An abnormal token flow-based price manipulation attack contract detection method and system

Abstract

The application discloses a kind of price manipulation attack contract detection method and system based on abnormal token flow.First, for all external calls of contract, relevant information is extracted from bytecode level, including target contract address and target function selection sub.Then, based on the control flow graph generated between processes, the basic block is extended as a node by the extracted call information, and the function call point graph across contracts is constructed by combining the jump relationship and cross-contract analysis.Next, based on the specific behavior of external call, its corresponding token operation is extracted, and a token flow graph is constructed.Finally, sensitive paths in the token flow graph are traversed, and whether the contract is used for price manipulation attack is judged according to the predefined price manipulation mode.The present application starts from contract bytecode only, without any transaction information, so once the smart contract with potential price manipulation attack intention is deployed on chain, the present application can immediately detect and generate warning information.

Description

Technical Field

[0001] The present invention relates to the field of attack contract detection technology, and in particular to a method and system for detecting price manipulation attack contracts based on abnormal token flows. Background Art

[0002] The decentralized finance (DeFi) ecosystem is rapidly developing, with decentralized applications based on smart contracts attracting significant investment. However, DeFi developers' lack of security awareness or oversight during development, coupled with the transparency and immutability of smart contracts, make DeFi projects vulnerable to various attacks, often resulting in significant financial losses and severely impacting the stability of the DeFi ecosystem. Price manipulation attacks are a major attack vector. Attackers exploit vulnerabilities to profit from unfair token transfers. Price manipulation vulnerabilities in DeFi can arise from a variety of factors, including incorrect slippage settings, unprotected public functions, and reliance on untrusted price oracles. Furthermore, attackers tend to bundle attack operations into a single contract to quickly launch the attack and evade on-chain detection tools. This approach also allows them to leverage flash loans to execute the attack and ensure a timely rollback if any conditions are not met.

[0003] While some tools currently exist for detecting price manipulation attacks, most rely on historical contract transaction information or code analysis of the victim contract. This means these tools can only identify attacks after the attacking contract actually initiates an attack and generates transactions. The large volume of transaction information complicates analysis, limiting the tools' accuracy. Detection tools based on the victim contract's code rely on predefined rules, but the diversity of vulnerabilities makes these rules incapable of covering all types, resulting in a high rate of missed detections.

[0004] Therefore, it is necessary to develop new detection methods to provide more effective early warning of potential attacks. Summary of the Invention

[0005] The present invention provides a price manipulation attack contract detection method and system based on abnormal token flow, which can identify price manipulation attack contracts and thus provide more effective early warning of potential attacks.

[0006] The present invention provides a method for detecting price manipulation attack contracts based on abnormal token flows, comprising:

[0007] Decompile the bytecode of the contract to be tested to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be tested. Construct the basic blocks according to the jump targets of the jump instructions to obtain an inter-procedural control flow graph; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths;

[0008] Track the instruction offsets of all external calls based on the opcodes contained in the intermediate representation of the basic block, and extract the target contract address and function selector of the specific call from different storages of the contract to be detected;

[0009] Construct a cross-contract call site graph based on the control flow graph, the target contract address, and the function selector; nodes in the call site graph are represented as <call site instruction offset, target contract address, target function selector> triples, and edges in the call site graph represent control flow connections between different call sites;

[0010] A token flow graph is constructed based on the cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triples plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connections between different call points and the data flow information from parameters to return values ​​between different call points;

[0011] According to the target contract address, perform cross-contract analysis on the nodes on the execution path in the token flow graph to obtain a complete execution path;

[0012] Execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, output the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim, and treat the contract to be detected as a price manipulation attack contract.

[0013] Specifically, the token flow graph is constructed based on the cross-contract call point graph, including:

[0014] Based on the call point instruction offset of the node in the call point graph, find the nearest instruction offset for starting a read operation on the base address, and then traverse all memory write operations between the position of the instruction offset and the call point offset to obtain actual parameters involved in each call point and the index positions of these parameters;

[0015] Heuristically inferring that an external call may be used to exchange tokens through the target function selector of the node in the call point graph, the preset function signature template information, and the index position, and obtaining operational semantic information related to the external call and the token;

[0016] According to the operation semantic information related to the token of the external call, a specific representation of a return value is obtained, and then based on a data flow transfer rule, data flow transfer information of parameters to return values between different external calls is obtained;

[0017] The operation semantic information related to the token of the external call is added to the node representation of the call point graph, the control flow connection relationship between different call points in the call point graph is retained, an edge representing the data flow transfer information of parameters to return values between different external calls is added, and the token flow graph is constructed.

[0018] Specifically, the cross-contract analysis is performed on the nodes on the execution path in the token flow graph according to the target contract address, and a complete execution path is obtained, including:

[0019] It is judged whether the semantic information of the node sequence in each path in the token flow graph satisfies a predefined transaction sensitive feature;

[0020] If the semantic information of the node sequence in any path satisfies the predefined transaction sensitive feature, the path is taken as a sensitive path.

[0021] According to the target contract address, cross-contract analysis is performed on the nodes on the sensitive path, and the complete execution path is obtained.

[0022] Specifically, the complete execution path is executed, and if the behavior constituted by the semantic sequence of the nodes in any execution path matches a behavior mode defined by a predefined rule, a specific attack behavior mode, a token address of a manipulated price, and a potential victim address are output, and the to-be-detected contract is taken as a price manipulation attack contract, including:

[0023] The complete execution path is executed, and if the behavior constituted by the semantic sequence of the nodes in any execution path matches one of a predefined direct or indirect price manipulation attack behavior mode, a matched predefined price manipulation attack behavior mode is obtained.

[0024] According to the matched predefined price manipulation attack behavior mode, a token address of a manipulated price and a potential victim address are obtained, and the to-be-detected contract is taken as a price manipulation attack contract.

[0025] Specifically, according to the matched predefined price manipulation attack behavior mode, a token address of a manipulated price and a potential victim address are obtained, including:

[0026] According to the matched predefined price manipulation attack behavior pattern, identifying the address type parameters of the nodes with two token exchange semantics in the matched attack behavior path as the token addresses of the manipulated prices; the address type parameters are determined according to the size of the fixed offset of parameter reading and writing;

[0027] determining whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern;

[0028] If the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern, the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path is identified as the potential victim address;

[0029] If the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern, the target contract address of the node with manipulated token transfer semantics in the matched attack behavior path is identified as the potential victim address.

[0030] The present invention also provides a price manipulation attack contract detection system based on abnormal token flow, comprising:

[0031] A control flow graph construction module is used to decompile the bytecode of the contract to be tested to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be tested, and construct the basic blocks into an inter-procedural control flow graph according to the jump targets of the jump instructions; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths;

[0032] A data acquisition module is used to track the instruction offsets of all external calls based on the opcodes contained in the intermediate representation of the basic block, and to extract the target contract address and function selector of the specific call from different storages of the contract to be detected;

[0033] A call point graph construction module, configured to construct a cross-contract call point graph based on the control flow graph, the target contract address, and the function selector; nodes in the call point graph are represented as <call point instruction offset, target contract address, target function selector> triples, and edges in the call point graph represent control flow connections between different call points;

[0034] A token flow graph construction module is used to construct a token flow graph based on the cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triples plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connections between different call points and the data flow information from parameters to return values ​​between different call points;

[0035] A complete execution path acquisition module is used to perform cross-contract analysis on the nodes on the execution path in the token flow graph according to the target contract address to obtain a complete execution path;

[0036] The contract detection module is used to execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim are output, and the contract to be detected is regarded as a price manipulation attack contract.

[0037] Specifically, the token flow graph construction module includes:

[0038] a parameter index obtaining unit, configured to find the nearest instruction offset for starting a read operation on the base address based on the call point instruction offset of the node in the call point graph, and then traverse all memory write operations between the position of the instruction offset and the call point offset to obtain the actual parameters involved in each call point and the index positions of these parameters;

[0039] an operational semantic information obtaining unit, configured to heuristically infer an external call that may be an exchange of tokens based on a target function selector of a node in the call site graph, preset function signature template information, and the index position, and obtain operational semantic information related to the external call and the token;

[0040] A data flow transfer information obtaining unit, configured to obtain a specific representation of a return value based on the operational semantics information related to the external call and the token, and then obtain data flow transfer information from parameters to return values ​​between different external calls based on data flow transfer rules;

[0041] A token flow graph construction unit is used to add the operational semantic information related to the external call and the token to the node representation of the call point graph, retain the control flow connection relationship between different call points in the call point graph, add edges representing the data flow transmission information from parameters to return values ​​between the different external calls, and construct the token flow graph.

[0042] Specifically, the complete execution path acquisition module includes:

[0043] A sensitive path judgment unit, configured to judge whether the semantic information of the node sequence in each path in the token flow graph satisfies predefined transaction sensitive features;

[0044] A sensitive path obtaining unit is used to treat any path as a sensitive path if the semantic information of the node sequence in the path meets the predefined transaction sensitive characteristics;

[0045] A complete execution path obtaining unit is used to perform cross-contract analysis on the nodes on the sensitive path according to the target contract address to obtain the complete execution path.

[0046] Specifically, the contract detection module includes:

[0047] a price manipulation attack behavior pattern matching unit, configured to execute the complete execution path, and obtain a matched predefined price manipulation attack behavior pattern if the behavior constituted by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns;

[0048] The price manipulation attack contract reporting unit is used to obtain the token address of the manipulated price and the address of the potential victim according to the matched predefined price manipulation attack behavior pattern, and to treat the contract to be detected as a price manipulation attack contract.

[0049] Specifically, the price manipulation attack contract reporting unit includes:

[0050] A price-manipulated token address identification subunit is configured to identify, based on the matched predefined price manipulation attack behavior pattern, the address type parameter of the node with two token exchange semantics in the matched attack behavior path as the price-manipulated token address; the address type parameter is determined based on the size of the fixed offset of parameter reading and writing;

[0051] a price manipulation attack behavior pattern determination subunit, configured to determine whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern;

[0052] A first victim address identification subunit is configured to identify, if the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern, the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path as the potential victim address;

[0053] A second victim address identification subunit is configured to identify, if the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern, the target contract address of the node with manipulated token transfer semantics in the matched attack behavior path as the potential victim address;

[0054] The price manipulation attack contract reporting subunit is used to report the contract to be detected as a price manipulation attack contract.

[0055] One or more technical solutions provided in the present invention have at least the following technical effects or advantages:

[0056] 1. First, for all external calls to the contract, relevant information is extracted from the bytecode, including the target contract address and target function selector. Then, based on the generated interprocedural control flow graph, the extracted call information is used to expand basic blocks as nodes. A cross-contract function call point graph is constructed by combining jump relationships and cross-contract analysis. Next, based on the specific behavior of the external calls, the corresponding token operations are extracted and a token flow graph is constructed. Finally, sensitive paths in the token flow graph are traversed, and based on predefined price manipulation patterns, the contract is determined to be used for price manipulation attacks. This method operates solely from the contract bytecode and does not require any transaction information. Therefore, once a smart contract with potential price manipulation attack intent is deployed on-chain, it can immediately detect and generate warnings. Furthermore, by detecting the behavioral patterns of the attacking contract, this method avoids the limitations of directly targeting the victim contract, which often result in large project sizes, diverse vulnerability causes, and complex exploit chains, thereby achieving more timely and accurate detection results.

[0057] 2. This invention fully considers the overall characteristics of the attack contract and realizes comprehensive recovery from the target contract address, function selector to specific parameters for each external call, and especially supports the recovery of complex type parameters such as arrays.

[0058] 3. This invention fills the gap between bytecode and token operation semantics. By combining standard function signature template information and customized heuristic rules, it obtains the specific execution logic of the contract for different tokens, thereby improving the accuracy of price manipulation attack contract detection.

[0059] 4. The present invention fully considers the time overhead, only analyzes the key nodes in the token flow graph that meet the predefined sensitive paths, and achieves the effect of real-time detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A flowchart of a method for detecting price manipulation attack contracts based on abnormal token flows provided by an embodiment of the present invention;

[0061] Figure 2 A schematic diagram of a method for detecting price manipulation attack contracts based on abnormal token flows provided by an embodiment of the present invention;

[0062] Figure 3 This is a module diagram of a price manipulation attack contract detection system based on abnormal token flows provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The embodiments of the present invention provide a method and system for detecting price manipulation attack contracts based on abnormal token flows, which can identify price manipulation attack contracts and thus provide more effective early warning of potential attacks.

[0064] The technical solution in the embodiment of the present invention is to achieve the above technical effects, and the overall idea is as follows:

[0065] This embodiment of the present invention proposes a method and system for detecting smart contracts used for price manipulation attacks based on abnormal token flows. This method aims to effectively identify and warn of potential price manipulation attacks on-chain, thereby reducing financial losses for legitimate users in the community. Specifically, starting from the smart contract bytecode, this embodiment first extracts key external calls to contract functions and, combined with semantic information about token operations, constructs a token flow graph to comprehensively understand the contract's token flow behavior. The resulting token flow graph reflects the contract's specific operational behavior for different tokens. This embodiment then effectively identifies contracts susceptible to price manipulation attacks based on predefined abnormal token flow detection rules.

[0066] In order to better understand the above technical solution, the above technical solution will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0067] like Figure 1 and Figure 2 As shown, the price manipulation attack contract detection method based on abnormal token flow provided by the embodiment of the present invention includes:

[0068] Step S110: Decompile the bytecode of the contract to be tested to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be tested. The basic blocks are constructed according to the jump targets of the jump instructions to obtain an inter-procedural control flow graph; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths; wherein, the intermediate representation is used to track data flow information between different variables, and the control flow graph is used to obtain control flow information of the contract code.

[0069] Step S120: Track the instruction offsets of all external calls (such as CALL, STATICCALL, and DELEDATECALL) based on the opcodes contained in the intermediate representation in the basic block, and extract the target contract address and function selector of the specific call from different storages of the contract to be detected;

[0070] Step S130: Construct a cross-contract call site graph based on the control flow graph, target contract address, and function selector. Nodes in the call site graph are represented as <call site instruction offset, target contract address, target function selector> triples. Edges in the call site graph represent control flow connections between different call sites. These edges can be used to analyze contract call paths and their interdependencies.

[0071] Step S140: Construct a token flow graph based on the cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triples plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connections between different call points and the data flow information from parameters to return values ​​between different call points;

[0072] This step is explained in detail. The token flow graph is constructed based on the cross-contract call point graph, including:

[0073] Based on the call point instruction offset of the node in the call point graph, find the instruction offset of the most recent read operation starting at base address 0x40, and then traverse all memory write operations between the instruction offset and the call point offset. Each write operation corresponds to a variable written to memory, so this step obtains the actual parameters involved in each call point and the index location of these parameters;

[0074] By using the target function selector, preset function signature template information, and index position of the node in the call point graph, it is heuristically inferred that the external call may be for exchanging tokens, and the operational semantics information related to the external call and the token is obtained;

[0075] In this embodiment, the preset function signature template information includes: flash loans, liquidity pools, common DeFi protocol interfaces, and ERC20 / ERC721 token standard interfaces, etc., which may be token-related operations.

[0076] Based on the operational semantics of the external call and the token, the specific representation of its return value is obtained. Then, based on the data flow transmission rules, the data flow transmission information from parameters to return values ​​between different external calls is obtained.

[0077] The operational semantic information related to external calls and tokens is added to the node representation of the call point graph, the control flow connection relationship between different call points in the call point graph is retained, and edges representing the data flow transmission information from parameters to return values ​​between different external calls are added to construct the token flow graph.

[0078] Step S150: Based on the target contract address, perform cross-contract analysis on the nodes on the execution path in the token flow graph to obtain a complete execution path;

[0079] To explain this step in detail, based on the target contract address, perform cross-contract analysis on the nodes on the execution path in the token flow graph to obtain the complete execution path, including:

[0080] Determine whether the semantic information of the node sequence in each path in the token flow graph meets the predefined transaction sensitive characteristics; in this embodiment, the predefined transaction sensitive characteristics include at least any one of fund preparation, fund exchange, and fund transfer.

[0081] If the semantic information of the node sequence in any path meets the predefined transaction sensitive characteristics, the path is regarded as a sensitive path;

[0082] According to the target contract address, cross-contract analysis is performed on the nodes on the sensitive path to obtain the complete execution path.

[0083] Step S160: Execute the complete execution path. If the behavior formed by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price, and the potential victim address are output, and the contract to be detected is treated as a price manipulation attack contract.

[0084] This step is explained in detail. The complete execution path is executed. If the behavior formed by the semantic sequence of nodes in any execution path meets the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim are output, and the contract to be tested is treated as a price manipulation attack contract, including:

[0085] Execute the complete execution path. If the behavior formed by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns, obtain the matching predefined price manipulation attack behavior pattern.

[0086] According to the matching predefined price manipulation attack behavior pattern, the token address of the manipulated price and the potential victim address are obtained, and the contract to be detected is treated as a price manipulation attack contract.

[0087] Specifically, based on the matching predefined price manipulation attack behavior pattern, the token address of the manipulated price and the potential victim address are obtained, including:

[0088] According to the matching predefined price manipulation attack behavior pattern, the address type parameter of the node with the two token exchange semantics in the matching attack behavior path is identified as the token address of the manipulated price; the address type parameter is determined according to the size of the fixed offset of the parameter reading and writing; specifically, if the size of the fixed offset of the parameter reading and writing is equal to the preset value (such as 0x20 bytes), it means that the parameter is an address type parameter.

[0089] determining whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern;

[0090] If the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern, the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path is identified as the potential victim address; that is, in this case, the victim address is the manipulated liquidity pool address. According to the rules, it appears as the target contract address in the node involving token exchange in the token flow graph. The node with token exchange semantics in the path is found, and the obtained target contract address is extracted to obtain the potential victim address;

[0091] If the matching predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern, the target contract address of the node with manipulated token transfer semantics in the matching attack behavior path is identified as the potential victim address. In other words, according to the rules, the victim address is the user address that relied on the manipulated liquidity pool to provide price predictions during the price fluctuations, i.e., the two token swaps. The attacker will transfer or stake at an unfair price. This victim address appears as the target contract address at the node involving token transfer in the token flow graph. The node with token transfer semantics in the path is found, and the target contract address that has been obtained is extracted to obtain the potential victim address.

[0092] Specifically, based on all nodes in the sensitive path that have undergone cross-contract analysis, the semantic information of their node sequences is used to determine whether they conform to one of the defined direct or indirect price manipulation attack behavior patterns. Specifically, the token operation semantics of each node are combined to detect token flows and exchanges across multiple contracts to identify possible manipulation.

[0093] Identify the external call nodes in the matching attack behavior path, combine the target contract address and semantic information obtained in the previous step, and extract the token address that is manipulated by the price and the address of the potential victim.

[0094] Based on the attack behavior pattern, the contract to be tested is identified as a contract used for price manipulation attacks. The contract address is combined with the token flow path in the behavior pattern to confirm its role in the manipulation behavior.

[0095] like Figure 3 As shown, the price manipulation attack contract detection system based on abnormal token flow provided by the embodiment of the present invention includes:

[0096] The control flow graph construction module 100 is used to decompile the bytecode of the contract to be tested to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be tested, and construct the basic blocks according to the jump targets of the jump instructions to obtain an inter-procedural control flow graph; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths; wherein, the intermediate representation is used to track data flow information between different variables, and the control flow graph is used to obtain control flow information of the contract code.

[0097] The data acquisition module 200 is used to track the instruction offsets of all external calls (such as CALL, STATICCALL, and DELEDATECALL) based on the opcodes contained in the intermediate representation of the basic block, and to extract the target contract address and function selector of the specific call from different storages of the contract to be detected;

[0098] The call site graph construction module 300 is used to construct a cross-contract call site graph based on the control flow graph, the target contract address, and the function selector. The nodes in the call site graph are represented as <call site instruction offset, target contract address, target function selector> triples. The edges in the call site graph represent the control flow connections between different call sites. These edges can be used to analyze contract call paths and their interdependencies.

[0099] The token flow graph construction module 400 is used to construct a token flow graph based on the cross-contract call point graph. The nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triples plus token-related operational semantic information. The edges in the token flow graph represent the control flow connections between different call points and the data flow information from parameters to return values ​​between different call points.

[0100] Specifically, the token flow graph construction module 400 includes:

[0101] The parameter index acquisition unit is used to find the nearest instruction offset that starts the read operation at base address 0x40 based on the call point instruction offset of the node in the call point graph. It then traverses all memory write operations between the instruction offset and the call point offset. Each write operation corresponds to a variable written to memory, so this step obtains the actual parameters involved in each call point and the index location of these parameters;

[0102] An operational semantic information acquisition unit is used to heuristically infer external calls that may be token exchange calls based on the target function selector, preset function signature template information, and index position of the nodes in the call point graph, and obtain operational semantic information related to the external call and the token;

[0103] In the embodiment, the preset function signature template information includes: lightning loan, liquidity pool, common DeFi protocol interface, and ERC20 / ERC721 token standard interface, and the like, which are possible operations related to the token.

[0104] A data flow transfer information obtaining unit is configured to obtain a specific representation of a return value of the operation semantics information related to the token according to an external call, and then obtain data flow transfer information of parameters to return values between different external calls based on a data flow transfer rule.

[0105] A token flow graph construction unit is configured to add the operation semantics information related to the token of the external call to a node representation of the call point graph, retain a control flow connection relationship between different call points in the call point graph, add an edge representing the data flow transfer information of parameters to return values between different external calls, and construct a token flow graph.

[0106] The complete execution path obtaining module 500 is configured to perform cross-contract analysis on the nodes on the execution path in the token flow graph according to the target contract address, and obtain a complete execution path.

[0107] Specifically, the complete execution path obtaining module 500 includes:

[0108] A sensitive path judgment unit is configured to judge whether the semantic information of the node sequence in each path in the token flow graph satisfies a predefined transaction sensitive feature. In the embodiment, the predefined transaction sensitive feature at least includes any one of fund preparation, fund exchange, and fund transfer.

[0109] A sensitive path obtaining unit is configured to take a path as a sensitive path if the semantic information of the node sequence in the path satisfies the predefined transaction sensitive feature.

[0110] A complete execution path obtaining unit is configured to perform cross-contract analysis on the nodes on the sensitive path according to the target contract address, and obtain a complete execution path.

[0111] The contract detection module 600 is configured to execute the complete execution path, and if the semantic sequence of the nodes in any one of the execution paths constitutes a behavior that matches a behavior mode defined by a predefined rule, output a specific attack behavior mode, a token address of a manipulated price, and a potential victim address, and take the to-be-detected contract as a price manipulation attack contract.

[0112] Specifically, the contract detection module 600 includes:

[0113] A price manipulation attack behavior pattern matching unit is used to execute the complete execution path. If the behavior formed by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns, the matched predefined price manipulation attack behavior pattern is obtained.

[0114] The price manipulation attack contract reporting unit is used to obtain the token address of the manipulated price and the address of the potential victim based on the matching predefined price manipulation attack behavior pattern, and to treat the contract to be detected as a price manipulation attack contract.

[0115] Among them, the price manipulation attack contract reporting unit includes:

[0116] The manipulated price token address identification subunit is used to identify, based on the matching predefined price manipulation attack behavior pattern, the address type parameter of the node with the two token exchange semantics in the matching attack behavior path as the manipulated price token address; the address type parameter is determined based on the size of the fixed offset of the parameter reading and writing; specifically, if the size of the fixed offset of the parameter reading and writing is equal to a preset value (such as 0x20 bytes), it means that the parameter is an address type parameter.

[0117] a price manipulation attack behavior pattern determination subunit, configured to determine whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern;

[0118] The first victim address identification subunit is used to identify the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path as a potential victim address if the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern. In other words, in this case, the victim address is the manipulated liquidity pool address. According to the rules, it appears as the target contract address at the node involving token exchange in the token flow graph. The node with token exchange semantics in the path is found, and the obtained target contract address is extracted, thereby obtaining the potential victim address.

[0119] The second victim address identification sub-unit is used to identify the target contract address of the node with manipulated token transfer semantics in the matching attack behavior path as a potential victim address if the matching pre-defined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern. In other words, according to the rules, the victim address is the user address that relied on the manipulated liquidity pool to provide price predictions during price fluctuations, i.e., between two token swaps. The attacker will transfer or stake at an unfair price. This victim address appears as the target contract address at the node involving token transfer in the token flow graph. The node with token transfer semantics in the path is found, and the target contract address that has been obtained is extracted, thereby obtaining the potential victim address.

[0120] The price manipulation attack contract reporting subunit is used to report the contract to be detected as a price manipulation attack contract.

[0121] The price manipulation attack contract detection method and system based on abnormal token flow proposed in the embodiment of the present invention adopts a static analysis method to gradually recover and construct the token flow graph containing specific token operation information from the contract bytecode, and then implements attack detection on this basis. It can provide timely warning before the actual attack occurs and provide developers with necessary report information.

[0122] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0123] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0124] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0125] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0126] Any details not described in the embodiments of the present invention are well-known to those skilled in the art. Finally, it should be noted that the above embodiments are only intended to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present invention may be modified or replaced with equivalents without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or equivalents should be included in the scope of the claims of the present invention.

Claims

1. A method for detecting price manipulation attack contracts based on abnormal token flows, characterized in that: include: Decompile the bytecode of the contract to be tested to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be tested. Construct the basic blocks according to the jump targets of the jump instructions to obtain an inter-procedural control flow graph; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths; Track the instruction offsets of all external calls based on the opcodes contained in the intermediate representation of the basic block, and extract the target contract address and function selector of the specific call from different storages of the contract to be detected; Construct a cross-contract call site graph based on the control flow graph, the target contract address, and the function selector; nodes in the call site graph are represented as <call site instruction offset, target contract address, target function selector> triples, and edges in the call site graph represent control flow connections between different call sites; Constructing a token flow graph based on the cross-contract call point graph; The nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triples plus token-related operational semantic information. The edges in the token flow graph represent the control flow connections between different call points and the data flow information from parameters to return values ​​between different call points. Specifically, based on the call point instruction offset of the node in the call point graph, find the nearest instruction offset that starts the read operation on the base address, and then traverse all memory write operations between the position of the instruction offset and the call point offset to obtain the actual parameters involved in each call point and the index positions of these parameters; Heuristically inferring that an external call may be used to exchange tokens through the target function selector of the node in the call point graph, the preset function signature template information, and the index position, and obtaining operational semantic information related to the external call and the token; According to the target contract address, perform cross-contract analysis on the nodes on the execution path in the token flow graph to obtain a complete execution path; Execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, output the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim, and treat the contract to be detected as a price manipulation attack contract.

2. The price manipulation attack contract detection method based on abnormal token flow according to claim 1 is characterized in that: The constructing of a token flow graph based on the cross-contract call point graph includes: Obtaining a specific representation of the return value based on the operational semantics information related to the external call and the token, and then obtaining data flow transfer information from parameters to return values ​​between different external calls based on data flow transfer rules; The operational semantic information related to the external call and the token is added to the node representation of the call point graph, the control flow connection relationship between different call points in the call point graph is retained, and edges representing the data flow transmission information from parameters to return values ​​between the different external calls are added to construct the token flow graph.

3. The price manipulation attack contract detection method based on abnormal token flow according to claim 1 is characterized in that: According to the target contract address, cross-contract analysis is performed on the nodes on the execution path in the token flow graph to obtain a complete execution path, including: Determining whether the semantic information of the node sequence in each path in the token flow graph meets predefined transaction sensitive characteristics; If the semantic information of the node sequence in any path meets the predefined transaction sensitive characteristics, the path is regarded as a sensitive path; According to the target contract address, cross-contract analysis is performed on the nodes on the sensitive path to obtain the complete execution path.

4. The price manipulation attack contract detection method based on abnormal token flow according to claim 2 is characterized in that: The executing of the complete execution path, if the behavior constituted by the semantic sequence of nodes in any execution path meets the behavior pattern defined by the predefined rules, outputs the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim, and treats the contract to be detected as a price manipulation attack contract, including: executing the complete execution path, and if a behavior constituted by a semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns, obtaining a matching predefined price manipulation attack behavior pattern; According to the matched predefined price manipulation attack behavior pattern, the token address of the manipulated price and the potential victim address are obtained, and the contract to be detected is used as a price manipulation attack contract.

5. The price manipulation attack contract detection method based on abnormal token flow according to claim 4 is characterized in that: Obtaining the manipulated token address and the potential victim address according to the matched predefined price manipulation attack behavior pattern includes: According to the matched predefined price manipulation attack behavior pattern, identifying the address type parameters of the nodes with two token exchange semantics in the matched attack behavior path as the token addresses of the manipulated prices; the address type parameters are determined according to the size of the fixed offset of parameter reading and writing; determining whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern; If the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern, the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path is identified as the potential victim address; If the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern, the target contract address of the node with manipulated token transfer semantics in the matched attack behavior path is identified as the potential victim address.

6. A price manipulation attack contract detection system based on abnormal token flow, characterized in that: include: A control flow graph construction module is used to decompile the bytecode of the contract to be tested to obtain an intermediate representation, and divide the intermediate representation into basic blocks based on the jump instructions in the contract to be tested, and construct the basic blocks into an inter-procedural control flow graph according to the jump targets of the jump instructions; the nodes in the control flow graph represent basic blocks, and the edges in the control flow graph represent control flow paths; A data acquisition module is used to track the instruction offsets of all external calls based on the opcodes contained in the intermediate representation of the basic block, and to extract the target contract address and function selector of the specific call from different storages of the contract to be detected; A call point graph construction module, configured to construct a cross-contract call point graph based on the control flow graph, the target contract address, and the function selector; nodes in the call point graph are represented as <call point instruction offset, target contract address, target function selector> triples, and edges in the call point graph represent control flow connections between different call points; A token flow graph construction module is used to construct a token flow graph based on the cross-contract call point graph; the nodes in the token flow graph represent the <call point instruction offset, target contract address, target function selector> triples plus token-related operational semantic information, and the edges in the token flow graph represent the control flow connections between different call points and the data flow information from parameters to return values ​​between different call points; Specifically, the token flow graph construction module includes: a parameter index obtaining unit, configured to find the nearest instruction offset for starting a read operation on the base address based on the call point instruction offset of the node in the call point graph, and then traverse all memory write operations between the position of the instruction offset and the call point offset to obtain the actual parameters involved in each call point and the index positions of these parameters; an operational semantic information obtaining unit, configured to heuristically infer an external call that may be an exchange of tokens based on a target function selector of a node in the call site graph, preset function signature template information, and the index position, and obtain operational semantic information related to the external call and the token; A complete execution path acquisition module is used to perform cross-contract analysis on the nodes on the execution path in the token flow graph according to the target contract address to obtain a complete execution path; The contract detection module is used to execute the complete execution path. If the behavior constituted by the semantic sequence of nodes in any execution path conforms to the behavior pattern defined by the predefined rules, the specific attack behavior pattern, the token address of the manipulated price, and the address of the potential victim are output, and the contract to be detected is regarded as a price manipulation attack contract.

7. The price manipulation attack contract detection system based on abnormal token flow according to claim 6 is characterized in that: The token flow graph construction module further includes: A data flow transfer information obtaining unit, configured to obtain a specific representation of a return value based on the operational semantics information related to the external call and the token, and then obtain data flow transfer information from parameters to return values ​​between different external calls based on data flow transfer rules; A token flow graph construction unit is used to add the operational semantic information related to the external call and the token to the node representation of the call point graph, retain the control flow connection relationship between different call points in the call point graph, add edges representing the data flow transmission information from parameters to return values ​​between the different external calls, and construct the token flow graph.

8. The price manipulation attack contract detection system based on abnormal token flow according to claim 6 is characterized in that: The complete execution path acquisition module includes: A sensitive path judgment unit, configured to judge whether the semantic information of the node sequence in each path in the token flow graph satisfies predefined transaction sensitive features; A sensitive path obtaining unit is used to treat any path as a sensitive path if the semantic information of the node sequence in the path meets the predefined transaction sensitive characteristics; A complete execution path obtaining unit is used to perform cross-contract analysis on the nodes on the sensitive path according to the target contract address to obtain the complete execution path.

9. The price manipulation attack contract detection system based on abnormal token flow according to claim 7, characterized in that: The contract detection module includes: a price manipulation attack behavior pattern matching unit, configured to execute the complete execution path, and obtain a matched predefined price manipulation attack behavior pattern if the behavior constituted by the semantic sequence of nodes in any execution path matches one of the predefined direct or indirect price manipulation attack behavior patterns; The price manipulation attack contract reporting unit is used to obtain the token address of the manipulated price and the address of the potential victim according to the matched predefined price manipulation attack behavior pattern, and to treat the contract to be detected as a price manipulation attack contract.

10. The price manipulation attack contract detection system based on abnormal token flow according to claim 9, characterized in that: The price manipulation attack contract reporting unit includes: A price-manipulated token address identification subunit is configured to identify, based on the matched predefined price manipulation attack behavior pattern, the address type parameter of the node with two token exchange semantics in the matched attack behavior path as the price-manipulated token address; the address type parameter is determined based on the size of the fixed offset of parameter reading and writing; a price manipulation attack behavior pattern determination subunit, configured to determine whether the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern or an indirect price manipulation attack behavior pattern; A first victim address identification subunit is configured to identify, if the matched predefined price manipulation attack behavior pattern is a direct price manipulation attack behavior pattern, the target contract address of the node with manipulated token exchange semantics in the matched attack behavior path as the potential victim address; A second victim address identification subunit is configured to identify, if the matched predefined price manipulation attack behavior pattern is an indirect price manipulation attack behavior pattern, the target contract address of the node with manipulated token transfer semantics in the matched attack behavior path as the potential victim address; The price manipulation attack contract reporting subunit is used to report the contract to be detected as a price manipulation attack contract.

Images