Intelligent contract auditing method and device, block chain system and computer equipment

Abstract

The invention relates to an intelligent contract auditing method and device, a block chain system, computer equipment, a computer readable storage medium and a computer program product, and the method comprises the steps: obtaining a to-be-audited intelligent contract, and extracting a source code and annotation information in the intelligent contract; performing semantic analysis on the source code and the annotation information to obtain code semantic features and annotation semantic features of the smart contract; based on the similarity between the code semantic feature and the annotation semantic feature, determining a semantic audit result of the smart contract; under the condition that the similarity meets a correction condition, performing correction processing on the source code based on the annotation semantic feature and the code semantic feature to obtain an updated code; and determining an audit result of the smart contract in combination with the semantic audit result and a vulnerability audit result obtained by performing vulnerability analysis on the update code. By adopting the method, the audit of the intelligent contract can be automatically completed, and the working efficiency of the intelligent contract audit process is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a smart contract auditing method, apparatus, blockchain system, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] Smart contracts are computer protocols that transmit, verify or execute contracts in an information-based manner and are widely used in blockchain technology. Due to the tamper-proof nature of blockchain, once a smart contract is published on the blockchain network, it cannot be modified. Therefore, smart contracts need to be audited before publication.

[0003] In traditional technology, professionals need to conduct repeated manual comparison and analysis to obtain relatively accurate audit results when auditing smart contracts. With the advancement of technology, the processing method of smart contract audits has shifted from offline to online processing with the help of computer equipment, but the current online processing process relies on human-computer interaction, and long-term data processing requires more computing resources. Therefore, there is a problem of low efficiency in the processing process. Summary of the invention

[0004] Based on this, it is necessary to provide a smart contract auditing method, device, computer equipment, blockchain system, computer-readable storage medium and computer program product that can improve efficiency in response to the above-mentioned technical problems.

[0005] In a first aspect, the present application provides a smart contract auditing method. The method comprises:

[0006] Obtain the smart contract to be audited, and extract the source code and annotation information in the smart contract;

[0007] Performing semantic analysis on the source code and the annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract;

[0008] Determining a semantic audit result of the smart contract based on the similarity between the code semantic feature and the annotation semantic feature;

[0009] When the similarity satisfies a correction condition, the source code is corrected based on the annotation semantic feature and the code semantic feature to obtain an updated code;

[0010] The audit result of the smart contract is determined by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the update code.

[0011] In the second aspect, the present application also provides a blockchain system. The system includes a contract audit node and an on-chain processing node;

[0012] The contract audit node is used to obtain the smart contract to be audited, extract the source code and annotation information in the smart contract; perform semantic analysis on the source code and the annotation information respectively to obtain the code semantic features and the annotation semantic features of the smart contract; determine the semantic audit result of the smart contract based on the similarity between the code semantic features and the annotation semantic features; if the similarity meets the correction condition, perform correction processing on the source code based on the annotation semantic features and the code semantic features to obtain the updated code; determine the audit result of the smart contract by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the updated code;

[0013] The on-chain processing node performs on-chain processing on the smart contract when the audit result meets the on-chain conditions.

[0014] In a third aspect, the present application also provides a smart contract auditing device. The device comprises:

[0015] An information extraction module, used to obtain the smart contract to be audited and extract the source code and annotation information in the smart contract;

[0016] A semantic analysis module, used to perform semantic analysis on the source code and the annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract;

[0017] A semantic audit module, used to determine a semantic audit result of the smart contract based on the similarity between the code semantic feature and the annotation semantic feature;

[0018] A code updating module, configured to, when the similarity satisfies a correction condition, perform correction processing on the source code based on the annotation semantic feature and the code semantic feature to obtain an updated code;

[0019] An audit result determination module is used to determine the audit result of the smart contract by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the update code.

[0020] In a fourth aspect, the present application provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0021] Obtain the smart contract to be audited, and extract the source code and annotation information in the smart contract;

[0022] Performing semantic analysis on the source code and the annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract;

[0023] Determining a semantic audit result of the smart contract based on the similarity between the code semantic feature and the annotation semantic feature;

[0024] When the similarity satisfies a correction condition, the source code is corrected based on the annotation semantic feature and the code semantic feature to obtain an updated code;

[0025] The audit result of the smart contract is determined by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the update code.

[0026] In a fifth aspect, the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0027] Obtain the smart contract to be audited, and extract the source code and annotation information in the smart contract;

[0028] Performing semantic analysis on the source code and the annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract;

[0029] Determining a semantic audit result of the smart contract based on the similarity between the code semantic feature and the annotation semantic feature;

[0030] When the similarity satisfies a correction condition, the source code is corrected based on the annotation semantic feature and the code semantic feature to obtain an updated code;

[0031] The audit result of the smart contract is determined by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the update code.

[0032] In a sixth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0033] Obtain the smart contract to be audited, and extract the source code and annotation information in the smart contract;

[0034] Performing semantic analysis on the source code and the annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract;

[0035] Determining a semantic audit result of the smart contract based on the similarity between the code semantic feature and the annotation semantic feature;

[0036] When the similarity satisfies a correction condition, the source code is corrected based on the annotation semantic feature and the code semantic feature to obtain an updated code;

[0037] The audit result of the smart contract is determined by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the update code.

[0038] The above-mentioned smart contract auditing method, device, blockchain system, computer equipment, computer-readable storage medium and computer program product extract source code and annotation information from the smart contract to be audited, and perform semantic analysis on the source code and annotation information in the smart contract respectively, and obtain semantic audit results based on the semantic similarity of the two. On this basis, if the similarity meets the correction condition, the source code is first corrected to obtain the updated code, and then the subsequent vulnerability analysis is performed. The vulnerability analysis of the corrected code after the semantic correction can avoid the misjudgment of vulnerabilities caused by source code logic errors, which is conducive to improving the accuracy of vulnerability audit results; combining the semantic audit results and the vulnerability audit results obtained by vulnerability analysis of the updated code to determine the audit results of the smart contract is equivalent to auditing the smart contract from the semantic and vulnerability levels, which can improve the accuracy of the audit results. At the same time, the above method can automatically complete the audit of the smart contract, which can improve the accuracy of the audit results while improving the work efficiency of the smart contract audit process. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 An application environment diagram of a smart contract auditing method in one embodiment;

[0040] Figure 2 1. A flowchart of a smart contract auditing method in one embodiment;

[0041] Figure 3 A schematic diagram of the process of uploading a smart contract to a blockchain in one embodiment;

[0042] Figure 4 Schematic diagram of the processing process of a smart contract in one embodiment;

[0043] Figure 5 A schematic diagram of a process of modifying source code to obtain updated code in one embodiment;

[0044] Figure 6 A flowchart of a smart contract auditing method in another embodiment;

[0045] Figure 7 A structural block diagram of a blockchain system in one embodiment;

[0046] Figure 8 A schematic diagram of the core components of a blockchain system for implementing contract auditing in one embodiment;

[0047] Fig. 9 Schematic diagram of the audit process of a smart contract in one embodiment;

[0048] Fig.10 It is a structural block diagram of a smart contract auditing device in one embodiment;

[0049] Fig.11 is an internal structure diagram of a computer device in one embodiment;

[0050] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in another embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] Before going into detail, some terms involved in this application are explained first.

[0053] Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0054] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operation monitoring. Among them, the user management module is responsible for the identity information management of all blockchain participants, including maintaining public and private key generation (account management), key management, and the maintenance of the correspondence between the user's real identity and the blockchain address (authority management), etc., and, under authorization, supervises and audits the transactions of certain real identities and provides risk control rule configuration (risk control audit); the basic service module is deployed on all blockchain node devices to verify the validity of business requests, and records valid requests to storage after consensus is reached. For a new business request, the basic service first adapts the interface for parsing and authentication (interface adaptation), and then encrypts the business information through the consensus algorithm (consensus management). The smart contract module is responsible for the registration and issuance of contracts, as well as contract triggering and contract execution. Developers can define the contract logic in a programming language and publish it to the blockchain (contract registration). According to the logic of the contract terms, the key or other events are called to trigger the execution and complete the contract logic. It also provides the function of contract upgrade and cancellation. The operation monitoring module is mainly responsible for the deployment, configuration modification, contract setting, cloud adaptation and real-time status visualization output of the product during the product release process, such as alarm, network status monitoring, node equipment health status monitoring, etc.

[0055] The platform product service layer provides the basic capabilities and implementation framework of typical applications. Developers can superimpose business features based on these basic capabilities to complete the blockchain implementation of business logic. The application service layer provides application services based on blockchain solutions for business participants to use.

[0056] The smart contract auditing method provided in this application can be applied to Figure 1In the application environment shown. The application environment includes a contract provider 101, a contract audit node 102 and an on-chain processing node 103 on the blockchain. The three can communicate over the network, and the contract audit node 102 and the on-chain processing node 103 can realize the consensus, data recording and on-chain functions in the blockchain technology based on the smart contract. Among them, the contract audit node 102 obtains the smart contract to be audited from the contract provider 101, and audits the smart contract to determine the audit result of the smart contract. When the audit result meets the on-chain conditions, the on-chain processing node 103 performs on-chain processing on the smart contract so that the smart contract can be called by the consensus node on the blockchain. In the process of auditing the smart contract, the contract audit node 102 extracts the source code and annotation information in the smart contract, performs semantic analysis on the source code and the annotation information respectively, and obtains the code semantic features and the annotation semantic features of the smart contract; determines the semantic audit result of the smart contract based on the similarity between the code semantic features and the annotation semantic features; when the similarity meets the correction condition, corrects the source code based on the annotation semantic features and the code semantic features to obtain the updated code; and determines the audit result of the smart contract by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the updated code.

[0057] Furthermore, the contract provider 101, the contract audit node 102 and the on-chain processing node 103 can all be implemented through a terminal or a server. Among them, the terminal includes but is not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc., and the server can be implemented as an independent server or a server cluster composed of multiple servers. The embodiments of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc.

[0058] In some embodiments, Figure 2 As shown, a smart contract audit method is provided. This embodiment applies this method to Figure 1 Taking the contract audit node 102 in the example as an example, the following steps are included:

[0059] Step S202: Obtain the smart contract to be audited, and extract the source code and annotation information in the smart contract.

[0060] Among them, the smart contracts to be audited refer to the smart contracts that have not yet been released on the blockchain network, that is, the smart contracts that have not yet been put on the chain. Smart contracts are one of the core applications of blockchain technology. They can realize decentralized automated contract execution and have the characteristics of programmability, non-tamperability, and transparency. However, since there may be loopholes and errors in the writing process of smart contracts, and once the smart contracts are released on the blockchain network, they cannot be modified. Once the loopholes and errors in the smart contracts released on the blockchain network are exploited by attackers, they may lead to asset losses and trust crises, seriously affecting the security of the blockchain system. Therefore, the smart contracts are usually audited before they are released.

[0061] Source code, also known as original code, refers to an uncompiled text file written in a specific programming language and written in accordance with certain programming language specifications. It is a series of human-readable computer language instructions. The programming language can be an object-oriented programming (OOP) type programming language, such as C++, Java, etc., or a procedure-oriented (PO) type programming language, such as C, Fortran, etc. Comment information is an explanation and description of the source code, and the specific type of comment information is not unique. In terms of the purpose of commenting, the comment information may include preface comments and functional comments. The preface comments may include description information on the interface, data, and functions of the module; the functional comments may include description information on the function of the program segment, the function of the statement, and the status of the data. In terms of the number of lines occupied by the comment information, the comment information may include single-line comments and multi-line comments. It can be understood that in the process of the smart contract being called, the source code will be executed and the comment information will not be executed.

[0062] Specifically, the contract audit node can obtain the smart contract to be audited from the contract provider. The contract provider can be, for example, the terminal where the developer is located, or a smart contract integrated development platform. After obtaining the smart contract to be audited, the contract audit node can perform information extraction processing on the smart contract to extract the source code and annotation information. Since smart contracts usually include two parts: source code and annotation information, the contract audit node can separate the source code and annotation information by extracting the source code or annotation information, and then obtain the source code and annotation information in the smart contract.

[0063] Furthermore, the specific method of extracting source code is not unique. For example, the contract audit node can extract the content that complies with the programming specification of the programming language from the smart contract according to the programming language of the source code to obtain the source code of the smart contract; it can also extract the source code from the smart contract based on the source code viewing function of the integrated development environment (IDE). Correspondingly, the specific method of extracting comment information is not unique. For example, the contract audit node can extract comment information from the smart contract based on the comment viewing function of the integrated development environment; it can also extract comment information from the smart contract by using a document tool (such as a Java document tool); it can also obtain the set comment delimiter, match each character contained in the smart contract with the comment delimiter, determine the position of the comment delimiter in the smart contract, and extract comment information from the smart contract according to the comment type corresponding to the comment delimiter according to the position of the comment delimiter.

[0064] Step S204: perform semantic analysis on the source code and the annotation information respectively to obtain the code semantic features and the annotation semantic features of the smart contract.

[0065] Among them, the code semantic feature is used to characterize the semantic characteristics of the source code, and the annotation semantic feature is used to characterize the semantic characteristics of the annotation information. The code semantic feature and the annotation semantic feature can be specifically represented by a vector or a matrix. The semantic feature may include features of at least one dimension such as control flow, data flow, or function call relationship. That is, the code semantic feature and the annotation semantic feature may include sub-features of at least one dimension such as control flow, data flow, or function call relationship. In one embodiment, the sub-features contained in the code semantic feature and the annotation semantic feature are the same, so that subsequent similarity analysis can be facilitated.

[0066] Specifically, the contract audit node can perform semantic analysis on the source code and the comment information respectively to obtain the code semantic features and the comment semantic features of the smart contract. For example, the contract audit node can perform grammatical analysis on the source code and the comment information respectively to obtain the grammatical information of the source code and the comment information respectively. On this basis, the semantic recognition is performed on each grammatical information respectively to obtain the semantic information of the source code and the comment information respectively. Finally, based on the trained feature extraction network, the feature extraction is performed on each semantic information respectively to obtain the code semantic features and the comment semantic features. Among them, the grammatical information of the source code can represent specific code statements, such as keywords, variable names, symbols, etc. The semantic information of the source code can represent the meaning of the source code, that is, the function implemented by the source code. The semantic information may include at least one of the information such as control flow information, data flow information or function call relationship. For another example, the contract audit node can first convert the source code and the comment information into natural language respectively, and then based on the natural language processing technology (Natural Language Processing, NLP), the converted source code and the comment information are semantically analyzed respectively to obtain the code semantic features and the comment semantic features of the smart contract.

[0067] In a specific embodiment, the contract audit node obtains the sub-semantic information of the source code and the annotation information in the dimensions of control flow, data flow, and function call relationship, performs feature extraction on each sub-semantic information, obtains sub-semantic features of multiple dimensions, and then fuses the sub-semantic features of the source code in each dimension to obtain the code semantic features, and fuses the sub-semantic features of the annotation information in each dimension to obtain the annotation semantic features. The specific implementation algorithm of feature fusion may include at least one of summation, concatenation, or cross multiplication algorithms.

[0068] Step S206, determining the semantic audit result of the smart contract based on the similarity between the code semantic features and the annotation semantic features.

[0069] Among them, the semantic audit result refers to the audit result of the semantic dimension, and the data form of the semantic audit result can be a level or a numerical value, etc. That is, the semantic audit result can be expressed as a semantic audit level or a semantic audit score. It can be understood that the higher the similarity between the code semantic features and the annotation semantic features, the higher the matching degree between the source code and the annotation information, and the annotation information is an explanation and description of the source code, which can usually reflect the true intention of the developer during the coding process, that is, the annotation semantic features can represent the expected code semantics of the source code. In other words, the higher the similarity between the annotation semantic features and the code semantic features, the lower the possibility of errors in the source code at the semantic level.

[0070] Based on this, after obtaining the code semantic features and annotation semantic features of the smart contract through semantic analysis, the contract audit node can perform similarity analysis on the two, determine the similarity between the code semantic features and the annotation semantic features, and determine the semantic audit result of the smart contract based on the similarity. The similarity can be characterized by at least one of multiple similarity indicators such as Euclidean distance, Manhattan distance, Mahalanobis distance or cosine similarity. In a specific implementation, the similarity is characterized by multiple similarity indicators. The contract audit node can perform similarity analysis on the code semantic features and the annotation semantic features based on the similarity algorithm of each similarity indicator, determine the index value of each similarity indicator, and then perform statistics on each index value based on the index weight of each similarity indicator to determine the similarity between the code semantic features and the annotation semantic features. The specific algorithm used in the process of statistically analyzing each index value may include at least one of the algorithms such as addition, subtraction or multiplication.

[0071] Furthermore, the specific method for the contract audit node to determine the semantic audit result based on similarity is not unique. For example, the contract audit node can convert the similarity between the code semantic features and the annotation semantic features into a semantic audit score based on the conversion relationship between similarity and the semantic audit score to obtain the semantic audit result of the smart contract. Among them, the similarity is positively correlated with the semantic audit score, and the higher the similarity, the higher the semantic audit score.

[0072] In one embodiment, step S206 includes: determining the similarity between the code semantic features and the annotation semantic features; determining the similarity interval where the similarity lies, and determining the semantic audit result of the smart contract based on the matching relationship between the similarity interval and the semantic audit result.

[0073] Specifically, the contract audit node can pre-establish a matching relationship between the similarity interval and the semantic audit result. The matching relationship can be set by the contract provider according to the specific application scenario of the smart contract, or determined by the contract audit node according to the historical contract audit situation and application situation, which is not limited here. After obtaining the code semantic features and the annotation semantic features, the contract audit node can determine the similarity between the code semantic features and the annotation semantic features, and then determine the similarity interval in which the similarity is located. Then, according to the similarity interval in which the similarity is located and the matching relationship between the similarity interval and the semantic audit result, the semantic audit result of the smart contract is determined. Taking the case where the semantic audit result is expressed as a semantic audit level as an example, the matching relationship between the similarity interval and the semantic audit result can include: the semantic audit level corresponding to the similarity interval (0.9, 1] is S, the semantic audit level corresponding to the similarity interval (0.85, 0.9] is A, the semantic audit level corresponding to the similarity interval (0.7, 0.85] is B, and the semantic audit level corresponding to the similarity interval (0, 0.7] is C.

[0074] In this embodiment, the semantic audit result of the smart contract is determined based on the matching relationship between the similarity interval and the semantic audit result. The algorithm is simple, can improve the audit efficiency, and save computing resources.

[0075] Step S208: When the similarity satisfies the correction condition, the source code is corrected based on the annotation semantic features and the code semantic features to obtain updated code.

[0076] Among them, the correction condition may refer to the similarity being less than the similarity threshold, or the similarity being less than or equal to the similarity threshold. It can be understood that when the similarity meets the correction condition, the greater the deviation between the actual code semantics of the source code and the expected code semantics, the more likely there is a grammatical or logical error, and the expected function cannot be achieved. If a subsequent vulnerability analysis is performed on this basis, even if the analysis result shows that there is no vulnerability, the smart contract cannot be processed on the chain. Based on this, when the similarity meets the correction condition, the contract audit node corrects the source code based on the annotation semantic features and the code semantic features, obtains the updated code, and then performs vulnerability analysis on the updated code to obtain the vulnerability audit result. Similar to the semantic audit result, the specific data form of the vulnerability audit result can be a level or a value, which can be represented by information such as the vulnerability audit level or the vulnerability audit score. Furthermore, if a vulnerability audit is performed and a vulnerability is found in the updated code, the vulnerability audit result can also include a description of the corresponding vulnerability.

[0077] There is no unique way to correct the source code and obtain the updated code. For example, the contract audit node can determine the annotation semantics represented by the annotation semantic feature and the code semantics represented by the code semantic feature, and then correct the code semantics according to the annotation semantics to obtain the updated code semantics, and correct the source code based on the updated code semantics to obtain the updated code. For another example, the contract audit node can also perform error analysis on the code semantic features based on the semantic error classification model and the annotation semantic features as a benchmark, determine the semantic error type of the source code, and correct the source code based on the semantic error type to obtain the updated code. The semantic error type may include, for example, data flow errors, function call relationship errors, etc. It can be understood that the training sample of the semantic error classification model may include the annotation semantic feature and the code semantic feature corresponding to the annotation semantic feature and carrying the semantic error type label. Exemplarily, the annotation semantic feature A and the multiple code semantic features corresponding to A can be used as sample subsets, and the semantic error type labels carried by each code semantic feature are different. The sample set may include sample subsets corresponding to multiple annotation semantic features. During the training process, each sample subset may be used in turn to train the model until the loss function converges, thereby obtaining a semantic error classification model for determining the type of semantic error.

[0078] The specific method of vulnerability analysis for the update code is not unique. For example, the contract audit node can determine the abstract syntax tree of the update code, and perform static analysis on the smart contract based on the abstract syntax tree. The static analysis may include at least one of alias analysis, taint analysis, data flow analysis, pointer analysis, function call detection, random number check, integer overflow check, permission check, and denial of service check. For another example, the contract audit node can implement dynamic analysis of the smart contract by inserting stubs into the update code. Among them, the insertion position may be a specified parameter variation position or a specified information monitoring position, and the specified parameter variation position may include at least one of a call sequence, a parameter list, a parameter value, and metadata, and the specified information monitoring position may include the function position to be detected, the first statement position of the program code, the start position of the branch statement, the start position of the loop statement, the statement position before the next entry statement, the end statement position of the program code, the end position of the branch statement, and the end position of the loop statement. For another example, the contract audit node can also attack the update code by using a black box attack model to implement attack vulnerability analysis of the smart contract.

[0079] It can be understood that when the similarity does not meet the correction conditions, there is no need to correct the source code, and a vulnerability audit can be performed directly on the source code.

[0080] Step S210, combining the semantic audit results and the vulnerability audit results obtained by performing vulnerability analysis on the updated code to determine the audit results of the smart contract.

[0081] Among them, the specific limitations on the vulnerability audit results are as mentioned above and will not be repeated here. Specifically, the contract audit node can determine the audit result of the smart contract in combination with the semantic audit results and the vulnerability audit results obtained by vulnerability analysis of the updated code. For example, when both the semantic audit results and the vulnerability audit results are expressed as audit levels, the contract audit node can determine the relatively poor audit level as the audit result of the smart contract. For another example, when both the semantic audit results and the vulnerability audit results are expressed as audit scores, the contract audit node can obtain the audit result of the smart contract by weighted summing the semantic audit score and the vulnerability audit score. It can be understood that since the source code has been corrected based on the annotation semantic features and the code semantic features during the semantic audit process, the weight of the semantic audit score can be relatively low in the weighted summation process. In the case where the source code is corrected based on the annotation semantic features and the code semantic features to obtain the updated code, the audit result of the smart contract is still determined in combination with the semantic audit results, which can ensure that the final audit result can reflect the quality of the smart contract from multiple levels, thereby improving the accuracy of the audit result.

[0082] Furthermore, after obtaining the audit results of the smart contract, the contract audit node can determine the risk level corresponding to the audit results, and output an alarm message when the risk level reaches the alarm threshold. In addition, the contract audit node can also generate an audit report that matches the audit results for the reference of the contract provider. When the audit results meet the conditions for on-chain processing, the on-chain processing node processes the smart contract on-chain, so that each node on the blockchain can realize transactions by calling the smart contract. Figure 3 As shown in the figure, the blockchain administrator can set up an incentive mechanism to encourage the on-chain processing nodes to package blocks, generate new blocks, and connect the new blocks to the blockchain through the consensus mechanism. After the contract audit node obtains the smart contract to be audited from the trusted data source (i.e. the contract provider), it conducts a contract audit on the smart contract. If the audit result meets the on-chain conditions, the on-chain processing node will write the smart contract into the block on the blockchain to realize the on-chain of the smart contract. Figure 4 As shown, the nodes on the blockchain can obtain the corresponding processing results and complete the on-chain transactions by calling the smart contract on the chain. In the process of calling the smart contract, external data can be imported, and the smart contract processes the external data to obtain the corresponding processing results, which may include the contract status and contract value. The processing results can be fed back to the blockchain node that calls the smart contract, and can also be recorded in the result record block of the blockchain.

[0083] The above-mentioned smart contract auditing method extracts source code and annotation information from the smart contract to be audited, and performs semantic analysis on the source code and annotation information in the smart contract respectively, and obtains semantic audit results based on the semantic similarity of the two. On this basis, if the similarity meets the correction condition, the source code is first corrected to obtain the updated code, and then the subsequent vulnerability analysis is performed. The vulnerability analysis of the corrected code after the semantic correction can avoid the misjudgment of vulnerabilities caused by source code logic errors, which is conducive to improving the accuracy of vulnerability audit results; combining the semantic audit results and the vulnerability audit results obtained by vulnerability analysis of the updated code to determine the audit results of the smart contract is equivalent to auditing the smart contract from the semantic and vulnerability levels, which can improve the accuracy of the audit results. At the same time, the above-mentioned method can automatically complete the audit of smart contracts, which can improve the accuracy of the audit results while improving the work efficiency of the smart contract audit process.

[0084] In one embodiment, the process of extracting comment information in a smart contract includes: obtaining a set comment delimiter; matching each character contained in the smart contract with the comment delimiter to determine the position of the comment delimiter in the smart contract; and extracting comment information from the smart contract according to the position of the comment delimiter and the comment type corresponding to the comment delimiter.

[0085] As mentioned above, the present application does not limit the programming language corresponding to the source code, and the annotation methods of different programming languages ​​are not the same. Exemplarily, in the C programming language, the comment information is any of the following: a block comment starting with " / *" and ending with "* / "; a single-line comment starting with " / / " and ending with a newline. In the Java programming language, in addition to the two types in the C programming language, the comment information also includes: a javadoc comment starting with " / **" and ending with "* / ". The comment type corresponding to the comment delimiter may include a single-line comment and a multi-line comment. Among them, the number of lines occupied by a single-line comment is one line, and the number of lines occupied by a multi-line comment is at least two lines. The multi-line comment may be, for example, a block comment or a javadoc comment, etc. It can be understood that in order to achieve the separation of source code and comment information and avoid program execution errors, the comment delimiters corresponding to the multi-line comment usually include a start delimiter and an end delimiter, for example, the start delimiter of the block comment is " / *" and the end delimiter is "* / ".

[0086] Specifically, the comment delimiter can be set by the contract provider, or by the contract audit node according to the programming language of the source code. The comment delimiter, for example, can include at least a part of symbols such as " / *...* / ", " / **...* / " or " / / ". The contract audit node can obtain the set comment delimiter, and then match each character contained in the smart contract with the comment delimiter to determine the position of the comment delimiter in the smart contract. The specific method of character matching can be, for example, partial matching or full matching. Exemplarily, in the case where the comment delimiter includes a start delimiter and an end delimiter, at least one of the start delimiter or the end delimiter can be matched to determine the position of the comment delimiter in the smart contract. Correspondingly, the position of the comment delimiter in the smart contract can include at least one of the start position or the end position. After determining the position of the comment delimiter in the smart contract, the contract audit node can extract the comment information from the smart contract according to the position of the comment delimiter and the comment type corresponding to the comment delimiter.

[0087] In a specific embodiment, comment information is extracted from a smart contract according to the comment type corresponding to the comment delimiter, including at least one of the following two items: when the comment type corresponding to the comment delimiter is a single-line comment, extracting the comment information located on the same line as the comment delimiter from the smart contract; when the comment type corresponding to the comment delimiter is a multi-line comment, determining the start delimiter and the end delimiter of the comment delimiter, and extracting the comment information between the start delimiter and the end delimiter from the smart contract.

[0088] As mentioned above, a single-line comment occupies one line, a multi-line comment occupies at least two lines, and the comment delimiter of a multi-line comment usually includes a start delimiter and an end delimiter. That is, when the comment type corresponding to the comment delimiter is a single-line comment, the comment information corresponding to the comment delimiter is located on the same line as the comment delimiter; when the comment type corresponding to the comment delimiter is a multi-line comment, the corresponding comment information is between the start delimiter and the end delimiter of the comment delimiter. Based on this, the contract audit node can extract the comment information on the same line as the comment delimiter from the smart contract when the comment type corresponding to the comment delimiter is a single-line comment; when the comment type corresponding to the comment delimiter is a multi-line comment, the contract audit node can extract the comment information between the start delimiter and the end delimiter included in the comment delimiter from the smart contract. The comment information is extracted based on the number of lines occupied by the comment information corresponding to the comment delimiter, and the algorithm is simple, which is conducive to improving audit efficiency.

[0089] The above embodiment extracts comment information from the smart contract based on the set comment delimiter, and can flexibly set the comment delimiter according to actual application requirements to ensure the accuracy of the extracted comment information, and further ensure the accuracy of the audit results determined based on the comment information.

[0090] In one embodiment, step S204 includes: performing grammatical analysis on the source code to obtain an intermediate code representation of the source code; based on natural language processing technology, performing semantic analysis on the intermediate code representation and annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract.

[0091] Among them, natural language processing is an important direction in the fields of computer science and artificial intelligence. It studies various theories and methods that can achieve effective communication between people and computers using natural language. Natural language processing is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field will involve natural language, that is, the language used by people in daily life, so it is closely related to the study of linguistics. Natural language processing technology usually includes text processing, semantic understanding, machine translation, robot question answering, knowledge graph and other technologies. Intermediate code (IR) is also called intermediate language, and the intermediate code representation is a representation between natural language and machine language. The intermediate code representation can specifically include graph IR and linear IR. The graph IR can include, for example, an abstract syntax tree, a syntax analysis tree, a directed acyclic graph, a control flow graph, a dependency graph, etc., and the linear IR can include, for example, a stack machine code, a three-address code, etc. It can be understood that in actual application, the annotation information is usually expressed in natural language, and the intermediate code representation of the source code is closer to the natural language representation, and can explain the source code to a certain extent.

[0092] Based on this, the contract review node performs a syntax analysis on the source code to obtain an intermediate code representation of the source code, and then, based on natural language processing technology, performs semantic analysis on the intermediate code representation and annotation information respectively to obtain the code semantic features and annotation semantic features of the smart contract. Furthermore, the contract review node can determine the matching syntax analysis algorithm according to the specific type of the intermediate code representation, and perform a syntax analysis on the source code based on the syntax analysis algorithm to obtain the intermediate code representation of the source code. The contract review node can also first convert the source code into an abstract syntax tree with a tree structure, and then convert the abstract syntax tree into a token sequence through standardization and serialization operations, and then use word embedding and sequence-to-sequence models to perform semantic analysis on the token sequence to obtain the code semantic features of the source code.

[0093] In this embodiment, based on natural language processing technology, semantic analysis is performed on the intermediate code identifiers and annotation information of the source code to obtain the code semantic features and annotation semantic features of the smart contract, which can ensure that the semantic feature dimensions represented by the code semantic features and the annotation semantic features are the same, facilitating subsequent audits.

[0094] In one embodiment, source code is corrected based on comment semantic features and code semantic features to obtain updated code, including: determining comment semantics represented by comment semantic features, and determining code semantics represented by code semantic features; correcting code semantics based on comment semantics to obtain updated code semantics; and correcting source code based on updated code semantics to obtain updated code.

[0095] Among them, the annotation semantics refers to the semantics represented by the annotation information; the code semantics refers to the semantic information represented by the source code. The semantic information may include sub-semantic information of at least one dimension such as control flow, data flow or function call relationship. Specifically, the contract audit node may also determine the annotation semantics represented by the annotation semantic features and the code semantics represented by the code semantic features, and then correct the code semantics according to the annotation semantics to obtain the updated code semantics. For example, the contract audit node may correct the function call relationship of the source code according to the annotation semantics to obtain the updated code semantics. Finally, the contract audit node corrects the source code based on the updated code semantics to obtain the updated code. Exemplarily, the contract audit node may encode the corrected part of the updated code semantics relative to the code semantics to obtain the corrected code, and then replace the corresponding code in the source code with the corrected code to obtain the updated code; the contract audit node may convert the updated code semantics into an intermediate code representation, and further encode the intermediate code representation to obtain the updated code to achieve the correction of the source code.

[0096] In a specific embodiment, the code semantic feature and the annotation semantic feature each include sub-features of multiple dimensions. The contract review node can determine the sub-semantic information represented by each sub-feature, and then, in a cascading manner, perform correction processing on the source code from each dimension in turn, wherein the correction processing object of the first correction dimension is the source code, the correction processing object of the next correction dimension is the correction code of the previous correction dimension, and the correction code of the last correction dimension is the update code. For the sub-semantic information of each dimension, the contract audit node can correct the sub-semantic information of the source code under this dimension based on the sub-semantic information of the annotation information under this dimension, obtain the updated sub-semantic information of the source code, and correct the source code based on the updated sub-semantic information to obtain the corrected code.

[0097] Furthermore, if Figure 5 As shown, the contract review node can calculate the sub-similarity between the sub-features of each dimension respectively, obtain a similarity set including multiple sub-similarity, and then take out the selected sub-similarity with the smallest value from the similarity set, and determine the selected sub-feature corresponding to the selected sub-similarity. Next, the contract review node corrects the source code for the selected sub-feature, obtains the corrected code, and determines whether the similarity set is an empty set. If the similarity set is an empty set, the corrected code is determined as the updated code. If the similarity set is not an empty set, return to the step of taking out the selected sub-similarity with the smallest value from the similarity set until the similarity set is an empty set. Code correction from multiple dimensions can ensure the accuracy of the updated code. In a specific implementation, considering the correlation between sub-semantic features of different dimensions, in order to improve efficiency, the contract review node can correct the source code only for the dimension with the lowest sub-similarity to obtain the updated code.

[0098] In this embodiment, the code semantics are first corrected to obtain the updated code semantics, and then the code is corrected on this basis, which can ensure that the updated code matches the updated code semantics.

[0099] In one embodiment, the data form of the semantic audit result is a numerical value. In this embodiment, step S210 includes: performing vulnerability analysis on the update code based on machine learning to obtain a vulnerability audit result in the form of a numerical value; performing statistical analysis on the semantic audit result and the vulnerability audit result to determine the audit result of the smart contract.

[0100] Among them, machine learning (ML) is a multi-disciplinary interdisciplinary subject, involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning.

[0101] Specifically, the contract audit node can construct a smart contract data set, and then use the smart contract data set to train the initial model constructed by the machine learning algorithm to obtain a machine learning model for vulnerability auditing. The machine learning algorithm can be, for example, a decision tree, a support vector machine, or a neural network. Further, the machine learning model for vulnerability auditing may include a vulnerability identification model for determining whether a vulnerability exists, a vulnerability classification model for determining the vulnerability category, and a vulnerability audit model for determining the vulnerability audit score. The vulnerability category may include numerical overflow vulnerabilities, reentry vulnerabilities, cross-contract call vulnerabilities, timestamp dependency vulnerabilities, short address attack vulnerabilities, and the like. It can be understood that the specific use of the model is different, and the corresponding training samples are also different. For example, the training samples of the vulnerability classification model include a smart contract vulnerability data set carrying a vulnerability category label; the training samples of the vulnerability audit model include a smart contract data set carrying an audit score label.

[0102] In actual applications, the contract audit node can perform vulnerability analysis on the update code based on the machine learning model to obtain a vulnerability audit result in the form of a numerical value, or, in the case of obtaining a vulnerability analysis result in a non-numerical form, obtain a vulnerability audit result in the form of a numerical value through numerical conversion. In a specific implementation, the contract audit node can set the correspondence between the vulnerability category and the audit score, and determine the vulnerability audit result in the form of a numerical value based on the vulnerability category of the vulnerability existing in the update code of the smart contract and the above correspondence. Exemplarily, the contract audit node can determine the minimum or average value of the audit score corresponding to the existing vulnerability as the vulnerability audit score of the smart contract. Finally, the contract audit node performs statistical analysis on the semantic audit results and vulnerability audit results in the form of numerical data to determine the audit result of the smart contract. The algorithms used in the statistical analysis process may include, for example, addition, subtraction, multiplication, etc. It can be understood that the data form of the final audit result is also numerical.

[0103] Furthermore, the contract detection node can also verify the update code of the smart contract by combining model detection and theorem proof to ensure that the smart contract meets the expected functional requirements and security requirements. Among them, theorem proof refers to the application of verifying the correctness of the software system or protocol. Based on the selected proof method, a series of logical reasoning steps are derived to prove the correctness of the target. This process needs to follow the rules of logical reasoning and the syntax and semantics of the proof system.

[0104] In this embodiment, the vulnerability audit results in the form of numerical data are obtained based on the machine learning algorithm, which can ensure that the data form of the final audit results is also numerical, thereby realizing quantitative auditing of smart contracts and improving the accuracy of the audit results.

[0105] In one embodiment, vulnerability analysis is performed on the update code based on machine learning to obtain vulnerability audit results in the form of numerical data, including: performing operational vulnerability analysis on the symbolic execution process of the update code to determine the operational vulnerability audit results of the update code; using a black box attack model to perform attack vulnerability analysis on the update code to determine the attack vulnerability audit results of the update code; combining the operational vulnerability audit results and the attack vulnerability audit results to obtain vulnerability audit results in the form of numerical data.

[0106] Among them, operation vulnerabilities refer to the vulnerabilities that exist in the operation process of smart contracts without considering external attacks. Such operation vulnerabilities may include numerical overflow vulnerabilities, cross-contract call vulnerabilities, timestamp dependency vulnerabilities, etc. Attack vulnerabilities refer to the vulnerabilities that exist in the operation process of smart contracts under external attacks. Such attack vulnerabilities may include reentrancy vulnerabilities, short address attack vulnerabilities, etc.

[0107] Specifically, the contract audit node can perform vulnerability analysis on the update code from multiple angles, including: performing operation vulnerability analysis on the symbolic execution process of the update code to determine the operation vulnerability audit results of the update code; using the black box attack model to perform attack vulnerability analysis on the update code to determine the attack vulnerability audit results of the update code. Among them, the black box attack model is used to provide various types of attack behaviors. For example, when using a smart contract to call other contracts, select an address ending with 00, and omit the last 00 when passing the address parameter to the smart contract to determine whether the smart contract has a short address attack vulnerability. Furthermore, the data form of the operation vulnerability audit results and the attack vulnerability audit results can both be numerical values. For the specific method of converting the vulnerability analysis results into the vulnerability audit results in numerical form, please refer to the above, which will not be repeated here. Under this premise, the contract audit node can perform statistical calculations on the operation vulnerability audit results and the attack vulnerability audit results to obtain vulnerability audit results in numerical data form. The specific algorithms for statistical calculations can include addition, subtraction, multiplication, averaging, and the like.

[0108] In this embodiment, vulnerability audits are performed from multiple angles such as operational vulnerabilities and attack vulnerabilities, which can achieve a comprehensive vulnerability audit of smart contracts and discover potential vulnerabilities in smart contracts, which is conducive to improving the accuracy of vulnerability audit results.

[0109] In a specific embodiment, a symbolic execution process of the update code is subjected to a runtime vulnerability analysis, including: based on the formal representation of the update code, symbolic execution processing is performed on the update code to obtain an execution process record; a behavioral model is used to perform a preliminary vulnerability analysis on the execution process record to obtain a preliminary audit result; when the preliminary audit result indicates that a vulnerability exists, a vulnerability classification model is used to classify the existing vulnerability to determine the vulnerability category of the vulnerability.

[0110] Among them, the preliminary audit results include the existence of vulnerabilities and the absence of vulnerabilities. Symbolic execution uses symbolic variables instead of specific values ​​as parameters of programs or functions, and simulates the execution of instructions in the program. The operation of each instruction is based on symbolic variables, where the value of the operand is represented by an expression composed of symbols and constants. For any program code, its execution process is controlled by the execution semantics of the instruction sequence, which includes: the description of data objects by variable definition statements; the modification of program data objects by declaration statements; and the control of program execution flow by conditional statements. When the input parameters of the program are determined, its instruction sequence is also fixed, so the program execution semantics and control flow are also determined. If symbolic values ​​are used as input parameters of the program instead of specific numerical values, the operation objects of the instruction sequence change from specific numerical values ​​to symbolic values, and accordingly, the execution semantics and control flow of the program also become symbolic expressions related to symbolic variables. Symbolic variables make the execution semantics of the program uncertain, and also enable symbolic execution technology to traverse all paths of the program execution tree under ideal circumstances. When a certain program path needs to be traversed and analyzed, the control flow can be guided to traverse the program input of the path based on the analysis results of the symbolic execution method.

[0111] The behavior model is a machine learning model obtained by using a deep reinforcement learning algorithm to learn the symbolic execution process of smart contracts with and without operational vulnerabilities. Deep reinforcement learning combines the perception ability of deep learning with the decision-making ability of reinforcement learning, and can be controlled directly based on input. It is an artificial intelligence method that is closer to the human way of thinking. The deep reinforcement learning algorithm can be a deep learning algorithm based on a convolutional neural network or a recursive neural network, which is not limited here.

[0112] Specifically, the contract audit node can obtain a formal representation of the update code based on a formal language model. The formal language model is a formal symbol system for representing natural language or programming language. It defines the grammar and syntax rules of the language and can be used for language analysis, translation, verification and other applications. The formal representation of the update code includes each symbolic expression corresponding to the update code. After obtaining the formal identification of the update code, the contract audit node can perform symbolic execution processing on the update code based on the formal representation to obtain an execution process record. Then, the behavior model is used to perform a preliminary vulnerability analysis on the execution process record to obtain a preliminary audit result to determine whether there is a vulnerability in the update code. It can be understood that the vulnerability here refers to a running vulnerability. In the case where the preliminary audit result shows that there is a vulnerability, the vulnerability classification model is used to classify the existing vulnerability and determine the vulnerability category of the vulnerability.

[0113] In this embodiment, a preliminary vulnerability analysis is first performed to determine whether a vulnerability exists, and if a vulnerability exists, the vulnerability category is further determined. This is equivalent to performing vulnerability analysis in a step-by-step manner, and can support simultaneous vulnerability analysis of multiple smart contracts, which is conducive to improving efficiency.

[0114] In one embodiment, the smart contract auditing method further includes: in the event that a vulnerability exists in the updated code, determining the associated code of the vulnerability from the updated code; and determining a repair suggestion for the smart contract based on a code sample in the code library that matches the associated code.

[0115] Among them, vulnerabilities include operational vulnerabilities and attack vulnerabilities, and the associated code of a vulnerability refers to the related code that causes the vulnerability. For example, the related code of a numerical overflow vulnerability may include the variable definition code of the overflow variable. For another example, the related code of an access control defect vulnerability includes the access keyword or judgment condition of the function with the access defect.

[0116] Specifically, the contract audit node can establish a code library, which includes code samples and vulnerability samples associated with the code samples, and each vulnerability sample carries a vulnerability category label. The vulnerability sample is a code with a vulnerability. In the case where the updated code is determined to have a vulnerability through vulnerability audit, the associated code of the vulnerability is determined from the updated code, and then the associated code is matched with each code sample in the code library to determine the code sample that matches the associated code. The specific method of code matching can be, for example, semantic matching or grammatical matching, or matching based on vulnerability categories. Then, the contract audit node determines the repair suggestion of the smart contract based on the difference between the matched code sample and the associated code, and outputs the audit results and repair suggestions, thereby assisting the contract provider to expressly locate and repair the vulnerability. Furthermore, the contract audit node can also repair the vulnerability of the smart contract based on the repair suggestion, and feedback the repaired smart contract to the contract provider so that the contract provider can conduct a secondary review of the repaired smart contract. In this way, automatic repair of vulnerabilities can be achieved.

[0117] In this embodiment, based on the code samples matching the associated codes of the vulnerability in the code library, repair suggestions are determined, which can improve the efficiency of vulnerability repair.

[0118] In one embodiment, Figure 6 As shown, the smart contract audit method includes the following steps:

[0119] Step S601, obtaining the smart contract to be audited and the set comment delimiter;

[0120] Step S602, character matching is performed on each character contained in the smart contract and the comment delimiter to determine the position of the comment delimiter in the smart contract;

[0121] Step S603, extracting comment information from the smart contract according to the position of the comment delimiter and the comment type corresponding to the comment delimiter, and determining the source code in the smart contract;

[0122] Among them, smart contracts usually include two parts: source code and comment information. After extracting the comment information based on the comment delimiter, it is equivalent to separating the comment information from the source code, and then extracting the source code;

[0123] Step S604, performing syntax analysis on the source code to obtain an intermediate code representation of the source code;

[0124] Step S605: Based on natural language processing technology, semantic analysis is performed on the intermediate code representation and the annotation information to obtain the code semantic features and the annotation semantic features of the smart contract;

[0125] Step S606, determining the similarity between the code semantic feature and the comment semantic feature;

[0126] Step S607, determining the similarity interval where the similarity lies, and determining the semantic audit result of the smart contract according to the matching relationship between the similarity interval and the semantic audit result;

[0127] Step S608, determining the annotation semantics represented by the annotation semantic features and the code semantics represented by the code semantic features;

[0128] Step S609, correcting the code semantics according to the annotation semantics to obtain updated code semantics;

[0129] Step S610, modifying the source code based on the updated code semantics to obtain the updated code;

[0130] Step S611, determining a formal representation of the update code, and performing symbolic execution processing on the update code based on the formal representation to obtain an execution process record;

[0131] Step S612, performing operation vulnerability analysis on the execution process record to determine the operation vulnerability audit result of the update code;

[0132] The operation vulnerability audit result may include the existence of an operation vulnerability and the non-existence of an operation vulnerability, and in the case of an operation vulnerability, the operation vulnerability audit result may also include a specific vulnerability category;

[0133] Step S613, using a black box attack model to perform attack vulnerability analysis on the update code, and determine the attack vulnerability audit result of the update code;

[0134] The attack vulnerability audit result may include the existence of an attack vulnerability and the non-existence of an attack vulnerability, and in the case of the existence of an attack vulnerability, the attack vulnerability audit result may also include a specific vulnerability category;

[0135] Step S614, combining the semantic audit results, the operational vulnerability audit results, and the attack vulnerability audit results to determine the audit results of the smart contract;

[0136] Among them, the data form of the semantic audit results, the operational vulnerability audit results, and the attack vulnerability audit results is the same, and the data form can be, for example, a numerical value or a level. In the case where the data form is a numerical value, the contract audit node can perform statistical calculations on the semantic audit results, the operational vulnerability audit results, and the attack vulnerability audit results to determine the audit result of the smart contract; in the case where the data form is a level, the contract audit node can determine the lowest level among the semantic audit results, the operational vulnerability audit results, and the attack vulnerability audit results as the audit result of the smart contract;

[0137] Step S615, when there is a vulnerability in the updated code, determine the associated code of the vulnerability from the updated code;

[0138] Step S616: Determine a repair suggestion for the smart contract based on the code samples in the code library that match the associated code.

[0139] The above contract audit method extracts source code and annotation information from the smart contract to be audited, and performs semantic analysis on the source code and annotation information in the smart contract respectively, and obtains semantic audit results based on the semantic similarity of the two. On this basis, if the similarity meets the correction condition, the source code is first corrected to obtain the updated code, and then the subsequent vulnerability analysis is performed. The vulnerability analysis of the corrected code after the semantic correction can avoid the misjudgment of vulnerabilities caused by source code logic errors, which is conducive to improving the accuracy of vulnerability audit results; combining the semantic audit results and the vulnerability audit results obtained by vulnerability analysis of the updated code to determine the audit results of the smart contract is equivalent to auditing the smart contract from the semantic and vulnerability levels, which can improve the accuracy of the audit results. In addition, repair suggestions are given based on the audit results, which can improve the efficiency of subsequent contract repairs. Most importantly, the above method can automatically complete the audit of smart contracts, which can improve the accuracy of the audit results while improving the efficiency of the smart contract audit process.

[0140] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0141] Based on the same inventive concept, the embodiment of the present application also provides a blockchain system for implementing the smart contract audit method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more blockchain system embodiments provided below can refer to the limitations of the smart contract audit method above, and will not be repeated here.

[0142] In one embodiment, Figure 7As shown, a blockchain system 700 is provided, including a contract audit node 701 and an on-chain processing node 702. The contract audit node 701 is used to obtain a smart contract to be audited, extract the source code and annotation information in the smart contract; perform semantic analysis on the source code and annotation information respectively to obtain the code semantic features and annotation semantic features of the smart contract; determine the semantic audit result of the smart contract based on the similarity between the code semantic features and the annotation semantic features; when the similarity meets the correction condition, perform correction processing on the source code based on the annotation semantic features and the code semantic features to obtain the updated code; combine the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the updated code to determine the audit result of the smart contract. The on-chain processing node 702 performs on-chain processing on the smart contract when the audit result meets the on-chain condition.

[0143] Among them, the audit result meeting the on-chain conditions can mean that the audit level is the set level, or the audit score is greater than the set score, or the audit score is greater than or equal to the set score. Specifically, when the audit result meets the on-chain conditions, the on-chain processing node processes the smart contract on the chain, so that each node on the blockchain can realize transactions by calling the smart contract. Figure 3 As shown in the figure, the blockchain administrator can set up an incentive mechanism to encourage the on-chain processing nodes to package blocks, generate new blocks, and connect the new blocks to the blockchain through the consensus mechanism. After the contract audit node obtains the smart contract to be audited from the trusted data source (i.e. the contract provider), it conducts a contract audit on the smart contract. If the audit result meets the on-chain conditions, the on-chain processing node will write the smart contract into the block on the blockchain to realize the on-chain of the smart contract.

[0144] The above blockchain system configures the contract audit node to extract source code and annotation information from the smart contract to be audited, and performs semantic analysis on the source code and annotation information in the smart contract respectively, and obtains the semantic audit result based on the semantic similarity of the two. On this basis, if the similarity meets the correction condition, the source code is first corrected to obtain the updated code, and then the subsequent vulnerability analysis is performed. The vulnerability analysis of the corrected code after the semantic correction can avoid the misjudgment of vulnerabilities caused by source code logic errors, which is conducive to improving the accuracy of vulnerability audit results; combining the semantic audit results and the vulnerability audit results obtained by vulnerability analysis of the updated code to determine the audit results of the smart contract is equivalent to auditing the smart contract from the semantic and vulnerability levels, which can improve the accuracy of the audit results. At the same time, the above method can automatically complete the audit of the smart contract, which can improve the accuracy of the audit results while improving the work efficiency of the smart contract audit process.

[0145] Combine the following Figure 8 and Fig. 9, a detailed description of the blockchain system and the smart contract audit process implemented based on the blockchain system. In one embodiment, an artificial intelligence contract audit automation method (Automated Contract Audit Technology, ACAT) is provided, which relies on semantic analysis and machine learning to realize the automated audit of smart contracts. Among them, semantic analysis can deeply understand and process smart contracts, identify the logical, grammatical and structural problems therein, and realize semantic audit. Machine learning can obtain a machine learning model by training samples of known vulnerabilities and attacks, which is used to determine whether the smart contract to be audited has similar problems and realize vulnerability audit. The advantages of ACAT technology include fast speed, high reliability, low cost and high efficiency, and it will not be affected by subjective factors in the manual audit process. At the same time, it can also provide real-time audit results and suggestions to help smart contract providers discover and solve problems in a timely manner, thereby protecting the assets and rights of blockchain users.

[0146] like Figure 8 As shown in the figure, from the perspective of the blockchain system level, the core components of the blockchain system to implement contract auditing can include four parts, namely, security monitoring engine, detection adaptation layer, core layer and presentation layer. Among them, the security detection engine and detection adaptation layer are used to adapt, parse and authenticate the interface. Specifically, ETH (Ethereum) adaptation, EOS (Enterprise Operation System, commercial distributed application design blockchain operating system) adaptation, TRON (The Real-time Operating System Nucleus, real-time operating system kernel) adaptation and fisco adaptation can be implemented. The core layer implements specific smart contract auditing services, including smart contract collection, smart contract code parsing, smart contract vulnerability detection, smart contract security assessment, etc. At the same time, it also involves the construction of contract vulnerability data sets, contract behavior learning, smart contract code analysis, scanning engine management, result prediction analysis, semantic analysis, syntax analysis and other functions, which can realize contract audit automation. The core layer and the presentation layer can communicate based on the standard SDK (Software Development Kit / Software Development Kit) / API (Application Programming Interface, Application Programming Interface) service. The presentation layer is used for smart contract management, security auditing, and output analysis reports.

[0147] In the process of automated auditing of smart contracts, the main technologies involved include smart contract code parsing technology, smart contract vulnerability detection technology, and smart contract security assessment technology. Specifically, Fig. 9As shown, the contract audit node can realize data collection of smart contracts through tools such as blockchain browsers. For the smart contract to be audited, the contract audit node extracts the source code and annotation information in the smart contract, and converts the source code into a format that can be processed by the machine, such as JSON format or SQL format, for subsequent parsing. Then, the contract audit node uses natural language processing technology to perform grammatical analysis and semantic understanding on the source code and annotation information respectively, and obtains the code semantic features of the source code and the annotation semantic features of the annotation information. Among them, grammatical analysis includes grammatical and lexical analysis, and the grammatical structure between each word can be obtained. In the process of semantic analysis, machine learning technology can be used to obtain the corresponding semantic features through a trained semantic analysis model.

[0148] After obtaining the semantic features, the contract audit node performs similarity analysis on the code semantic features and the annotation semantic features, determines the similarity between the two, and then obtains the semantic audit results of the smart contract. In addition, when the similarity meets the correction conditions, the source code is automatically corrected based on the annotation semantic features and the code semantic features, and the syntax and logic errors that may exist in the source code are corrected and optimized to obtain updated code to improve the quality and reliability of the smart contract, and facilitate subsequent vulnerability analysis.

[0149] The vulnerability analysis process can also be implemented based on machine learning. Specifically, the contract audit node can use the known smart contract vulnerability data set to build a classification model through machine learning algorithms such as decision trees, support vector machines and neural networks to achieve vulnerability classification of the smart contract to be audited. In practical applications, the contract audit node can also first use the deep reinforcement learning algorithm to learn the behavior during the execution of the update code to determine whether the update code has vulnerabilities, and further use the classification model to classify the vulnerabilities if there are vulnerabilities. Among them, the update code execution process can refer to the symbolic execution process. The contract audit node can convert the update code into a formal language representation, and on this basis, perform symbolic execution processing on the update code. Furthermore, the contract audit node can also use the black box attack model to perform predictive analysis on the smart contract for different attack scenarios, find out the attack vulnerabilities in the update code, and thus improve the accuracy and coverage of vulnerability detection.

[0150] After the vulnerability analysis is completed, the vulnerability audit results can be determined. The contract audit node can determine the audit results of the smart contract by combining the semantic audit results and the vulnerability audit results. The data form of the audit result can be either a level or a value. After obtaining the audit result, the contract audit node can also determine the security risk level that matches the audit result. At the same time, it can also generate vulnerability description information and repair suggestions to assist auditors in locating and repairing vulnerabilities more quickly, and output alarm information when the audit results meet the alarm conditions. In addition, this technical solution can also generate reports regularly to summarize the problems and solutions found throughout the audit process. These reports can show stakeholders the security and compliance status so that they can better understand the progress of the audit.

[0151] In some specific implementations, real-time monitoring and alarm functions can also be provided. Specifically, once a potential security issue or error is found in the smart contract, the system will immediately issue an alarm and notify relevant personnel to deal with it in time. This real-time monitoring and alarm function is achieved by applying machine learning models to real-time data streams in the smart contract audit process. The analysis and modeling of historical data provides basic data for real-time monitoring and alarms. With the arrival of real-time data streams, the system will detect according to the current status and dynamically update the model. If the system finds any abnormal situation, such as abnormal transactions, vulnerability attacks, etc., the alarm mechanism will be triggered immediately.

[0152] The above-mentioned smart contract auditing method uses machine learning algorithms to model and analyze smart contracts, which can automatically extract key information from smart contract codes and generate models for automated analysis and prediction. Compared with traditional auditing methods, it can more quickly and accurately discover potential problems in smart contracts, reduce the time and cost of manual intervention, and improve auditing efficiency and accuracy. The above-mentioned method can also handle the interaction between multiple smart contracts, as well as the control flow and data flow conversion of complex smart contracts, so as to detect security vulnerabilities and errors more comprehensively.

[0153] Based on the same inventive concept, the embodiment of the present application also provides a smart contract auditing device for implementing the smart contract auditing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more smart contract auditing device embodiments provided below can refer to the limitations of the smart contract auditing method above, and will not be repeated here.

[0154] In one embodiment, Fig.10As shown, a smart contract auditing device 1000 is provided, comprising: an information extraction module 1002, a semantic analysis module 1004, a semantic auditing module 1006, a code update module 1008 and an audit result determination module 1010, wherein:

[0155] The information extraction module 1002 is used to obtain the smart contract to be audited and extract the source code and annotation information in the smart contract;

[0156] Semantic analysis module 1004, used to perform semantic analysis on source code and annotation information respectively to obtain code semantic features and annotation semantic features of smart contracts;

[0157] A semantic audit module 1006, used to determine a semantic audit result of the smart contract based on the similarity between the code semantic features and the annotation semantic features;

[0158] A code updating module 1008 is used to modify the source code based on the annotation semantic features and the code semantic features to obtain updated code when the similarity meets the modification condition;

[0159] The audit result determination module 1010 is used to determine the audit result of the smart contract by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the updated code.

[0160] In one embodiment, the information extraction module 1002 includes: a set delimiter acquisition unit, used to obtain a set comment delimiter; a character matching unit, used to match each character contained in the smart contract with the comment delimiter respectively, and determine the position of the comment delimiter in the smart contract; a comment information extraction unit, used to extract comment information from the smart contract according to the position of the comment delimiter and the comment type corresponding to the comment delimiter.

[0161] In one embodiment, the comment information extraction unit is specifically used to perform at least one of the following two items: when the comment type corresponding to the comment delimiter is a single-line comment, extracting the comment information located on the same line as the comment delimiter from the smart contract; when the comment type corresponding to the comment delimiter is a multi-line comment, determining the start delimiter and the end delimiter of the comment delimiter, and extracting the comment information between the start delimiter and the end delimiter from the smart contract.

[0162] In one embodiment, the semantic analysis module 1004 is specifically used to: perform grammatical analysis on the source code to obtain an intermediate code representation of the source code; based on natural language processing technology, perform semantic analysis on the intermediate code representation and annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract.

[0163] In one embodiment, the semantic audit module 1006 is specifically used to: determine the similarity between the code semantic features and the annotation semantic features; determine the similarity interval where the similarity lies, and determine the semantic audit result of the smart contract based on the matching relationship between the similarity interval and the semantic audit result.

[0164] In one embodiment, the code update module 1008 is specifically used to: determine the annotation semantics represented by the annotation semantic features, and determine the code semantics represented by the code semantic features; correct the code semantics according to the annotation semantics to obtain updated code semantics; and correct the source code based on the updated code semantics to obtain updated code.

[0165] In one embodiment, the data form of the semantic audit result is a numerical value. In this embodiment, the audit result determination module 1010 includes: a vulnerability audit result determination unit, which is used to perform vulnerability analysis on the update code based on machine learning to obtain a vulnerability audit result in the form of a numerical value; and an audit result determination unit, which is used to perform statistical analysis on the semantic audit result and the vulnerability audit result to determine the audit result of the smart contract.

[0166] In one embodiment, the vulnerability audit result determination unit includes: an operation vulnerability audit result determination component, which is used to perform an operation vulnerability analysis on the symbolic execution process of the update code to determine the operation vulnerability audit result of the update code; an attack vulnerability audit result determination component, which is used to perform an attack vulnerability analysis on the update code using a black box attack model to determine the attack vulnerability audit result of the update code; and a vulnerability audit result determination component, which is used to combine the operation vulnerability audit result and the attack vulnerability audit result to obtain a vulnerability audit result in the form of a numerical value.

[0167] In a specific embodiment, the running vulnerability audit result determination component is specifically used to: based on the formal representation of the update code, perform symbolic execution processing on the update code to obtain an execution process record; use a behavioral model to perform preliminary vulnerability analysis on the execution process record to obtain a preliminary audit result, which includes the existence of vulnerabilities and the non-existence of vulnerabilities; when the preliminary audit result is that a vulnerability exists, use a vulnerability classification model to classify the existing vulnerability and determine the vulnerability category of the vulnerability.

[0168] In one embodiment, the smart contract auditing device 1000 also includes a repair suggestion determination module, which is used to: when there is a vulnerability in the updated code, determine the associated code of the vulnerability from the updated code; based on the code samples in the code library that match the associated code, determine the repair suggestion of the smart contract.

[0169] Each module in the above-mentioned smart contract auditing device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0170] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data involved in the smart contract audit method. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a smart contract audit method is implemented.

[0171] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.12As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless method can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a smart contract audit method is implemented. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse, etc.

[0172] Those skilled in the art will understand that Fig.11 and Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0173] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned smart contract auditing method when executing the computer program.

[0174] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above-mentioned smart contract auditing method are implemented.

[0175] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above-mentioned smart contract auditing method when executed by a processor.

[0176] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0177] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0178] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0179] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A smart contract auditing method, characterized in that: The method comprises: Obtain the smart contract to be audited and extract the source code and annotation information in the smart contract; Performing semantic analysis on the source code and the annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract; Determining a semantic audit result of the smart contract based on the similarity between the code semantic feature and the annotation semantic feature; When the similarity satisfies a correction condition, the source code is corrected based on the annotation semantic feature and the code semantic feature to obtain an updated code; The audit result of the smart contract is determined by combining the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the updated code.

2. The method according to claim 1, characterized in that The process of extracting annotation information from the smart contract includes: Get the set comment delimiter; Match each character contained in the smart contract with the comment delimiter to determine the position of the comment delimiter in the smart contract; According to the position of the comment delimiter, the comment information is extracted from the smart contract according to the comment type corresponding to the comment delimiter.

3. The method according to claim 2, characterized in that The extracting annotation information from the smart contract according to the annotation type corresponding to the annotation delimiter includes at least one of the following: When the comment type corresponding to the comment delimiter is a single-line comment, extracting the comment information located on the same line as the comment delimiter from the smart contract; In a case where the comment type corresponding to the comment delimiter is a multi-line comment, a start delimiter and an end delimiter of the comment delimiter are determined, and comment information between the start delimiter and the end delimiter is extracted from the smart contract.

4. The method according to claim 1, wherein The performing semantic analysis on the source code and the annotation information respectively to obtain the code semantic features and the annotation semantic features of the smart contract includes: Performing syntax analysis on the source code to obtain an intermediate code representation of the source code; Based on natural language processing technology, semantic analysis is performed on the intermediate code representation and the annotation information respectively to obtain the code semantic features and the annotation semantic features of the smart contract.

5. The method according to claim 1, characterized in that The determining of the semantic audit result of the smart contract based on the similarity between the code semantic feature and the annotation semantic feature includes: Determining the similarity between the code semantic feature and the comment semantic feature; Determine a similarity interval in which the similarity lies, and determine a semantic audit result of the smart contract based on a matching relationship between the similarity interval and the semantic audit result.

6. The method according to claim 1, characterized in that The correcting the source code based on the annotation semantic feature and the code semantic feature to obtain updated code includes: Determining the annotation semantics represented by the annotation semantic feature, and determining the code semantics represented by the code semantic feature; Modifying the code semantics according to the annotation semantics to obtain updated code semantics; The source code is modified based on the updated code semantics to obtain updated code.

7. The method according to claim 1, characterized in that The data form of the semantic audit result is a numerical value; the combination of the semantic audit result and the vulnerability audit result obtained by performing vulnerability analysis on the updated code to determine the audit result of the smart contract includes: Performing vulnerability analysis on the updated code based on machine learning to obtain vulnerability audit results in the form of numerical data; Perform statistical analysis on the semantic audit results and the vulnerability audit results to determine the audit results of the smart contract.

8. The method according to claim 7, characterized in that The vulnerability analysis of the updated code based on machine learning is performed to obtain a vulnerability audit result in the form of numerical data, including: Performing an operational vulnerability analysis on the symbolic execution process of the update code to determine an operational vulnerability audit result of the update code; Performing an attack vulnerability analysis on the updated code using a black box attack model to determine an attack vulnerability audit result of the updated code; The operation vulnerability audit result and the attack vulnerability audit result are combined to obtain a vulnerability audit result in the form of a numerical value.

9. The method according to claim 8, characterized in that The performing of a running vulnerability analysis on the symbolic execution process of the update code includes: Based on the formal representation of the update code, symbolic execution is performed on the update code to obtain an execution process record; Performing a preliminary vulnerability analysis on the execution process record using a behavioral model to obtain a preliminary audit result; the preliminary audit result includes whether a vulnerability exists or does not exist; When the preliminary audit result indicates that a vulnerability exists, a vulnerability classification model is used to classify the existing vulnerability to determine the vulnerability category of the vulnerability.

10. The method according to any one of claims 1 to 9, characterized in that The method further comprises: In the case where a vulnerability exists in the update code, determining a code associated with the vulnerability from the update code; Determine a repair suggestion for the smart contract based on code samples in a code library that match the associated code.

11. A blockchain system, characterized in that: Including contract audit nodes and on-chain processing nodes; The contract audit node is used to obtain the smart contract to be audited, extract the source code and annotation information in the smart contract; perform semantic analysis on the source code and the annotation information respectively to obtain the code semantic features and annotation semantic features of the smart contract; Determining a semantic audit result of the smart contract based on the similarity between the code semantic feature and the annotation semantic feature; and if the similarity satisfies a correction condition, correcting the source code based on the annotation semantic feature and the code semantic feature to obtain an updated code; Determining an audit result of the smart contract by combining the semantic audit result and a vulnerability audit result obtained by performing a vulnerability analysis on the updated code; The on-chain processing node processes the smart contract on-chain when the audit result meets the on-chain conditions.

12. A smart contract auditing device, characterized in that: The device comprises: An information extraction module, used to obtain the smart contract to be audited and extract the source code and annotation information in the smart contract; A semantic analysis module, configured to perform semantic analysis on the source code and the annotation information respectively to obtain code semantic features and annotation semantic features of the smart contract; A semantic audit module, configured to determine a semantic audit result of the smart contract based on the similarity between the code semantic features and the annotation semantic features; A code updating module, configured to, when the similarity satisfies a correction condition, correct the source code based on the annotation semantic features and the code semantic features to obtain an updated code; An audit result determination module is used to determine the audit result of the smart contract by combining the semantic audit result and the vulnerability audit result obtained by vulnerability analysis of the updated code.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images