Fine-grained analysis method for Ethereum smart contracts

Abstract

The present invention discloses a method for fine-grained analysis of Ethereum smart contracts, which relates to the technical field of smart contract analysis tools. The method comprises the following steps: converting EVM contract bytecode: utilizing the Gigahorse framework to convert Ethereum smart contract bytecode into a high-level intermediate representation; constructing a control flow graph: constructing a detailed control flow graph based on the high-level intermediate representation generated by Gigahorse using backpropagation technology; and simulating EVM memory operations: accurately identifying and tracking variables in memory by simulating the memory operations of the Ethereum virtual machine. The present invention enables comprehensive, fine-grained analysis of Ethereum smart contracts. This method is advantageous in that it can directly process bytecode without the need for source code, making it applicable to a variety of scenarios, including deployed and closed-source contracts. By combining high-level intermediate representation, control flow analysis, memory operation simulation, and symbolic execution, the method provides a deep understanding of contract behavior and potential risks.

Description

Technical Field

[0001] The present invention relates to the technical field of smart contract analysis tools, and in particular to a fine-grained analysis method for Ethereum smart contracts. Background Art

[0002] As one of the leading blockchain platforms, Ethereum has enabled widespread deployment of decentralized applications through smart contracts. However, as smart contracts grow in complexity, their security and reliability have become crucial research topics. Currently, smart contract analysis primarily involves static analysis and dynamic analysis, each with its own advantages and disadvantages.

[0003] Static analysis methods analyze contract code or bytecode to identify potential issues without actually executing the contract. The advantage of this approach is that it provides comprehensive code coverage, detecting potential vulnerabilities and logical errors. However, static analysis also has limitations. These include difficulty handling complex dynamic behavior, particularly those involving external calls and state changes; the potential for generating numerous false positives that require manual verification; and the potential for inaccurate analysis of certain advanced language features and complex control flows.

[0004] Dynamic analysis detects issues through actual contract execution or simulated execution. This approach has the advantage of identifying issues during actual operation and reducing false positives. However, dynamic analysis also has its drawbacks. For example, it struggles to cover all possible execution paths, potentially missing edge cases. It requires building a suitable test environment and input data, which is costly. Furthermore, it can be difficult to detect vulnerabilities that are triggered only under specific conditions.

[0005] Existing smart contract analysis tools, whether based on static or dynamic analysis, struggle to comprehensively and accurately analyze contract behavior. These tools often struggle to provide fine-grained analysis results, especially when dealing with complex data and control flows. Furthermore, most tools require source code for analysis, which limits their applicability to deployed contracts.

[0006] Recognizing the shortcomings of existing techniques, we propose a novel fine-grained analysis method for smart contracts. This approach directly processes the contract's bytecode and, through advanced symbolic execution and data flow analysis techniques, achieves a precise mapping between internal contract variables and input parameters. This approach not only overcomes the limitations of both static and dynamic analysis but also enables in-depth analysis of deployed contracts. Our method is able to capture complex data dependencies and control flow information, providing a solid foundation for security analysis, performance optimization, and formal verification of smart contracts. Summary of the Invention

[0007] In response to the shortcomings of the existing technology, the present invention provides a fine-grained analysis method for Ethereum smart contracts, which solves the problems mentioned in the above background technology.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions: a fine-grained analysis method for Ethereum smart contracts, comprising:

[0009] Convert EVM contract bytecode: Use the Gigahorse framework to convert Ethereum smart contract bytecode into high-level intermediate representation;

[0010] Build a control flow graph: Based on the high-level intermediate representation generated by Gigahorse, use backpropagation technology to build a detailed control flow graph;

[0011] Simulate EVM memory operations: Accurately identify and track variables in memory by simulating the memory operations of the Ethereum Virtual Machine;

[0012] Symbolic execution analysis: The final step uses symbolic execution technology to deduce the conditions for all successful execution paths;

[0013] Fine-grained analysis report: All information collected through symbolic execution is used to generate a fine-grained analysis report that lists all successful execution paths and their corresponding input conditions. This provides developers and auditors with a powerful tool for in-depth understanding of contract behavior, helping to discover potential security vulnerabilities and optimize contract design.

[0014] Preferably, the specific method for converting EVM contract bytecode is as follows: Gigahorse first parses the smart contract bytecode and identifies basic blocks and jump instructions; then, it converts the bytecode instructions into equivalent high-level intermediate representation instructions, which are closer to human-readable form; during the conversion process, Gigahorse also performs some optimizations, such as eliminating dead code and simplifying expressions; finally, the generated high-level intermediate representation contains the complete logic of the original contract.

[0015] Preferably, the control flow graph is constructed as follows: first, all possible execution paths are identified from the high-level intermediate representation, including conditional branches, loops, and function calls; then, a backpropagation algorithm is used to trace the possible execution paths in reverse, starting from the termination point of the contract (such as return or abort instructions); during the tracing process, focus is placed on the paths that lead to the successful execution of the contract, as these paths are generally more valuable for analysis; a unique identifier is assigned to each basic block, and the jump relationship between blocks is recorded, ultimately generating a complete control flow graph. This step helps to understand the overall structure and execution logic of the contract.

[0016] Preferably, the specific method is:

[0017] Step 1: Start: Initialize the control flow graph (CFG) to set up the necessary environment and initial state for the analysis process of the entire algorithm;

[0018] Step 2: Identify CFG connections: Traverse all nodes in the control flow graph generated by Gigahorse, identify and record the connection relationships between each node, and ensure that all possible conditional branches, loop structures, and function calls are captured in this step;

[0019] Step 3: Locate the CFG endpoint: Find and mark all endpoint nodes in the control flow graph. The endpoint nodes usually include return statements and stop instructions (such as terminate or return) in the contract.

[0020] Step 4: Backward propagation path: Starting from the end node marked in the previous step, reverse path propagation begins. By traversing the control flow graph in reverse, the possible execution paths are gradually traced back.

[0021] Step 5: Output reverse paths: Once all paths have been identified, output the results of these reverse paths. These outputs will serve as the basis for further analysis of the contract structure and execution logic. The path diagram output in this step will display all possible contract execution sequences, helping to understand the overall control flow structure of the contract.

[0022] Step 6: Obtain each path constraint: For each identified execution path, analyze and extract the logical constraints on the path. These constraints will be used for further verification or optimization analysis, such as symbolic execution or security verification.

[0023] Step 7: End: After all paths have been analyzed and recorded, the control flow graph is constructed. At this point, the entire algorithm process ends, and the generated path graph and analysis results will be used for further contract verification and optimization.

[0024] Preferably, the nodes represent basic blocks and the edges represent possible execution flows.

[0025] Preferably, the specific method of simulating EVM memory operations is as follows: first, a virtual Ethereum virtual machine memory model is implemented to simulate the stack and memory operations of the Ethereum virtual machine; then, each basic block in the control flow graph is traversed and high-level intermediate representation instructions are executed in sequence; each memory operation (such as memory read and memory write) is simulated and the memory read and write locations and values ​​are recorded; by analyzing the pattern of memory operations, the variables used in the contract and their life cycles are identified; finally, a dependency graph between variables is established, including data flow and control flow dependencies; this step provides key information for understanding the internal state management and data flow of the contract.

[0026] Preferably, the specific method of the symbolic execution analysis is: first, assign symbolic values ​​to each input parameter and key state variable; starting from the contract entry point, perform symbolic execution along the path in the control flow graph; when encountering conditional branches, record the path conditions that lead to the execution of different branches; for each successfully executed path, collect all accumulated path conditions; use a constraint solver to simplify and solve these path conditions; for large contracts, most of the constraints of some paths are the same, so the same constraints can be used to merge paths to achieve optimization purposes; in addition, multiple processors can be used to process constraints in parallel to achieve the purpose of optimizing analysis speed.

[0027] Beneficial effects

[0028] This invention provides a fine-grained analysis method for Ethereum smart contracts. Compared with existing technologies, it has the following advantages:

[0029] (1) This paper implements a comprehensive and fine-grained analysis of Ethereum smart contracts. The advantage of this approach is that it can directly process bytecode without the need for source code, and can therefore be applied to a variety of scenarios, including deployed and closed-source contracts. By combining high-level intermediate representation, control flow analysis, memory operation simulation, and symbolic execution, this approach can provide a deep understanding of contract behavior and potential risks.

[0030] (2) The fine-grained analysis method of this invention provides a powerful tool for smart contract developers, security auditors, and researchers. It not only discovers common vulnerabilities such as reentrancy attacks, integer overflows, and unauthorized access, but also identifies more complex logic errors and optimization opportunities. By generating detailed execution path and condition reports, developers can better understand and improve their contract designs. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flowchart of the fine-grained analysis method for Ethereum smart contracts provided by the present invention;

[0032] Figure 2 A flowchart for constructing a control flow graph for the fine-grained analysis method of Ethereum smart contracts provided by the present invention. DETAILED DESCRIPTION

[0033] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0034] See also Figure 1-Figure 2The present invention provides a technical solution: a fine-grained analysis method for Ethereum smart contracts, comprising:

[0035] Converting EVM contract bytecode: Using the Gigahorse framework, we convert Ethereum smart contract bytecode into a high-level intermediate representation (HIR). Gigahorse first parses the smart contract bytecode and identifies basic blocks and jump instructions. It then converts the bytecode instructions into equivalent high-level intermediate representation (HIR) instructions, which are closer to human-readable form. Finally, the generated HIR contains the complete logic of the original contract.

[0036] Constructing a control flow graph: First, identify all possible execution paths from the high-level intermediate representation, including conditional branches, loops, and function calls. Then, use the backpropagation algorithm to trace possible execution paths backwards, starting from the termination point of the contract. During the tracing process, focus on the paths that lead to successful contract execution, as these paths are generally more valuable for analysis. Assign a unique identifier to each basic block and record the jump relationships between blocks. Finally, a complete control flow graph is generated. This step helps understand the overall structure and execution logic of the contract. The specific method is as follows:

[0037] Step 1: Start: Initialize the control flow graph (CFG) to set up the necessary environment and initial state for the analysis process of the entire algorithm;

[0038] Step 2: Identify CFG connections: Traverse all nodes in the control flow graph generated by Gigahorse, identify and record the connection relationships between each node, and ensure that all possible conditional branches, loop structures, and function calls are captured in this step;

[0039] Step 3: Locate the CFG endpoint: Find and mark all endpoint nodes in the control flow graph. The endpoint nodes usually include return statements and stop instructions (such as terminate or return) in the contract.

[0040] Step 4: Backward propagation path: Starting from the end node marked in the previous step, reverse path propagation begins. By traversing the control flow graph in reverse, the possible execution paths are gradually traced back.

[0041] Step 5: Output reverse paths: Once all paths have been identified, output the results of these reverse paths. These outputs will serve as the basis for further analysis of the contract structure and execution logic. The path diagram output in this step will display all possible contract execution sequences, helping to understand the overall control flow structure of the contract.

[0042] Step 6: Obtain each path constraint: For each identified execution path, analyze and extract the logical constraints on the path. These constraints will be used for further verification or optimization analysis, such as symbolic execution or security verification.

[0043] Step 7: End: After all paths have been analyzed and recorded, the control flow graph is constructed. At this point, the entire algorithm process ends, and the generated path graph and analysis results will be used for further contract verification and optimization;

[0044] Simulating EVM memory operations: Accurately identify and track variables in memory by simulating the memory operations of the Ethereum Virtual Machine. The specific method is as follows: First, implement a virtual Ethereum Virtual Machine memory model to simulate the Ethereum Virtual Machine's stack and memory operations. Then, traverse each basic block in the control flow graph and execute high-level intermediate representation instructions in sequence. Each memory operation (such as memory read and memory write) is simulated, and the memory read and write locations and values ​​are recorded. By analyzing the pattern of memory operations, the variables used in the contract and their lifecycles are identified. Finally, a dependency graph between variables is established, including data flow and control flow dependencies. This step provides key information for understanding the contract's internal state management and data flow.

[0045] Symbolic execution analysis: The final step uses symbolic execution technology to derive the conditions for all successful execution paths. The specific method is as follows: First, assign symbolic values ​​to each input parameter and key state variable; Starting from the contract entry point, symbolic execution is performed along the paths in the control flow graph; When encountering conditional branches, the path conditions that lead to the execution of different branches are recorded; For each successfully executed path, all accumulated path conditions are collected; These path conditions are simplified and solved using a constraint solver; For large contracts, some paths have most of the same constraints, so the same constraints can be used to merge paths for optimization purposes; In addition, multiple processors can be used to process constraints in parallel to optimize analysis speed;

[0046] Among them, nodes represent basic blocks and edges represent possible execution flows;

[0047] Fine-grained analysis report: All information collected through symbolic execution is used to generate a fine-grained analysis report that lists all successful execution paths and their corresponding input conditions. This provides developers and auditors with a powerful tool for in-depth understanding of contract behavior, helping to discover potential security vulnerabilities and optimize contract design.

[0048] This paper proposes a fine-grained analysis method for Ethereum smart contracts, primarily targeting the bytecode of smart contracts. By parsing the bytecode, performing symbolic analysis, and constructing a variable dependency graph, this method implements a mapping relationship between contract internal variables and input parameters. This method allows all variables to be represented by all inputs, providing the Ethereum community with a new contract analysis tool. Specifically, this method first disassembles the Ethereum smart contract bytecode and then constructs basic blocks and function boundaries through control flow analysis. Symbolic execution technology is then used to simulate the contract execution process and track variable state changes. Finally, data flow analysis is used to establish the dependency relationship between input parameters and internal variables, thereby enabling fine-grained contract behavior analysis. This method helps improve the understandability and analyzability of smart contracts, providing support for security audits and performance optimization.

[0049] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0050] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0051] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A fine-grained analysis method for Ethereum smart contracts, characterized by: include: Convert EVM contract bytecode: Use the Gigahorse framework to convert Ethereum smart contract bytecode into high-level intermediate representation; Build a control flow graph: Based on the high-level intermediate representation generated by Gigahorse, use backpropagation technology to build a detailed control flow graph; Simulate EVM memory operations: Accurately identify and track variables in memory by simulating the memory operations of the Ethereum Virtual Machine; Symbolic execution analysis: The final step uses symbolic execution technology to deduce the conditions for all successful execution paths; Fine-grained analysis report: All information collected through symbolic execution is used to generate a fine-grained analysis report that lists all successful execution paths and their corresponding input conditions. This provides developers and auditors with a powerful tool for in-depth understanding of contract behavior, helping to discover potential security vulnerabilities and optimize contract design. The control flow graph construction method is as follows: first, all possible execution paths are identified from the high-level intermediate representation, including conditional branches, loops, and function calls; then, a backpropagation algorithm is used to trace the possible execution paths backwards from the termination point of the contract; during the tracing process, the path that leads to the successful execution of the contract is focused on; a unique identifier is assigned to each basic block, and the jump relationship between blocks is recorded, ultimately generating a complete control flow graph. This step helps to understand the overall structure and execution logic of the contract; The specific method of constructing a control flow graph is: Step 1: Start: Initialize CFG and set up the necessary environment and initial state for the analysis process of the entire algorithm; Step 2: Identify CFG connections: Traverse all nodes in the control flow graph generated by Gigahorse, identify and record the connection relationships between each node, and ensure that all possible conditional branches, loop structures, and function calls are captured in this step; Step 3: Locate the CFG endpoint: Find and mark all endpoint nodes in the control flow graph, including return statements and stop instructions in the contract; Step 4: Backward propagation path: Starting from the end node marked in the previous step, reverse path propagation begins, and by traversing the control flow graph in reverse, the possible execution paths are gradually traced back; Step 5: Output reverse paths: Once all paths have been identified, output the results of these reverse paths. These outputs will serve as the basis for further analysis of the contract structure and execution logic. The path diagram output in this step will show all possible contract execution sequences, helping to understand the overall control flow structure of the contract. Step 6: Obtain each path constraint: For each identified execution path, analyze and extract the logical constraints on the path. These constraints will be used for further verification or optimization analysis. Step 7: End: After all paths have been analyzed and recorded, the control flow graph is constructed. At this point, the entire algorithm process ends, and the generated path graph and analysis results will be used for further contract verification and optimization.

2. The Ethereum smart contract fine-grained analysis method according to claim 1, characterized in that: The specific method for converting EVM contract bytecode is as follows: Gigahorse first parses the smart contract bytecode and identifies basic blocks and jump instructions; then, it converts the bytecode instructions into equivalent high-level intermediate representation instructions, which are closer to human-readable form; finally, the generated high-level intermediate representation contains the complete logic of the original contract.

3. The Ethereum smart contract fine-grained analysis method according to claim 1, characterized in that: in, Nodes represent basic blocks and edges represent possible execution flows.

4. The Ethereum smart contract fine-grained analysis method according to claim 1, characterized in that: The specific method for simulating EVM memory operations is as follows: first, a virtual Ethereum virtual machine memory model is implemented to simulate the Ethereum virtual machine's stack and memory operations; then, each basic block in the control flow graph is traversed and high-level intermediate representation instructions are executed in sequence; each memory operation is simulated and the memory read and write locations and values ​​are recorded; by analyzing the pattern of memory operations, the variables used in the contract and their lifecycles are identified; finally, a dependency graph between variables is established, including data flow and control flow dependencies; this step provides key information for understanding the contract's internal state management and data flow.

5. The Ethereum smart contract fine-grained analysis method according to claim 1, characterized in that: The specific method of symbolic execution analysis is as follows: first, assign symbolic values ​​to each input parameter and key state variable; starting from the contract entry point, perform symbolic execution along the paths in the control flow graph; when encountering conditional branches, record the path conditions that lead to the execution of different branches; for each successfully executed path, collect all accumulated path conditions; use a constraint solver to simplify and solve these path conditions; for large contracts, some paths have most of the same constraints, so the same constraints are used to merge paths for optimization purposes; In addition, multiple processors are used to process constraints in parallel to optimize the analysis speed.

Images