorized and fused. The candidate category set is updated. The final candidate category set obtained after fusion is the output functional vulnerability detection result, specifically the second-level category of the smart contract functional vulnerability. The fusion model of the dual-perspective large language model agent specifically includes the following fusion rules: Rule 1): If t belong T , then t Join the candidate category set; Rule 2): If t belong T , then t Add to the candidate category set, and T Other secondary categories are also added to the candidate category set; Rule 3): If t Not T , then skip; Rule 4): If T Empty, only exists t , then skip; Rule 5): If t Empty, only exists T , then skip; In the above rules, T Indicates the first-level category of smart contract functional vulnerabilities, t Represents the secondary classification of smart contract functional vulnerabilities; For vulnerabilities of the first-level category of contract token value manipulation vulnerabilities and contract token transfer authorization loss vulnerabilities, the fusion model of the dual-perspective large language model intelligent agent adopts fusion rules 2), 3), 4) and 5); for vulnerabilities of the first-level category of computational logic error vulnerabilities and control logic error vulnerabilities, the fusion rules 1), 3), 4) and 5) are adopted.

2. The method for detecting functional vulnerabilities in smart contracts based on a large language model according to claim 1, characterized in that: In step S3, the contract-level filtering operation refers to: for the input source code, using heuristic rules to remove contract files that are not related to vulnerability detection, and the remaining source code after removal is the core contract related to the business; the contract files that are not related to vulnerability detection specifically include general library files and interface files.

3. The method for detecting functional vulnerabilities in smart contracts based on a large language model according to claim 1, wherein: In step S4, the function-level filtering operation refers to: using heuristic rules to analyze each function contained in the core contract in turn, and outputting a set of functions containing actual business functions, that is, the core function code related to the business.

4. The method for detecting functional vulnerabilities in smart contracts based on a large language model according to claim 1, wherein: In step S5, the use of the large language model agent based on the auditor's perspective to perform detection and analysis on the core function codes one by one specifically includes the following steps: S501: Construct a fine-tuning dataset based on historical smart contract projects to enhance the auditing capabilities of the large language model. In the fine-tuning dataset, a set of data is created for each functional vulnerability existing in the source code of the historical smart contract projects. Each set of data includes: the content of the vulnerability code, the specific business description in the vulnerability code, the type of functional vulnerability covered, and a description of the impact caused by the vulnerability; S502: Build a large language model agent based on the auditor's perspective, and fine-tune the large language model agent using a fine-tuning dataset used to enhance the auditing capability of the large language model; S503: Based on the business scenario and implementation form, a multi-round query strategy is used to perform security analysis of the core function codes one by one through a fine-tuned large language model agent. S504: Determine potential functional vulnerabilities in the core function code of the smart contract based on the analysis results of the large language model agent, and at the same time determine the secondary category of the functional vulnerabilities based on the analysis results of the large language model agent.

5. The method for detecting functional vulnerabilities in smart contracts based on a large language model according to claim 4, characterized in that: In step S503, the multi-round inquiry strategy based on the business scenario and implementation form includes the following three rounds, as follows: The first round defines the large language model agent as the auditor role, and the large language model agent does not need to answer; In the second round, the large language model agent is fed the core function code to be analyzed and asked questions related to smart contract business scenarios to determine whether the core function code contains any of the preset business scenarios. The format of the question related to the smart contract business scenario is "Does the code contain a certain business scenario?", where "a certain business scenario" needs to be replaced with a preset smart contract business scenario. The basic format of the large language model's answer is "yes" or "no". If the large language model agent answers "yes" in this round, the business scenario present in the core function code is obtained and the third round of inquiries is executed. Otherwise, the inquiry ends. The third round is to input the core function code to be analyzed into the large language model, and ask the large language model questions related to the implementation form of the smart contract code; the format of the questions related to the implementation form of the smart contract is "whether there is a certain business scenario in the code and whether the code satisfies a certain form in the business implementation", where "certain business scenario" needs to be replaced with the business scenario obtained in the second round, and "certain form" needs to be replaced with the preset smart contract business implementation form. The basic format of the large language model's answer is "yes" or "no"; if the answer of the large language model agent is "yes", the business implementation form of the core function code is obtained. Step S504 specifically includes: if all three rounds of the multi-round query strategy based on business scenarios and implementation forms are executed and the answer of the large language model agent in the third round is "yes", then it is determined that the input smart contract function code contains potential functional vulnerabilities, and based on the business scenario determined in the second round and the code implementation form determined in this round, the secondary category of the potential functional vulnerability in the core function code is determined; Otherwise, there are no functional vulnerabilities in the core function code.

6. The method for detecting functional vulnerabilities in smart contracts based on a large language model according to claim 1, wherein: In step S6, the large language model agent based on the attacker's perspective is used to detect and analyze the core function codes one by one, specifically including the following steps: S601: Based on historical smart contract attack events, a fine-tuning dataset is constructed to enhance the vulnerability exploitation capabilities of the large language model. In the fine-tuning dataset, a set of data is created for each round of attack in the historical smart contract attack events. Each set of data includes the content of the attacked code, the type of functional vulnerability covered, the specific method of exploiting the vulnerability in this round of attack, and the impact of this round of attack. S602: Build a large language model agent based on the attacker's perspective, and fine-tune the large language model agent using a fine-tuning dataset used to enhance the vulnerability exploitation capability of the large language model; S603: Based on a multi-round query strategy based on vulnerability characteristics and attack exploitation, a fine-tuned large language model agent is used to perform security analysis on the core function code of the smart contract. S604: Determine potential functional vulnerabilities in the core function code of the smart contract based on the analysis results of the large language model agent, and at the same time determine the first-level category to which the functional vulnerability belongs based on the analysis results of the large language model agent.

7. The method for detecting functional vulnerabilities in smart contracts based on a large language model according to claim 6, characterized in that: In step S603, the multi-round query strategy based on vulnerability characteristics and attack exploitation includes the following three rounds, as follows: In the first round, the large language model agent is defined as the attacker, and the large language model agent does not need to answer; In the second round, the large language model agent is fed with the core function code of the smart contract that needs to be analyzed, and is asked questions related to the characteristics of the smart contract vulnerabilities. The format of the question is "Is there any unsafe logic implementation in the code?" The basic format of the large language model agent's answer is "yes" or "no". If the large language model agent answers "yes" in this round, the unsafe logic in the core function code is determined to exist, and the third round of inquiry is executed. Otherwise, the inquiry ends. The third round involves inputting the smart contract core function code and the unsafe logic obtained in the second round into the large language model. The large language model agent is then asked questions related to smart contract attack exploitation analysis. The format of the question is "Introduce the characteristics and attack process of a certain type of attack method. Can this type of attack be used to exploit the relevant unsafe logic in the code?" The phrase "Introduce the characteristics and attack process of a certain type of attack method" needs to be replaced with the corresponding description based on the preset attack method. The basic format of the large language model agent's answer is "yes" or "no". If the large language model agent answers "yes", the core function code is at risk of attack, and the attack method is determined. Specifically, step S604 is as follows: if all three rounds are completed and the answer of the large language model agent in the third round is "yes", then it is determined that the input smart contract function code contains a potential functional vulnerability, and based on the attack method determined in the query, the first-level category to which the potential functional vulnerability belongs is determined; otherwise, there is no functional vulnerability in the core function code.

8. A smart contract functional vulnerability detection system based on a large language model, used to implement the method described in claim 1, characterized in that: The system comprises: Input module, used to read the source code of the smart contract project to be analyzed; The data preprocessing module is used to perform analysis and filtering operations based on the contract level and function level, and further perform analysis and filtering operations at the function level to extract the core function code related to the business; The large language model agent module based on the auditor's perspective is used to detect and analyze the core function code from the auditor's perspective and obtain the secondary categories to which potential functional vulnerabilities in each core function code belong; The large language model agent module based on the attacker's perspective is used to detect and analyze the core function code from the attacker's perspective, and obtain the first-level category to which the potential functional vulnerabilities in each core function code belong; The fusion analysis module is used to fuse the output results of the large language model agent module based on the auditor's perspective and the large language model agent module based on the attacker's perspective, and output the final vulnerability detection results.

Images