Code instrumentation-based Ethereum transaction automatic analysis system and analysis method

Abstract

The invention discloses an Ethereum transaction automatic analysis system and analysis method based on code instrumentation. The system comprises an instrumentation information analysis module, a transaction logic extraction module, an association contract construction module, a contract code instrumentation module and an analysis script execution module. The instrumentation information analysis module analyzes structured information input by a user and records target transaction hash, instrumentation points and instrumentation functions specified by the user; the transaction logic extraction module obtains original data of a transaction specified by a user from the Ethereum node and extracts function call information of a related contract in a transaction execution process; associating the function call information of the contract construction module, and constructing a source code of the contract; and the contract code instrumentation module performs instrumentation in the source code of the contract according to the instrumentation point and the instrumentation function specified by the user to generate an analysis contract. And the analysis script execution module executes the analysis contract to obtain an analysis result. According to the method, analysts can be helped to quickly understand attack transactions, and a response time window is shortened.

Description

Technical Field

[0001] The present invention relates to the field of program analysis, and in particular to an automated analysis system and method for Ethereum transactions based on code insertion. Background Art

[0002] With the development of the blockchain-based decentralized finance (DeFi) ecosystem, the implementation of on-chain smart contracts tends to be more complex and diversified. This is reflected in the fact that, first of all, the functions provided by the contracts are becoming more and more abundant. On the one hand, inspired by traditional financial services, decentralized financial protocols such as cryptocurrency exchanges, lending platforms and financial derivatives have emerged in the market; on the other hand, the innovative model of blockchain technology has also spawned special mechanisms such as "flash loans" and "combinable atomic transactions". Secondly, the semantic information contained in the smart contract code is also expanding rapidly. For example, in order to standardize the definition of financial assets, the Ethereum community has successively proposed different asset standards, including ERC-20, ERC-721 and ERC-1155, etc. These different standards have made new agreements on variables and interfaces that smart contracts need to comply with. At the same time, decentralized financial protocols can depend on each other in a combined way. For example, the price of the collateral assets of a lending platform may be provided by another decentralized exchange.

[0003] Due to the complexity and diversity of the above-mentioned smart contracts and the composability of DeFi protocols, the analysis of Ethereum transaction behavior has become increasingly difficult. The so-called "DeFi attacks" have occurred frequently and caused huge losses. However, transactions involving DeFi attacks often contain multi-level contract interactions and complex function call logic, which brings challenges to the analysis of the causes of the attacks and the location of vulnerabilities.

[0004] Code instrumentation is a technique that inserts additional code into source code or binary code to monitor, analyze or debug the program while it is running. This technique is often used in performance analysis, debugging, security monitoring and testing. Its essence is to insert a "probe" into the original program, that is, a code segment for information collection, and output additional information about the program through the execution of the "probe". Code instrumentation is widely used in the field of traditional program analysis.

[0005] Existing transaction analysis tools such as Phalcon Explorer, Transaction Tracer, and Tenderly only support the analysis of transaction execution paths (including contract creation, internal transactions, function call stacks, and analysis of trigger events) and the viewing of state (EVM Storage) changes in transactions, and cannot obtain user-defined debugging information at specified locations in the execution path. Therefore, the current analysis of complex transactions requires analysts to have a good understanding of the DeFi protocol design involved in the transaction and to pay a high time cost to understand the behavior occurring in the transaction. When an attack occurs, a faster understanding of the attack transaction can locate the cause of the vulnerability in the DeFi project and shorten the response time window, which can often avoid further losses. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention provides an automated analysis system and analysis method for Ethereum transactions based on code instrumentation, which aims to help analysts quickly understand attack transactions, thereby locating the causes of vulnerabilities in DeFi projects, shortening the time consumed in locating the causes of vulnerabilities, and shortening the response time window, thereby avoiding further losses.

[0007] The purpose of the present invention is achieved through the following technical solutions:

[0008] An automated analysis system for Ethereum transactions based on code instrumentation, the system comprising an instrumentation information parsing module, a transaction logic extraction module, an associated contract construction module, a contract code instrumentation module and an analysis script execution module:

[0009] The instrumentation information parsing module is used to parse the structured information input by the user and record the target transaction hash, instrumentation point and instrumentation function specified by the user;

[0010] The transaction logic extraction module is used to obtain the original data of the user-specified transaction from the Ethereum node and extract the function call information of the relevant contract during the transaction execution process;

[0011] The associated contract construction module is used to receive the function call information output by the transaction logic extraction module and construct the source code of the related contract;

[0012] The contract code plugging module is used to insert plugging in the source code of the relevant contract according to the plugging point and plugging function specified by the user, so as to generate an analysis contract;

[0013] The analysis script execution module is used to execute the analysis contract generated by the contract code plug-in module to obtain the analysis result.

[0014] Furthermore, the user-specified insertion point includes the beginning and the end of the transaction execution path.

[0015] Furthermore, the user-specified stub function is a high-level language code segment that can be compiled to generate Ethereum virtual machine bytecode.

[0016] Furthermore, the transaction logic extraction module extracts the transaction logic by traversing the execution path of the transaction using a depth-first search method.

[0017] Furthermore, the analysis script execution module simulates the execution of the analysis contract by placing the local forked Ethereum node in a state at the user-specified transaction time.

[0018] An automated analysis method for Ethereum transactions based on code plugging is implemented by an automated analysis system for Ethereum transactions based on code plugging; the method comprises the following steps:

[0019] Parse the structured information input by the user through the instrumentation information parsing module, and record the target transaction hash, instrumentation point and instrumentation function specified by the user;

[0020] The transaction logic extraction module obtains the original data of the user-specified transaction from the Ethereum node, and extracts the function call information of the relevant contract during the transaction execution process;

[0021] Receiving the function call information output by the transaction logic extraction module through the associated contract construction module, and constructing the source code of the related contract;

[0022] The contract code plugging module inserts plugs into the source code of the relevant contract according to the plugging points and plugging functions specified by the user to generate an analysis contract;

[0023] The analysis contract generated by the contract code plug-in module is executed by the analysis script execution module to obtain the analysis result.

[0024] The beneficial effects of the present invention are as follows:

[0025] The beneficial effect of the present invention is that the automated analysis framework of Ethereum transactions based on code stubs can help analysts quickly and deeply understand the internal behavior of transactions. Through the stub information parsing module, analysts can insert custom or predefined codes into the original transaction to assist in analyzing the changes before and after the internal function calls of the transaction, thereby reducing development costs; through the transaction logic extraction module, the effectiveness and reliability of user transaction analysis are improved; through the analysis script execution module, the time overhead of analyzing complex transactions such as attack event transactions is reduced to the greatest extent while ensuring the scalability of the framework. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1Schematic diagram of an automated analysis system and method for Ethereum transactions based on code instrumentation according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The present invention will be described in detail below based on the accompanying drawings and preferred embodiments, and the purpose and effects of the present invention will become more clear. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0028] like Figure 1 As shown, on the one hand, the Ethereum transaction automation analysis system based on code instrumentation provided by an embodiment of the present invention includes an instrumentation information parsing module, a transaction logic extraction module, an associated contract construction module, a contract code instrumentation module and an analysis script execution module.

[0029] Among them, the instrumentation information parsing module provides a high-level language instrumentation interface for parsing the structured information input by the user and recording the target transaction hash, instrumentation point and instrumentation function specified by the user. The instrumentation point includes the start and end of the transaction execution path. The instrumentation function refers to a high-level language code segment that can be compiled to generate Ethereum virtual machine bytecode, such as a function written in the smart contract programming language Solidity.

[0030] The transaction logic extraction module provides an interface for viewing the status of Ethereum specified transactions, which is used to obtain the original data of user-specified transactions from the Ethereum node and extract the function call information of related contracts during the transaction execution process. In terms of algorithm implementation, this module uses a depth-first search method to traverse the execution path of the transaction.

[0031] The associated contract construction module receives the function call information output by the transaction logic extraction module and constructs the source code of the related contract. This module only constructs the contract source code based on the information of the function call between contracts in the user-specified transaction. Its purpose is to completely restore the internal transaction behavior of the related contract during the transaction execution process, and it is not equivalent to the implementation logic of the real contract.

[0032] The contract code plug-in module is used to insert plug-ins in the source code of the relevant contract according to the plug-in points and plug-in functions specified by the user to generate an analysis contract.

[0033] The analysis script execution module is equipped with a high-performance simulation execution engine to execute the analysis contract generated by the contract code plug-in module to obtain the analysis results. This module simulates the execution of the analysis contract by placing the local forked Ethereum node in the state of the user-specified transaction time.

[0034] like Figure 1As shown, the automated analysis system of Ethereum transactions based on code plugging of the present invention obtains the original data of transactions through Ethereum nodes. Among them, the analysis contract implementation language generated by the contract code plugging module is Solidity; the analysis contract execution module uses a customized Ethereum virtual machine built based on REVM as the simulation execution engine of the transaction, and the state of the user-specified transaction time is derived from the original data obtained from the Ethereum node.

[0035] On the other hand, an embodiment of the present invention further provides an automated analysis method for Ethereum transactions based on code instrumentation, which is implemented by an automated analysis system for Ethereum transactions based on code instrumentation, and includes the following steps:

[0036] Parse the structured information input by the user through the instrumentation information parsing module, and record the target transaction hash, instrumentation point and instrumentation function specified by the user;

[0037] The transaction logic extraction module obtains the original data of the user-specified transaction from the Ethereum node, and extracts the function call information of the relevant contract during the transaction execution process;

[0038] Receive the function call information output by the transaction logic extraction module through the associated contract construction module, and build the source code of the related contract;

[0039] Through the contract code plug-in module, according to the plug-in points and plug-in functions specified by the user, plug-in is performed in the source code of the relevant contract to generate an analysis contract;

[0040] The analysis contract generated by the contract code plug-in module is executed by the analysis script execution module to obtain the analysis result.

[0041] Those skilled in the art can understand that the above are only preferred examples of the invention and are not intended to limit the invention. Although the invention is described in detail with reference to the above examples, those skilled in the art can still modify the technical solutions recorded in the above examples or replace some of the technical features therein with equivalents. Any modification, equivalent replacement, etc. made within the spirit and principle of the invention shall be included in the protection scope of the invention.

Claims

1. An automated analysis system for Ethereum transactions based on code instrumentation, characterized in that: The system includes an instrumentation information parsing module, a transaction logic extraction module, an associated contract construction module, a contract code instrumentation module, and an analysis script execution module: The instrumentation information parsing module is used to parse the structured information input by the user and record the target transaction hash, instrumentation point and instrumentation function specified by the user; The transaction logic extraction module is used to obtain the original data of the user-specified transaction from the Ethereum node and extract the function call information of the relevant contract during the transaction execution process; The associated contract construction module is used to receive the function call information output by the transaction logic extraction module and construct the source code of the related contract; The contract code plugging module is used to insert plugging in the source code of the relevant contract according to the plugging point and plugging function specified by the user, so as to generate an analysis contract; The analysis script execution module is used to execute the analysis contract generated by the contract code plug-in module to obtain the analysis result.

2. The automated analysis system for Ethereum transactions based on code plugging according to claim 1, characterized in that: The user-specified instrumentation points include the beginning and end of a transaction execution path.

3. The automated analysis system for Ethereum transactions based on code plugging according to claim 1, characterized in that: The user-specified stub function is a high-level language code segment that can be compiled to generate Ethereum virtual machine bytecode.

4. The automated analysis system for Ethereum transactions based on code plugging according to claim 1, characterized in that: The transaction logic extraction module extracts the transaction logic by traversing the execution path of the transaction in a depth-first search manner.

5. The automated analysis system for Ethereum transactions based on code insertion according to claim 1, characterized in that: The analysis script execution module simulates the execution of the analysis contract by locating the state of the local forked Ethereum node at the user-specified transaction time.

6. An automated analysis method for Ethereum transactions based on code instrumentation, characterized in that: The method is implemented by the automated analysis system for Ethereum transactions based on code stubbing as described in any one of claims 1 to 5; the method comprises the following steps: Parse the structured information input by the user through the instrumentation information parsing module, and record the target transaction hash, instrumentation point and instrumentation function specified by the user; The transaction logic extraction module obtains the original data of the user-specified transaction from the Ethereum node, and extracts the function call information of the relevant contract during the transaction execution process; Receiving the function call information output by the transaction logic extraction module through the associated contract construction module, and constructing the source code of the related contract; The contract code plugging module inserts plugs into the source code of the relevant contract according to the plugging points and plugging functions specified by the user to generate an analysis contract; The analysis contract generated by the contract code plug-in module is executed by the analysis script execution module to obtain the analysis result.

Images