Intelligent contract audit verification method and system based on block chain, and medium

Abstract

The invention discloses a smart contract audit verification method and system based on a block chain, and a medium. The smart contract audit verification method comprises the steps of obtaining a to-be-audited smart contract; performing static analysis on the code of the smart contract, recording security vulnerability information, and executing a first security measure according to the security vulnerability information; dynamically analyzing the running process of the smart contract, recording first abnormal information, and executing a second security measure according to the first abnormal information; generating a test case, testing the smart contract according to the test case, recording second abnormal information, and executing a third security measure according to the second abnormal information; and performing formalized verification on the attributes of the smart contract, recording performance data, and executing performance optimization measures according to the performance data. The method can reduce the attack and abuse of the smart contract, reduces the occurrence probability of contract logic errors and potential safety hazards, and can be widely applied to the technical field of block chains.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a blockchain-based smart contract audit verification method, system and medium. Background Art

[0002] Smart contracts are automated contracts based on blockchain technology, which are designed to disseminate, verify or execute contracts in an information-based manner. In previous technologies, blockchain smart contracts lacked effective security verification mechanisms, were vulnerable to attacks and abuse, and had contract logic errors and security risks. Summary of the invention

[0003] In order to solve the above technical problems, the purpose of the present invention is to provide a blockchain-based smart contract audit verification method, system and medium to improve the security of smart contracts.

[0004] To achieve the above purpose, one aspect of the embodiment of the present application proposes a blockchain-based smart contract audit verification method, comprising the following steps:

[0005] Get the smart contract to be audited;

[0006] Performing static analysis on the code of the smart contract, recording security vulnerability information, and executing a first security measure according to the security vulnerability information;

[0007] Dynamically analyzing the operation process of the smart contract, recording first abnormal information, and executing second security measures according to the first abnormal information;

[0008] Generate a test case, test the smart contract according to the test case, record the second exception information, and execute a third security measure according to the second exception information;

[0009] The properties of the smart contract are formally verified, performance data is recorded, and performance optimization measures are executed based on the performance data.

[0010] In some embodiments, the performing of static analysis on the code of the smart contract and recording security vulnerability information, and executing a first security measure according to the security vulnerability information, specifically includes:

[0011] Setting a security vulnerability detection threshold, wherein the security vulnerability detection threshold includes at least one or a combination of a complexity threshold or a pattern occurrence threshold;

[0012] Calculating the complexity of the code and counting the number of occurrences of a preset pattern;

[0013] Obtaining the security vulnerability information according to the complexity threshold, the complexity, the pattern occurrence threshold, and the number of occurrences;

[0014] A security vulnerability alert is triggered according to the security vulnerability information, and a code modification suggestion is generated to notify an administrator or developer to review the code according to the code modification suggestion.

[0015] In some embodiments, the dynamically analyzing the operation process of the smart contract, recording the first abnormal information, and executing the second security measure according to the first abnormal information specifically includes:

[0016] Setting an abnormal situation threshold, wherein the abnormal situation threshold includes at least one or a combination of a transaction failure rate threshold and an abnormal log quantity threshold;

[0017] During the operation of the smart contract, the transaction status of the smart contract is obtained, and the number of abnormal logs is counted;

[0018] Obtaining the first abnormality information according to the transaction failure rate threshold, the transaction status, the abnormal log quantity threshold, and the abnormal log quantity;

[0019] A first abnormal alarm is triggered according to the first abnormal information, and a problem repair suggestion is generated to notify an administrator to review the smart contract according to the problem repair suggestion.

[0020] In some embodiments, generating a test case specifically includes:

[0021] Determine the test rules;

[0022] The test rules are input into a preset neural network model to generate the test cases.

[0023] In some embodiments, the testing of the smart contract according to the test case, recording the second exception information, and executing the third security measure according to the second exception information specifically includes:

[0024] Set test thresholds;

[0025] Testing the smart contract through the test case to obtain a current test value;

[0026] When the current test value is greater than the test threshold, generating the second abnormal information;

[0027] A second abnormal alarm is triggered according to the second abnormal information to notify the administrator to stop executing the smart contract or implement risk mitigation measures.

[0028] In some embodiments, testing the smart contract through the test case to obtain the current test value specifically includes:

[0029] Testing the smart contract through the test case;

[0030] During the testing of the smart contract, the operation of the smart contract is monitored to obtain the corresponding contract state variables, transaction volume and user behavior;

[0031] The current test value is calculated based on the contract state variable, the transaction volume and the user behavior.

[0032] In some embodiments, the formal verification of the properties of the smart contract and recording of performance data, and the execution of performance optimization measures based on the performance data specifically include:

[0033] Setting a performance threshold, wherein the performance threshold includes at least one or a combination of an execution time threshold, a resource usage threshold, or a transaction throughput threshold;

[0034] During the execution of the smart contract, obtaining the contract execution time, resource usage and transaction log;

[0035] Obtaining the performance data according to the execution time threshold, the contract execution time, the resource usage threshold, the resource usage, the transaction throughput threshold, and the transaction log;

[0036] triggering a performance monitoring alarm based on the performance data to notify an administrator to implement performance optimization measures;

[0037] The performance optimization measures include one or a combination of resource reallocation, rate limiting or contract logic adjustment.

[0038] To achieve the above purpose, another aspect of the embodiment of the present application proposes a blockchain-based smart contract audit verification system, including:

[0039] Smart contract acquisition module, used to obtain smart contracts to be audited;

[0040] A security vulnerability detection module, used to perform static analysis on the code of the smart contract, record security vulnerability information, and execute a first security measure according to the security vulnerability information;

[0041] A real-time anomaly detection module, configured to dynamically analyze the operation process of the smart contract, record first anomaly information, and execute second security measures according to the first anomaly information;

[0042] An automated testing module, configured to generate a test case, test the smart contract according to the test case, record second exception information, and execute a third security measure according to the second exception information;

[0043] The formal verification module is used to perform formal verification on the properties of the smart contract, record performance data, and execute performance optimization measures based on the performance data.

[0044] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the blockchain-based smart contract audit and verification method as described above is implemented.

[0045] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the blockchain-based smart contract audit and verification method as described above.

[0046] The beneficial effects of the present invention are as follows: the blockchain-based smart contract audit verification method, system and medium of the present invention, by statically analyzing the code of the smart contract, and recording security vulnerability information, execute the first security measure according to the security vulnerability information, and then dynamically analyze the operation process of the smart contract, and record the first exception information, execute the second security measure according to the first exception information, then generate a test case, test the smart contract according to the test case, and record the second exception information, execute the third security measure according to the second exception information, and finally, formally verify the properties of the smart contract, and record performance data, and execute performance optimization measures according to the performance data. The present invention performs security audit and verification on smart contracts through static analysis, dynamic analysis, real-time monitoring and formal verification, which can reduce the occurrence of attacks and abuses of smart contracts and reduce the probability of contract logic errors and security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 A flowchart of a blockchain-based smart contract audit and verification method provided by an embodiment of the present invention;

[0049] Figure 2An example diagram of a static analysis process provided by an embodiment of the present invention;

[0050] Figure 3 An example diagram of a dynamic analysis process provided by an embodiment of the present invention;

[0051] Figure 4 A flow chart of steps for generating a test case provided by an embodiment of the present invention;

[0052] Figure 5 A flowchart of steps for obtaining a current test value provided by an embodiment of the present invention;

[0053] Figure 6 An example diagram of a real-time monitoring process provided by an embodiment of the present invention;

[0054] Figure 7 An example diagram of a process for formal verification provided by an embodiment of the present invention;

[0055] Figure 8 A flowchart of a blockchain-based smart contract audit and verification method provided by an embodiment of the present invention;

[0056] Fig. 9 A schematic diagram of the structure of a blockchain-based smart contract audit and verification system provided by an embodiment of the present invention;

[0057] Fig.10 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0059] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0060] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0061] Smart contracts are automated contracts based on blockchain technology, which are designed to disseminate, verify or execute contracts in an information-based manner. In previous technologies, blockchain smart contracts lacked effective security verification mechanisms, were vulnerable to attacks and abuse, and had contract logic errors and security risks.

[0062] To this end, an embodiment of the present invention proposes a smart contract audit verification method based on blockchain, which performs static analysis on the code of the smart contract, records security vulnerability information, executes a first security measure based on the security vulnerability information, and then dynamically analyzes the operation process of the smart contract, records the first exception information, and executes a second security measure based on the first exception information. Then, a test case is generated, the smart contract is tested according to the test case, and the second exception information is recorded, and the third security measure is executed according to the second exception information. Finally, the properties of the smart contract are formally verified, and performance data is recorded, and performance optimization measures are executed based on the performance data. The present invention performs security audit and verification on smart contracts through static analysis, dynamic analysis, real-time monitoring and formal verification, which can reduce the occurrence of attacks and abuses of smart contracts, and reduce the probability of contract logic errors and security risks. The smart contract audit verification method can be applied to fields such as finance, supply chain management and digital identity management, but is not limited to this.

[0063] Reference Figure 1 , Figure 1 A flowchart of a smart contract audit verification method based on blockchain provided by an embodiment of the present invention. An embodiment of the present invention proposes a smart contract audit verification method based on blockchain, which includes steps S101 to S105:

[0064] S101. Obtain the smart contract to be audited;

[0065] S102, statically analyzing the code of the smart contract, recording security vulnerability information, and executing the first security measure according to the security vulnerability information;

[0066] Specifically, program analysis techniques are used to perform static analysis and inspection on the code of smart contracts to identify and fix potential security vulnerabilities and logical errors in smart contracts.

[0067] As an optional implementation, the code of the smart contract is statically analyzed, and security vulnerability information is recorded. The step of executing the first security measure according to the security vulnerability information can be further divided into the following steps S1021 to S1024:

[0068] S1021. Setting a security vulnerability detection threshold, where the security vulnerability detection threshold includes at least one or a combination of a complexity threshold and a pattern occurrence threshold;

[0069] In some optional embodiments, the security vulnerability detection threshold is a preset standard or limit for determining whether there is a security risk in the smart contract code. It may include complexity thresholds, pattern occurrence thresholds, code quality thresholds and other determination criteria, which may be selected and set according to actual needs.

[0070] Exemplarily, the security vulnerability detection threshold may include one or a combination of a complexity threshold or a pattern occurrence threshold. The complexity threshold is used to set the maximum complexity of the code, for example, to set the cyclomatic complexity of the contract to be less than a specific value (such as 15, 20, etc.). The pattern occurrence threshold is used to set the maximum allowed number of occurrences (such as 2 times, 3 times, etc.) of a known security vulnerability pattern (i.e., a preset pattern). The security vulnerability pattern may be privilege escalation, such as allowing non-privileged users to perform privileged operations through improper privilege management; overflow / underflow, such as overflow / underflow is not considered in integer operations, resulting in unexpected fund losses or contract status errors; timestamp dependency, such as relying on block timestamps for key logic judgments, thereby being attacked due to attackers manipulating timestamps.

[0071] S1022, calculating the complexity of the code, and counting the number of occurrences of the preset pattern;

[0072] In some optional embodiments, static analysis tools such as SonarQube or Slither may be used to calculate the complexity of the code and detect the number of occurrences of a preset pattern in the code through regular expressions or specific rule sets.

[0073] Among them, SonarQube is an open source static code analysis platform designed to help developers effectively manage code quality. It can perform functions such as defect and vulnerability detection, complexity analysis, and code coverage analysis on the code; Slither is a static analysis framework for the Solidity language, mainly used for code analysis of smart contracts. It can perform automatic vulnerability detection, automatic optimization detection, code understanding, and assisted code review on the code.

[0074] S1023, obtaining security vulnerability information according to the complexity threshold, complexity, pattern occurrence threshold, and occurrence count;

[0075] S1024. A security vulnerability alert is triggered based on the security vulnerability information, and a code modification suggestion is generated to notify an administrator or developer to review the code based on the code modification suggestion.

[0076] For example, Figure 2 The figure shows an example flow chart of static analysis. When the calculated code complexity is less than or equal to the complexity threshold, or the statistical number of occurrences of the preset pattern is less than or equal to the pattern occurrence threshold, the code complexity or pattern usage is determined to be within a safe range, and no additional measures are taken. When the calculated code complexity is greater than the complexity threshold, or the statistical number of occurrences of the preset pattern is greater than the pattern occurrence threshold, the detailed information of the vulnerability, including location, type, potential impact, etc., is recorded to obtain security vulnerability information, and code modification suggestions are generated based on the security vulnerability information. The first abnormal alert can then be sent through a visualization platform, email, or text message to notify the code developer or administrator to review the code.

[0077] S103, dynamically analyzing the operation process of the smart contract, recording the first abnormal information, and executing the second security measure according to the first abnormal information;

[0078] Specifically, during the deployment and operation of smart contracts, by dynamically analyzing the behavior of the contract, abnormal conditions can be discovered and responded to in a timely manner, thereby maintaining the security of the smart contract.

[0079] As an optional implementation, the operation process of the smart contract is dynamically analyzed, and the first abnormal information is recorded. The step of executing the second security measure according to the first abnormal information can be further divided into the following steps S1031 to S1034:

[0080] S1031. Setting an abnormal situation threshold, where the abnormal situation threshold includes at least one or a combination of a transaction failure rate threshold and an abnormal log quantity threshold;

[0081] In some optional embodiments, the abnormal situation threshold is a boundary value used to determine whether an abnormal situation occurs during the execution of a transaction or contract. It may include judgment criteria such as a transaction failure rate threshold, an abnormal log quantity threshold, and a transaction delay time threshold, which can be selected and set according to actual needs.

[0082] Exemplarily, the abnormal situation threshold may include one or a combination of a transaction failure rate threshold or an abnormal log quantity threshold. The transaction failure rate threshold is used to set a reasonable upper limit of the transaction failure rate. For example, within a specific time period (such as one day, one week, or one month, etc.), the proportion of transaction failures is set to a certain percentage (such as 5%, 8%, etc.). The abnormal log quantity threshold is used to determine the upper limit (such as 3, 5, etc.) of the number of abnormal logs allowed to be generated within a specific time period (such as one day, one week, or one month, etc.).

[0083] S1032. During the operation of the smart contract, obtain the transaction status of the smart contract and count the number of abnormal logs;

[0084] In some optional embodiments, the status of contract transactions, including successful and failed transactions, can be obtained in real time through blockchain network monitoring tools or APIs, and the transaction failure rate can be counted. At the same time, the logging service provided by the logging framework or blockchain platform can be used to capture abnormal logs generated during the contract execution in real time, and the number of abnormal logs can be counted.

[0085] S1033, obtaining first abnormality information according to the transaction failure rate threshold, the transaction status, the abnormal log quantity threshold, and the abnormal log quantity;

[0086] S1034. Trigger a first abnormal alarm according to the first abnormal information, and generate a problem repair suggestion to notify the administrator to review the smart contract according to the problem repair suggestion.

[0087] In some optional embodiments, such as Figure 3 The figure shows an example flow chart of dynamic analysis. When the statistical transaction failure rate is less than or equal to the transaction failure rate threshold, or the statistical number of exception logs is less than or equal to the exception log number threshold, the abnormal situation is determined to be within an acceptable range, and the abnormal data is recorded but no additional measures are taken. When the statistical transaction failure rate is greater than the transaction failure rate threshold, or the statistical number of exception logs is greater than the exception log number threshold, the basic abnormal data, the environment and context in which the abnormality occurred, etc. are recorded to obtain the first abnormal information, and a problem repair suggestion is generated based on the first abnormal information. Then, the first abnormal alert can be sent through a visualization platform, email, or text message, etc., to notify the administrator to review the code for further investigation.

[0088] S104, generating a test case, testing the smart contract according to the test case, recording the second abnormal information, and executing the third security measure according to the second abnormal information;

[0089] Specifically, smart contracts are tested through test cases, and key operations during contract execution are tracked and recorded so that a quick response can be made when anomalies are found.

[0090] Reference Figure 4 , Figure 4 A flowchart of steps for generating a test case provided in an embodiment of the present invention, further as an optional implementation manner, the step of generating a test case can be further divided into the following steps S1041 and S1042:

[0091] S1041. Determine test rules;

[0092] S1042. Input the test rules into the preset neural network model to generate test cases.

[0093] Specifically, the intelligent generation capability of the neural network model can be used to automatically generate test cases. First, the functions and characteristics of the smart contract to be audited are analyzed, and then the specific scenarios that need to be tested are listed according to the functions of the smart contract, and the test coverage target is set to cover the critical paths and edge cases. Then, the specific test scenarios and coverage targets are converted into a preliminary framework of test rules and test cases, and then input into the neural network model to automatically generate test cases. Finally, the generated test cases are screened and gradually optimized for subsequent smart contract testing. The neural network model can adopt neural network models such as large language models, reinforcement learning models, and natural semantic processing models, but is not limited to them.

[0094] As an optional implementation, the smart contract is tested according to the test case, and the second exception information is recorded. The step of executing the third security measure according to the second exception information can be further divided into the following steps S1043 to S1046:

[0095] S1043, setting a test threshold;

[0096] In some optional embodiments, the test threshold is a limit value used to determine whether abnormalities occur in key operations during the execution of a smart contract. It may include a contract state quantity change threshold, a maximum transaction limit, a daily transaction volume threshold, a user behavior threshold, etc., which can be selected and set specifically according to the business logic and security requirements of the smart contract.

[0097] For example, if the contract involves fund transfer, the test threshold may be the maximum allowed transaction limit, daily transaction volume threshold, etc.; it may also be the maximum change threshold of the contract balance, the maximum transfer threshold of contract ownership, the threshold of the number of abnormal interactions between the user and the smart contract, etc.

[0098] S1044. Test the smart contract through the test case to obtain the current test value;

[0099] Reference Figure 5 , Figure 5 A flowchart of steps for obtaining the current test value provided in an embodiment of the present invention is further provided. As an optional implementation, the step of testing the smart contract through a test case to obtain the current test value can be further divided into the following steps S10441 to S10443:

[0100] S10441. Test smart contracts through test cases;

[0101] S10442. During the testing of the smart contract, monitor the operation of the smart contract to obtain the corresponding contract state variables, transaction volume, and user behavior;

[0102] S10443. Calculate the current test value based on the contract status variables, transaction volume, and user behavior.

[0103] Specifically, the key operations in the smart contract testing process are tracked and recorded continuously, and the real-time changes of the internal state variables of the smart contract, such as contract balance, contract ownership, contract lock-up period, etc., are monitored to identify whether the internal state variables of the smart contract conform to the business logic and expected behavior; the transaction volume, transaction amount, transaction frequency and counterparty involved in the contract are monitored to identify whether there are potential abnormal transaction patterns; the interaction between users and smart contracts, such as function calls, parameter passing and return results, are tracked and recorded to identify whether there are potential security vulnerabilities or malicious behavior.

[0104] S1045. When the current test value is greater than the test threshold, generate second abnormal information;

[0105] S1046. Triggering a second abnormal alarm according to the second abnormal information to notify the administrator to stop executing the smart contract or implement risk mitigation measures;

[0106] For example, Figure 6The figure shows an example of a real-time monitoring process. When the current test value is less than or equal to the test threshold, the contract is judged to be executed normally and the contract logic continues to be executed. When the current test value is greater than the test threshold, such as the maximum transaction amount in a specific time period is greater than the maximum transaction limit, the daily transaction volume is greater than the daily transaction volume threshold, the change value of the contract balance is greater than the maximum change threshold of the contract balance in a short period of time, and the number of abnormal interactions between the user and the smart contract is greater than the set threshold, it is judged that there is a risk or abnormality in the smart contract, and the time, location, cause and possible solutions of the abnormality are recorded in the monitoring log to obtain the second abnormality information. Then, according to the second abnormal information and risk assessment, the second abnormal alarm is triggered to notify the administrator to suspend the execution of the contract or implement risk mitigation measures, such as limiting the transaction amount, freezing the account or triggering the emergency response process.

[0107] S105. Perform formal verification on the properties of the smart contract, record performance data, and execute performance optimization measures based on the performance data.

[0108] Specifically, mathematical models are used to prove the properties of smart contracts, such as immutability, security, and compliance, to ensure that smart contracts meet specific performance and security requirements during execution.

[0109] As an optional implementation method, formal verification is performed on the properties of the smart contract, and performance data is recorded. The step of performing performance optimization measures according to the performance data can be further divided into the following steps S1051 to S1054:

[0110] S1051. Setting a performance threshold, where the performance threshold includes at least one or a combination of an execution time threshold, a resource usage threshold, or a transaction throughput threshold;

[0111] In some optional embodiments, the performance threshold is a boundary value used to determine whether a smart contract has performance problems or resource abuse. It may include an execution time threshold, a resource usage threshold (such as memory and CPU usage), a transaction throughput threshold, and a data accuracy threshold, etc., which can be selected and set specifically according to the application scenario and security policy of the smart contract.

[0112] Exemplarily, the performance threshold may include one or a combination of an execution time threshold, a resource usage threshold, or a transaction throughput threshold. The execution time threshold is used to determine the speed and efficiency of contract execution, such as setting the contract execution time to 30 minutes, one hour, etc.; the resource usage threshold is used to determine whether the system is overloaded, such as setting the memory usage threshold to 70%, 85%, etc.; the transaction throughput threshold is used to determine whether the contract execution is stable and reliable, to ensure that the system can still maintain stable performance during peak hours, which needs to be set according to hardware resources, external environment, etc.

[0113] S1052. During the execution of the smart contract, obtain the contract execution time, resource usage, and transaction log;

[0114] Specifically, the contract execution status can be monitored in real time and data collected through integrated sensors, log recorders and other tools. The collected data includes contract execution time, resource usage and transaction logs.

[0115] S1053. Obtain performance data according to the execution time threshold, the contract execution time, the resource usage threshold, the resource usage, the transaction throughput threshold, and the transaction log;

[0116] S1054. triggering a performance monitoring alarm according to the performance data to notify an administrator to implement performance optimization measures;

[0117] Among them, performance optimization measures include one or a combination of resource reallocation, rate limiting or contract logic adjustment.

[0118] For example, Figure 7 The figure shows an example of the process of formal verification. When the obtained contract execution time is less than or equal to the execution time threshold, or the resource usage is less than or equal to the resource usage threshold, or the transaction throughput determined according to the transaction log is less than or equal to the transaction throughput threshold, the contract performance is judged to be in line with expectations and the contract logic continues to be executed; when the obtained contract execution time is greater than the execution time threshold, or the resource usage is greater than the resource usage threshold, or the transaction throughput determined according to the transaction log is greater than the transaction throughput threshold, it is judged that the smart contract may have performance problems or resource abuse, and performance data is collected and recorded. Then, performance monitoring alarms are triggered based on performance data, and administrators are notified to implement performance optimization measures, such as reallocating resources, executing rate limits, or dynamically adjusting contract logic.

[0119] In summary, the processing flow of the blockchain-based smart contract audit verification method of the embodiment of the present invention is as follows: Figure 8 As shown:

[0120] The first step is to perform static analysis on the code of the smart contract to be audited, record security vulnerability information, provide code modification suggestions, and notify the administrator or developer to review the code;

[0121] The second step is to dynamically analyze the operation process of the smart contract to be audited, record the first abnormal information, provide problem repair suggestions, and notify the administrator to review the smart contract;

[0122] The third step is to generate test cases, test and monitor the smart contract in real time according to the test cases, and record the second abnormal information to notify the administrator to stop executing the smart contract or implement risk mitigation measures;

[0123] The fourth step is to formally verify the properties of the smart contract, record performance data, and notify the administrator to implement performance optimization measures.

[0124] In order to better understand the solution of the embodiment of the present invention, the smart contract audit verification method provided by the embodiment of the present application is explained below through several specific application examples.

[0125] The smart contract audit and verification method is deployed on the smart contract audit and verification platform, which includes a user interface, a contract analysis engine, a monitoring module, a database and a report generator. The user interface is used to provide an interface for users to interact with the system, including contract uploading, audit request submission, etc.; the contract analysis engine is responsible for performing static and dynamic analysis and generating analysis reports; the monitoring module is used to monitor the execution status of the smart contract in real time and record key operation logs; the database is used to store smart contract code, analysis reports, monitoring logs and other data; the report generator is used to generate detailed audit reports based on the analysis and monitoring results.

[0126] Example 1: Security check before contract deployment

[0127] The user uploads the smart contract code through the user interface. The contract analysis engine performs static analysis on the uploaded contract code to find security vulnerabilities, and then displays the analysis results to the user through the user interface, pointing out potential security issues. The user corrects the contract code based on the analysis report and resubmits it for review.

[0128] Example 2: Real-time monitoring of contract execution

[0129] After the smart contract is deployed on the blockchain, the monitoring module begins to monitor the behavior of the contract in real time. Once it is found that the contract execution deviates from the predetermined logic or abnormal operation occurs, the platform will record the log and trigger an alarm. After receiving the alarm, the platform administrator will analyze the abnormal situation and take corresponding measures.

[0130] Example 3: Automated testing and formal verification

[0131] The platform automatically generates test cases, conducts comprehensive testing of smart contracts, and uses mathematical models to prove the security and compliance properties of the contracts. It then records the test and verification results and generates detailed reports for users and administrators to refer to.

[0132] Example 4: Audit Reporting and Continuous Monitoring

[0133] The platform regularly conducts security audits on smart contracts and generates audit reports, which include the contract's security score, potential risks, and improvement suggestions. Users can optimize contracts based on audit reports to improve their security and performance. The platform continuously monitors the operating status of contracts to ensure long-term contract security.

[0134] The above is a description of the blockchain-based smart contract audit and verification method of the embodiment of the present invention. It can be recognized that compared with the smart contract audit and verification method in the prior art, the embodiment of the present invention performs security audit and verification on smart contracts through static analysis, dynamic analysis, real-time monitoring and formal verification, which can reduce the occurrence of smart contracts being attacked and abused, reduce the probability of contract logic errors and security risks, and further improve the security of smart contracts through the dual protection mechanism of audit and verification.

[0135] Reference Fig. 9 The embodiment of the present invention also provides a blockchain-based smart contract audit verification system, including:

[0136] Smart contract acquisition module, used to obtain smart contracts to be audited;

[0137] The security vulnerability detection module is used to perform static analysis on the code of the smart contract, record the security vulnerability information, and execute the first security measure according to the security vulnerability information;

[0138] A real-time anomaly detection module, used to dynamically analyze the operation process of the smart contract, record the first anomaly information, and execute the second security measure according to the first anomaly information;

[0139] An automated testing module, used to generate test cases, test the smart contract according to the test cases, record the second abnormal information, and execute the third security measure according to the second abnormal information;

[0140] The formal verification module is used to formally verify the properties of the smart contract, record performance data, and perform performance optimization measures based on the performance data.

[0141] The contents of the above-mentioned blockchain-based smart contract audit and verification method embodiment are all applicable to the present blockchain-based smart contract audit and verification system embodiment. The functions specifically implemented by the present blockchain-based smart contract audit and verification system embodiment are the same as those of the above-mentioned blockchain-based smart contract audit and verification method embodiment, and the beneficial effects achieved are also the same as those achieved by the above-mentioned blockchain-based smart contract audit and verification method embodiment.

[0142] The embodiment of the present invention also provides an electronic device, which includes: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and when the program is executed by the processor, the above-mentioned blockchain-based smart contract audit verification method is realized. The electronic device can be any smart terminal including a tablet computer, a car computer, etc.

[0143] like Fig.10 FIG. 1 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Fig.10 , an embodiment of the present invention provides an electronic device, including:

[0144] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0145] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the blockchain-based smart contract audit verification method of the embodiment of the present invention;

[0146] Input / output interface 1003, used to implement information input and output;

[0147] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0148] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0149] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0150] An embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned blockchain-based smart contract audit and verification method.

[0151] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0152] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0153] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0154] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0155] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0156] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0157] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0158] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0159] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0160] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0161] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A blockchain-based smart contract audit verification method, characterized in that: The following steps are involved: Get the smart contract to be audited; Performing static analysis on the code of the smart contract, recording security vulnerability information, and executing a first security measure according to the security vulnerability information; Dynamically analyzing the operation process of the smart contract, recording first abnormal information, and executing second security measures according to the first abnormal information; Generate a test case, test the smart contract according to the test case, record the second exception information, and execute a third security measure according to the second exception information; The properties of the smart contract are formally verified, performance data is recorded, and performance optimization measures are executed based on the performance data.

2. According to the blockchain-based smart contract audit verification method of claim 1, it is characterized in that: The performing static analysis on the code of the smart contract, recording security vulnerability information, and executing the first security measure according to the security vulnerability information specifically includes: Setting a security vulnerability detection threshold, wherein the security vulnerability detection threshold includes at least one or a combination of a complexity threshold or a pattern occurrence threshold; Calculating the complexity of the code and counting the number of occurrences of a preset pattern; Obtaining the security vulnerability information according to the complexity threshold, the complexity, the pattern occurrence threshold, and the number of occurrences; A security vulnerability alert is triggered according to the security vulnerability information, and a code modification suggestion is generated to notify an administrator or developer to review the code according to the code modification suggestion.

3. According to a blockchain-based smart contract audit verification method according to claim 1, it is characterized in that: The dynamically analyzing the operation process of the smart contract, recording the first abnormal information, and executing the second security measure according to the first abnormal information specifically includes: Setting an abnormal situation threshold, wherein the abnormal situation threshold includes at least one or a combination of a transaction failure rate threshold and an abnormal log quantity threshold; During the operation of the smart contract, the transaction status of the smart contract is obtained, and the number of abnormal logs is counted; Obtaining the first abnormality information according to the transaction failure rate threshold, the transaction status, the abnormal log quantity threshold, and the abnormal log quantity; A first abnormal alarm is triggered according to the first abnormal information, and a problem repair suggestion is generated to notify an administrator to review the smart contract according to the problem repair suggestion.

4. According to a blockchain-based smart contract audit verification method according to claim 1, it is characterized in that: The generating of test cases specifically includes: Determine the test rules; The test rules are input into a preset neural network model to generate the test cases.

5. According to a blockchain-based smart contract audit verification method according to claim 1, it is characterized in that: The testing of the smart contract according to the test case, recording the second abnormal information, and executing the third security measure according to the second abnormal information specifically includes: Set test thresholds; Testing the smart contract through the test case to obtain a current test value; When the current test value is greater than the test threshold, generating the second abnormal information; A second abnormal alarm is triggered according to the second abnormal information to notify the administrator to stop executing the smart contract or implement risk mitigation measures.

6. According to claim 5, a blockchain-based smart contract audit verification method is characterized in that: The testing of the smart contract through the test case to obtain the current test value specifically includes: Testing the smart contract through the test case; During the testing of the smart contract, the operation of the smart contract is monitored to obtain the corresponding contract state variables, transaction volume and user behavior; The current test value is calculated based on the contract state variable, the transaction volume and the user behavior.

7. According to a blockchain-based smart contract audit verification method according to claim 1, it is characterized in that: The formal verification of the properties of the smart contract and recording of performance data, and execution of performance optimization measures according to the performance data, specifically includes: Setting a performance threshold, wherein the performance threshold includes at least one or a combination of an execution time threshold, a resource usage threshold, or a transaction throughput threshold; During the execution of the smart contract, obtaining the contract execution time, resource usage and transaction log; Obtaining the performance data according to the execution time threshold, the contract execution time, the resource usage threshold, the resource usage, the transaction throughput threshold, and the transaction log; triggering a performance monitoring alarm based on the performance data to notify an administrator to implement performance optimization measures; The performance optimization measures include one or a combination of resource reallocation, rate limiting or contract logic adjustment.

8. A blockchain-based smart contract audit and verification system, characterized in that: include: Smart contract acquisition module, used to obtain smart contracts to be audited; A security vulnerability detection module, used to perform static analysis on the code of the smart contract, record security vulnerability information, and execute a first security measure according to the security vulnerability information; A real-time anomaly detection module, configured to dynamically analyze the operation process of the smart contract, record first anomaly information, and execute second security measures according to the first anomaly information; An automated testing module, configured to generate a test case, test the smart contract according to the test case, record second exception information, and execute a third security measure according to the second exception information; The formal verification module is used to perform formal verification on the properties of the smart contract, record performance data, and execute performance optimization measures based on the performance data.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the blockchain-based smart contract audit and verification method as described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the blockchain-based smart contract audit and verification method as described in any one of claims 1 to 7.

Images