Method and system for testing safety performance of cryptocurrency wallet based on mutation

Abstract

The invention discloses a mutation-based cryptocurrency wallet safety performance test method and system. Wallet expansion is used as input, a simulator, a safety alarm system and user interface selection seeds are obtained respectively, and the seeds are requests of a user for wallet expansion; modifying the obtained seed, and providing the modified data as an external request of wallet extension to the wallet extension; and then verifying whether the seed can be abused as an attack medium according to the obtained dynamic execution result so as to detect a final affected component, so that the security of the block chain wallet and the transaction-related component can be detected, and a component carrier which may be abused by an attacker or cause a user error is found, thereby improving the security of the block chain wallet and the transaction-related component. And thus, asset loss is avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain wallets, and in particular to a mutation-based cryptocurrency wallet security performance testing method and system. Background Art

[0002] As the influence of blockchain rapidly expands, the number of cryptocurrency wallet users has surged, directly affecting the security of user assets. A cryptocurrency wallet extension is a software tool provided in the form of a browser extension to help users manage and use their cryptocurrency assets. As the first point of contact for users to enter the world of cryptocurrency, blockchain cryptocurrency wallets allow users to manage, receive and transfer digital assets on blockchain networks and interact with emerging decentralized finance (DeFi) applications. Unfortunately, cryptocurrency wallets have always been the main target of attackers, and wallet leaks have been reported from time to time. According to statistics, in 2023 alone, the total economic losses caused by crypto scams conducted through wallets reached US$300 million. In the first two months of 2024, an estimated 97,000 users were affected by phishing incidents, with a total economic loss of US$104 million. As of June 2024, the number of fraud cases on Trust Wallet has increased dramatically, including ice phishing, fake giveaways, etc.

[0003] Currently, some work studies cryptocurrency wallets. Among them, Erinle classified wallet types, identified common vulnerabilities and attacks, and discussed defense mechanisms. However, their research focused on key management and ignored the wallet's ability to interact with the blockchain. The increase in malicious activity in the emerging blockchain ecosystem has prompted efforts to understand and address these threats. Some other work introduced a classifier that uses blockchain transactions to identify phishing accounts. They suggested integrating this classifier into users' cryptocurrency wallets to warn them of potential risks when using risky accounts.

[0004] The transaction-related components of blockchain cryptocurrency wallets include user interfaces, transaction simulators, and security alarm systems, but the abuse related to wallet extensions has not yet been explored. Therefore, it is necessary and urgent to test wallet extensions on the market and find component vectors that may be abused by attackers or cause user errors, thereby avoiding asset losses. Summary of the invention

[0005] The present invention provides a mutation-based cryptocurrency wallet security performance testing method and system, which can detect the security of blockchain wallet and transaction-related components, thereby discovering component carriers that may be abused by attackers or cause user errors, thereby avoiding asset losses.

[0006] The present invention provides a method for testing the security performance of a cryptocurrency wallet based on mutation, comprising:

[0007] Get user requests for wallet simulators, security alert systems, and user interfaces;

[0008] Modifying user requests to the simulator, security alarm system, and user interface, and sending the modified user requests to the wallet for execution;

[0009] The execution result of the wallet is obtained, and the security of the simulator, the security alarm system and the user interface of the wallet is determined according to the execution result.

[0010] Specifically, the user request for obtaining the wallet simulator, security alert system, and user interface includes:

[0011] Deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate a new transaction as a user request for the simulator;

[0012] Obtaining the original request format of known and / or pre-set fraudulent transaction patterns as a user request for a security alert system;

[0013] The browser extension source code is statically analyzed, and each interface event that triggers network message transmission is used as a starting point, and the code is traced back to the corresponding event handler as an element of the user interface; the event position is located in the element through regular matching as a data entry; the code context of the data entry is dynamically identified to obtain data type requirements, labels and code context meanings, and the user request of the user interface is inferred from the data type requirements, labels and code context meanings.

[0014] Specifically, the modification of the user request to the simulator, the security alarm system and the user interface includes:

[0015] In response to the user request of the simulator, at least one of the following modifications is performed:

[0016] Changing the transfer value to zero or an unaffordable number, replacing a token address with another address not held by the entity involved, modifying verification data for cross-chain transactions;

[0017] For a user request of the security alarm system, deleting a prefix in the user request and / or converting the case of letters in the user request;

[0018] For the message signing request in the user request of the user interface, change the order of setting parameters in the message signing request and / or randomly modify the character string in the message signing request; for the user interaction request in the user request of the user interface, randomly truncate or append the character string of the ENS name and the token name.

[0019] Specifically, obtaining the execution result of the wallet includes:

[0020] Identify text fields on a page with hints and / or detect error messages returned from a wallet browser and / or capture automatically recommended content.

[0021] Specifically, judging the security of the simulator, the security alarm system and the user interface of the wallet according to the execution result includes:

[0022] If the text field with the prompt on the page is inconsistent with the execution result on the real blockchain, it is determined that the security of the wallet simulator is at risk;

[0023] If an error message returned from the wallet browser is detected, it is determined that the security of the wallet's security alarm system is at risk;

[0024] If the automatically recommended content is inconsistent with the preset display content, it is determined that there is a risk to the security of the wallet's user interface.

[0025] The present invention also provides a mutation-based cryptocurrency wallet security performance testing system, comprising:

[0026] A user request acquisition module, used to obtain user requests for the wallet simulator, security alarm system, and user interface;

[0027] A user request modification module, used to modify the user request of the simulator, the security alarm system and the user interface, and send the modified user request to the wallet for execution;

[0028] The component security performance determination module is used to obtain the execution result of the wallet and determine the security of the simulator, security alarm system and user interface of the wallet according to the execution result.

[0029] Specifically, the user request acquisition module includes:

[0030] The simulator user request acquisition unit is used to deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate a new transaction as a user request of the simulator;

[0031] A security alarm system user request acquisition unit, used to acquire an original request format of a known and / or preset fraudulent transaction pattern as a user request of the security alarm system;

[0032] The user interface user request acquisition unit is used to perform static analysis on the browser extension source code, taking each interface event that triggers network message transmission as the starting point, tracing back the code to the corresponding event handler as the element of the user interface; locating the event position in the element as the data entry through regular matching; dynamically identifying the code context of the data entry to obtain data type requirements, labels and code context meanings, and inferring the user request of the user interface from the data type requirements, labels and code context meanings.

[0033] Specifically, the user request modification module includes:

[0034] The simulator user request modification unit is used to perform at least one of the following modifications on the simulator user request:

[0035] Changing the transfer value to zero or an unaffordable number, replacing a token address with another address not held by the entity involved, modifying verification data for cross-chain transactions;

[0036] A security alarm system user request modification unit, configured to delete a prefix in the user request and / or convert the case of letters in the user request for the security alarm system;

[0037] A user interface user request modification unit, configured to change the order of setting parameters in the message signature request and / or randomly modify the character string in the message signature request for the message signature request in the user request of the user interface; and to randomly truncate or append the character string of the ENS name and the token name for the user interaction request in the user request of the user interface;

[0038] The user request sending unit is used to send the modified user request to the wallet for execution.

[0039] Specifically, the component safety performance determination module includes:

[0040] An execution result acquisition unit of the wallet, used to identify a text field with a prompt on a page and / or detect an error message returned from a wallet browser and / or capture automatically recommended content;

[0041] The first component, a security performance determination unit, is used to determine that the security of the wallet simulator is at risk if the text field with a prompt on the page is inconsistent with the execution result on the real blockchain;

[0042] A second component, a security performance determination unit, is used to determine that there is a risk to the security of the wallet's security alarm system if an error message returned from the wallet browser is detected;

[0043] The third component is a security performance determination unit, which is used to determine that there is a risk to the security of the wallet user interface if the automatically recommended content is inconsistent with the preset display content.

[0044] One or more technical solutions provided in the present invention have at least the following technical effects or advantages:

[0045] 1. Take the wallet extension as input, obtain the simulator, security alert system and user interface selection seeds respectively. These seeds are user requests to the wallet extension, such as signing messages, sending transactions and resolving ENS names; then modify the obtained seeds and provide the modified data as an external request of the wallet extension to the wallet extension; then verify whether the seeds can be abused as an attack vector based on the obtained dynamic execution results to detect the components that will eventually be affected. Therefore, the security of the blockchain wallet and transaction-related components can be tested, so as to find component carriers that may be abused by attackers or cause user errors, thereby avoiding asset losses.

[0046] 2. Detect potential vulnerabilities in the transaction simulator through smart contracts: This is a detection method for simulator variable values. It is the first time that a design pattern of using two smart contracts to automatically obtain simulator variable values ​​is proposed. Therefore, it is a heuristic solution that greatly improves the detection coverage.

[0047] 3. Automatically modify transaction data. It can automatically modify message data in different protocols. It is a type-sensitive modifier that can ensure that the modified data still complies with the type required by the data field.

[0048] 4. For different seeds (user operation requests), the execution results of different wallet extensions can be automatically evaluated to determine whether the seed will cause confusion or direct asset loss to users of a specific wallet, thereby discovering component carriers that may be abused by attackers or cause user errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A flowchart of a method for testing the security performance of a cryptocurrency wallet based on mutations provided by an embodiment of the present invention;

[0050] Figure 2 A module diagram of a mutation-based cryptocurrency wallet security performance testing system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The embodiments of the present invention provide a mutation-based cryptocurrency wallet security performance testing method and system, which can detect the security of blockchain wallet and transaction-related components, thereby discovering component carriers that may be abused by attackers or cause user errors, thereby avoiding asset losses.

[0052] The technical solution in the embodiment of the present invention is to achieve the above technical effects, and the overall idea is as follows:

[0053] (1) Identify available seeds (user requests) as candidates for attack vectors. Specifically:

[0054] 1) First, identify the state variable values ​​in the simulator to further determine whether they may be abused. First, this embodiment explores whether there are inconsistencies in the state variables and deploys two contracts: Contract 1 is a common ERC-20 token contract, and Contract 2 calls Contract 1 to mint tokens. The number of tokens minted can reflect the state variables of the current operating environment (for example, mint(amount=Uint256(block.timestamp)) can reflect the block timestamp). Such transactions will be simulated by the simulator and executed simultaneously on the connected blockchain network. Secondly, observe the execution results in different environments and summarize the generation pattern of inconsistent state variables on a simulator. Third, deploy Contract 3 to "attack" the simulator, which contains a function with an if-else structure. The condition is whether the current execution is in a simulation or a real environment. Such a judgment can be made by checking whether the state variable value follows the pattern summarized in the second step. This process can identify state variables that may be used to attack the simulator and generate attack transactions using the logic of Contract 3. In addition to attack transactions, this step also additionally includes normal transactions, such as token exchange, cross-chain transactions, direct transfer transactions, etc., to form a comprehensive seed corpus.

[0055] 2) In addition, this embodiment uses the incoming signature request that can trigger an alarm as a seed. Specifically, the known risk patterns are summarized and specific examples are generated for each pattern. In this embodiment, five risky transaction patterns are summarized, including phishing transactions, account authorization requirements, NFT pending orders, fake function name scams, risky address transactions, etc. For each of the above risk patterns, 3 transactions are randomly generated as seeds.

[0056] 3) Extract all UI elements of a given wallet extension, identify data entry points (e.g., transfer recipient address input point, ENS name address input point, etc.), and obtain all possible user request patterns (e.g., request to resolve ENS name, request to search for token information using token name, etc.). Each data entry has type restrictions, and the data type requirements are sensed and the requests that users may submit are generated as seeds.

[0057] (2) Modify the content and format of the generated seeds. All modified data will be used as external requests to the wallet extension. Specifically, for the simulator's seeds, their content is changed to deliberately make them fail on the real blockchain. The seeds for the security alarm system are various signature requests, and the format is mutated. For requests embedded in transactions, the "0x" prefix of the transaction input data is removed or the case of the letters in the input data is changed. For requests in the message format, their data types are changed. For the wallet user interface seeds, both the content and format are mutated. The user interface can directly receive input from the user, and the external requests are encoded as signature requests and user interactions. For message signature requests, the order of the specified parameters in the message is changed, random text or blanks are injected into the human-readable message field, and the strings in the message are randomly modified. For user interaction requests, special ENS names are selected, corresponding to names that have been updated or registered on multiple blockchain networks. The strings of ENS names and token names are randomly truncated or appended. It should be noted that the modifications to the strings do not contain any illegal symbols, thereby ensuring their validity. After mutation, the external request will be passed back to the wallet extension with its corresponding data entry.

[0058] (3) Determine whether an external request can be abused as an attack vector and further identify which components will be affected. Specifically:

[0059] 1) Get the dynamic execution results of the wallet extension: First, pay attention to all warnings by combining static string keyword matching and dynamic behavior analysis. Each time a signature request is submitted, a pop-up window with display keywords is captured. Another form of warning is that some extensions may directly block the submitted activity and refuse to provide subsequent services. Therefore, this embodiment also detects the error message returned from the browser console to understand what execution results the security detection system in the wallet extension will produce for different risky transactions. Second, it also pays attention to the presentation format of the input message, such as JSON format or key value highlighting. Some wallet UIs may only display part of the data and hide key information (for example, in the EIP-712 protocol message, the fixed field verfierContract represents the contract address for verification and authorization, but the fixed field will be hidden by some wallets), causing trouble or potential risks to users. To this end, this embodiment also identifies the text field with prompts on the page, and then verifies which key value items are displayed in the submitted message. However, if there is no text field, it will be checked whether the message is displayed in JSON format, so as to understand the way the wallet displays the message, and thus confirm whether there is a potential risk. Third, capture the automatically recommended content.

[0060] 2) Identify attack vectors: Based on the dynamic execution results of the mutated external requests, this embodiment identifies attack vectors from them through an oracle. First, the attack vectors are determined for the simulator and the alarm system respectively based on the results generated by the two oracles according to the illegal transactions and risk requests. Among them, the first oracle assumes that all illegal transactions will fail during the simulation. If it succeeds or the user can sign the transaction, the oracle will regard the mutated transaction as an attack vector. The second oracle intuitively expects that all risk requests can trigger the extension alarm. If the alarm is bypassed, the oracle will regard the risk request as an attack vector against the extension. In addition, the third oracle determines whether the ENS name resolution returned by the wallet's user interface is accurate, whether the token recommendation list is a fake token, and whether the transaction information displayed by the UI is complete or whether the key information is hidden, thereby identifying the attack vector of the wallet's user interface.

[0061] 3) Determine the affected components: By capturing the execution results, verify the correctness of the response information, and determine whether they will mislead the user or even display an error message. If so, it indicates that it may be abused as an attack vector. Specifically, if the execution results of the attack vector are presented on the page in a way that causes user confusion (for example, the wallet display requires an incomplete signature message, key information is hidden, etc.), then the wallet user interface is the affected component, indicating that the security of the wallet's user interface component is at risk. If the result of the executed transaction is inconsistent with the result of the real blockchain environment, it means that the simulator is abused, and the simulator is a risky component. If the security detection system in the wallet extension cannot promptly warn of the public risky transaction mode, it means that the security detection system is a risky component of the wallet.

[0062] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0063] like Figure 1 As shown, the encryption currency wallet security performance testing method based on mutation provided by the embodiment of the present invention includes:

[0064] Step S110: Obtain user requests for a wallet simulator, a security alarm system, and a user interface;

[0065] This step is specifically described to obtain user requests for the wallet simulator, security alert system, and user interface, including:

[0066] Deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate new transactions as user requests for the simulator; in addition, randomly select normal transactions from the historical transaction list of contracts of well-known decentralized projects as user requests for the simulator.

[0067] Obtaining the original request format of known and / or pre-set fraudulent transaction patterns as a user request for a security alert system;

[0068] Perform static analysis on the browser extension source code, starting from each interface event that triggers network message transmission, trace back the code to the corresponding event handler as the element of the user interface; locate the event position in the element as the data entry through regular matching; dynamically identify the code context of the data entry to obtain the data type requirements, labels and code context meanings, and infer the user request of the user interface from the data type requirements, labels and code context meanings. Specifically, for the user interface of a given wallet extension, use the Tarnish tool to perform static analysis on the browser extension source code, starting from each interface event that triggers network message transmission (for example, sending an ENS name resolution request), trace back the code to the corresponding event handler (for example, onClick). Events that do not trigger system network requests (for example, using URL.openConnection) are filtered out, and other events and corresponding handlers are collected and identified as elements of the user interface. In the element set, regular matching is used to locate the event positions such as placeholders and input boxes, and identify them as data entries. Then, the code context of the data entry is dynamically identified to obtain the data type requirements, labels, and code context meanings, and then infer the user request content (for example, the data type is a variable-length string, and the previous text indicates adding a token, so it can be determined that the user needs to enter the token name or address). Finally, a user request that meets the entry specifications is generated and submitted to the wallet for execution by subsequent components through these data entries.

[0069] Step S120: modifying the user request of the simulator, the security alarm system and the user interface, and sending the modified user request to the wallet for execution;

[0070] This step specifies the user-requested modifications to the simulator, safety alarm system, and user interface, including:

[0071] In response to a user request from the simulator, make at least one of the following modifications:

[0072] Changing the transfer value to zero or an unaffordable number, replacing a token address with another address not held by the entity involved, modifying verification data for cross-chain transactions;

[0073] For user requests of the security alarm system, remove prefixes in the user request and / or convert the case of letters in the user request;

[0074] For the message signing request in the user request of the user interface, change the order of the set parameters in the message signing request and / or randomly modify the string in the message signing request; for the user interaction request in the user request of the user interface, randomly truncate or append the string of the ENS name and token name.

[0075] Step S130: Obtain the execution result of the wallet, and determine the security of the wallet simulator, security alarm system and user interface according to the execution result.

[0076] This step is described in detail to obtain the execution results of the wallet, including:

[0077] Identify text fields on a page with hints and / or detect error messages returned from a wallet browser and / or capture automatically recommended content.

[0078] The security of the wallet simulator, security alarm system and user interface is determined based on the execution results, including:

[0079] If the text field with a prompt on the page is inconsistent with the execution result on the real blockchain, it means that the execution logic of the transaction in the simulated environment will be disturbed, and it is determined that there is a risk to the security of the wallet simulator;

[0080] If an error message is detected from the wallet browser, it means that the security alarm system cannot promptly warn of malicious transactions, and it is determined that there is a risk to the security of the wallet's security alarm system;

[0081] If the automatically recommended content is inconsistent with the preset display content, that is, the content automatically recommended by the wallet is incorrect, including: retrieving the wrong ENS name, displaying false token information, or hiding key information in the text field with information prompts displayed on the page, causing user confusion, it is determined that the security of the wallet's user interface is at risk.

[0082] After identifying wallet components with security risks, the risky components are sent to the maintenance end for component maintenance to improve the security performance of the risky components.

[0083] like Figure 2 As shown, the mutation-based cryptocurrency wallet security performance testing system provided by the embodiment of the present invention includes:

[0084] A user request acquisition module 100, for acquiring user requests for the wallet simulator, the security alarm system, and the user interface;

[0085] Specifically, the user request acquisition module 100 includes:

[0086] The simulator user request acquisition unit is used to deploy smart contracts, design and publish transactions to obtain the difference value between the simulator and the real network environment; use the difference value as a judgment condition to generate a new transaction as the simulator's user request; in addition, normal transactions are randomly selected from the historical transaction list of contracts of well-known decentralized project parties as user requests of the simulator.

[0087] A security alarm system user request acquisition unit, used to acquire an original request format of a known and / or preset fraudulent transaction pattern as a user request of the security alarm system;

[0088] The user interface user request acquisition unit is used to statically analyze the browser extension source code, starting from each interface event that triggers network message transmission, tracing back the code to the corresponding event handler as the element of the user interface; locating the event position in the element as the data entry through regular matching; dynamically identifying the code context of the data entry to obtain the data type requirements, labels and code context meanings, and infer the user request of the user interface from the data type requirements, labels and code context meanings. Specifically, for the user interface of a given wallet extension, the Tarnish tool is used to statically analyze the browser extension source code, starting from each interface event that triggers network message transmission (for example, sending an ENS name resolution request), tracing back the code to the corresponding event handler (for example, onClick). Events that do not trigger system network requests (for example, using URL.openConnection) are filtered out, and other events and corresponding handlers are collected and identified as elements of the user interface. In the element set, regular matching is used to locate the event positions such as placeholders and input boxes, and identify them as data entries. Then, the code context of the data entry is dynamically identified to obtain the data type requirements, labels, and code context meanings, and then infer the user request content (for example, the data type is a variable-length string, and the previous text indicates adding a token, so it can be determined that the user needs to enter the token name or address). Finally, a user request that meets the entry specifications is generated and submitted to the wallet for execution by subsequent components through these data entries.

[0089] A user request modification module 200, for modifying user requests of the simulator, the security alarm system and the user interface, and sending the modified user requests to the wallet for execution;

[0090] Specifically, the user request modification module 200 includes:

[0091] The simulator user request modification unit is used to perform at least one of the following modifications on the simulator user request:

[0092] Changing the transfer value to zero or an unaffordable number, replacing a token address with another address not held by the entity involved, modifying verification data for cross-chain transactions;

[0093] A security alarm system user request modification unit, used for deleting a prefix in a user request and / or converting the case of letters in the user request for the security alarm system;

[0094] The user interface user request modification unit is used to change the order of setting parameters in the message signature request and / or randomly modify the character string in the message signature request for the message signature request in the user request of the user interface; and randomly truncate or append the character string of the ENS name and token name for the user interaction request in the user request of the user interface.

[0095] The user request sending unit is used to send the modified user request to the wallet for execution.

[0096] The component security performance determination module 300 is used to obtain the execution result of the wallet and determine the security of the wallet simulator, security alarm system and user interface according to the execution result.

[0097] Specifically, the component safety performance determination module 300 includes:

[0098] The execution result acquisition unit of the wallet is used to identify the text field with the prompt on the page and / or detect the error message returned from the wallet browser and / or capture the automatically recommended content.

[0099] The first component, a security performance determination unit, is used to determine that if the text field with a prompt on the page is inconsistent with the execution result on the real blockchain, it means that the execution logic of the transaction in the simulation environment will be disturbed, and it is determined that there is a risk to the security of the wallet simulator;

[0100] The second component, a security performance determination unit, is used to detect an error message returned from the wallet browser, indicating that the security alarm system is unable to promptly warn of malicious transactions, and determines that there is a risk to the security of the wallet's security alarm system;

[0101] The third component, the security performance determination unit, is used to determine that if the automatically recommended content is inconsistent with the preset display content, that is, the content automatically recommended by the wallet is incorrect, including: retrieving an ENS name error, displaying false token information, or hiding key information in the text field with information prompts displayed on the page, causing user confusion, and determining that there is a risk to the security of the wallet's user interface.

[0102] The structure of the embodiment of the present invention is further described, and further includes:

[0103] The risk component sending module is used to send the risk component to the maintenance end for component maintenance after identifying the wallet component with security risk, so as to improve the security performance of the risk component.

[0104] The embodiment of the present invention detects the security performance of components in the cryptocurrency wallet extension in the blockchain. First, the request data fields of different wallet extension components are obtained, and the data types are sensed at the same time; all message signature methods, message structures, and transactions of various fraud modes are covered, so that the security performance of the wallet extension can be fully tested to the greatest extent. Then, the obtained request data is automatically modified, and the type is kept sensitive. Finally, the execution results of the wallet extension for different seeds are automatically evaluated by the oracle, so that the security vulnerabilities of the blockchain wallet component can be mined.

[0105] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0109] The parts not described in detail in the embodiments of the present invention are all known technologies to those skilled in the art. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A method for testing the security performance of a cryptocurrency wallet based on mutation, characterized in that: include: Get user requests for wallet simulators, security alert systems, and user interfaces; Modifying user requests to the simulator, security alarm system, and user interface, and sending the modified user requests to the wallet for execution; The execution result of the wallet is obtained, and the security of the simulator, the security alarm system and the user interface of the wallet is determined according to the execution result.

2. The method for testing the security performance of a cryptocurrency wallet based on mutation according to claim 1, characterized in that: The user request for obtaining the wallet simulator, security alert system and user interface includes: Deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate a new transaction as a user request for the simulator; Obtaining the original request format of known and / or pre-set fraudulent transaction patterns as a user request for a security alert system; The browser extension source code is statically analyzed, and each interface event that triggers network message transmission is used as a starting point, and the code is traced back to the corresponding event handler as an element of the user interface; the event position is located in the element through regular matching as a data entry; the code context of the data entry is dynamically identified to obtain data type requirements, labels and code context meanings, and the user request of the user interface is inferred from the data type requirements, labels and code context meanings.

3. The mutation-based cryptocurrency wallet security performance testing method according to claim 1, characterized in that: The modifying of the user request of the simulator, the security alarm system and the user interface comprises: In response to the user request of the simulator, at least one of the following modifications is performed: Changing the transfer value to zero or an unaffordable number, replacing a token address with another address not held by the entity involved, modifying verification data for cross-chain transactions; For a user request of the security alarm system, deleting a prefix in the user request and / or converting the case of letters in the user request; For the message signing request in the user request of the user interface, change the order of setting parameters in the message signing request and / or randomly modify the character string in the message signing request; for the user interaction request in the user request of the user interface, randomly truncate or append the character string of the ENS name and the token name.

4. The method for testing the security performance of a cryptocurrency wallet based on mutation according to claim 1, characterized in that: The obtaining of the execution result of the wallet includes: Identify text fields on a page with hints and / or detect error messages returned from a wallet browser and / or capture automatically recommended content.

5. The method for testing the security performance of a cryptocurrency wallet based on mutation according to claim 4, characterized in that: Determining the security of the simulator, the security alarm system, and the user interface of the wallet according to the execution result includes: If the text field with the prompt on the page is inconsistent with the execution result on the real blockchain, it is determined that the security of the wallet simulator is at risk; If an error message returned from the wallet browser is detected, it is determined that the security of the wallet's security alarm system is at risk; If the automatically recommended content is inconsistent with the preset display content, it is determined that there is a risk to the security of the wallet's user interface.

6. A mutation-based cryptocurrency wallet security performance testing system, characterized in that: include: A user request acquisition module, used to obtain user requests for the wallet simulator, security alarm system, and user interface; A user request modification module, used to modify the user request of the simulator, the security alarm system and the user interface, and send the modified user request to the wallet for execution; The component security performance determination module is used to obtain the execution result of the wallet and determine the security of the simulator, security alarm system and user interface of the wallet according to the execution result.

7. The mutation-based cryptocurrency wallet security performance testing system according to claim 6, characterized in that: The user request acquisition module includes: The simulator user request acquisition unit is used to deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate a new transaction as a user request of the simulator; A security alarm system user request acquisition unit, used to acquire an original request format of a known and / or preset fraudulent transaction pattern as a user request of the security alarm system; The user interface user request acquisition unit is used to perform static analysis on the browser extension source code, taking each interface event that triggers network message transmission as the starting point, tracing back the code to the corresponding event handler as the element of the user interface; locating the event position in the element as the data entry through regular matching; dynamically identifying the code context of the data entry to obtain data type requirements, labels and code context meanings, and inferring the user request of the user interface from the data type requirements, labels and code context meanings.

8. The mutation-based cryptocurrency wallet security performance testing system according to claim 6, characterized in that: The user request modification module includes: The simulator user request modification unit is used to perform at least one of the following modifications on the simulator user request: Changing the transfer value to zero or an unaffordable number, replacing a token address with another address not held by the entity involved, modifying verification data for cross-chain transactions; A security alarm system user request modification unit, configured to delete a prefix in the user request and / or convert the case of letters in the user request for the security alarm system; A user interface user request modification unit, configured to change the order of setting parameters in the message signature request and / or randomly modify the character string in the message signature request for the message signature request in the user request of the user interface; and to randomly truncate or append the character string of the ENS name and the token name for the user interaction request in the user request of the user interface; The user request sending unit is used to send the modified user request to the wallet for execution.

9. The mutation-based cryptocurrency wallet security performance testing system according to any one of claims 6 to 8, characterized in that: The component safety performance determination module comprises: An execution result acquisition unit of the wallet, used to identify a text field with a prompt on a page and / or detect an error message returned from a wallet browser and / or capture automatically recommended content; The first component, a security performance determination unit, is used to determine that the security of the wallet simulator is at risk if the text field with a prompt on the page is inconsistent with the execution result on the real blockchain; A second component, a security performance determination unit, is used to determine that there is a risk to the security of the wallet's security alarm system if an error message returned from the wallet browser is detected; The third component is a security performance determination unit, which is used to determine that there is a risk to the security of the wallet user interface if the automatically recommended content is inconsistent with the preset display content.

Images