Intelligent contract static analysis method and device

Abstract

The embodiment of the invention discloses an intelligent static contract analysis method and device, and the method comprises the steps: analyzing a source code of an intelligent contract into a unified abstract syntax tree, and carrying out the static analysis based on the unified abstract syntax tree, thereby achieving the unified conversion and wide compatibility of various intelligent contract languages. Besides, the method allows a user to develop a self-defined static analysis strategy for nodes of a unified abstract syntax number according to specific requirements, so that variables can be positioned and tracked more accurately, and the requirements of the user for refinement and flexibility of detection rules are met. The intelligent contract static analysis device disclosed by the embodiment of the specification also has the above beneficial effects.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for static analysis of smart contracts. Background Art

[0002] Currently, there are a variety of analysis tools for analyzing potential vulnerabilities and code quality issues in smart contracts. However, most of these analysis tools build their core analysis capabilities around a single or a few smart contract programming languages, which means that for each new smart contract language that emerges, the analysis solution needs to be rebuilt, and the technical implementation cost is high. In addition, these analysis tools do not support rule customization, making it difficult to meet users' needs for refined and flexible detection rules, and also limiting the scope of supported detection vulnerabilities. Summary of the invention

[0003] One or more embodiments of the present specification provide a smart contract static analysis method and device that can be applied to the analysis needs of multi-language smart contracts. At the same time, it provides the function of user-defined configuration of scanning and analysis rules to meet the user's needs for refinement and flexibility of detection rules.

[0004] In the first aspect, a smart contract static analysis method is provided, comprising:

[0005] Get the target smart contract;

[0006] Performing syntax analysis on the target smart contract to generate a unified abstract syntax tree of the target smart contract;

[0007] According to the user's custom operation, a static analysis strategy is matched for the target node of the unified abstract syntax tree;

[0008] According to the unified abstract syntax tree, the target smart contract is simulated and executed, and when the simulation execution reaches the target node, the static analysis strategy of the target node is called to perform static analysis on the target smart contract.

[0009] As an optional implementation manner of the method of the first aspect, performing syntax analysis on the target smart contract to generate a unified abstract syntax tree of the target smart contract specifically includes:

[0010] Obtain an abstract syntax tree constructed according to the programming language type of the target smart contract;

[0011] The abstract syntax tree is converted into the unified abstract syntax tree.

[0012] As an optional implementation of the method of the first aspect, according to a user's custom operation, matching a static analysis strategy for a target node of the unified abstract syntax tree specifically includes:

[0013] According to the user's customized operation, determine the rule injection point and configure the static analysis strategy for the rule injection point;

[0014] The rule injection point is associated and matched with a target node of the unified abstract syntax tree.

[0015] Specifically, the method further includes:

[0016] After configuring a static analysis strategy for the rule injection point, the rule injection point is constructed as an API interface.

[0017] Specifically, according to the unified abstract syntax tree, the target smart contract is simulated and executed, and when the simulation execution reaches the target node, the static analysis strategy of the target node is called to perform static analysis on the target smart contract, specifically including:

[0018] When the simulation is executed to the target node, the rule injection point is called, the static analysis strategy of the rule injection point is injected into the thread of simulation execution, and the static analysis strategy is executed.

[0019] As an optional implementation manner of the method of the first aspect, simulating the execution of the target smart contract according to the unified abstract syntax tree specifically includes:

[0020] Based on the user's selection operation, all or part of the target smart contract is simulated and executed according to the unified abstract syntax tree.

[0021] In a second aspect, a smart contract static analysis device is provided, comprising:

[0022] A data acquisition module, configured to acquire a target smart contract;

[0023] A contract normalization module, configured to perform syntax analysis on the target smart contract and generate a unified abstract syntax tree of the target smart contract;

[0024] A rule customization module, configured to match a static analysis strategy for a target node of the unified abstract syntax tree according to a user's customized operation;

[0025] The analysis module is configured to simulate the execution of the target smart contract according to the unified abstract syntax tree, and when the simulation execution reaches the target node, call the static analysis strategy of the target node to perform static analysis on the target smart contract.

[0026] As an optional implementation of the device described in the second aspect, the contract normalization module is specifically used to obtain an abstract syntax tree constructed according to the programming language type of the target smart contract; and convert the abstract syntax tree into the unified abstract syntax tree.

[0027] As an optional implementation of the device described in the second aspect, the rule customization module is specifically used to determine the rule injection point according to the user's customized operation, and configure the static analysis strategy for the rule injection point; and associate and match the rule injection point with the target node of the unified abstract syntax tree.

[0028] Specifically, the rule customization module is further used to construct the rule injection point as an API interface after configuring a static analysis strategy for the rule injection point.

[0029] Specifically, the analysis module is specifically used to call the rule injection point when the simulation is executed to the target node, inject the static analysis strategy of the rule injection point into the thread of simulation execution, and execute the static analysis strategy.

[0030] As an optional implementation manner of the device described in the second aspect, the analysis module is specifically used to simulate the execution of all or part of the target smart contract based on the user's selection operation and according to the unified abstract syntax tree.

[0031] In a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the above-mentioned smart contract static analysis method.

[0032] In a fourth aspect, an electronic device is provided, including:

[0033] One or more processors; and a memory associated with the one or more processors, the memory being used to store program instructions, which, when read and executed by the one or more processors, enable the electronic device to execute the above-mentioned smart contract static analysis method.

[0034] The beneficial effect of the static contract intelligent analysis method described in one or more embodiments of this specification is that the method parses the source code of the smart contract into a unified abstract syntax tree (UAST), and performs static analysis based on the unified abstract syntax tree (UAST), thereby achieving unified conversion and wide compatibility of multiple smart contract languages. In addition, the method allows users to develop custom static analysis strategies for nodes of the unified abstract syntax tree according to specific needs, so that variables can be more accurately located and tracked, and meet the user's needs for refinement and flexibility of detection rules. The smart contract static analysis device described in the embodiments of this specification also has the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 A flowchart of a smart contract static analysis method provided for one or more embodiments of this specification.

[0037] Figure 2 A schematic diagram of a unified abstract syntax tree generation process provided for one or more embodiments of this specification.

[0038] Figure 3 A schematic diagram of the structure of a static contract intelligent analysis device provided in one or more embodiments of this specification.

[0039] Figure 4 A schematic diagram of the structure of an electronic device provided in one or more embodiments of this specification. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0041] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0042] Those skilled in the art will appreciate that the terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms of "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0043] As an important part of blockchain technology, smart contracts play a vital role in decentralized applications and smart contract platforms (such as Ethereum). However, due to the immutability of smart contracts, their security and reliability issues have gradually become a difficulty in the industry. Frequently emerging smart contract vulnerabilities not only lead to serious economic losses and data leaks, but also affect the operation of the entire blockchain network.

[0044] In order to effectively identify and fix potential vulnerabilities and code quality issues in smart contracts, a variety of analysis tools have emerged in the industry. These analysis tools can use static analysis, taint analysis and other technologies to conduct in-depth analysis and inspection of the source code or bytecode of smart contracts, discover potential vulnerabilities and code quality issues in smart contracts, and ensure the security and reliability of smart contracts.

[0045] However, smart contracts can be written in a variety of programming languages, such as Solidity, Vyper (Ethereum), Move (Libra), Rust, Go, etc. Although this diversity enriches the choices of developers, it also makes it difficult for static analysis tools designed for a single language to meet the needs of a multi-language environment. Many existing static analysis tools often only support a few specific languages, which means that when developers write smart contracts in different languages, they need to rely on different analysis tools, which brings additional learning costs and complexity. At the same time, for common static analysis tools on the market, each time a new language is supported, its analysis engine needs to be redeveloped or modified, which requires a lot of technical resources and funds, increasing the difficulty of technical implementation and development costs.

[0046] In addition, although some analysis tools provide vulnerability detection and code quality analysis functions, they do not support rule customization, such as Oyente, or have limited rule customization capabilities, such as SmartCheck, Securify, Mythril, and MythX. This makes it difficult for users to meet the needs of refined and flexible detection rules, and also limits the scope of supported detection vulnerabilities.

[0047] Therefore, the industry is in urgent need of a unified multi-language static analysis solution. In view of this, one or more embodiments of this specification propose a smart contract static analysis method and device, which can be applied to the analysis needs of multi-language smart contracts, and at the same time, provide users with the function of customizing the configuration of scanning and analysis rules to meet the user's needs for refinement and flexibility of detection rules.

[0048] The following will further describe in detail the smart contract static analysis method and device described in one or more embodiments of this specification in conjunction with the drawings and specific embodiments of the specification, but this detailed description does not constitute a limitation on the embodiments of this specification.

[0049] First, the technical terms involved in the embodiments of this specification are explained.

[0050] Static analysis: refers to a type of technology that infers program behavior by analyzing program code and its related resources (such as configuration files, documents, etc.) without running the program. Static analysis mainly relies on the analysis of code structure, control flow, and data flow to identify potential programming errors, security vulnerabilities, performance bottlenecks, and code quality issues. Static analysis tools are usually used in the compilation phase to provide instant feedback to help developers find and fix problems at an early stage. Its wide applications include type checking, code review, security analysis, complexity measurement, and optimization suggestions.

[0051] Taint analysis: A static analysis technique that focuses on tracking the flow path of untrusted data in a program. The core idea is to mark input data as "taints" and then track the propagation of these taints in the program through data flow analysis to determine whether there is a path to propagate untrusted input to key points (such as database queries, system commands, file operations, etc.). Taint analysis is often used to discover potential security vulnerabilities, such as SQL injections, cross-site scripting attacks (XSS), etc., and to improve program security by identifying and blocking illegal use paths of untrusted data.

[0052] Control flow analysis and data flow analysis: Control flow analysis aims to build a model of the program execution path, describe the possible control transfer relationship between the various parts of the program, and generate a control flow graph (CFG) to understand the program execution order, find dead code and potential loops, etc. Data flow analysis focuses on the value and state of variables at different program points. By tracking the definition, use and assignment of variables, a data flow graph (DFG) is constructed to perform constant propagation, dead code elimination, data dependency analysis and optimization, etc. The combination of the two can provide comprehensive support for program optimization, security analysis and error detection.

[0053] Unified Abstract Syntax Tree (UAST): A unified abstract syntax tree (AST) expression that aims to provide a high-level (higher level) common intermediate expression for programming languages. UAST can be used to uniformly process and analyze code in multiple programming languages, supporting static analysis tools, code review tools, and integrated development environments (IDEs) to perform consistent operations on source code.

[0054] Please refer to Figure 1 , Figure 1 Flowchart of a static analysis method for smart contracts proposed in one or more embodiments of this specification. Figure 1 As shown, the smart contract static analysis method may include steps S100 to S106.

[0055] S100: Get the target smart contract.

[0056] The target smart contract mentioned above refers to the smart contract that needs to be analyzed. Specifically, in this step, it is necessary to obtain the source code of the target smart contract, or directly obtain the abstract syntax tree constructed according to the programming language type of the target smart contract.

[0057] S102: Perform syntax analysis on the target smart contract to generate a unified abstract syntax tree of the target smart contract.

[0058] In some implementations, in step S100, the source code of the target smart contract is obtained. Then, in step S102, the source code of the target smart contract may be directly parsed to generate a unified abstract syntax tree of the target smart contract.

[0059] In some implementations, an abstract syntax tree constructed according to the programming language type of the target smart contract is directly obtained in step S100. Then, in step S102, it is only necessary to convert the abstract syntax tree of the target smart contract into a unified abstract syntax tree.

[0060] by Figure 2 Taking the unified abstract syntax tree generation process shown as an example, according to the programming language type of the target smart contract, such as Solidity, Java or other (Other), you can first obtain the abstract syntax tree of the programming language type of the target smart contract, such as Solidity AST, Java AST or Other AST, and then normalize these abstract syntax trees AST into a common intermediate expression form to obtain the unified abstract syntax tree of the target smart contract.

[0061] S104: According to the user's customized operation, a static analysis strategy is matched for a target node of the unified abstract syntax tree.

[0062] In the conventional static analysis process based on the abstract syntax tree, the abstract syntax tree is usually traversed to perform analysis based on preset purposes, such as checking contract vulnerabilities, checking code errors, optimizing code, etc. In the process of traversing the abstract syntax tree, the analysis method used is usually single.

[0063] However, due to the different types of smart contracts, their characteristics are also different. For different types of smart contracts, or for different parts of the same smart contract, in actual operation, it is often necessary to pay attention to different details in different locations. Based on this, in this step S104, a solution for user-defined static analysis rules is provided. The user can select the target node in the unified abstract syntax tree according to the analysis requirements, and then customize the static analysis strategy for the target node to flexibly configure the analysis method for different target nodes of the unified abstract syntax tree.

[0064] In some implementations, a rule injection point can be constructed based on a user's customized operations, and a user-defined static analysis strategy, such as a data flow analysis strategy, a control flow analysis strategy, a taint tracking strategy, etc., can be configured at the rule injection point. Then, the rule injection point is associated and matched with a target node of a unified abstract syntax tree.

[0065] Still Figure 2 Take the unified abstract syntax tree shown as an example, which contains function definition nodes ContractDef, FunctionDef, Assign, TBranch, FBranch and if statement nodes. When configuring a custom static analysis strategy, you can configure control flow analysis and data flow analysis strategies for the entire unified abstract syntax tree, and at certain target nodes, such as function definition nodes (FunctionDef), you can customize other static analysis strategies as needed, for example, you can obtain the current data flow, control flow and node information, and configure the corresponding vulnerability check strategy or warning strategy.

[0066] The above rule injection points can be presented in the form of API interfaces, allowing users to call these rule injections in the unified abstract syntax tree and add customized static analysis strategies such as vulnerability check strategies and code check strategies, thereby enhancing the flexibility and functionality of the entire static analysis solution.

[0067] S106: According to the unified abstract syntax tree, simulate the execution of the target smart contract, and when the simulation execution reaches the target node, call the static analysis strategy of the target node to perform static analysis on the target smart contract.

[0068] Specifically, when simulating the execution of the target smart contract according to the unified abstract syntax tree, all nodes of the unified abstract syntax tree can be simulated, or some nodes of the unified abstract syntax tree can be simulated, such as simulating a subtree in the unified abstract syntax tree, which is not limited in this embodiment. For the simulation execution method, adaptive selection can be made according to the needs, such as symbolic execution, which is not limited in this embodiment.

[0069] In the process of simulating the execution of the target smart contract according to the unified abstract syntax tree, when the simulation is executed to the target node, the corresponding rule injection point can be called according to the matching relationship between the target node and the rule injection point set in the pre-examination, and the static analysis strategy configured by the rule injection point can be injected into the thread of the simulated execution. By executing the static analysis strategy, the analysis purpose is achieved.

[0070] The above is Figure 1 The specific implementation process of the smart contract analysis method shown in the figure. This method is based on the unified abstract syntax tree (UAST) for static analysis, thereby achieving unified conversion and wide compatibility of multiple smart contract languages. It also has the advantages of no need for compilation and ignoring the build environment, so that the contract analysis can be completed quickly. For newly added smart contract languages, it is only necessary to implement its UAST parsing support without redeveloping the analysis engine.

[0071] This method adopts an architecture that separates the analysis engine from the scanning rules, that is, it provides rule injection points and allows users to develop analysis rules and scanners with custom rule injection points according to specific needs to adapt to the evolving smart contract ecosystem. Through the setting of rule injection points, this method can support different analysis strategies for different parts of the unified abstract syntax tree during one analysis process. For example, it supports data flow analysis and control flow analysis of the entire unified abstract syntax tree while also supporting taint analysis of parts of the unified abstract syntax tree. Compared with ordinary static analysis solutions, this method can locate and track variables more accurately.

[0072] This method supports simulated execution of smart contract code, such as symbolic execution. Compared with ordinary static analysis solutions, this method simulates the execution status of smart contracts, statements, and functions more accurately.

[0073] Corresponding to the above-mentioned smart contract static analysis method, one or more embodiments of this specification also propose a smart contract static analysis device. Figure 3 , Figure 3 Schematic diagram of the structure of a static analysis device for smart contracts proposed in one or more embodiments of this specification. The device can be used to implement the above-mentioned static analysis method for smart contracts. It should be noted that the static analysis method for smart contracts described in one or more embodiments of this application can rely on Figure 3 The smart contract static analysis device shown is implemented, but not limited to this device.

[0074] like Figure 3 As shown, the static contract intelligent analysis device includes:

[0075] The data acquisition module 301 is configured to acquire the target smart contract.

[0076] The contract normalization module 302 is configured to perform syntax analysis on the target smart contract and generate a unified abstract syntax tree of the target smart contract.

[0077] The rule customization module 303 is configured to match a static analysis strategy for a target node of the unified abstract syntax tree according to a user's customization operation.

[0078] The analysis module 304 is configured to simulate the execution of the target smart contract according to the unified abstract syntax tree, and when the simulation execution reaches the target node, call the static analysis strategy of the target node to perform static analysis on the target smart contract.

[0079] For the above-mentioned data acquisition module 301, the target smart contract acquired by the data acquisition module 301 refers to the smart contract that needs to be analyzed. Specifically, the data acquisition module 301 needs to obtain the source code of the target smart contract, or directly obtain the abstract syntax tree constructed according to the programming language type of the target smart contract.

[0080] Regarding the above-mentioned contract normalization module 302, the contract normalization module 302 is specifically used to normalize the abstract syntax tree constructed by the source code of the target smart contract or the programming language type of the target smart contract obtained by the data acquisition module 301 to obtain a unified abstract syntax tree.

[0081] Specifically, if the data acquisition module 301 acquires the source code of the target smart contract, the contract normalization module 302 can directly perform syntax analysis on the source code of the target smart contract to generate a unified abstract syntax tree of the target smart contract.

[0082] If the data acquisition module 301 directly obtains the abstract syntax tree constructed according to the programming language type of the target smart contract, the contract normalization module 302 only needs to convert the abstract syntax tree of the target smart contract into a unified abstract syntax tree. For example, the data acquisition module 301 can first obtain the abstract syntax tree of the programming language type of the target smart contract, such as Solidity AST, Java AST or Other AST, and then the contract normalization module 302 normalizes these abstract syntax trees AST into a common intermediate expression form to obtain the unified abstract syntax tree of the target smart contract.

[0083] With respect to the above rule customization module 303, the rule customization module 303 provides the user with the function of customizing static analysis rules. The user can select a target node in the unified abstract syntax tree according to the analysis requirements, and then customize the static analysis strategy for the target node to flexibly configure the analysis method for different target nodes of the unified abstract syntax tree.

[0084] Specifically, the rule customization module 303 can construct a rule injection point according to the user's customized operations, configure a user-defined static analysis strategy at the rule injection point, such as a data flow analysis strategy, a control flow analysis strategy, a taint tracking strategy, etc., and then associate and match the rule injection point with the target node of the unified abstract syntax tree.

[0085] The above rule injection points can be presented in the form of API interfaces, allowing users to call these rule injections in the unified abstract syntax tree and add customized static analysis strategies such as vulnerability check strategies and code check strategies, thereby enhancing the flexibility and functionality of the entire static analysis solution.

[0086] Regarding the above-mentioned analysis module 304, the analysis module 304 is mainly used to simulate the execution of the entire target smart contract or some functions, statements, etc. therein based on the unified abstract syntax tree according to the user's selection operation.

[0087] When the analysis module 304 simulates the execution of the target smart contract according to the unified abstract syntax tree, it can simulate the execution of all nodes of the unified abstract syntax tree, or simulate the execution of some nodes of the unified abstract syntax tree, for example, simulate the execution of a subtree in the unified abstract syntax tree, which is not limited in this embodiment. For the simulation execution method, an adaptive selection can be made according to the needs, for example, a symbolic execution method can be selected, which is not limited in this embodiment.

[0088] In the process of the analysis module 304 simulating the execution of the target smart contract according to the unified abstract syntax tree, when the simulation is executed to the target node, the corresponding rule injection point can be called according to the matching relationship between the target node and the rule injection point set in advance, and the static analysis strategy configured by the rule injection point can be injected into the thread of the simulated execution. By executing the static analysis strategy, the analysis purpose is achieved.

[0089] For the above-mentioned smart contract analysis device, taking the module as an example of a software functional unit, the data acquisition module 301 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the data acquisition module 301 may include code running on multiple hosts / virtual machines / containers. The multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple data centers with close geographical locations. Among them, usually a region may include multiple AZs.

[0090] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0091] As an example of a hardware functional unit, the data acquisition module 301 may include at least one computing device, such as a server, etc. Alternatively, the data acquisition module 301 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0092] The multiple computing devices included in the data acquisition module 301 can be distributed in the same region or in different regions. The multiple computing devices included in the data acquisition module 301 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the data acquisition module 301 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0093] In other embodiments, the data acquisition module 301 can be used to execute any step in the above-mentioned smart contract static analysis method, the contract normalization module 302 can be used to execute any step in the above-mentioned smart contract static analysis method, the rule customization module 303 can be used to execute any step in the above-mentioned smart contract static analysis method, and the analysis module 304 can be used to execute any step in the above-mentioned smart contract static analysis method. The steps that the data acquisition module 301, the contract normalization module 302, the rule customization module 303 and the analysis module 304 are responsible for implementing can be specified as needed, and the data acquisition module 301, the contract normalization module 302, the rule customization module 303 and the analysis module 304 respectively implement different steps in the above-mentioned smart contract static analysis method to realize all the functions of the above-mentioned smart contract static analysis device.

[0094] In this implementation, the smart contract static analysis device can also be applied to computing devices such as computers and servers, or to a computing device cluster including at least one computing device, to realize the specific functions of the smart contract static analysis device.

[0095] In some embodiments, an electronic device is also provided for implementing the above-mentioned gateway server 31. Figure 4 , the electronic device includes: a bus 401, a processor 402, a memory 403 and a communication interface 404. The processor 402, the memory 403 and the communication interface 404 communicate with each other through the bus 401. The electronic device can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the electronic device.

[0096] The bus 401 may be a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4The use of only one line does not mean that there is only one bus or one type of bus. Bus 401 may include a path for transmitting information between various components of the electronic device (eg, processor 402, memory 403, and communication interface 404).

[0097] The processor 402 may include any one or more processors such as a CPU, a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0098] The memory 403 may include a volatile memory, such as a random access memory (RAM). The memory 403 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0099] The memory 403 stores executable program codes, and the processor 402 executes the executable program codes to implement the functions of the aforementioned gateway server 31, that is, to implement the aforementioned method for accessing the third-party large language model.

[0100] The communication interface 404 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the electronic device and other devices or a communication network.

[0101] In some embodiments, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the above-mentioned smart contract static analysis method.

[0102] The computer-readable storage medium may be any available medium that can be stored in an electronic device or a data storage device such as a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the electronic device to execute the above-mentioned static analysis method for smart contracts.

[0103] It is to be understood that the structure illustrated in the embodiments of this specification does not constitute a specific limitation on the system of the embodiments of this specification. In other embodiments of the specification, the above system may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0104] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0105] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0106] It should be noted that the above examples are only specific embodiments of the present invention, and the present invention is obviously not limited to the above examples, and there are many similar variations. All variations directly derived or associated from the contents disclosed by the technicians in this field should fall within the protection scope of the present invention.

Claims

1. A static analysis method for smart contracts, comprising: Get the target smart contract; Performing syntax analysis on the target smart contract to generate a unified abstract syntax tree of the target smart contract; According to the user's custom operation, a static analysis strategy is matched for the target node of the unified abstract syntax tree; According to the unified abstract syntax tree, the target smart contract is simulated and executed, and when the simulation execution reaches the target node, the static analysis strategy of the target node is called to perform static analysis on the target smart contract.

2. The method according to claim 1, performing syntax analysis on the target smart contract to generate a unified abstract syntax tree of the target smart contract, specifically comprising: Obtain an abstract syntax tree constructed according to the programming language type of the target smart contract; The abstract syntax tree is converted into the unified abstract syntax tree.

3. The method according to claim 1, matching a static analysis strategy for a target node of the unified abstract syntax tree according to a user-defined operation, specifically comprising: According to the user's customized operation, determine the rule injection point and configure the static analysis strategy for the rule injection point; The rule injection point is associated and matched with a target node of the unified abstract syntax tree.

4. The method of claim 3, further comprising: After configuring a static analysis strategy for the rule injection point, the rule injection point is constructed as an API interface.

5. The method according to claim 3, wherein the target smart contract is simulated and executed according to the unified abstract syntax tree, and when the simulation execution reaches the target node, the static analysis strategy of the target node is called to perform static analysis on the target smart contract, specifically comprising: When the simulation is executed to the target node, the rule injection point is called, the static analysis strategy of the rule injection point is injected into the thread of simulation execution, and the static analysis strategy is executed.

6. The method according to claim 1, wherein the target smart contract is simulated and executed according to the unified abstract syntax tree, specifically comprising: Based on the user's selection operation, all or part of the target smart contract is simulated and executed according to the unified abstract syntax tree.

7. A smart contract static analysis device, comprising: A data acquisition module, configured to acquire a target smart contract; A contract normalization module, configured to perform syntax analysis on the target smart contract and generate a unified abstract syntax tree of the target smart contract; A rule customization module, configured to match a static analysis strategy for a target node of the unified abstract syntax tree according to a user's customized operation; The analysis module is configured to simulate the execution of the target smart contract according to the unified abstract syntax tree, and when the simulation execution reaches the target node, call the static analysis strategy of the target node to perform static analysis on the target smart contract.

8. In the device as described in claim 7, the contract normalization module is specifically used to obtain an abstract syntax tree constructed according to the programming language type of the target smart contract; and convert the abstract syntax tree into the unified abstract syntax tree.

9. In the device as described in claim 7, the rule customization module is specifically used to determine the rule injection point according to the user's customization operation, and configure the static analysis strategy for the rule injection point; and associate and match the rule injection point with the target node of the unified abstract syntax tree.

10. The device as described in claim 9, wherein the rule customization module is further used to construct the rule injection point as an API interface after configuring a static analysis strategy for the rule injection point.

11. The device as described in claim 9, wherein the analysis module is specifically used to call the rule injection point when the simulation is executed to the target node, inject the static analysis strategy of the rule injection point into the thread of simulation execution, and execute the static analysis strategy.

12. In the device as described in claim 7, the analysis module is specifically used to simulate the execution of all or part of the target smart contract based on the user's selection operation and according to the unified abstract syntax tree.

13. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the processor is caused to execute the method according to any one of claims 1 to 6.

14. An electronic device comprising: one or more processors; And a memory associated with the one or more processors, the memory is used to store program instructions, and when the program instructions are read and executed by the one or more processors, the electronic device executes the method according to any one of claims 1 to 6.

Images