A blockchain-based smart contract audit verification method, system and medium

Abstract

The application discloses a kind of based on blockchain smart contract audit verification method, system and medium, and smart contract audit verification method includes: obtaining the smart contract to be audited;The code of smart contract is statically analyzed, and security vulnerability information is recorded, and first security measure is executed according to security vulnerability information;The running process of smart contract is dynamically analyzed, and first exception information is recorded, and second security measure is executed according to first exception information;Test case is generated, and smart contract is tested according to test case, and second exception information is recorded, and third security measure is executed according to second exception information;The attribute of smart contract is formalized verification, and performance data is recorded, and performance optimization measure is executed according to performance data.The application can reduce the occurrence of smart contract attack and abuse, reduce the probability of contract logic error and security risk, and can be widely applied in the field of blockchain technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain, in particular to a smart contract audit verification method and system based on blockchain and a medium. BACKGROUND

[0002] A smart contract is an automated contract based on blockchain technology, aiming to disseminate, verify or execute contracts in an information-based manner. In previous technologies, blockchain smart contracts lack effective security verification mechanisms, are vulnerable to attacks and misuse, and have contract logic errors and security risks. SUMMARY

[0003] To solve the above technical problems, the purpose of the present application is to provide a smart contract audit verification method and system based on blockchain and a medium to improve the security of smart contracts.

[0004] To achieve the above purpose, one aspect of the embodiments of the present application provides a smart contract audit verification method based on blockchain, comprising the following steps:

[0005] Obtain a smart contract to be audited;

[0006] Perform static analysis on the code of the smart contract and record security vulnerability information, and execute first security measures according to the security vulnerability information;

[0007] Perform dynamic analysis on the running process of the smart contract and record first exception information, and execute second security measures according to the first exception information;

[0008] Generate test cases, test the smart contract according to the test cases, and record second exception information, and execute third security measures according to the second exception information;

[0009] Perform formal verification on the properties of the smart contract and record performance data, and execute performance optimization measures according to the performance data.

[0010] In some embodiments, the static analysis of the code of the smart contract and the recording of the security vulnerability information, and the execution of the first security measures according to the security vulnerability information specifically include:

[0011] Set a security vulnerability detection threshold, which includes at least one or a combination of a complexity threshold or a pattern occurrence threshold;

[0012] Calculate the complexity of the code and count the number of occurrences of a preset pattern;

[0013] According to the complexity threshold, the complexity, the pattern occurrence threshold and the number of occurrences, the security vulnerability information is obtained;

[0014] trigger a security vulnerability alert according to the security vulnerability information, and generate a code modification suggestion to notify an administrator or a developer to review the code according to the code modification suggestion.

[0015] In some embodiments, the running process of the smart contract is dynamically analyzed, and first exception information is recorded, and a second security measure is executed according to the first exception information, specifically including:

[0016] An exception condition threshold is set, and the exception condition threshold includes at least one or a combination of a transaction failure rate threshold or an abnormal log quantity threshold;

[0017] During the running process of the smart contract, a transaction state of the smart contract is obtained, and an abnormal log quantity is counted;

[0018] The first exception information is obtained according to the transaction failure rate threshold, the transaction state, the abnormal log quantity threshold, and the abnormal log quantity;

[0019] A first exception alert is triggered according to the first exception information, and a problem repair suggestion is generated to notify an administrator to review the smart contract according to the problem repair suggestion.

[0020] In some embodiments, the test case is generated, specifically including:

[0021] A test rule is determined;

[0022] The test rule is input into a preset neural network model to generate the test case.

[0023] In some embodiments, the smart contract is tested according to the test case, and second exception information is recorded, and a third security measure is executed according to the second exception information, specifically including:

[0024] A test threshold is set;

[0025] The smart contract is tested through the test case to obtain a current test value;

[0026] When the current test value is greater than the test threshold, the second exception information is generated;

[0027] A second exception alert is triggered according to the second exception information to notify an administrator to stop executing the smart contract or to implement a risk mitigation measure.

[0028] In some embodiments, the smart contract is tested through the test case to obtain a current test value, specifically including:

[0029] test the smart contract through the test case;

[0030] In the process of testing the smart contract, the operation of the smart contract is monitored to obtain corresponding contract state variables, transaction volume and user behavior;

[0031] According to the contract state variables, the transaction volume and the user behavior, the current test value is calculated.

[0032] In some embodiments, the properties of the smart contract are formally verified, and performance data is recorded, and performance optimization measures are performed according to the performance data, specifically including:

[0033] Set performance threshold, the performance threshold includes at least one or combination of execution time threshold, resource usage threshold or transaction throughput threshold;

[0034] In the process of executing the smart contract, the contract execution time, resource usage and transaction log are obtained;

[0035] According to the execution time threshold, the contract execution time, the resource usage threshold, the resource usage, the transaction throughput threshold and the transaction log, the performance data is obtained;

[0036] According to the performance data, trigger performance monitoring alarm to notify administrator to implement performance optimization measures;

[0037] The performance optimization measures include one or combination of resource reallocation, rate limiting or contract logic adjustment.

[0038] To achieve the above purpose, another aspect of the embodiment of the present application proposes a smart contract audit verification system based on block chain, comprising:

[0039] The smart contract acquisition module is used for acquiring the smart contract to be audited;

[0040] The security vulnerability detection module is used for static analysis of the code of the smart contract, and records security vulnerability information, and performs first security measures according to the security vulnerability information;

[0041] The real-time exception detection module is used for dynamic analysis of the running process of the smart contract, and records first exception information, and performs second security measures according to the first exception information;

[0042] The automatic test module is used for generating test cases, testing the smart contract according to the test cases, and recording second exception information, and performing third security measures according to the second exception information;

[0043] A formal verification module is configured to perform formal verification on properties of the smart contract, record performance data, and perform performance optimization measures according to the performance data.

[0044] To achieve the above object, another aspect of the embodiment of the present application provides an electronic device, which comprises a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection communication between the processor and the memory, and the program is executed by the processor to realize the smart contract auditing and verification method based on a blockchain as described above.

[0045] To achieve the above object, another aspect of the embodiment of the present application provides a storage medium, which is a computer-readable storage medium for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs are executable by one or more processors to realize the smart contract auditing and verification method based on a blockchain as described above.

[0046] The smart contract auditing and verification method, system and medium based on a blockchain have the following beneficial effects: the smart contract auditing and verification method, system and medium based on a blockchain perform static analysis on the code of a smart contract, record security vulnerability information, perform a first security measure according to the security vulnerability information, perform dynamic analysis on the running process of the smart contract, record first abnormal information, perform a second security measure according to the first abnormal information, generate a test case, test the smart contract according to the test case, record second abnormal information, perform a third security measure according to the second abnormal information, perform formal verification on the properties of the smart contract, record performance data, and perform a performance optimization measure according to the performance data. The smart contract auditing and verification method, system and medium based on a blockchain perform security auditing and verification on the smart contract through static analysis, dynamic analysis, real-time monitoring and formal verification, can reduce the occurrence of attacks and misuse of the smart contract, and reduce the probability of occurrence of contract logic errors and security risks. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following introduces the drawings needed to be used in the embodiments of the present application. It should be understood that the drawings introduced below are only for facilitating clear description of some embodiments in the technical solutions of the present application, and other drawings can be obtained by those skilled in the art without any creative labor on the basis of these drawings.

[0048] Figure 1 A step flow chart of the smart contract auditing and verification method based on a blockchain provided by the embodiments of the present application is shown in the following figure.

[0049] Figure 2A flowchart example diagram of static analysis provided for the embodiment of the present application;

[0050] Figure 3 A flowchart example diagram of dynamic analysis provided for the embodiment of the present application;

[0051] Figure 4 A step flowchart of test case generation provided for the embodiment of the present application;

[0052] Figure 5 A step flowchart of current test value acquisition provided for the embodiment of the present application;

[0053] Figure 6 A flowchart example diagram of real-time monitoring provided for the embodiment of the present application;

[0054] Figure 7 A flowchart example diagram of formal verification provided for the embodiment of the present application;

[0055] Figure 8 A flowchart of the smart contract audit verification method based on the blockchain provided for the embodiment of the present application;

[0056] Figure 9 A structural schematic diagram of the smart contract audit verification system based on the blockchain provided for the embodiment of the present application;

[0057] Figure 10 A hardware structural schematic diagram of an electronic device provided for the embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. When the following description relates to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application, but are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0059] It can be understood that the terms "first", "second", and the like used in the present application can be used herein to describe various concepts, but unless specifically stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to determining".

[0060] The terms "at least one", "multiple", "each", "any" and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0061] The smart contract is an automatic contract based on blockchain technology, which aims to spread, verify or execute the contract in an informationized way. The blockchain smart contract in the prior art lacks effective security verification mechanism, which is vulnerable to attacks and abuse, and has contract logic errors and security risks.

[0062] To this end, the embodiments of the present application provide a blockchain-based smart contract audit verification method. By performing static analysis on the code of the smart contract and recording security vulnerability information, a first security measure is performed according to the security vulnerability information, and then the running process of the smart contract is dynamically analyzed and first exception information is recorded, and a second security measure is performed according to the first exception information. Next, a test case is generated, the smart contract is tested according to the test case, and second exception information is recorded, and a third security measure is performed according to the second exception information. Finally, the properties of the smart contract are formally verified, and performance data is recorded, and performance optimization measures are performed according to the performance data. The present application can reduce the occurrence of attacks and abuse of smart contracts, and reduce the probability of occurrence of contract logic errors and security risks. The smart contract audit verification method can be applied to the fields of finance, supply chain management and digital identity management, but is not limited thereto.

[0063] Reference Figure 1 , Figure 1 A step flowchart of the blockchain-based smart contract audit verification method provided by the embodiments of the present application is provided. The embodiments of the present application provide a blockchain-based smart contract audit verification method, which includes steps S101-S105:

[0064] S101, obtaining a smart contract to be audited;

[0065] S102, performing static analysis on the code of the smart contract and recording security vulnerability information, and performing a first security measure according to the security vulnerability information;

[0066] Specifically, the code of the smart contract is statically analyzed and checked using program analysis techniques to identify and fix potential security vulnerabilities and logical errors in the smart contract.

[0067] Further as an optional implementation, the step of performing static analysis on the code of the smart contract and recording security vulnerability information, and performing a first security measure according to the security vulnerability information can be further divided into the following steps S1021 to S1024:

[0068] S1021, setting a security vulnerability detection threshold, the security vulnerability detection threshold including at least one or a combination of a complexity threshold or a pattern occurrence threshold;

[0069] In some optional embodiments, the security vulnerability detection threshold is a preset standard or limit for determining whether the smart contract code has security risks, which can include complexity threshold, pattern occurrence threshold, code quality threshold, etc. determination criteria, which can be selected and set according to actual needs.

[0070] For example, the security vulnerability detection threshold can include one or a combination of a complexity threshold or a pattern occurrence threshold, the complexity threshold is used to set the maximum complexity of the code, for example, the cyclomatic complexity of the contract is set to be less than a certain value (such as 15, 20, etc.). The pattern occurrence threshold is used to set the maximum allowed number of occurrences (such as 2 times, 3 times, etc.) of known security vulnerability patterns (i.e. preset patterns), which can be privilege escalation, such as allowing non-privileged users to perform privileged operations through improper privilege management; overflow / underflow, such as not considering overflow / underflow in integer operations, resulting in unexpected financial loss or contract state error; timestamp dependency, such as relying on block timestamp for critical logic judgment, which can be attacked by attackers manipulating the timestamp.

[0071] S1022, calculating the complexity of the code and counting the number of occurrences of the preset pattern;

[0072] In some optional embodiments, the complexity of the code can be calculated using static analysis tools such as SonarQube or Slither, and the number of occurrences of the preset pattern in the code can be detected by regular expressions or specific rule sets.

[0073] Among them, SonarQube is an open source static code analysis platform designed to help developers effectively manage code quality. It can perform functions such as defect and vulnerability detection, complexity analysis, and code coverage analysis on the code; Slither is a static analysis framework for the Solidity language, mainly used for code analysis of smart contracts. It can perform automatic vulnerability detection, automatic optimization detection, code understanding, and assisted code review on the code.

[0074] S1023. Obtain security vulnerability information based on the complexity threshold, complexity, pattern occurrence threshold, and number of occurrences;

[0075] S1024. A security vulnerability alert is triggered based on the security vulnerability information, and a code modification suggestion is generated to notify an administrator or developer to review the code based on the code modification suggestion.

[0076] For example, Figure 2 The figure shows an example process diagram of static analysis. When the calculated code complexity is less than or equal to the complexity threshold, or the number of occurrences of the preset pattern is less than or equal to the pattern occurrence threshold, the code complexity or pattern usage is determined to be within a safe range and no additional measures are taken; when the calculated code complexity is greater than the complexity threshold, or the number of occurrences of the preset pattern is greater than the pattern occurrence threshold, the detailed information of the vulnerability is recorded, including location, type, potential impact, etc., to obtain security vulnerability information, and generate code modification suggestions based on the security vulnerability information. The first abnormality alert can then be sent through a visualization platform, email, or text message to notify the code developer or administrator to review the code.

[0077] S103. Dynamically analyze the operation process of the smart contract, record the first abnormal information, and execute the second security measure based on the first abnormal information;

[0078] Specifically, during the deployment and operation of smart contracts, by dynamically analyzing the behavior of the contract, abnormal conditions can be discovered and responded to in a timely manner, thereby maintaining the security of the smart contract.

[0079] As an optional implementation, the operation process of the smart contract is dynamically analyzed, the first abnormal information is recorded, and the second security measure is executed according to the first abnormal information. This step can be further divided into the following steps S1031 to S1034:

[0080] S1031. Setting an abnormality threshold, where the abnormality threshold includes at least one or a combination of a transaction failure rate threshold and an abnormal log quantity threshold;

[0081] In some optional embodiments, the abnormal situation threshold is a limit value for determining whether an abnormal situation occurs in the transaction or contract execution process, which can include a transaction failure rate threshold, an abnormal log quantity threshold, a transaction delay time threshold, and the like, which can be selected and set according to actual needs.

[0082] For example, the abnormal situation threshold can include one or a combination of a transaction failure rate threshold or an abnormal log quantity threshold. The transaction failure rate threshold is used to set a reasonable upper limit of the transaction failure rate, for example, the proportion of transaction failures is set to a certain percentage (such as 5%, 8%, etc.) within a certain period of time (such as a day, a week, or a month, etc.). The abnormal log quantity threshold is used to determine the upper limit of the number of abnormal logs allowed to be generated within a certain period of time (such as a day, a week, or a month, etc.) (such as 3, 5, etc.).

[0083] S1032, obtaining the transaction state of the smart contract during the running of the smart contract, and counting the number of abnormal logs;

[0084] In some optional embodiments, the state of the contract transaction can be obtained in real time through a blockchain network monitoring tool or API, including successful and failed transactions, and then the transaction failure rate can be counted. At the same time, the abnormal logs generated during the execution of the contract can be captured in real time using a log recording framework or a log service provided by a blockchain platform, and the number of abnormal logs can be counted.

[0085] S1033, obtaining first abnormal information according to the transaction failure rate threshold, the transaction state, the abnormal log quantity threshold, and the number of abnormal logs;

[0086] S1034, triggering a first abnormal alarm according to the first abnormal information, and generating a problem repair suggestion to notify an administrator to review the smart contract according to the problem repair suggestion.

[0087] In some optional embodiments, as Figure 3 As shown in the flowchart of dynamic analysis, when the counted transaction failure rate is less than or equal to the transaction failure rate threshold, or the counted number of abnormal logs is less than or equal to the abnormal log quantity threshold, it is determined that the abnormal situation is within an acceptable range, and abnormal data is recorded but no additional measures are taken; when the counted transaction failure rate is greater than the transaction failure rate threshold, or the counted number of abnormal logs is greater than the abnormal log quantity threshold, basic abnormal data, the environment, context, and the like of the abnormal occurrence are recorded to obtain first abnormal information, and a problem repair suggestion is generated according to the first abnormal information, and then a first abnormal alarm can be sent through a visual platform, an email, or a short message, etc. to notify an administrator to review the code for further investigation.

[0088] S104, generate a test case, test the smart contract according to the test case, record second exception information, and execute third security measures according to the second exception information;

[0089] Specifically, the smart contract is tested by the test case, and the key operations in the contract execution process are tracked and recorded, so as to respond quickly when an exception is found.

[0090] Referring to Figure 4 , Figure 4 A step flowchart for generating a test case according to an embodiment of the present application is provided, and as a further optional implementation, the step of generating a test case can be further divided into steps S1041 and S1042:

[0091] S1041, determine a test rule;

[0092] S1042, input the test rule into a preset neural network model to generate a test case.

[0093] Specifically, the intelligent generation capability of the neural network model can be used to automatically generate test cases. First, the functions and characteristics of the smart contract to be audited are analyzed, and then the specific scenarios to be tested are listed according to the functions of the smart contract, and the test coverage target is set to cover the critical path and edge cases. Then, the specific test scenarios and coverage targets are converted into test rules and preliminary frameworks of test cases, and then input into the neural network model to automatically generate test cases. Finally, the generated test cases are screened and gradually optimized for subsequent smart contract testing. The neural network model can be a large language model, a reinforcement learning model, a natural semantic processing model, etc., but is not limited thereto.

[0094] As a further optional implementation, the step of testing the smart contract according to the test case and recording the second exception information, and executing the third security measures according to the second exception information can be further divided into steps S1043 to S1046:

[0095] S1043, set a test threshold;

[0096] In some optional embodiments, the test threshold is a limit value for judging whether the key operation in the smart contract execution process is abnormal, which can include a contract state quantity change threshold, a maximum transaction limit, a daily transaction volume threshold, a user behavior threshold, etc. The specific can be selected and set according to the business logic and security requirements of the smart contract.

[0097] Exemplarily, if the contract involves fund transfer, the test threshold can be the maximum transaction limit allowed, the daily transaction volume threshold, etc.; it can also be the maximum change threshold of the contract balance, the maximum transfer threshold of the contract ownership, the threshold of the number of abnormal interaction behaviors of the user with the smart contract, etc.

[0098] S1044, testing the smart contract through the test case to obtain a current test value;

[0099] Referring to Figure 5 , Figure 5 A step flowchart of the current test value provided by the embodiment of the present application is further provided as an optional implementation, and the step of testing the smart contract through the test case to obtain a current test value can be further divided into the following steps S10441 to S10443:

[0100] S10441, testing the smart contract through the test case;

[0101] S10442, monitoring the smart contract during the testing of the smart contract to obtain corresponding contract state variables, transaction volumes, and user behaviors;

[0102] S10443, calculating the current test value according to the contract state variables, the transaction volumes, and the user behaviors.

[0103] Specifically, the key operations in the process of testing the smart contract are tracked and recorded without interruption, the real-time changes of the internal state variables of the smart contract are monitored, such as the contract balance, the contract ownership, the contract lock-up period, etc., to identify whether the internal state variables of the smart contract conform to the business logic and the expected behaviors; the transaction volumes, transaction amounts, transaction frequencies, and transaction counterparties involved in the contract are monitored to identify whether there is a potential abnormal transaction pattern; the interaction behaviors of the user with the smart contract, such as function calls, parameter passing, and return results, are tracked and recorded to identify whether there is a potential security vulnerability or malicious behavior.

[0104] S1045, generating a second abnormal information when the current test value is greater than the test threshold;

[0105] S1046, triggering a second abnormal alarm according to the second abnormal information to notify an administrator to stop executing the smart contract or to implement a risk mitigation measure;

[0106] Exemplarily, as Figure 6The flowchart shown is an example of real-time monitoring. When the obtained current test value is less than or equal to the test threshold value, it is determined that the contract is executing normally, and the contract logic is continued to be executed. When the obtained current test value is greater than the test threshold value, such as when the maximum transaction amount in a specific time period is greater than the maximum transaction limit, the daily transaction volume is greater than the daily transaction volume threshold, the change value of the contract balance in a short time is greater than the maximum change threshold of the contract balance, and the number of abnormal interaction behaviors of the user with the smart contract is greater than the set threshold, it is determined that the smart contract has risks or abnormalities. The time, location, cause and possible solution of the abnormality are recorded in the monitoring log to obtain second abnormal information. Then, a second abnormal alarm is triggered according to the second abnormal information and risk assessment, and the administrator is notified to suspend the execution of the contract or implement risk mitigation measures, such as limiting transaction amount, freezing account or triggering emergency response process, etc.

[0107] S105, formal verification of the properties of the smart contract is performed, and performance data is recorded. Performance optimization measures are performed according to the performance data.

[0108] Specifically, a mathematical model is used to prove the properties of the smart contract, such as invariance, security and compliance, so as to ensure that the smart contract meets specific performance and security requirements during execution.

[0109] Further as an optional implementation, the step of formal verification of the properties of the smart contract and recording of performance data, and performance optimization measures performed according to the performance data can be further divided into the following steps S1051 to S1054:

[0110] S1051, a performance threshold value is set, which includes at least one or a combination of an execution time threshold value, a resource usage threshold value or a transaction throughput threshold value;

[0111] In some optional embodiments, the performance threshold value is a limit value for judging whether the smart contract has performance problems or resource abuse, which can include an execution time threshold value, a resource usage threshold value (such as memory, CPU usage), a transaction throughput threshold value and a data accuracy rate threshold value, etc. The specific selection and setting can be made according to the application scenario and security policy of the smart contract.

[0112] For example, the performance threshold value can include one or a combination of an execution time threshold value, a resource usage threshold value or a transaction throughput threshold value. The execution time threshold value is used to determine the speed and efficiency of contract execution, for example, the contract execution time is set to be, for example, 30 minutes, one hour, etc. The resource usage threshold value is used to determine whether the system is overloaded, for example, the memory usage threshold value is set to be 70%, 85%, etc. The transaction throughput threshold value is used to determine whether the contract execution is stable and reliable to ensure that the system can still maintain stable performance during peak periods, which needs to be set according to hardware resources, external environment, etc.

[0113] S1052, during the execution of the smart contract, obtaining contract execution time, resource usage, and transaction log;

[0114] Specifically, the contract execution state can be monitored and data collected in real time by integrating sensors, loggers, and other tools. The collected data includes contract execution time, resource usage, and transaction log.

[0115] S1053, according to the execution time threshold, contract execution time, resource usage threshold, resource usage, transaction throughput threshold, and transaction log, obtaining performance data;

[0116] S1054, triggering a performance monitoring alarm according to the performance data to notify the administrator to implement performance optimization measures;

[0117] The performance optimization measures include one or a combination of resource reallocation, rate limiting, or contract logic adjustment.

[0118] Exemplarily, as Figure 7 The flowchart of formal verification is shown in the figure. When the obtained contract execution time is less than or equal to the execution time threshold, or the resource usage is less than or equal to the resource usage threshold, or the transaction throughput determined according to the transaction log is less than or equal to the transaction throughput threshold, it is determined that the contract performance meets the expectation, and the contract logic is continued. When the obtained contract execution time is greater than the execution time threshold, or the resource usage is greater than the resource usage threshold, or the transaction throughput determined according to the transaction log is greater than the transaction throughput threshold, it is determined that the smart contract may have performance problems or resource abuse, and the performance data is collected and recorded. Further, according to the performance data, a performance monitoring alarm is triggered to notify the administrator to implement performance optimization measures, such as reallocating resources, performing rate limiting, or dynamically adjusting contract logic.

[0119] In summary, the processing flow of the smart contract audit verification method based on the blockchain of the embodiment of the present application is shown in Figure 8

[0120] The first step is to perform static analysis on the code of the smart contract to be audited, record security vulnerability information, and provide code modification suggestion to notify the administrator or developer to review the code;

[0121] The second step is to perform dynamic analysis on the running process of the smart contract to be audited, record the first exception information, and provide problem repair suggestion to notify the administrator to review the smart contract;

[0122] The third step is to generate test cases, test and monitor the smart contract according to the test cases, record the second exception information, and notify the administrator to stop executing the smart contract or implement risk mitigation measures; ​

[0123] Fourthly, the properties of the smart contract are formally verified, performance data is recorded, and the administrator is notified to implement performance optimization measures.

[0124] To better understand the scheme of the embodiments of the application, the smart contract audit and verification method provided by the embodiments of the application is described below through several specific application examples.

[0125] The smart contract audit and verification method is deployed on a smart contract audit and verification platform, which includes a user interface, a contract analysis engine, a monitoring module, a database, and a report generator. The user interface is used to provide an interface for user interaction with the system, including contract uploading and audit request submission. The contract analysis engine is responsible for performing static and dynamic analysis and generating analysis reports. The monitoring module is used to monitor the execution status of the smart contract in real time and record key operation logs. The database is used to store smart contract code, analysis reports, monitoring logs, and other data. The report generator is used to generate detailed audit reports based on analysis and monitoring results.

[0126] Embodiment 1: Security check before contract deployment

[0127] The user uploads the smart contract code through the user interface, the contract analysis engine performs static analysis on the uploaded contract code to find security vulnerabilities, and then displays the analysis results to the user through the user interface, pointing out potential security problems. The user modifies the contract code according to the analysis report and resubmits it for review.

[0128] Embodiment 2: Real-time monitoring of contract runtime

[0129] After the smart contract is deployed on the blockchain, the monitoring module begins to monitor the contract's behavior in real time. Once it finds that the contract execution deviates from the predetermined logic or abnormal operations occur, the platform will record the log and trigger an alarm. After receiving the alarm, the platform administrator analyzes the abnormal situation and takes appropriate measures.

[0130] Embodiment 3: Automated testing and formal verification

[0131] The platform automatically generates test cases for comprehensive testing of the smart contract and uses mathematical models to prove the security and compliance properties of the contract. Then, it records the testing and verification results and generates detailed reports for users and administrators to refer to.

[0132] Embodiment 4: Audit report and continuous monitoring

[0133] The platform periodically performs security audits on the smart contract and generates an audit report, which includes the contract's security score, potential risks, and improvement suggestions. Users can optimize the contract based on the audit report to improve its security and performance. The platform continuously monitors the contract's running status to ensure long-term contract security.

[0134] The above describes the blockchain-based smart contract auditing and verification method of the embodiments of the present application. It can be realized that, compared with the smart contract auditing and verification method in the prior art, the embodiments of the present application can reduce the occurrence of smart contract attacks and abuses, reduce the probability of contract logic errors and security risks, and further improve the security of smart contracts through the dual security mechanisms of auditing and verification, by means of static analysis, dynamic analysis, real-time monitoring, and formal verification.

[0135] With reference to Figure 9 The embodiments of the present application also provide a blockchain-based smart contract auditing and verification system, comprising:

[0136] A smart contract acquisition module is configured to acquire a smart contract to be audited.

[0137] A security vulnerability detection module is configured to perform static analysis on the code of the smart contract, record security vulnerability information, and execute a first security measure according to the security vulnerability information.

[0138] A real-time anomaly detection module is configured to perform dynamic analysis on the running process of the smart contract, record first anomaly information, and execute a second security measure according to the first anomaly information.

[0139] An automated testing module is configured to generate a test case, test the smart contract according to the test case, record second anomaly information, and execute a third security measure according to the second anomaly information.

[0140] A formal verification module is configured to perform formal verification on the properties of the smart contract, record performance data, and execute a performance optimization measure according to the performance data.

[0141] The contents of the above blockchain-based smart contract auditing and verification method embodiments are applicable to the present blockchain-based smart contract auditing and verification system embodiment. The blockchain-based smart contract auditing and verification system embodiment specifically realizes the same functions as the above blockchain-based smart contract auditing and verification method embodiments, and achieves the same beneficial effects as the above blockchain-based smart contract auditing and verification method embodiments.

[0142] The embodiments of the present application also provide an electronic device, which comprises a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing the connection and communication between the processor and the memory. The program is executed by the processor to realize the above blockchain-based smart contract auditing and verification method. The electronic device can be any smart terminal, such as a tablet computer or a vehicle-mounted computer.

[0143] As Figure 10 Fig. 1 shows a schematic diagram of a hardware structure of an electronic device according to an embodiment of the present application. As shown in Figure 10 The electronic device according to an embodiment of the present application comprises:

[0144] The processor 1001 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is configured to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0145] The memory 1002 can be implemented by a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory), and the like. The memory 1002 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 1002 and are called and executed by the processor 1001 to implement the method for auditing and verifying a smart contract based on a block chain.

[0146] The input / output interface 1003 is configured to realize information input and output.

[0147] The communication interface 1004 is configured to realize the communication interaction between the device and other devices. The communication can be realized by a wired manner (for example, a USB, a network cable, or the like) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, or the like).

[0148] The bus 1005 is configured to transmit information between the components (for example, the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004) of the device.

[0149] The processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004 are connected to each other through the bus 1005 to realize the communication connection between them in the device.

[0150] The embodiments of the present application further provide a storage medium. The storage medium is a computer readable storage medium, and is configured to store computer readable information. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for auditing and verifying a smart contract based on a block chain.

[0151] Memory, as used in the specification, includes both volatile and nonvolatile memory, and can include but is not limited to removable memory and non-removable memory such as RAM, ROM, EEPROM, flash memory or other memory technology. Memory can also include remote storage devices that are not physically located on the processor, such as a remote memory device that is in communication with the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0152] The embodiments of the present application further disclose a computer program product or computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to perform the method shown in the embodiments of the present application. Figure 1 The embodiments of the present application further disclose a computer program product or computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device can read the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to perform the method shown in the embodiments of the present application.

[0153] In some alternative embodiments, the functions / operations mentioned in the block diagrams can not occur in the order mentioned in the operation diagrams. For example, two blocks shown in succession can actually be executed substantially concurrently with each other, or the blocks can sometimes be executed in reverse order, depending on the functionality / operations involved. Furthermore, the embodiments presented and described in the flowcharts of the present application are only examples of implementations. The processes disclosed are not necessarily limited to the orders and sequences presented and described in this specification. Alternative embodiments are possible, where the sequences of various operations are changed and where sub-operations described as part of a larger operation are independently executed.

[0154] Furthermore, although the present application is described in the context of functional modules, it is to be understood that one or more of the functions and / or features described above can be integrated in a single physical device and / or software module, or one or more functions and / or features can be implemented in separate physical devices or software modules, unless otherwise specified. It is also to be understood that detailed discussion of the actual implementation of each module is unnecessary to an understanding of the present application. Rather, the actual implementation is to be understood in the context of the attributes, functions and internal relationships of the various functional modules disclosed herein, which would be understood by one of ordinary skill in the art considering the present disclosure. Thus, the present application is not limited to the specific embodiments described herein, but only by the scope of the appended claims, and their equivalents.

[0155] If the above functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or parts of the technical solutions that essentially contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described above in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0156] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a list of executable instructions for implementing logic functions, which can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus or device, such as a computer-based system, a system including a processor or other system that can fetch the instructions from the instruction execution system, apparatus or device and execute the instructions, or in conjunction with these instructions execution systems, apparatus or devices. For the purpose of this specification, the "computer-readable medium" can be any device that can contain, store, communicate, propagate or transport programs for use by or in connection with an instruction execution system, apparatus or device, or in conjunction with these instruction execution systems, apparatus or devices.

[0157] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection having one or more wires (electrical devices), a portable computer diskette (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium can even be paper or other suitable medium on which the aforementioned programs can be printed, because the aforementioned programs can be obtained electronically, for example, by optical scanning of the paper or other medium, followed by editing, interpreting or otherwise processing, if necessary, in other suitable ways, to be stored in the computer memory.

[0158] It should be understood that various parts of the present application can be implemented in hardware, software, firmware or a combination thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following technologies, known in the art, or their equivalents, can be employed for implementation: discrete logic circuitry having logic gates for implementing logic functions upon data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0159] In the above description of the present specification, the description of the terms "one embodiment", "another embodiment", or "certain embodiments" or the like means that the specific features, structures, materials or characteristics described in connection with the embodiments or examples are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0160] Although the embodiments of the present application have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made thereto without departing from the principles and spirit of the present application, the scope of which is defined by the claims and their equivalents.

[0161] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the embodiments, and those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present application, and these equivalent modifications or substitutions are included in the scope defined by the claims of the present application.

Claims

1. A blockchain-based smart contract audit verification method, characterized in that, The method comprises the following steps: obtaining a smart contract to be audited; performing static analysis on the code of the smart contract and recording security vulnerability information, and performing a first security measure according to the security vulnerability information; performing dynamic analysis on the running process of the smart contract and recording first exception information, and performing a second security measure according to the first exception information; generating test cases, testing the smart contract according to the test cases, recording second exception information, and performing a third security measure according to the second exception information; performing formal verification on the properties of the smart contract and recording performance data, and performing performance optimization measures according to the performance data; The static analysis of the code of the smart contract and the recording of the security vulnerability information, and the first security measure according to the security vulnerability information, specifically include: setting a security vulnerability detection threshold, the security vulnerability detection threshold including at least one or a combination of a complexity threshold or a pattern occurrence threshold; calculating the complexity of the code and counting the number of occurrences of a preset pattern; obtaining the security vulnerability information according to the complexity threshold, the complexity, the pattern occurrence threshold, and the number of occurrences; triggering a security vulnerability alert according to the security vulnerability information, and generating a code modification suggestion to notify an administrator or a developer to review the code according to the code modification suggestion; The dynamic analysis of the running process of the smart contract and the recording of the first exception information, and the second security measure according to the first exception information, specifically include: setting an exception condition threshold, the exception condition threshold including at least one or a combination of a transaction failure rate threshold or an abnormal log quantity threshold; obtaining the transaction status of the smart contract during the running process of the smart contract and counting the number of abnormal logs; obtaining the first exception information according to the transaction failure rate threshold, the transaction status, the abnormal log quantity threshold, and the number of abnormal logs; triggering a first exception alert according to the first exception information, and generating a problem repair suggestion to notify an administrator to review the smart contract according to the problem repair suggestion; The testing of the smart contract according to the test cases, the recording of the second exception information, and the third security measure according to the second exception information, specifically include: setting a test threshold; testing the smart contract through the test cases to obtain a current test value; generating the second exception information when the current test value is greater than the test threshold; triggering a second exception alert according to the second exception information to notify an administrator to stop executing the smart contract or implement a risk mitigation measure. 2.The method of claim 1, wherein, The generation of test cases specifically includes: determining a test rule; inputting the test rule into a preset neural network model to generate the test cases.

3. The blockchain-based smart contract audit and verification method according to claim 1, characterized in that: The testing of the smart contract through the test cases to obtain a current test value specifically includes: testing the smart contract through the test cases; In the process of testing the smart contract, the smart contract is monitored to obtain corresponding contract state variables, transaction volume and user behavior; According to the contract state variables, the transaction volume and the user behavior, the current test value is calculated. 4.The method of claim 1, wherein, The properties of the smart contract are formally verified, and performance data is recorded, and performance optimization measures are performed according to the performance data, specifically including: Set performance threshold, the performance threshold includes at least one or a combination of execution time threshold, resource usage threshold or transaction throughput threshold; In the execution process of the smart contract, the contract execution time, resource usage and transaction log are obtained; According to the execution time threshold, the contract execution time, the resource usage threshold, the resource usage, the transaction throughput threshold and the transaction log, the performance data is obtained; According to the performance data, trigger performance monitoring alarm to notify administrator to implement performance optimization measures; Wherein, the performance optimization measures include one or a combination of resource reallocation, rate limiting or contract logic adjustment. 5.A blockchain-based smart contract audit verification system, characterized in that, Including: The smart contract acquisition module is used for acquiring the smart contract to be audited; The security vulnerability detection module is used for static analysis of the code of the smart contract, and records security vulnerability information, and performs the first security measure according to the security vulnerability information; The real-time exception detection module is used for dynamic analysis of the running process of the smart contract, and records the first exception information, and performs the second security measure according to the first exception information; The automatic test module is used for generating test cases, testing the smart contract according to the test cases, and recording the second exception information, and performing the third security measure according to the second exception information; The formal verification module is used for formal verification of the properties of the smart contract, and records performance data, and performs performance optimization measures according to the performance data; The code of the smart contract is statically analyzed, and the security vulnerability information is recorded, and the first security measure is performed according to the security vulnerability information, specifically including: Set security vulnerability detection threshold, the security vulnerability detection threshold includes at least one or a combination of complexity threshold or pattern occurrence threshold; The complexity of the code is calculated, and the occurrence number of the preset pattern is counted; According to the complexity threshold, the complexity, the pattern occurrence threshold and the occurrence number, the security vulnerability information is obtained; According to the security vulnerability information, trigger security vulnerability alarm, and generate code modification suggestion, to notify administrator or developer to review the code according to the code modification suggestion; The running process of the smart contract is dynamically analyzed, and the first exception information is recorded, and the second security measure is performed according to the first exception information, specifically including: Set exception condition threshold, the exception condition threshold includes at least one or a combination of transaction failure rate threshold or abnormal log quantity threshold; In the running process of the smart contract, the transaction state of the smart contract is obtained, and the number of abnormal logs is counted; According to the transaction failure rate threshold, the transaction state, the abnormal log quantity threshold, and the abnormal log quantity, the first abnormal information is obtained; According to the first abnormal information, a first abnormal alarm is triggered, and a problem repair suggestion is generated to notify an administrator to review the smart contract according to the problem repair suggestion; The smart contract is tested according to the test case, and second abnormal information is recorded, and a third security measure is executed according to the second abnormal information, specifically comprising: Setting a test threshold; The smart contract is tested by the test case to obtain a current test value; When the current test value is greater than the test threshold, the second abnormal information is generated; According to the second abnormal information, a second abnormal alarm is triggered to notify an administrator to stop executing the smart contract or implement a risk mitigation measure.

6. An electronic device, comprising: The electronic device includes a memory, a processor, a program stored on the memory and executable on the processor, and a data bus for realizing connection communication between the processor and the memory, and the program is executed by the processor to realize the steps of the smart contract auditing and verifying method based on the blockchain in any one of claims 1 to 4.

7. A storage medium, the storage medium being a computer-readable storage medium for computer-readable storage, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to realize the steps of the smart contract auditing and verifying method based on the blockchain in any one of claims 1 to 4.

Images