A mutation-based cryptocurrency wallet security performance testing method and system

Abstract

This invention discloses a mutation-based cryptocurrency wallet security performance testing method and system. Using a wallet extension as input, the system obtains simulator, security alert system, and user interface selection seeds, representing user requests to the wallet extension. The obtained seeds are then modified and the modified data is provided to the wallet extension as an external request. The obtained dynamic execution results are then used to verify whether the seeds can be abused as attack vectors, thereby detecting components that will ultimately be affected. This method can thus test the security of transaction-related components of blockchain wallets, identifying component carriers that could be abused by attackers or cause user errors, thereby preventing asset losses.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain wallets, and in particular to a mutation-based cryptocurrency wallet security performance testing method and system. Background Art

[0002] With the rapid expansion of blockchain's influence, the number of cryptocurrency wallet users has skyrocketed, directly impacting the security of their assets. A cryptocurrency wallet extension is a software tool, available as a browser extension, that helps users manage and use their cryptocurrency assets. As the user's first point of entry into the world of cryptocurrency, a blockchain cryptocurrency wallet allows users to manage, receive, and transfer digital assets on blockchain networks and interact with emerging decentralized finance (DeFi) applications. Cryptocurrency wallets have always been a prime target for attackers, and wallet breaches are frequently reported.

[0003] Currently, some work examines cryptocurrency wallets. Erinle et al. categorizes wallet types, identifies common vulnerabilities and attacks, and discusses defense mechanisms. However, their research focuses on key management, overlooking the wallet's ability to interact with the blockchain. The rise in malicious activity within the emerging blockchain ecosystem has spurred efforts to understand and address these threats. Other work has introduced a classifier that uses blockchain transactions to identify phishing accounts. They propose integrating this classifier into users' cryptocurrency wallets to warn them of potential risks when using risky accounts.

[0004] Blockchain cryptocurrency wallets and transaction-related components include user interfaces, transaction simulators, and security alert systems. However, the potential for abuse related to wallet extensions has not yet been explored. Therefore, it is necessary and urgent to test wallet extensions on the market and identify potential vectors for abuse by attackers or user errors to prevent asset loss. Summary of the Invention

[0005] The present invention provides a mutation-based cryptocurrency wallet security performance testing method and system, which can detect the security of blockchain wallet and transaction-related components, thereby discovering component carriers that may be abused by attackers or cause user errors, thereby avoiding asset losses.

[0006] The present invention provides a method for testing the security performance of a cryptocurrency wallet based on mutation, comprising:

[0007] User requests for wallet simulators, security alert systems, and user interfaces;

[0008] Modifying user requests to the simulator, security alert system, and user interface, and sending the modified user requests to the wallet for execution;

[0009] Obtain an execution result of the wallet, and determine the security of the wallet simulator, security alarm system, and user interface according to the execution result.

[0010] Specifically, the user request to obtain the wallet simulator, security alert system, and user interface includes:

[0011] Deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate a new transaction as a user request for the simulator;

[0012] Obtaining the original request format of known and / or pre-set fraudulent transaction patterns as a user request to the security alert system;

[0013] The browser extension source code is statically analyzed, starting from each interface event that triggers network message transmission, and the code is traced back to the corresponding event handler as the user interface element; the event position is located in the element through regular matching as the data entry; the code context of the data entry is dynamically identified to obtain data type requirements, labels and code context meanings, and the user request of the user interface is inferred from the data type requirements, labels and code context meanings.

[0014] Specifically, the modification of user requests to the simulator, the security alarm system, and the user interface includes:

[0015] In response to a user request of the simulator, at least one of the following modifications is performed:

[0016] Changing the transfer value to zero or an unacceptable number, replacing a token address with another address not held by the involved entity, or modifying verification data for cross-chain transactions;

[0017] For a user request of the security alarm system, deleting a prefix in the user request and / or converting the case of letters in the user request;

[0018] For the message signature request in the user request of the user interface, change the order of the set parameters in the message signature request and / or randomly modify the character string in the message signature request; for the user interaction request in the user request of the user interface, randomly truncate or append the character string of the ENS name and token name.

[0019] Specifically, obtaining the execution result of the wallet includes:

[0020] Identify text fields with hints on the page and / or detect error messages returned from the wallet browser and / or capture automatically recommended content.

[0021] Specifically, determining the security of the wallet simulator, security alarm system, and user interface based on the execution result includes:

[0022] If the text field with the prompt on the page is inconsistent with the execution result on the real blockchain, it is determined that there is a risk to the security of the wallet simulator;

[0023] If an error message is detected returned from the wallet browser, it is determined that the security of the wallet's security alert system is at risk;

[0024] If the automatically recommended content is inconsistent with the preset display content, it is determined that there is a risk to the security of the wallet user interface.

[0025] The present invention also provides a mutation-based cryptocurrency wallet security performance testing system, comprising:

[0026] A user request acquisition module, used to obtain user requests for the wallet simulator, security alert system, and user interface;

[0027] A user request modification module, configured to modify user requests to the simulator, the security alarm system, and the user interface, and send the modified user requests to the wallet for execution;

[0028] The component security performance determination module is used to obtain the execution result of the wallet and determine the security of the wallet simulator, security alarm system and user interface based on the execution result.

[0029] Specifically, the user request acquisition module includes:

[0030] The simulator user request acquisition unit is used to deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate a new transaction as the simulator user request;

[0031] a security alarm system user request acquisition unit, configured to acquire an original request format of a known and / or preset fraudulent transaction pattern as a user request for the security alarm system;

[0032] The user interface user request acquisition unit is used to perform static analysis on the browser extension source code, starting from each interface event that triggers network message transmission, tracing back the code to the corresponding event handler as the user interface element; locating the event position in the element as the data entry through regular matching; dynamically identifying the code context of the data entry to obtain data type requirements, labels and code context meanings, and inferring the user request of the user interface from the data type requirements, labels and code context meanings.

[0033] Specifically, the user request modification module includes:

[0034] The simulator user request modification unit is configured to perform at least one of the following modifications on the simulator user request:

[0035] Changing the transfer value to zero or an unacceptable number, replacing a token address with another address not held by the involved entity, or modifying verification data for cross-chain transactions;

[0036] a security alarm system user request modification unit, configured to delete a prefix in the user request and / or convert the case of letters in the user request for the security alarm system;

[0037] A user interface user request modification unit, configured to change the order of parameters set in the message signature request and / or randomly modify the character string in the message signature request for a message signature request in the user interface user request; and randomly truncate or append the character string of the ENS name and token name for a user interaction request in the user interface user request;

[0038] The user request sending unit is used to send the modified user request to the wallet for execution.

[0039] Specifically, the component safety performance determination module includes:

[0040] The execution result acquisition unit of the wallet is used to identify the text field with the prompt on the page and / or detect the error message returned from the wallet browser and / or capture the automatically recommended content;

[0041] The first component, a security performance determination unit, is configured to determine that the security of the wallet simulator is at risk if the text field with the prompt on the page is inconsistent with the execution result on the real blockchain;

[0042] A second component, a security performance determination unit, is configured to determine that there is a risk to the security of the wallet's security alarm system if an error message returned from the wallet browser is detected;

[0043] The third component is a security performance determination unit, which is used to determine that there is a risk to the security of the wallet user interface if the automatically recommended content is inconsistent with the preset display content.

[0044] One or more technical solutions provided in the present invention have at least the following technical effects or advantages:

[0045] 1. Take the wallet extension as input and obtain the simulator, security alert system, and user interface selection seeds respectively. These seeds are user requests to the wallet extension, such as signing messages, sending transactions, and resolving ENS names. The obtained seeds are then modified and the modified data is provided to the wallet extension as an external request. The obtained dynamic execution results are then used to verify whether the seeds can be abused as an attack vector to detect the components that will ultimately be affected. This allows the security of blockchain wallet and transaction-related components to be tested, thereby discovering component carriers that may be abused by attackers or cause user errors, thereby preventing asset losses.

[0046] 2. Detecting potential vulnerabilities in the trading simulator through smart contracts: This is a detection method for simulator variable values. It is the first to propose a design pattern that uses two smart contracts to automatically obtain simulator variable values. Therefore, it is a heuristic solution that greatly improves the detection coverage.

[0047] 3. Automatically modify transaction data. It can automatically modify message data in different protocols. It is a type-sensitive modifier that can ensure that the modified data still complies with the type required by the data field.

[0048] 4. Automated evaluation of the execution results of different wallet extensions for different seeds (user operation requests) can be used to determine whether the seed will cause confusion or direct asset loss to users of a specific wallet, thereby discovering component carriers that may be abused by attackers or cause user errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A flowchart of a mutation-based cryptocurrency wallet security performance testing method provided in an embodiment of the present invention;

[0050] Figure 2 This is a module diagram of the mutation-based cryptocurrency wallet security performance testing system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The embodiments of the present invention provide a mutation-based cryptocurrency wallet security performance testing method and system, which can detect the security of blockchain wallet and transaction-related components, thereby discovering component carriers that may be abused by attackers or cause user errors, thereby avoiding asset losses.

[0052] The technical solution in the embodiment of the present invention is to achieve the above technical effects, and the overall idea is as follows:

[0053] (1) Identify available seeds (user requests) as candidates for attack vectors. Specifically:

[0054] 1) First, identify state variable values ​​within the simulator to further determine whether they could be abused. This example explores whether state variable inconsistencies exist by deploying two contracts: Contract 1 is a standard ERC-20 token contract, and Contract 2 calls Contract 1 to mint tokens. The amount of tokens minted reflects the state variables of the current runtime environment (for example, mint(amount = Uint256(block.timestamp)) reflects the block timestamp). These transactions are simulated by the simulator and executed simultaneously on the connected blockchain network. Secondly, the execution results in different environments are observed to identify patterns in the generation of inconsistent state variables within a simulator. Third, Contract 3 is deployed to "attack" the simulator. This function contains a function with an if-else structure. The condition determines whether the current execution is in simulation or the real environment. This determination is made by checking whether the state variable values ​​follow the patterns identified in step 2. This process identifies state variables that could be used to attack the simulator and generates attack transactions using the logic of Contract 3. In addition to attack transactions, this step also includes normal transactions such as token swaps, cross-chain transactions, and direct transfers, forming a comprehensive seed corpus.

[0055] 2) Furthermore, this embodiment uses incoming signature requests that could trigger an alert as seeds. Specifically, known risk patterns are summarized and specific examples are generated for each pattern. In this embodiment, five risky transaction patterns are summarized, including phishing transactions, account authorization requirements, NFT pending orders, fake function name scams, and risky address transactions. For each of these risk patterns, three transactions are randomly generated as seeds.

[0056] 3) Extract all UI elements of a given wallet extension, identify data entry points (e.g., transfer recipient address input, ENS name address input, etc.), and obtain all possible user request patterns (e.g., request to resolve ENS name, request to search for token information using token name, etc.). Each data entry has type restrictions, and by sensing the data type requirements, it generates possible user requests as seeds.

[0057] (2) Modify the content and format of the generated seed. All modified data will be used as external requests to the wallet extension. Specifically, for the simulator seed, its content is changed to deliberately make it fail on the real blockchain. The seeds for the security alert system are various signature requests, and the format is mutated. For requests embedded in transactions, the "0x" prefix of the transaction input data is removed or the case of the letters in the input data is changed. For requests in the message format, its data type is changed. For the wallet user interface seed, both the content and format are mutated. The user interface can directly receive input from the user, and the external requests are encoded as signature requests and user interactions. For message signature requests, the order of the specified parameters in the message is changed, random text or blanks are injected into the human-readable message field, and the strings in the message are randomly modified. For user interaction requests, special ENS names are selected, corresponding to names that have been updated or registered on multiple blockchain networks. The strings of ENS names and token names are randomly truncated or appended. It is important to note that the modifications to the strings do not contain any illegal symbols to ensure their validity. After mutation, the external request will be passed back to the wallet extension through its corresponding data entry.

[0058] (3) Determine whether an external request can be abused as an attack vector and further identify which components are affected. Specifically:

[0059] 1) Obtaining the dynamic execution results of the wallet extension: First, all warnings are monitored by combining static string keyword matching with dynamic behavior analysis. Each time a signature request is submitted, pop-up windows displaying keywords are captured. Another form of warning is that some extensions may directly block the submitted activity and refuse to provide subsequent services. Therefore, this embodiment also detects error messages returned from the browser console to understand the execution results of the wallet extension's security detection system for different risky transactions. Second, the presentation format of input messages is also monitored, such as JSON format or key-value highlighting. Some wallet UIs may only display partial data and hide key information (for example, in EIP-712 protocol messages, the fixed field "verfierContract" represents the contract address for verification and authorization, but this fixed field is hidden by some wallets), which can cause confusion or potential risks for users. To this end, this embodiment also identifies text fields with prompts on the page and verifies which key-value items are displayed in the submitted message. However, if no text field is present, the message is checked to see if it is displayed in JSON format. This allows us to understand the wallet's message display method and confirm whether it poses a potential risk. Third, automatically recommended content is captured.

[0060] 2) Identifying Attack Vectors: Based on the dynamic execution results of mutated external requests, this embodiment uses oracles to identify attack vectors. First, two oracles determine attack vectors for the simulator and alert system, respectively, based on the results generated by illegal transactions and risky requests. The first oracle assumes that all illegal transactions will fail during the simulation. If a transaction succeeds or the user can sign the transaction, the oracle will consider the mutated transaction an attack vector. The second oracle intuitively expects that all risky requests can trigger an extension alert. If the alert is bypassed, the oracle will consider the risky request an attack vector against the extension. Furthermore, a third oracle determines whether the ENS name resolution returned by the wallet's user interface is accurate, whether the token recommendation list contains fake tokens, and whether the transaction information displayed in the UI is complete or whether key information is hidden, thereby identifying attack vectors against the wallet's user interface.

[0061] 3) Identify affected components: Capture execution results, verify the correctness of response information, and determine whether they mislead users or even display error messages. If so, this indicates potential abuse as an attack vector. Specifically, if the attack vector's execution results are presented on the page in a way that confuses users (for example, the wallet displays an incomplete signature message, key information is hidden, etc.), the wallet user interface is an affected component, indicating a security risk to the wallet's user interface components. If the results of executed transactions are inconsistent with those in the real blockchain environment, this indicates that the simulator is being misused and is a risky component. If the security detection system in the wallet extension fails to promptly warn of publicly exposed risky transaction patterns, this indicates that the security detection system is a risky component of the wallet.

[0062] In order to better understand the above technical solution, the above technical solution will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0063] like Figure 1 As shown, the mutation-based cryptocurrency wallet security performance testing method provided by the embodiment of the present invention includes:

[0064] Step S110: Obtain user requests for the wallet simulator, security alarm system, and user interface;

[0065] This step is specifically explained to obtain user requests for the wallet simulator, security alert system, and user interface, including:

[0066] Deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate new transactions as user requests for the simulator; in addition, randomly select normal transactions from the historical transaction list of contracts of well-known decentralized projects as user requests for the simulator.

[0067] Obtaining the original request format of known and / or pre-set fraudulent transaction patterns as a user request to the security alert system;

[0068] The browser extension source code is statically analyzed. Starting from each interface event that triggers network message transmission, the code is traced back to the corresponding event handler as the user interface element; the event position is located in the element through regular matching as the data entry; the code context of the data entry is dynamically identified to obtain the data type requirements, labels and code context meaning, and the user request of the user interface is inferred from the data type requirements, labels and code context meaning. Specifically, for the user interface of a given wallet extension, the browser extension source code is statically analyzed using the Tarnish tool. Starting from each interface event that triggers network message transmission (for example, sending an ENS name resolution request), the code is traced back to the corresponding event handler (for example, onClick). Events that do not trigger system network requests (for example, using URL.openConnection) are filtered out, and other events and corresponding handlers are collected and identified as user interface elements. In the element set, the event positions such as placeholders and input boxes are located through regular matching and identified as data entries. Then, the code context of the data entry is dynamically identified to obtain the data type requirements, labels, and code context meaning, and then infer the content of the user request (for example, if the data type is a variable-length string and the previous text indicates adding a token, it can be determined that the user needs to enter the token name or address). Finally, a user request that meets the entry specifications is generated and submitted to the wallet for execution by subsequent components through these data entries.

[0069] Step S120: Modify the user request of the simulator, the security alarm system, and the user interface, and send the modified user request to the wallet for execution;

[0070] This step specifies the user-requested modifications to the simulator, safety alert system, and user interface, including:

[0071] In response to user requests for the simulator, make at least one of the following modifications:

[0072] Changing the transfer value to zero or an unacceptable number, replacing a token address with another address not held by the involved entity, or modifying verification data for cross-chain transactions;

[0073] For user requests to the security alarm system, remove prefixes in the user request and / or convert the case of letters in the user request;

[0074] For the message signing request in the user request of the user interface, the order of the set parameters in the message signing request is changed and / or the string in the message signing request is randomly modified; for the user interaction request in the user request of the user interface, the strings of the ENS name and token name are randomly truncated or appended.

[0075] Step S130: Obtain the execution result of the wallet, and determine the security of the wallet simulator, security alarm system, and user interface based on the execution result.

[0076] This step is described in detail to obtain the execution results of the wallet, including:

[0077] Identify text fields with hints on the page and / or detect error messages returned from the wallet browser and / or capture automatically recommended content.

[0078] The security of the wallet simulator, security alert system, and user interface is determined based on the execution results, including:

[0079] If the text field with the prompt on the page is inconsistent with the execution result on the real blockchain, it means that the execution logic of the transaction in the simulated environment will be disturbed, and it is determined that there is a risk to the security of the wallet simulator;

[0080] If an error message is returned from the wallet browser, it means that the security alarm system is unable to issue a timely warning about malicious transactions, and it is determined that the security of the wallet's security alarm system is at risk;

[0081] If the automatically recommended content is inconsistent with the preset display content, that is, the content automatically recommended by the wallet is incorrect, including: incorrect ENS name retrieval, displaying false token information, or hiding key information in the text field with information prompts displayed on the page, causing user confusion, it is determined that there is a risk to the security of the wallet's user interface.

[0082] After identifying wallet components with security risks, the risky components are sent to the maintenance end for component maintenance to improve the security performance of the risky components.

[0083] like Figure 2 As shown, the mutation-based cryptocurrency wallet security performance testing system provided by the embodiment of the present invention includes:

[0084] A user request acquisition module 100, for acquiring user requests for the wallet simulator, security alert system, and user interface;

[0085] Specifically, the user request acquisition module 100 includes:

[0086] The simulator user request acquisition unit is used to deploy smart contracts, design and publish transactions to obtain the difference value between the simulator and the real network environment; use the difference value as a judgment condition to generate a new transaction as the simulator's user request; in addition, normal transactions are randomly selected from the historical transaction list of contracts of well-known decentralized projects as user requests for the simulator.

[0087] a security alarm system user request acquisition unit, configured to acquire an original request format of a known and / or preset fraudulent transaction pattern as a user request for the security alarm system;

[0088] The user interface user request acquisition unit is used to perform static analysis on the browser extension source code, starting from each interface event that triggers network message transmission, and tracing back the code to the corresponding event handler as the element of the user interface; locating the event position in the element as the data entry through regular matching; dynamically identifying the code context of the data entry to obtain the data type requirements, labels and code context meaning, and inferring the user request of the user interface from the data type requirements, labels and code context meaning. Specifically, for the user interface of a given wallet extension, the Tarnish tool is used to perform static analysis on the browser extension source code, starting from each interface event that triggers network message transmission (for example, sending an ENS name resolution request), and tracing back the code to the corresponding event handler (for example, onClick). Events that do not trigger system network requests (for example, using URL.openConnection) are filtered out, and other events and corresponding handlers are collected and identified as elements of the user interface. In the element set, regular matching is used to locate the event position of placeholders, input boxes, etc., and identify them as data entries. Then, the code context of the data entry is dynamically identified to obtain the data type requirements, labels, and code context meaning, and then infer the content of the user request (for example, if the data type is a variable-length string and the previous text indicates adding a token, it can be determined that the user needs to enter the token name or address). Finally, a user request that meets the entry specifications is generated and submitted to the wallet for execution by subsequent components through these data entries.

[0089] A user request modification module 200, configured to modify user requests to the simulator, the security alarm system, and the user interface, and to send the modified user requests to the wallet for execution;

[0090] Specifically, the user request modification module 200 includes:

[0091] The simulator user request modification unit is configured to perform at least one of the following modifications in response to the simulator user request:

[0092] Changing the transfer value to zero or an unacceptable number, replacing a token address with another address not held by the involved entity, or modifying verification data for cross-chain transactions;

[0093] a security alarm system user request modification unit, configured to delete a prefix in a user request and / or convert the case of letters in the user request for the security alarm system;

[0094] The user interface user request modification unit is used to change the order of set parameters in the message signature request and / or randomly modify the character string in the message signature request for the message signature request in the user interface user request; and randomly truncate or append the character string of the ENS name and token name for the user interaction request in the user interface user request.

[0095] The user request sending unit is used to send the modified user request to the wallet for execution.

[0096] The component security performance determination module 300 is used to obtain the execution result of the wallet and determine the security of the wallet simulator, security alarm system and user interface based on the execution result.

[0097] Specifically, the component safety performance determination module 300 includes:

[0098] The execution result acquisition unit of the wallet is used to identify the text field with prompts on the page and / or detect the error message returned from the wallet browser and / or capture the automatically recommended content.

[0099] The first component, a security performance determination unit, is used to determine that if the text field with a prompt on the page is inconsistent with the execution result on the real blockchain, it means that the execution logic of the transaction in the simulated environment will be disturbed, and the security of the wallet simulator is considered to be at risk;

[0100] The second component, a security performance determination unit, is configured to detect an error message returned from the wallet browser, indicating that the security alarm system is unable to issue a timely warning for malicious transactions, and thus deeming that there is a risk to the security of the wallet's security alarm system;

[0101] The third component, the security performance judgment unit, is used to determine that if the automatically recommended content is inconsistent with the preset display content, that is, the content automatically recommended by the wallet is incorrect, including: retrieving the wrong ENS name, displaying false token information, or hiding key information in the text field with information prompts displayed on the page, causing user confusion, and determining that there is a risk to the security of the wallet's user interface.

[0102] The structure of the embodiment of the present invention is further described, which also includes:

[0103] The risk component sending module is used to send the risk components to the maintenance terminal for component maintenance after identifying wallet components with security risks, so as to improve the security performance of the risk components.

[0104] This embodiment of the present invention tests the security performance of components within cryptocurrency wallet extensions within blockchains. It first obtains request data fields from different wallet extension components and simultaneously detects data types. This covers all message signature methods, message structures, and transactions with various fraudulent patterns, enabling the most comprehensive testing of the wallet extension's security performance. It then automatically modifies the obtained request data while maintaining type sensitivity. Finally, an oracle automatically evaluates the wallet extension's execution results for different seeds, thereby uncovering security vulnerabilities within blockchain wallet components.

[0105] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0109] Any details not described in the embodiments of the present invention are well-known to those skilled in the art. Finally, it should be noted that the above embodiments are only intended to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present invention may be modified or replaced with equivalents without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or equivalents should be included in the scope of the claims of the present invention.

Claims

1. A method for testing the security performance of a cryptocurrency wallet based on mutation, characterized in that: include: User requests for wallet simulators, security alert systems, and user interfaces; Modifying user requests to the simulator, security alert system, and user interface, and sending the modified user requests to the wallet for execution; Obtaining an execution result of the wallet, and determining the security of the wallet simulator, security alarm system, and user interface based on the execution result; The user request to obtain the wallet simulator, security alert system, and user interface includes: Deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate a new transaction as a user request for the simulator; Obtaining the original request format of known and / or pre-set fraudulent transaction patterns as a user request to the security alert system; The browser extension source code is statically analyzed, starting from each interface event that triggers network message transmission, and the code is traced back to the corresponding event handler as the user interface element; the event position is located in the element through regular matching as the data entry; the code context of the data entry is dynamically identified to obtain data type requirements, labels and code context meanings, and the user request of the user interface is inferred from the data type requirements, labels and code context meanings.

2. The method for testing the security performance of a cryptocurrency wallet based on mutation according to claim 1, wherein: The modifying of user requests to the simulator, the security alarm system, and the user interface comprises: In response to a user request of the simulator, at least one of the following modifications is performed: Changing the transfer value to zero or an unacceptable number, replacing a token address with another address not held by the involved entity, or modifying verification data for cross-chain transactions; For a user request of the security alarm system, deleting a prefix in the user request and / or converting the case of letters in the user request; For the message signature request in the user request of the user interface, change the order of the set parameters in the message signature request and / or randomly modify the character string in the message signature request; for the user interaction request in the user request of the user interface, randomly truncate or append the character string of the ENS name and token name.

3. The method for testing the security performance of a cryptocurrency wallet based on mutation according to claim 1, wherein: The obtaining of the execution result of the wallet includes: Identify text fields with hints on the page and / or detect error messages returned from the wallet browser and / or capture automatically recommended content.

4. The method for testing the security performance of a cryptocurrency wallet based on mutation according to claim 3, wherein: Determining the security of the wallet simulator, security alarm system, and user interface according to the execution result includes: If the text field with the prompt on the page is inconsistent with the execution result on the real blockchain, it is determined that there is a risk to the security of the wallet simulator; If an error message is detected returned from the wallet browser, it is determined that the security of the wallet's security alert system is at risk; If the automatically recommended content is inconsistent with the preset display content, it is determined that there is a risk to the security of the wallet user interface.

5. A mutation-based cryptocurrency wallet security performance testing system, characterized in that: include: A user request acquisition module, used to obtain user requests for the wallet simulator, security alert system, and user interface; A user request modification module, configured to modify user requests to the simulator, the security alarm system, and the user interface, and send the modified user requests to the wallet for execution; a component security performance determination module, configured to obtain an execution result of the wallet and determine the security of the wallet's simulator, security alarm system, and user interface based on the execution result; The user request acquisition module includes: The simulator user request acquisition unit is used to deploy smart contracts, design and publish transactions to obtain the difference between the simulator and the real network environment; use the difference as a judgment condition to generate a new transaction as the simulator user request; a security alarm system user request acquisition unit, configured to acquire an original request format of a known and / or preset fraudulent transaction pattern as a user request for the security alarm system; The user interface user request acquisition unit is used to perform static analysis on the browser extension source code, starting from each interface event that triggers network message transmission, tracing back the code to the corresponding event handler as the user interface element; locating the event position in the element as the data entry through regular matching; dynamically identifying the code context of the data entry to obtain data type requirements, labels and code context meanings, and inferring the user request of the user interface from the data type requirements, labels and code context meanings.

6. The mutation-based cryptocurrency wallet security performance testing system according to claim 5, characterized in that: The user request modification module includes: The simulator user request modification unit is configured to perform at least one of the following modifications on the simulator user request: Changing the transfer value to zero or an unacceptable number, replacing a token address with another address not held by the involved entity, or modifying verification data for cross-chain transactions; a security alarm system user request modification unit, configured to delete a prefix in the user request and / or convert the case of letters in the user request for the security alarm system; A user interface user request modification unit, configured to change the order of parameters set in the message signature request and / or randomly modify the character string in the message signature request for a message signature request in the user interface user request; and randomly truncate or append the character string of the ENS name and token name for a user interaction request in the user interface user request; The user request sending unit is used to send the modified user request to the wallet for execution.

7. The mutation-based cryptocurrency wallet security performance testing system according to any one of claims 5-6, characterized in that: The component safety performance determination module includes: The execution result acquisition unit of the wallet is used to identify the text field with the prompt on the page and / or detect the error message returned from the wallet browser and / or capture the automatically recommended content; The first component, a security performance determination unit, is configured to determine that the security of the wallet simulator is at risk if the text field with the prompt on the page is inconsistent with the execution result on the real blockchain; A second component, a security performance determination unit, is configured to determine that there is a risk to the security of the wallet's security alarm system if an error message returned from the wallet browser is detected; The third component is a security performance determination unit, which is used to determine that there is a risk to the security of the wallet user interface if the automatically recommended content is inconsistent with the preset display content.

Images