Price manipulation attack contract detection method and system based on abnormal token flow

Abstract

The invention discloses a price manipulation attack contract detection method and system based on an abnormal token flow. Firstly, for all external calls of a contract, related information including a target contract address and a target function selector is extracted from a byte code level; then, on the basis of the generated inter-process control flow diagram, basic blocks are expanded through the extracted calling information to serve as nodes, and a cross-contract function calling point diagram is constructed in combination with a jump relation and cross-contract analysis; then, based on a specific behavior of external calling, a token operation corresponding to the specific behavior is extracted, and a token flow graph is constructed; and finally, traversing the sensitive paths in the token flow graph, and judging whether the contract is used for price manipulation attacks or not according to a predefined price manipulation mode. According to the method, only from the contract byte code, no transaction information is needed, so that once the smart contract with the potential price manipulation attack intention is deployed to be linked, the early warning information can be immediately detected and generated.

Description

Technical Field

[0001] The present invention relates to the technical field of attack contract detection, and in particular to a price manipulation attack contract detection method and system based on abnormal token flow. Background Art

[0002] At present, the decentralized finance (DeFi) ecosystem is developing rapidly, and decentralized applications based on smart contracts have attracted a lot of investment. By 2024, the total locked value of DeFi protocols has exceeded US$90 billion. However, DeFi developers lack awareness of security issues or are negligent in the development process, coupled with the transparency and immutability of smart contracts, making DeFi projects vulnerable to various types of attacks, often accompanied by huge economic losses, seriously affecting the stability of the DeFi ecosystem. Among them, price manipulation attacks are one of the most notorious attack methods in DeFi history. Attackers exploit vulnerabilities to profit from unfair token transfers. There are various reasons for price manipulation vulnerabilities in DeFi, including incorrect slippage settings, unprotected public functions, and reliance on untrusted price oracles. In addition, attackers tend to package attack operations into a single contract to quickly launch attacks and evade on-chain detection tools. This approach also allows them to use flash loans to execute attacks and ensure that the entire operation can be rolled back in time if any conditions are not met.

[0003] Although there are some tools for detecting price manipulation attacks on the market, most of them rely on historical transaction information generated by the contract or code analysis of the victim contract. This means that these tools can only identify the attack contract after it actually launches the attack and generates transactions. The large amount of transaction information increases the difficulty of analysis, resulting in limited recognition accuracy of the tools. The effectiveness of detection tools based on the victim contract code depends on predefined rules, and the diversity of vulnerabilities makes it impossible for these rules to cover all types of vulnerabilities, so the underreporting rate of identification is relatively high.

[0004] Therefore, it is necessary to develop new detection methods to more effectively warn of potential attacks. Summary of the invention

[0005] The present invention provides a price manipulation attack contract detection method and system based on abnormal token flow, which can identify price manipulation attack contracts and thus provide more effective early warning of potential attacks.

[0006] The present invention provides a price manipulation attack contract detection method based on abnormal token flow, comprising:

[0007] Decompile the bytecode of the contract to be detected to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be detected, and construct the basic blocks according to the jump targets of the jump instructions to obtain an inter-procedural control flow graph; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths;

[0008] Tracking the instruction offsets of all external calls based on the opcodes contained in the intermediate representation in the basic block, and extracting the target contract address and function selector of the specific call from different storages of the contract to be detected;

[0009] A cross-contract call point graph is constructed based on the control flow graph, the target contract address and the function selector; the nodes in the call point graph are represented as <call point instruction offset, target contract address, target function selector> triples, and the edges in the call point graph represent control flow connections between different call points;

[0010] A token flow graph is constructed based on the cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triple plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connection between different call points and the data flow information from parameters to return values ​​between different call points;

[0011] According to the target contract address, perform cross-contract analysis on the nodes on the execution path in the token flow graph to obtain a complete execution path;

[0012] Execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, output the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim, and treat the contract to be detected as a price manipulation attack contract.

[0013] Specifically, the token flow graph is constructed based on the cross-contract call point graph, including:

[0014] Based on the call point instruction offset of the node in the call point graph, find the nearest instruction offset for starting the read operation on the base address, and then traverse all memory write operations from the position of the instruction offset to the call point offset to obtain the actual parameters involved in each call point and the index positions of these parameters;

[0015] By using the target function selector of the node in the call point graph, the preset function signature template information, and the index position, it is heuristically inferred that the external call may be for exchanging tokens, and the operational semantic information related to the external call and the token is obtained;

[0016] Obtaining a specific representation of the return value according to the operational semantics information related to the external call and the token, and then obtaining data flow transfer information from parameters to return values ​​between different external calls based on data flow transfer rules;

[0017] The operational semantic information related to the external call and the token is added to the node representation of the call point graph, the control flow connection relationship between different call points in the call point graph is retained, and edges representing the data flow transfer information from parameters to return values ​​between different external calls are added to construct the token flow graph.

[0018] Specifically, according to the target contract address, a cross-contract analysis is performed on the nodes on the execution path in the token flow graph to obtain a complete execution path, including:

[0019] Determining whether the semantic information of the node sequence in each path in the token flow graph meets the predefined transaction sensitive characteristics;

[0020] If the semantic information of the node sequence in any path meets the predefined transaction sensitive characteristics, the path is regarded as a sensitive path;

[0021] According to the target contract address, cross-contract analysis is performed on the nodes on the sensitive path to obtain the complete execution path.

[0022] Specifically, the execution of the complete execution path, if the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, then the specific attack behavior pattern, the token address of the manipulated price and the address of the potential victim are output, and the contract to be detected is used as a price manipulation attack contract, including:

[0023] Executing the complete execution path, if the behavior constituted by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns, obtaining a matching predefined price manipulation attack behavior pattern;

[0024] According to the matched predefined price manipulation attack behavior pattern, the token address of the manipulated price and the address of the potential victim are obtained, and the contract to be detected is used as a price manipulation attack contract.

[0025] Specifically, the token address of the manipulated price and the potential victim address are obtained according to the matched predefined price manipulation attack behavior pattern, including:

[0026] According to the matched predefined price manipulation attack behavior pattern, the address type parameter of the node with two token exchange semantics in the matched attack behavior path is identified as the token address of the manipulated price; the address type parameter is determined according to the size of the fixed offset of parameter reading and writing;

[0027] Determining whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern;

[0028] If the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern, identifying the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path as the potential victim address;

[0029] If the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern, the target contract address of the node with manipulated token transfer semantics in the matched attack behavior path is identified as the potential victim address.

[0030] The present invention also provides a price manipulation attack contract detection system based on abnormal token flow, comprising:

[0031] A control flow graph construction module, used to decompile the bytecode of the contract to be detected to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be detected, and construct the basic blocks according to the jump targets of the jump instructions to obtain an inter-procedural control flow graph; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths;

[0032] A data acquisition module, used to track the instruction offsets of all external calls based on the opcodes contained in the intermediate representation in the basic block, and extract the target contract address and function selector of the specific call from different storages of the contract to be detected;

[0033] A call point graph construction module, used to construct a cross-contract call point graph based on the control flow graph, the target contract address and the function selector; the nodes in the call point graph are represented as <call point instruction offset, target contract address, target function selector> triples, and the edges in the call point graph represent control flow connections between different call points;

[0034] A token flow graph construction module is used to construct a token flow graph based on the cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triple plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connection between different call points and the data flow information from parameters to return values ​​between different call points;

[0035] A complete execution path acquisition module is used to perform cross-contract analysis on the nodes on the execution path in the token flow graph according to the target contract address to obtain a complete execution path;

[0036] The contract detection module is used to execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price and the address of the potential victim are output, and the contract to be detected is used as a price manipulation attack contract.

[0037] Specifically, the token flow graph construction module includes:

[0038] A parameter index obtaining unit, used to find the nearest instruction offset for starting a read operation on a base address based on the call point instruction offset of a node in the call point graph, and then traverse all memory write operations from the position of the instruction offset to the call point offset to obtain actual parameters involved in each call point and the index positions of these parameters;

[0039] An operational semantic information obtaining unit, used to heuristically infer that an external call that may be used to exchange tokens is obtained through a target function selector of a node in the call point graph, preset function signature template information, and the index position, and obtain operational semantic information related to the external call and the token;

[0040] A data flow transfer information obtaining unit, used to obtain a specific representation of its return value according to the operational semantic information related to the external call and the token, and then obtain the data flow transfer information from parameters to return values ​​between different external calls based on the data flow transfer rules;

[0041] A token flow graph construction unit is used to add the operational semantic information related to the external call and the token to the node representation of the call point graph, retain the control flow connection relationship between different call points in the call point graph, add edges representing the data flow transfer information from parameters to return values ​​between different external calls, and construct the token flow graph.

[0042] Specifically, the complete execution path acquisition module includes:

[0043] A sensitive path judgment unit, used to judge whether the semantic information of the node sequence in each path in the token flow graph meets the predefined transaction sensitive characteristics;

[0044] A sensitive path obtaining unit, used for treating any path as a sensitive path if the semantic information of the node sequence in the path meets the predefined transaction sensitive characteristics;

[0045] A complete execution path acquisition unit is used to perform cross-contract analysis on the nodes on the sensitive path according to the target contract address to obtain the complete execution path.

[0046] Specifically, the contract detection module includes:

[0047] a price manipulation attack behavior pattern matching unit, configured to execute the complete execution path, and obtain a matched predefined price manipulation attack behavior pattern if the behavior constituted by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns;

[0048] The price manipulation attack contract reporting unit is used to obtain the token address of the manipulated price and the address of the potential victim according to the matched predefined price manipulation attack behavior pattern, and to treat the contract to be detected as a price manipulation attack contract.

[0049] Specifically, the price manipulation attack contract reporting unit includes:

[0050] A token address identification subunit of manipulated price, used to identify, according to the matched predefined price manipulation attack behavior pattern, the address type parameter of the node of the two token exchange semantics in the matched attack behavior path as the token address of the manipulated price; the address type parameter is determined according to the size of the fixed offset of parameter reading and writing;

[0051] a price manipulation attack behavior pattern determination subunit, configured to determine whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern;

[0052] A first victim address identification subunit is used to identify the target contract address of the node of the manipulated token exchange semantics in the matched attack behavior path as the potential victim address if the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern;

[0053] A second victim address identification subunit is used to identify the target contract address of the node of the manipulated token transfer semantics in the matched attack behavior path as the potential victim address if the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern;

[0054] The price manipulation attack contract reporting subunit is used to report the contract to be detected as a price manipulation attack contract.

[0055] One or more technical solutions provided in the present invention have at least the following technical effects or advantages:

[0056] 1. First, for all external calls of the contract, relevant information is extracted from the bytecode level, including the target contract address and the target function selector. Then, based on the generated inter-procedural control flow graph, the basic block is extended as a node through the extracted call information, and the cross-contract function call point graph is constructed in combination with the jump relationship and cross-contract analysis. Next, based on the specific behavior of the external call, the corresponding token operation is extracted, and the token flow graph is constructed. Finally, the sensitive paths in the token flow graph are traversed, and the contract is judged whether it is used for price manipulation attacks according to the predefined price manipulation mode. The present invention only starts from the contract bytecode and does not require any transaction information. Therefore, once a smart contract with potential price manipulation attack intentions is deployed on the chain, the present invention can immediately detect and generate early warning information. In addition, based on the behavior pattern of detecting the attacking contract, the present invention avoids the limitations of large project volume, diverse vulnerability causes, and complex utilization chains brought about by directly starting from the victim contract, thereby obtaining more timely and accurate detection results.

[0057] 2. The present invention fully considers the overall characteristics of the attack contract, and realizes all-round recovery from the target contract address, function selector to specific parameters for each external call, and especially supports the recovery of complex type parameters such as arrays.

[0058] 3. The present invention fills the gap between bytecode and token operation semantics. By combining standard function signature template information and custom heuristic rules, the specific execution logic of the contract for different tokens is obtained, thereby improving the accuracy of price manipulation attack contract detection.

[0059] 4. The present invention fully considers the time overhead, only analyzes the key nodes in the token flow graph that meet the predefined sensitive paths, and achieves the effect of real-time detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A flow chart of a method for detecting price manipulation attack contracts based on abnormal token flows provided by an embodiment of the present invention;

[0061] Figure 2 A schematic diagram of a price manipulation attack contract detection method based on abnormal token flow provided by an embodiment of the present invention;

[0062] Figure 3 A module diagram of a price manipulation attack contract detection system based on abnormal token flow provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The embodiments of the present invention provide a price manipulation attack contract detection method and system based on abnormal token flow, which can identify price manipulation attack contracts, thereby more effectively warning of potential attacks.

[0064] The technical solution in the embodiment of the present invention is to achieve the above technical effects, and the overall idea is as follows:

[0065] The embodiment of the present invention proposes a method and system for detecting smart contracts used for price manipulation attacks based on abnormal token flows, aiming to effectively identify and warn potential price manipulation attacks on the chain, thereby reducing the economic losses of normal users in the community. Specifically, starting from the smart contract bytecode, the embodiment of the present invention first extracts the key external calls of the contract function and constructs a token flow graph in combination with the semantic information of the token operation to achieve a comprehensive understanding of the contract token flow behavior. The constructed token flow graph can reflect the specific operational behavior of the contract for different tokens. Then the embodiment of the present invention realizes the effective identification of price manipulation attack contracts based on predefined abnormal token flow detection rules.

[0066] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0067] like Figure 1 and Figure 2 As shown, the price manipulation attack contract detection method based on abnormal token flow provided by the embodiment of the present invention includes:

[0068] Step S110: Decompile the bytecode of the contract to be tested to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be tested, and construct the basic blocks according to the jump targets of the jump instructions to obtain a control flow graph between processes; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths; wherein, the intermediate representation is used to track data flow information between different variables, and the control flow graph is used to obtain control flow information of the contract code.

[0069] Step S120: Track the instruction offsets of all external calls (such as CALL, STATICCALL, DELEDATECALL) based on the opcodes contained in the intermediate representation in the basic block, and extract the target contract address and function selector of the specific call from different storages of the contract to be detected;

[0070] Step S130: construct a cross-contract call point graph based on the control flow graph, the target contract address and the function selector; the nodes in the call point graph are represented as <call point instruction offset, target contract address, target function selector> triples, and the edges in the call point graph represent the control flow connections between different call points. These edges can be used to analyze the contract call paths and their interdependencies;

[0071] Step S140: construct a token flow graph based on the cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triple plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connection between different call points and the data flow information from parameters to return values ​​between different call points;

[0072] This step is explained in detail. The token flow graph is constructed based on the cross-contract call point graph, including:

[0073] Based on the call point instruction offset of the node in the call point graph, find the nearest instruction offset that starts the read operation at the base address 0x40, and then traverse all memory write operations from the instruction offset to the call point offset. Each write operation corresponds to a variable written to the memory, so this step obtains the actual parameters involved in each call point and the index position of these parameters;

[0074] Through the target function selector, preset function signature template information, and index position of the node in the call point graph, it is heuristically inferred that the external call that may be the exchange of tokens is obtained, and the operational semantic information related to the external call and the token is obtained;

[0075] In this embodiment, the preset function signature template information includes: flash loans, liquidity pools, common DeFi protocol interfaces, and ERC20 / ERC721 token standard interfaces and other operations that may be related to tokens.

[0076] According to the operational semantics information related to the external call and the token, the specific representation of its return value is obtained, and then based on the data flow transmission rules, the data flow transmission information from parameters to return values ​​between different external calls is obtained;

[0077] The operational semantics information related to external calls and tokens is added to the node representation of the call point graph, the control flow connection relationship between different call points in the call point graph is retained, and edges representing the data flow transmission information from parameters to return values ​​between different external calls are added to construct a token flow graph.

[0078] Step S150: According to the target contract address, perform cross-contract analysis on the nodes on the execution path in the token flow graph to obtain a complete execution path;

[0079] This step is explained in detail. According to the target contract address, cross-contract analysis is performed on the nodes on the execution path in the token flow graph to obtain a complete execution path, including:

[0080] Determine whether the semantic information of the node sequence in each path in the token flow graph meets the predefined transaction sensitive characteristics; in this embodiment, the predefined transaction sensitive characteristics include at least any one of fund preparation, fund exchange, and fund transfer.

[0081] If the semantic information of the node sequence in any path meets the predefined transaction sensitive characteristics, the path is regarded as a sensitive path;

[0082] According to the target contract address, cross-contract analysis is performed on the nodes on the sensitive path to obtain the complete execution path.

[0083] Step S160: Execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim are output, and the contract to be detected is treated as a price manipulation attack contract.

[0084] This step is explained in detail. The complete execution path is executed. If the behavior formed by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim are output, and the contract to be detected is used as a price manipulation attack contract, including:

[0085] Execute the complete execution path, and if the behavior constituted by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns, obtain the matching predefined price manipulation attack behavior pattern;

[0086] According to the matching predefined price manipulation attack behavior pattern, the token address of the manipulated price and the address of the potential victim are obtained, and the contract to be detected is used as a price manipulation attack contract.

[0087] Specifically, according to the matching predefined price manipulation attack behavior pattern, the token address of the manipulated price and the potential victim address are obtained, including:

[0088] According to the matched predefined price manipulation attack behavior pattern, the address type parameter of the node with the two token exchange semantics in the matched attack behavior path is identified as the token address of the manipulated price; the address type parameter is determined according to the size of the fixed offset of the parameter reading and writing; specifically, if the size of the fixed offset of the parameter reading and writing is equal to the preset value (such as 0x20 bytes), it means that the parameter is an address type parameter.

[0089] Determine whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern;

[0090] If the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern, the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path is identified as the potential victim address; that is, at this time, the victim address is the manipulated liquidity pool address, and according to the rules, it appears as the target contract address in the node involving token exchange in the token flow graph, find the node with token exchange semantics in the path, and extract the obtained target contract address, thereby obtaining the potential victim address;

[0091] If the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern, the target contract address of the node with manipulated token transfer semantics in the matched attack behavior path is identified as the potential victim address. That is to say, according to the rules, the victim address is the user address that relies on the manipulated liquidity pool to give price predictions during the price fluctuation, i.e., the two token exchanges. The attacker will transfer or pledge at an unfair price, and it will appear as the target contract address in the token flow graph involving the node of token transfer. The node with token transfer semantics in the path is found, and the target contract address that has been obtained is extracted, thereby obtaining the potential victim address.

[0092] That is, based on all nodes in the sensitive path that have completed cross-contract analysis, according to the semantic information of its node sequence, it is determined whether it conforms to one of the defined direct or indirect price manipulation attack behavior patterns. In particular, combined with the token operation semantics of each node, the token flow and exchange behavior across multiple contracts is detected to identify possible manipulation behaviors.

[0093] Identify the external call nodes in the matching attack behavior path, combine the target contract address and semantic information obtained in the previous step, and extract the token address that is manipulated by the price and the address of the potential victim.

[0094] According to the attack behavior pattern, the contract to be tested is identified as a contract used for price manipulation attacks. The contract address is combined with the token flow path in the behavior pattern to confirm its role in the manipulation behavior.

[0095] like Figure 3 As shown, the price manipulation attack contract detection system based on abnormal token flow provided by the embodiment of the present invention includes:

[0096] The control flow graph construction module 100 is used to decompile the bytecode of the contract to be detected to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be detected, and construct the basic blocks according to the jump targets of the jump instructions to obtain a control flow graph between processes; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths; wherein, the intermediate representation is used to track data flow information between different variables, and the control flow graph is used to obtain control flow information of the contract code.

[0097] The data acquisition module 200 is used to track the instruction offsets of all external calls (such as CALL, STATICCALL, DELEDATECALL) based on the opcodes contained in the intermediate representation in the basic block, and extract the target contract address and function selector of the specific call from different storages of the contract to be detected;

[0098] A call point graph construction module 300 is used to construct a cross-contract call point graph based on a control flow graph, a target contract address, and a function selector; a node in the call point graph is represented as a <call point instruction offset, target contract address, target function selector> triple, and an edge in the call point graph represents a control flow connection between different call points, which can be used to analyze contract call paths and their interdependencies;

[0099] The token flow graph construction module 400 is used to construct a token flow graph based on a cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triple plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connection between different call points and the data flow information from parameters to return values ​​between different call points;

[0100] Specifically, the token flow graph construction module 400 includes:

[0101] The parameter index obtaining unit is used to find the nearest instruction offset of the read operation starting from the base address 0x40 based on the call point instruction offset of the node in the call point graph, and then traverse all memory write operations between the instruction offset position and the call point offset. Each write operation corresponds to a variable written to the memory, so this step obtains the actual parameters involved in each call point and the index position of these parameters;

[0102] An operational semantic information acquisition unit is used to heuristically infer that an external call that may be used to exchange tokens is obtained through the target function selector, preset function signature template information, and index position of the node in the call point graph, and obtain operational semantic information related to the external call and the token;

[0103] In this embodiment, the preset function signature template information includes: flash loans, liquidity pools, common DeFi protocol interfaces, and ERC20 / ERC721 token standard interfaces and other operations that may be related to tokens.

[0104] A data flow transfer information obtaining unit is used to obtain a specific representation of the return value according to the operation semantic information related to the external call and the token, and then obtain the data flow transfer information from the parameters to the return value between different external calls based on the data flow transfer rules;

[0105] The token flow graph construction unit is used to add the operational semantic information related to the external call and the token to the node representation of the call point graph, retain the control flow connection relationship between different call points in the call point graph, add edges representing the data flow transmission information from parameters to return values ​​between different external calls, and construct the token flow graph.

[0106] The complete execution path acquisition module 500 is used to perform cross-contract analysis on the nodes on the execution path in the token flow graph according to the target contract address to obtain the complete execution path;

[0107] Specifically, the complete execution path obtaining module 500 includes:

[0108] The sensitive path judgment unit is used to judge whether the semantic information of the node sequence in each path in the token flow graph meets the predefined transaction sensitive characteristics; in this embodiment, the predefined transaction sensitive characteristics include at least one of fund preparation, fund exchange, and fund transfer.

[0109] A sensitive path obtaining unit, used for treating any path as a sensitive path if the semantic information of the node sequence in the path meets the predefined transaction sensitive characteristics;

[0110] The complete execution path acquisition unit is used to perform cross-contract analysis on the nodes on the sensitive path according to the target contract address to obtain the complete execution path.

[0111] The contract detection module 600 is used to execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price and the address of the potential victim are output, and the contract to be detected is treated as a price manipulation attack contract.

[0112] Specifically, the contract detection module 600 includes:

[0113] A price manipulation attack behavior pattern matching unit is used to execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns, a matching predefined price manipulation attack behavior pattern is obtained;

[0114] The price manipulation attack contract reporting unit is used to obtain the token address of the manipulated price and the address of the potential victim according to the matched predefined price manipulation attack behavior pattern, and to treat the contract to be detected as a price manipulation attack contract.

[0115] Among them, the price manipulation attack contract reporting unit includes:

[0116] The manipulated price token address identification subunit is used to identify the address type parameter of the node with two token exchange semantics in the matching attack behavior path as the manipulated price token address according to the matching predefined price manipulation attack behavior pattern; the address type parameter is determined according to the size of the fixed offset of the parameter reading and writing; specifically, if the size of the fixed offset of the parameter reading and writing is equal to the preset value (such as 0x20 bytes), it means that the parameter is an address type parameter.

[0117] a price manipulation attack behavior pattern determination subunit, used to determine whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern;

[0118] The first victim address identification subunit is used to identify the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path as a potential victim address if the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern; that is, at this time, the victim address is the manipulated liquidity pool address, and according to the rule, it appears as the target contract address in the node involving token exchange in the token flow graph, finds the node with token exchange semantics in the path, and extracts the obtained target contract address, thereby obtaining the potential victim address;

[0119] The second victim address identification subunit is used to identify the target contract address of the node with manipulated token transfer semantics in the matched attack behavior path as a potential victim address if the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern. That is, according to the rules, the victim address is the user address that relies on the manipulated liquidity pool to give price predictions during the price fluctuation, i.e., the two token exchanges. The attacker will transfer or pledge at an unfair price. It appears as the target contract address in the token flow graph involving the node of token transfer. The node with token transfer semantics in the path is found, and the target contract address that has been obtained is extracted, thereby obtaining the potential victim address;

[0120] The price manipulation attack contract reporting subunit is used to report the contract to be detected as a price manipulation attack contract.

[0121] The price manipulation attack contract detection method and system based on abnormal token flow proposed in the embodiment of the present invention adopts a static analysis method to gradually recover and construct the token flow graph containing specific token operation information from the contract bytecode, and then implements attack detection on this basis. It can provide timely warning before the actual attack occurs and provide developers with necessary report information.

[0122] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0123] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0124] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0125] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0126] The parts not described in detail in the embodiments of the present invention are all known technologies to those skilled in the art. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A price manipulation attack contract detection method based on abnormal token flow, characterized in that: include: Decompile the bytecode of the contract to be detected to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be detected, and construct the basic blocks according to the jump targets of the jump instructions to obtain an inter-procedural control flow graph; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths; Tracking the instruction offsets of all external calls based on the opcodes contained in the intermediate representation in the basic block, and extracting the target contract address and function selector of the specific call from different storages of the contract to be detected; A cross-contract call point graph is constructed based on the control flow graph, the target contract address and the function selector; the nodes in the call point graph are represented as <call point instruction offset, target contract address, target function selector> triples, and the edges in the call point graph represent control flow connections between different call points; Construct a token flow graph based on the cross-contract call point graph; The nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triple plus the token-related operational semantics information, and the edges in the token flow graph represent the control flow connection between different call points and the data flow information from parameters to return values ​​between different call points; According to the target contract address, perform cross-contract analysis on the nodes on the execution path in the token flow graph to obtain a complete execution path; Execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, output the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim, and treat the contract to be detected as a price manipulation attack contract.

2. The price manipulation attack contract detection method based on abnormal token flow as claimed in claim 1 is characterized in that: The constructing of a token flow graph based on the cross-contract call point graph includes: Based on the call point instruction offset of the node in the call point graph, find the nearest instruction offset for starting the read operation on the base address, and then traverse all memory write operations from the position of the instruction offset to the call point offset to obtain the actual parameters involved in each call point and the index positions of these parameters; By using the target function selector of the node in the call point graph, the preset function signature template information, and the index position, it is heuristically inferred that the external call may be for exchanging tokens, and the operational semantic information related to the external call and the token is obtained; Obtaining a specific representation of the return value according to the operational semantics information related to the external call and the token, and then obtaining data flow transfer information from parameters to return values ​​between different external calls based on data flow transfer rules; The operational semantic information related to the external call and the token is added to the node representation of the call point graph, the control flow connection relationship between different call points in the call point graph is retained, and edges representing the data flow transfer information from parameters to return values ​​between different external calls are added to construct the token flow graph.

3. The price manipulation attack contract detection method based on abnormal token flow as claimed in claim 1, characterized in that: According to the target contract address, cross-contract analysis is performed on the nodes on the execution path in the token flow graph to obtain a complete execution path, including: Determining whether the semantic information of the node sequence in each path in the token flow graph meets the predefined transaction sensitive characteristics; If the semantic information of the node sequence in any path meets the predefined transaction sensitive characteristics, the path is regarded as a sensitive path; According to the target contract address, cross-contract analysis is performed on the nodes on the sensitive path to obtain the complete execution path.

4. The price manipulation attack contract detection method based on abnormal token flow as claimed in claim 2, characterized in that: The executing of the complete execution path, if the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, outputs the specific attack behavior pattern, the token address of the manipulated price and the address of the potential victim, and uses the contract to be detected as a price manipulation attack contract, including: Executing the complete execution path, if the behavior constituted by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns, obtaining a matching predefined price manipulation attack behavior pattern; According to the matched predefined price manipulation attack behavior pattern, the token address of the manipulated price and the address of the potential victim are obtained, and the contract to be detected is used as a price manipulation attack contract.

5. The price manipulation attack contract detection method based on abnormal token flow as claimed in claim 4 is characterized in that: The obtaining, according to the matched predefined price manipulation attack behavior pattern, the token address of the manipulated price and the address of the potential victim party includes: According to the matched predefined price manipulation attack behavior pattern, the address type parameter of the node with two token exchange semantics in the matched attack behavior path is identified as the token address of the manipulated price; the address type parameter is determined according to the size of the fixed offset of parameter reading and writing; determining whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern; If the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern, identifying the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path as the potential victim address; If the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern, the target contract address of the node with manipulated token transfer semantics in the matched attack behavior path is identified as the potential victim address.

6. A price manipulation attack contract detection system based on abnormal token flow, characterized in that: include: A control flow graph construction module, used to decompile the bytecode of the contract to be detected to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be detected, and construct the basic blocks according to the jump targets of the jump instructions to obtain an inter-procedural control flow graph; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths; A data acquisition module, used to track the instruction offsets of all external calls based on the opcodes contained in the intermediate representation in the basic block, and extract the target contract address and function selector of the specific call from different storages of the contract to be detected; A call point graph construction module, used to construct a cross-contract call point graph based on the control flow graph, the target contract address and the function selector; the nodes in the call point graph are represented as <call point instruction offset, target contract address, target function selector> triples, and the edges in the call point graph represent control flow connections between different call points; A token flow graph construction module is used to construct a token flow graph based on the cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triple plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connection between different call points and the data flow information from parameters to return values ​​between different call points; A complete execution path acquisition module is used to perform cross-contract analysis on the nodes on the execution path in the token flow graph according to the target contract address to obtain a complete execution path; The contract detection module is used to execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price and the address of the potential victim are output, and the contract to be detected is used as a price manipulation attack contract.

7. The price manipulation attack contract detection system based on abnormal token flow as claimed in claim 6, characterized in that: The token flow graph construction module includes: A parameter index obtaining unit, used to find the nearest instruction offset for starting a read operation on a base address based on the call point instruction offset of a node in the call point graph, and then traverse all memory write operations from the position of the instruction offset to the call point offset to obtain actual parameters involved in each call point and the index positions of these parameters; An operational semantic information obtaining unit, used to heuristically infer that an external call that may be used to exchange tokens is obtained through a target function selector of a node in the call point graph, preset function signature template information, and the index position, and obtain operational semantic information related to the external call and the token; A data flow transfer information obtaining unit, used to obtain a specific representation of its return value according to the operational semantic information related to the external call and the token, and then obtain the data flow transfer information from parameters to return values ​​between different external calls based on the data flow transfer rules; A token flow graph construction unit is used to add the operational semantic information related to the external call and the token to the node representation of the call point graph, retain the control flow connection relationship between different call points in the call point graph, add edges representing the data flow transfer information from parameters to return values ​​between different external calls, and construct the token flow graph.

8. The price manipulation attack contract detection system based on abnormal token flow as claimed in claim 6, characterized in that: The complete execution path acquisition module includes: A sensitive path judgment unit, used to judge whether the semantic information of the node sequence in each path in the token flow graph meets the predefined transaction sensitive characteristics; A sensitive path obtaining unit, used for treating any path as a sensitive path if the semantic information of the node sequence in the path meets the predefined transaction sensitive characteristics; A complete execution path acquisition unit is used to perform cross-contract analysis on the nodes on the sensitive path according to the target contract address to obtain the complete execution path.

9. The price manipulation attack contract detection system based on abnormal token flow as claimed in claim 7, characterized in that: The contract detection module includes: a price manipulation attack behavior pattern matching unit, configured to execute the complete execution path, and obtain a matched predefined price manipulation attack behavior pattern if the behavior constituted by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns; The price manipulation attack contract reporting unit is used to obtain the token address of the manipulated price and the address of the potential victim according to the matched predefined price manipulation attack behavior pattern, and to treat the contract to be detected as a price manipulation attack contract.

10. The price manipulation attack contract detection system based on abnormal token flow as claimed in claim 9, characterized in that: The price manipulation attack contract reporting unit includes: A token address identification subunit of manipulated price, used to identify, according to the matched predefined price manipulation attack behavior pattern, the address type parameter of the node of the two token exchange semantics in the matched attack behavior path as the token address of the manipulated price; the address type parameter is determined according to the size of the fixed offset of parameter reading and writing; a price manipulation attack behavior pattern determination subunit, configured to determine whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern; A first victim address identification subunit is used to identify the target contract address of the node of the manipulated token exchange semantics in the matched attack behavior path as the potential victim address if the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern; A second victim address identification subunit is used to identify the target contract address of the node of the manipulated token transfer semantics in the matched attack behavior path as the potential victim address if the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern; The price manipulation attack contract reporting subunit is used to report the contract to be detected as a price manipulation attack contract.

Images