Ethereum intelligent contract fine-grained analysis method

Abstract

The invention discloses an Ethereum intelligent contract fine-grained analysis method, and relates to the technical field of intelligent contract analysis tools, and the method comprises the steps: converting an EVM contract byte code: converting the Ethereum intelligent contract byte code into a high-level intermediate representation by using a Gigaharse framework; constructing a control flow diagram: constructing a detailed control flow diagram by using a back propagation technology based on the advanced intermediate representation generated by Gigaharse; and simulating EVM (Error Vector Magnitude) memory operation: accurately identifying and tracking variables in the memory by simulating the memory operation of the Ethereum virtual machine. According to the method, comprehensive fine-grained analysis of the Ethereum smart contract is realized, and the method has the advantages that byte codes can be directly processed without source codes, so that the method can be applied to various scenes including deployed contracts and closed source contracts. By combining advanced intermediate representation, control flow analysis, memory operation simulation and symbolic execution, the method can deeply understand behaviors and potential risks of the contract.

Description

Technical Field

[0001] The present invention relates to the technical field of smart contract analysis tools, and in particular to a fine-grained analysis method for Ethereum smart contracts. Background Art

[0002] As one of the leading blockchain platforms, Ethereum has achieved widespread deployment of decentralized applications through smart contracts. However, as the complexity of smart contracts increases, their security and reliability have also become important research topics. At present, smart contract analysis is mainly divided into two methods: static analysis and dynamic analysis, each with its own advantages and disadvantages.

[0003] Static analysis methods can identify potential problems by analyzing contract code or bytecode without actually executing the contract. The advantage of this method is that it can fully cover the code and detect potential vulnerabilities and logical errors. However, static analysis also has some limitations, such as difficulty in handling complex dynamic behaviors, especially those involving external calls and state changes; it may generate a large number of false positives that require manual verification; and the analysis may not be accurate enough for some advanced language features and complex control flows.

[0004] The dynamic analysis method detects problems by actually executing the contract or simulating the execution. The advantage of this method is that it can detect problems in actual operation and reduce false positives. However, dynamic analysis also has its shortcomings, such as it is difficult to cover all possible execution paths and may miss some edge cases; it requires building an appropriate test environment and input data, which is costly; and it may be difficult to detect some vulnerabilities that are only triggered under certain conditions.

[0005] Existing smart contract analysis tools, whether based on static analysis or dynamic analysis, have difficulty in comprehensively and accurately analyzing the behavior of contracts. Especially when dealing with complex data flows and control flows, these tools often have difficulty providing fine-grained analysis results. In addition, most tools require source code for analysis, which limits their application on deployed contracts.

[0006] In view of the shortcomings of existing technologies, we propose a new fine-grained analysis method for smart contracts. This method directly processes the bytecode of the contract and achieves accurate mapping between the internal variables of the contract and the input parameters through advanced symbolic execution and data flow analysis techniques. This not only overcomes the limitations of static analysis and dynamic analysis, but also provides the possibility of in-depth analysis of deployed contracts. Our method is able to capture complex data dependencies and control flow information, providing a solid foundation for security analysis, performance optimization, and formal verification of smart contracts. Summary of the invention

[0007] In view of the deficiencies in the prior art, the present invention provides a fine-grained analysis method for Ethereum smart contracts, which solves the problems mentioned in the above background technology.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions: Ethereum smart contract fine-grained analysis method, including:

[0009] Convert EVM contract bytecode: Use the Gigahorse framework to convert Ethereum smart contract bytecode into a high-level intermediate representation;

[0010] Constructing a control flow graph: Based on the high-level intermediate representation generated by Gigahorse, a detailed control flow graph is constructed using back-propagation techniques;

[0011] Simulate EVM memory operations: Accurately identify and track variables in memory by simulating the memory operations of the Ethereum virtual machine;

[0012] Symbolic execution analysis: The last step uses symbolic execution technology to derive the conditions of all successful execution paths;

[0013] Fine-grained analysis report: All information collected through symbolic execution generates a fine-grained analysis report that lists all successful execution paths and their corresponding input conditions, providing developers and auditors with a powerful tool to deeply understand contract behavior, helping to discover potential security vulnerabilities and optimize contract design.

[0014] Preferably, the specific method for converting the EVM contract bytecode is as follows: Gigahorse first parses the smart contract bytecode and identifies the basic blocks and jump instructions; then, it converts the bytecode instructions into equivalent high-level intermediate representation instructions, which are closer to human-readable form; during the conversion process, Gigahorse also performs some optimizations, such as eliminating dead code, simplifying expressions, etc.; finally, the generated high-level intermediate representation contains the complete logic of the original contract.

[0015] Preferably, the control flow graph is constructed as follows: first, all possible execution paths are identified from the high-level intermediate representation, including conditional branches, loops, and function calls; then, a back-propagation algorithm is used to reversely trace possible execution paths starting from the termination point of the contract (such as return and abort instructions); during the tracing process, focus is placed on the paths that lead to the successful execution of the contract, which are usually more valuable for analysis; a unique identifier is assigned to each basic block, and the jump relationship between blocks is recorded, and finally a complete control flow graph is generated, which helps to understand the overall structure and execution logic of the contract.

[0016] Preferably, the specific method is:

[0017] Step 1: Start: Initialize the control flow graph (CFG) to set the necessary environment and initial state for the analysis process of the entire algorithm;

[0018] Step 2: Identify CFG connections: traverse all nodes in the control flow graph generated by Gigahorse, identify and record the connection relationship between each node, and ensure that all possible conditional branches, loop structures, and function calls are captured in this step;

[0019] Step 3: Locate the CFG endpoint: Find and mark all endpoint nodes in the control flow graph. The endpoint nodes usually include return statements and stop instructions (such as terminate or return) in the contract.

[0020] Step 4: Backward propagation path: Starting from the end node marked in the previous step, start the reverse path propagation. By traversing the control flow graph in reverse, the possible execution paths are gradually traced back;

[0021] Step 5: Output reverse paths: Once all paths have been identified, output the results of these reverse paths. These outputs will serve as the basis for further analysis of the contract structure and execution logic. The path diagram output in this step will show all possible contract execution sequences, helping to understand the overall control flow structure of the contract;

[0022] Step 6: Obtain each path constraint: For each identified execution path, analyze and extract the logical constraints on the path. These constraints will be used for further verification or optimization analysis, such as symbolic execution or security verification.

[0023] Step 7: End: After all paths have been analyzed and recorded, the control flow graph is constructed. At this point, the entire algorithm process ends, and the generated path graph and analysis results will be used for further contract verification and optimization.

[0024] Preferably, the nodes represent basic blocks and the edges represent possible execution flows.

[0025] Preferably, the specific method of simulating EVM memory operations is: first, implement a virtual Ethereum virtual machine memory model to simulate the stack and memory operations of the Ethereum virtual machine; then, traverse each basic block in the control flow graph and execute high-level intermediate representation instructions in sequence; simulate each memory operation (such as memory read, memory write), and record the read and write location and value of the memory; by analyzing the pattern of memory operations, identify the variables used in the contract and their life cycle; finally, establish a dependency graph between variables, including data flow and control flow dependencies; this step provides key information for understanding the internal state management and data flow of the contract.

[0026] Preferably, the specific method of the symbolic execution analysis is: first, assign symbolic values ​​to each input parameter and key state variable; starting from the contract entry point, perform symbolic execution along the path in the control flow graph; when encountering conditional branches, record the path conditions that lead to the execution of different branches; for each successfully executed path, collect all accumulated path conditions; use a constraint solver to simplify and solve these path conditions; for large contracts, most of the constraints of some paths are the same, so the same constraints can be used to merge paths to achieve optimization purposes; in addition, multiple processors can be used to process constraints in parallel to achieve the purpose of optimizing analysis speed.

[0027] Beneficial Effects

[0028] The present invention provides a fine-grained analysis method for Ethereum smart contracts. Compared with the prior art, it has the following beneficial effects:

[0029] (1) This paper implements a comprehensive and fine-grained analysis of Ethereum smart contracts. The advantage of this method is that it can directly process bytecode without source code, so it can be applied to various scenarios, including deployed contracts and closed-source contracts. By combining high-level intermediate representation, control flow analysis, memory operation simulation and symbolic execution, this method can deeply understand the behavior and potential risks of contracts.

[0030] (2) The fine-grained analysis method of the present invention provides a powerful tool for smart contract developers, security auditors, and researchers. It can not only discover common vulnerabilities such as reentrancy attacks, integer overflows, and unauthorized access, but also identify more complex logic errors and optimization opportunities. By generating detailed execution path and condition reports, developers can better understand and improve their contract designs. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flowchart provided for the Ethereum smart contract fine-grained analysis method of the present invention;

[0032] Figure 2 A flow chart for constructing a control flow graph provided for the fine-grained analysis method of Ethereum smart contracts of the present invention. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] See also Figure 1-Figure 2The present invention provides a technical solution: a fine-grained analysis method for Ethereum smart contracts, comprising:

[0035] Convert EVM contract bytecode: Use the Gigahorse framework to convert Ethereum smart contract bytecode into a high-level intermediate representation. The specific method is as follows: Gigahorse first parses the smart contract bytecode and identifies basic blocks and jump instructions. Then, it converts the bytecode instructions into equivalent high-level intermediate representation instructions, which are closer to human-readable form. Finally, the generated high-level intermediate representation contains the complete logic of the original contract.

[0036] Constructing a control flow graph: First, identify all possible execution paths from the high-level intermediate representation, including conditional branches, loops, and function calls; then, use the backpropagation algorithm to trace possible execution paths in reverse from the termination point of the contract; during the tracing process, focus on the paths that lead to the successful execution of the contract, which are usually more valuable for analysis; assign a unique identifier to each basic block, and record the jump relationship between blocks, and finally generate a complete control flow graph. This step helps to understand the overall structure and execution logic of the contract; the specific method is:

[0037] Step 1: Start: Initialize the control flow graph (CFG) to set the necessary environment and initial state for the analysis process of the entire algorithm;

[0038] Step 2: Identify CFG connections: traverse all nodes in the control flow graph generated by Gigahorse, identify and record the connection relationship between each node, and ensure that all possible conditional branches, loop structures, and function calls are captured in this step;

[0039] Step 3: Locate the CFG endpoint: Find and mark all endpoint nodes in the control flow graph. The endpoint nodes usually include return statements and stop instructions (such as terminate or return) in the contract.

[0040] Step 4: Backward propagation path: Starting from the end node marked in the previous step, start the reverse path propagation. By traversing the control flow graph in reverse, the possible execution paths are gradually traced back;

[0041] Step 5: Output reverse paths: Once all paths have been identified, output the results of these reverse paths. These outputs will serve as the basis for further analysis of the contract structure and execution logic. The path diagram output in this step will show all possible contract execution sequences, helping to understand the overall control flow structure of the contract;

[0042] Step 6: Obtain each path constraint: For each identified execution path, analyze and extract the logical constraints on the path. These constraints will be used for further verification or optimization analysis, such as symbolic execution or security verification.

[0043] Step 7: End: After all paths have been analyzed and recorded, the control flow graph is constructed. At this point, the entire algorithm process ends, and the generated path graph and analysis results will be used for further contract verification and optimization;

[0044] Simulate EVM memory operations: Accurately identify and track variables in memory by simulating the memory operations of the Ethereum virtual machine. The specific method is as follows: First, implement a virtual Ethereum virtual machine memory model to simulate the stack and memory operations of the Ethereum virtual machine. Then, traverse each basic block in the control flow graph and execute high-level intermediate representation instructions in sequence. Simulate each memory operation (such as memory read and memory write) and record the read and write locations and values ​​of the memory. By analyzing the pattern of memory operations, identify the variables used in the contract and their life cycle. Finally, establish a dependency graph between variables, including data flow and control flow dependencies. This step provides key information for understanding the internal state management and data flow of the contract.

[0045] Symbolic execution analysis: The last step uses symbolic execution technology to derive the conditions of all successful execution paths. The specific method is as follows: first, assign symbolic values ​​to each input parameter and key state variable; start from the contract entry point and perform symbolic execution along the path in the control flow graph; when encountering conditional branches, record the path conditions that lead to the execution of different branches; for each successfully executed path, collect all accumulated path conditions; use constraint solvers to simplify and solve these path conditions; for large contracts, most of the constraints of some paths are the same, so the same constraints can be used to merge paths for optimization purposes; in addition, multiple processors can be used to process constraints in parallel to achieve the purpose of optimizing analysis speed;

[0046] Among them, nodes represent basic blocks and edges represent possible execution flows;

[0047] Fine-grained analysis report: All information collected through symbolic execution generates a fine-grained analysis report that lists all successful execution paths and their corresponding input conditions, providing developers and auditors with a powerful tool to deeply understand contract behavior, helping to discover potential security vulnerabilities and optimize contract design.

[0048] The present invention proposes a fine-grained analysis method for Ethereum smart contracts, which mainly processes the bytecode of smart contracts. The method realizes the mapping relationship between contract internal variables and input parameters by parsing bytecode, performing symbolic analysis and constructing a variable dependency graph. This method allows all variables to be represented by all inputs, providing a new contract analysis tool for the Ethereum community. Specifically, the method first disassembles the Ethereum smart contract bytecode, and then constructs basic blocks and function boundaries through control flow analysis. Then, the symbolic execution technology is used to simulate the contract running process and track the variable state changes. Finally, the dependency relationship between input parameters and internal variables is established through data flow analysis, thereby realizing fine-grained contract behavior analysis. This method helps to improve the comprehensibility and analyzability of smart contracts, and provides support for security audits and performance optimization.

[0049] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0050] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0051] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A fine-grained analysis method for Ethereum smart contracts, characterized in that: include: Convert EVM contract bytecode: Use the Gigahorse framework to convert Ethereum smart contract bytecode into a high-level intermediate representation; Constructing a control flow graph: Based on the high-level intermediate representation generated by Gigahorse, a detailed control flow graph is constructed using back-propagation techniques; Simulate EVM memory operations: Accurately identify and track variables in memory by simulating the memory operations of the Ethereum virtual machine; Symbolic execution analysis: The last step uses symbolic execution technology to derive the conditions of all successful execution paths; Fine-grained analysis report: All information collected through symbolic execution generates a fine-grained analysis report that lists all successful execution paths and their corresponding input conditions, providing developers and auditors with a powerful tool to deeply understand contract behavior, helping to discover potential security vulnerabilities and optimize contract design.

2. The Ethereum smart contract fine-grained analysis method according to claim 1 is characterized in that: The specific method for converting EVM contract bytecode is as follows: Gigahorse first parses the smart contract bytecode and identifies basic blocks and jump instructions; then, it converts the bytecode instructions into equivalent high-level intermediate representation instructions, which are closer to human-readable form; finally, the generated high-level intermediate representation contains the complete logic of the original contract.

3. The Ethereum smart contract fine-grained analysis method according to claim 1 is characterized in that: The control flow graph construction method is as follows: first, identify all possible execution paths from the high-level intermediate representation, including conditional branches, loops, and function calls; then, use the back-propagation algorithm to trace the possible execution paths in reverse from the termination point of the contract; during the tracing process, focus on the paths that lead to the successful execution of the contract, which are usually more valuable for analysis; assign a unique identifier to each basic block, and record the jump relationship between blocks, and finally generate a complete control flow graph. This step helps to understand the overall structure and execution logic of the contract.

4. The Ethereum smart contract fine-grained analysis method according to claim 3 is characterized in that: The specific method is: Step 1: Start: Initialize the control flow graph (CFG) to set the necessary environment and initial state for the analysis process of the entire algorithm; Step 2: Identify CFG connections: traverse all nodes in the control flow graph generated by Gigahorse, identify and record the connection relationship between each node, and ensure that all possible conditional branches, loop structures, and function calls are captured in this step; Step 3: Locate the CFG endpoint: Find and mark all endpoint nodes in the control flow graph. The endpoint nodes usually include return statements and stop instructions (such as terminate or return) in the contract. Step 4: Backward propagation path: Starting from the end node marked in the previous step, start the reverse path propagation. By traversing the control flow graph in reverse, the possible execution paths are gradually traced back; Step 5: Output reverse paths: Once all paths have been identified, output the results of these reverse paths. These outputs will serve as the basis for further analysis of the contract structure and execution logic. The path diagram output in this step will show all possible contract execution sequences, helping to understand the overall control flow structure of the contract; Step 6: Obtain each path constraint: For each identified execution path, analyze and extract the logical constraints on the path. These constraints will be used for further verification or optimization analysis, such as symbolic execution or security verification. Step 7: End: After all paths have been analyzed and recorded, the control flow graph is constructed. At this point, the entire algorithm process ends, and the generated path graph and analysis results will be used for further contract verification and optimization.

5. The Ethereum smart contract fine-grained analysis method according to claim 4 is characterized in that: in, Nodes represent basic blocks and edges represent possible execution flows.

6. The Ethereum smart contract fine-grained analysis method according to claim 1, characterized in that: The specific method of simulating EVM memory operation is as follows: first, a virtual Ethereum virtual machine memory model is implemented to simulate the stack and memory operations of the Ethereum virtual machine; then, each basic block in the control flow graph is traversed to execute the high-level intermediate representation instructions in sequence; Each memory operation (such as memory read, memory write) is simulated to record the memory read and write location and value; by analyzing the pattern of memory operations, the variables used in the contract and their life cycle are identified; finally, a dependency graph between variables is established, including data flow and control flow dependencies; this step provides key information for understanding the contract's internal state management and data flow.

7. The Ethereum smart contract fine-grained analysis method according to claim 1, characterized in that: The specific method of the symbolic execution analysis is as follows: first, assign symbolic values ​​to each input parameter and key state variable; starting from the contract entry point, perform symbolic execution along the path in the control flow graph; when encountering conditional branches, record the path conditions that lead to the execution of different branches; for each successfully executed path, collect all accumulated path conditions; use a constraint solver to simplify and solve these path conditions; for large contracts, most of the constraints of some paths are the same, so the same constraints can be used to merge paths to achieve optimization purposes; in addition, multiple processors can be used to process constraints in parallel to achieve the purpose of optimizing analysis speed.

Images