Large language model intelligent contract code auditing method and system based on retrieval enhancement generation and back one-step cue word

Abstract

The invention relates to a large language model intelligent contract code auditing method and system based on retrieval enhancement generation and back one-step prompt words. The method comprises the steps of performing block processing on a to-be-audited smart contract code, inputting the block processing into an embedding model, calculating cosine similarity between feature vectors, and outputting a similar feature vector set; obtaining a historical audit case by adopting a retrieval enhancement generation technology; identifying security risk points through a large language model to obtain a risk point set; the large language model adopts a one-step prompt word backing method to calculate and obtain an audit result set, and an audit report is generated according to the audit result set. According to the method, intelligent contract codes are segmented and subdivided into logic units, and potential risks can be identified and analyzed more accurately by using the powerful capability of a large language model, so that the safety and reliability of the intelligent contract are improved; and in combination with a backward one-step prompt word technology, the auditing efficiency and accuracy are remarkably improved, and a comprehensive security guarantee is provided for development and application of the smart contract.

Description

Technical Field

[0001] The present invention relates to the technical field of smart contract code auditing, and in particular to a large language model smart contract code auditing method and system based on retrieval enhanced generation and one-step-back prompt words. Background Art

[0002] As an application of blockchain technology, smart contracts reduce the need for trust or third-party intervention by automatically executing, controlling or documenting related events or actions on the blockchain. With the development of blockchain technology, smart contracts are increasingly used in finance, law, the Internet of Things and other fields. However, the security issues of smart contracts are also becoming increasingly prominent. For example, security vulnerabilities or logical errors that may exist in the contract code may lead to significant financial losses or data leaks. At present, the security audit of smart contracts mainly relies on manual code review and automated tools. Manual code review is time-consuming and labor-intensive, and it is easy to miss errors; although automated tools can quickly discover problems with some known patterns, they are insufficient in identifying complex logical errors and new attack methods. In addition, existing automated tools often lack an in-depth understanding of the unique problems of smart contracts and cannot adapt well to the development and changes of smart contracts.

[0003] Therefore, traditional smart contract code auditing methods suffer from low efficiency and accuracy. Summary of the invention

[0004] Based on this, in order to solve the above technical problems, a large language model smart contract code auditing method and system based on retrieval enhanced generation and step-back prompt words are provided, which can improve the efficiency and accuracy of smart contract code auditing.

[0005] A method for auditing smart contract codes using a large language model based on retrieval-enhanced generation and one-step-back prompt words, the method comprising:

[0006] The smart contract code to be audited is segmented into pieces to obtain a set of code snippets and input into the embedding model to generate each feature vector;

[0007] The feature vectors are stored in a vector database, the cosine similarity between the feature vectors is calculated, and a set of similar feature vectors is output according to the calculation results;

[0008] Based on the similar feature vector set, the retrieval enhancement generation RAG technology is used to obtain the historical audit cases corresponding to the smart contract code to be audited;

[0009] Inputting the code snippet set and historical audit cases into a large language model, identifying security risk points through the large language model, and obtaining a risk point set;

[0010] The large language model adopts a one-step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, and generates an audit report based on the audit result set.

[0011] In one embodiment, the smart contract code to be audited is segmented and processed, including:

[0012] Determine the code structure features of the smart contract code to be audited, and extract the fragment length in the code structure features;

[0013] The smart contract code to be audited is segmented according to the fragment length, and the smart contract code to be audited is divided into logical units.

[0014] In one embodiment, calculating the cosine similarity between the feature vectors and outputting a set of similar feature vectors according to the calculation result includes:

[0015] Get the dot product and bi-norm of the two feature vectors to be calculated for cosine similarity;

[0016] Calculate the cosine similarity between two feature vectors according to the calculated dot product and bi-norm;

[0017] The cosine similarity between each of the feature vectors in the vector database is calculated by calculating the dot product and the bi-norm, and a set of similar feature vectors is obtained.

[0018] In one of the embodiments, the vector database supports query and retrieval operations; and the vector database is used to store feature vectors that describe code semantics and structural characteristics.

[0019] In one embodiment, based on the similar feature vector set, the retrieval enhancement generation RAG technology is used to obtain the historical audit cases corresponding to the smart contract code to be audited, including:

[0020] Based on the similar feature vector set, the code features corresponding to the smart contract code to be audited are retrieved from the vector database using the retrieval enhancement generation RAG technology;

[0021] Search historical audit cases based on code features corresponding to the smart contract code to be audited.

[0022] In one embodiment, the code snippet set and historical audit cases are input into a large language model, and security risk points are identified by the large language model to obtain a risk point set, including:

[0023] Using the large language model to perform semantic interpretation based on the input code snippet set, and extracting target features and logical structures in the code;

[0024] Through the large language model, based on the target features and logical structure, combined with the historical audit cases, security risk points are identified to obtain a risk point set.

[0025] In one embodiment, the large language model adopts a step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, including:

[0026] The large language model is guided by a step-back prompt word method, and the large language model performs smart contract practice audit, security vulnerability or logic error audit, and code behavior audit according to the input code snippet set and risk point set to obtain an audit result set.

[0027] In one embodiment, generating an audit report according to the audit result set includes:

[0028] According to the audit result set, each risk is evaluated and classified based on the risk point set to obtain a risk level;

[0029] Find the risk description and improvement suggestions corresponding to the risk level, and generate an audit report based on the risk description and improvement suggestions.

[0030] In one embodiment, the method further comprises:

[0031] Feedback data generated during the audit process is collected, and parameters of the large language model are adjusted according to the feedback data to obtain an optimized large language model.

[0032] A large language model smart contract code auditing system based on retrieval enhancement generation and one-step-back prompt words, the system comprising:

[0033] The code processing module is used to slice and dice the smart contract code to be audited, obtain a set of code fragments and input them into the embedding model to generate various feature vectors;

[0034] A similar feature vector calculation module is used to store each of the feature vectors in a vector database, calculate the cosine similarity between each of the feature vectors, and output a similar feature vector set according to the calculation result;

[0035] A historical audit case search module, used to obtain historical audit cases corresponding to the smart contract code to be audited based on the similar feature vector set and using the retrieval enhancement generation RAG technology;

[0036] A risk identification module, used for inputting the code snippet set and historical audit cases into a large language model, identifying security risk points through the large language model, and obtaining a risk point set;

[0037] The audit module is used for the large language model to adopt a step-back prompt word method, calculate an audit result set according to the input code snippet set and risk point set, and generate an audit report according to the audit result set.

[0038] The above-mentioned large language model smart contract code audit method and system based on retrieval enhanced generation and step-back prompt words, by segmenting the smart contract code into logical units, utilizes the powerful capabilities of the large language model, and can more accurately identify and analyze potential risks, thereby improving the security and reliability of the smart contract; combined with the step-back prompt word technology, it guides the large language model to abstractly think from higher-level concepts and principles, and supports efficient feature retrieval and risk assessment, which significantly improves the audit efficiency and accuracy, and provides comprehensive security protection for the development and application of smart contracts. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is an application environment diagram of a large language model smart contract code auditing method based on retrieval enhancement generation and one-step-back prompt words in one embodiment;

[0040] Figure 2 A flowchart of a method for auditing smart contract codes using a large language model based on retrieval-enhanced generation and one-step-back prompt words in one embodiment;

[0041] Figure 3 A schematic diagram of combining vector database retrieval and RAG technology in one embodiment;

[0042] Figure 4 The overall framework diagram of the large language model smart contract code auditing method based on retrieval-enhanced generation and one-step-back prompt words;

[0043] Figure 5 A structural block diagram of a schematic diagram system combining vector database retrieval and RAG technology in one embodiment;

[0044] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] The large language model smart contract code audit method based on retrieval enhancement generation and step-back prompt words provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1 As shown, the application environment includes a computer device 110. The computer device 110 can slice the smart contract code to be audited, obtain a code snippet set and input it into the embedding model to generate each feature vector; the computer device 110 can store each feature vector in a vector database, calculate the cosine similarity between each feature vector, and output a similar feature vector set according to the calculation result; the computer device 110 can use the retrieval enhancement generation RAG technology based on the similar feature vector set to obtain the historical audit case corresponding to the smart contract code to be audited; the computer device 110 can input the code snippet set and the historical audit case into the large language model, identify the security risk points through the large language model, and obtain the risk point set; the large language model uses a step-back prompt word method to calculate the audit result set according to the input code snippet set and risk point set, and generate an audit report according to the audit result set. Among them, the computer device 110 can be, but not limited to, various personal computers, laptops, smart phones, robots, unmanned aerial vehicles, tablet computers and other devices.

[0047] In one embodiment, Figure 2 As shown, a large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words is provided, including the following steps:

[0048] Step 202, the smart contract code to be audited is segmented to obtain a set of code fragments and input into the embedding model to generate various feature vectors.

[0049] The computer device can pre-process the smart contract code to be audited, specifically by cutting code fragments of different lengths into logical units. Then the smart contract code is converted into a feature vector, specifically by using an embedding model to generate the feature vector.

[0050] Specifically, the computer device can convert the smart contract code into feature vectors. These vectors are generated by the embedding model to describe the semantic and structural characteristics of the code. Specifically, first input the code fragment f∈F; then, use the embedding model f Embedding Convert the input code snippet f into a feature vector

[0051] In one embodiment, a large language model smart contract code auditing method based on retrieval enhanced generation and step-back prompt words is provided, which may also include a process of processing the code, and the specific process includes: determining the code structure characteristics of the smart contract code to be audited, and extracting the fragment length in the code structure characteristics; slicing the smart contract code to be audited according to the fragment length, and dividing the smart contract code to be audited into logical units.

[0052] Specifically, the computer equipment can pre-process the smart contract code to be audited, cut the code into blocks according to different lengths, and subdivide the smart contract code into logical units, so that the large language model can understand and analyze the independent functions and potential risks in the code. Among them, the code cutting process is carried out according to the code structure characteristics to ensure the semantic integrity of each logical unit. The basis for cutting includes function definitions, control flow statements, and state variables of the contract.

[0053] In this embodiment, the computer device preprocesses the audited smart contract code C, cuts the code into blocks C', and cuts it according to the code structure characteristics to ensure the semantic integrity of each logical unit. The basis for cutting includes function definitions, control flow statements, and state variables of the contract. The set of code fragments F after cutting facilitates the large language model to understand and analyze the independent functions and potential risks in the code.

[0054] The computing device can use the embedding model to convert the code snippet f∈F into a feature vector These feature vectors are used to describe the semantic and structural properties of the code.

[0055] Step 204: store each feature vector in a vector database, calculate the cosine similarity between each feature vector, and output a set of similar feature vectors according to the calculation result.

[0056] In one embodiment, the vector database supports query and retrieval operations; and the vector database is used to store feature vectors that describe the semantics and structural characteristics of the code. The vector database VDB is used to store feature vectors and supports efficient query and retrieval operations. That is, the implementation of the vector database VDB adopts high-dimensional vector storage technology, supports dynamic updates, and performs similarity searches by calculating the cosine similarity between vectors. As new audit data and feedback accumulate, the vectors in the database will be continuously optimized and updated. By calculating the cosine similarity between vectors, code features related to the current audit task can be quickly retrieved. The feature vectors entered into the vector database are The output is a set of similar feature vectors

[0057] The vector database is used to store feature vectors, which supports dynamic updates. By calculating the cosine similarity between vectors, the code features related to the current audit task can be quickly retrieved. The vectorized data storage method significantly improves processing efficiency. First, storing data as vectors makes the data more compact, thereby reducing the need for storage space; second, vectorized data facilitates parallel computing, which is particularly important when processing large-scale data sets; an important feature of the vector database is that it can efficiently perform similarity searches, which is particularly beneficial when processing high-dimensional data sets.

[0058] The vector database supports dynamic updates. As new audit data and feedback accumulate, the stored vectors are continuously optimized and updated to reflect the latest security risks and coding practices. The design of the vector database enables efficient similarity searches when processing large-scale data, significantly improving the efficiency of audits.

[0059] Among them, in one embodiment, a large language model smart contract code audit method for retrieval enhancement generation and step-back prompt words provided can also include a process of calculating a set of similar feature vectors, and the specific process includes: obtaining the dot product and the second norm of the two feature vectors whose cosine similarity is to be calculated; calculating the cosine similarity between the two feature vectors based on the calculated dot product and the second norm; calculating the cosine similarity between each feature vector in the vector database by calculating the dot product and the second norm, and obtaining a set of similar feature vectors.

[0060] The similarity search of a computer device in a vector database can be realized by calculating the cosine similarity between two vectors. The calculation formula is expressed as: Where A and B are two vectors, A·B is their dot product, and ||A||2 and ||B||2 are their bi-norms, i.e., lengths.

[0061] Step 206: Based on the similar feature vector set, the retrieval enhancement generation RAG technology is used to obtain the historical audit cases corresponding to the smart contract code to be audited.

[0062] Computer equipment can use retrieval-enhanced generation RAG technology, combining retrieval and generation methods, to retrieve relevant code features and historical audit cases from the vector database and incorporate this information into the generation process.

[0063] Specifically, in one embodiment, a large language model smart contract code audit method based on retrieval enhanced generation and step-back prompt words is provided, which can also include a process of searching for historical audit cases. The specific process includes: based on a set of similar feature vectors, using retrieval enhanced generation RAG technology to retrieve code features corresponding to the smart contract code to be audited from a vector database; searching for historical audit cases based on the code features corresponding to the smart contract code to be audited.

[0064] During the query process, the computer device first converts the smart contract to be audited into a vector, and then performs efficient matching and retrieval operations in the vector database. At the final stage of the query, the matching results are converted back into a format that the user can understand and use. In this way, the vector database can quickly and accurately retrieve code features related to the current audit task, thereby significantly improving the efficiency and accuracy of smart contract code audits.

[0065] The computer device uses RAG (Retrieval-Augmented Generation) technology, combining retrieval and generation methods, first retrieving code features and historical audit cases related to the current audit task from the vector database, and then integrating this information into the generation process. Specifically, the input is a set of similar feature vectors Output is a collection of historical audit cases

[0066] In this embodiment, a large language model is used to interpret the smart contract code semantically, extract the key features and logical structure in the code, and combine it with a collection of historical audit cases. Identify possible security risk points, such as reentrancy attacks, integer overflows, improper permission control, etc. Specifically, the large language model in this embodiment is not limited to a specific model, and can be used alone or in combination with multiple models to improve the comprehensiveness and accuracy of the analysis.

[0067] Step 208: input the code snippet set and historical audit cases into the large language model, identify security risk points through the large language model, and obtain a risk point set.

[0068] In one embodiment, a large language model smart contract code audit method based on retrieval enhanced generation and step-back prompt words is provided, which may also include a process of identifying security risk points. The specific process includes: using a large language model to perform semantic interpretation based on a set of input code snippets, and extracting target features and logical structures in the code; through the large language model, based on the target features and logical structures, combined with historical audit cases, security risk points are identified to obtain a risk point set.

[0069] The schematic diagram of the combination of vector database retrieval and RAG technology is shown in Figure 3 As shown, the vector database stores feature vectors that describe the semantics and structural characteristics of the code. After the query content is input, it is converted into a feature vector through the embedding model, and then the large language model LLM is used to perform semantic interpretation based on the input code snippet set.

[0070] In step 210, the large language model uses a one-step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, and generates an audit report based on the audit result set.

[0071] Among them, the step-back prompting method guides the large language model to focus on higher-level logic and design principles by raising abstract questions, helping it to identify potential design defects and safety hazards. That is, the step-back prompting method is used to guide the large language model to think from higher-level concepts and principles, and to use the ability of the large language model to abstract high-level concepts and basic principles from specific code examples. The model can not only understand the literal meaning of the code, but also understand the underlying logic and design patterns through abstract thinking.

[0072] In this embodiment, the step-back prompt word method includes two main steps:

[0073] The first is abstraction. Instead of asking specific questions directly, this embodiment asks general backward questions about higher-level concepts or principles and retrieves facts related to these high-level concepts or principles. When detecting bad practices in smart contracts, abstract prompts are used to guide the large language model to explore not only the literal meaning of the code, but also the deeper structure and intent. These prompts may include questions such as "What are the possible risks of this implementation?" or "Does this approach comply with the basic principles of secure smart contracts?"

[0074] Next comes model reasoning. The large language model can infer the answer to the original question based on facts about high-level concepts or principles, which is called abstract-based reasoning. In this embodiment, these abstract prompts can be used for reasoning to try to analyze the code from a broader perspective, including comparing the pros and cons of different implementations and how they coincide with known best practices or common bad practices. In this way, potential security risk points in the smart contract code can be effectively identified and audit results can be generated.

[0075] In one embodiment, a large language model smart contract code audit method based on retrieval enhancement generation and step-back prompt words is provided, which may also include a process of calculating a set of audit results. The specific process includes: using the step-back prompt word method to guide the large language model, and using the large language model to perform smart contract practice audits, security vulnerability or logic error audits, and code behavior audits based on the input code snippet set and risk point set to obtain an audit result set.

[0076] That is, in this embodiment, the computer device can use the step-back prompting method to guide the large language model to think from a higher level of concepts and principles. By raising abstract questions, the model is prompted to consider whether the code implementation complies with the best practices of smart contracts, whether there are potential security vulnerabilities or logical errors, and whether the behavior of the code meets expectations in specific situations. The principle of the step-back prompt is to help identify potential design flaws and security risks by guiding the model to focus on higher-level logic and design principles. The input is a risk point set {r i}, the output is the audit result set {R i}.

[0077] In one embodiment, a large language model smart contract code audit method based on retrieval enhanced generation and step-back prompt words is provided, which may also include a process of generating an audit report. The specific process includes: according to the audit result set, each risk is evaluated and classified based on the risk point set to obtain a risk level; searching for risk descriptions and improvement suggestions corresponding to the risk level, and generating an audit report based on the risk descriptions and improvement suggestions.

[0078] Computer equipment can evaluate and classify identified risks based on the set of audit results, determine the severity of the risks, the scope of impact, and possible attack paths, divide the risks into three levels: high, medium, and low, and provide detailed descriptions and improvement suggestions for each risk, thereby generating an audit report.

[0079] The detailed audit report includes the risk ID, risk title, risk type, problem code block, code location, risk level, cause analysis, and improvement suggestions. After the audit report is generated, the developer can modify the code according to the suggestions in the report. The modified code can be input into the audit system again for iterative audit to ensure that all risks are effectively handled. That is, the input is the audit result set {R i}, and the output is the audit report R. The audit report can be output in JSON format to facilitate developers to understand and use it, and supports integration with other development tools.

[0080] In order to accurately locate the bad practices in the smart contract code, first extract the JSON array containing the bad practice information from the provided session history file. These JSON arrays may be scattered in different locations in the session history, so they need to be combined into a complete array and the ID of each bad practice is reassigned to ensure its uniqueness and continuity. Specifically, in order to locate the specific location of the bad practice in the code, the similarity between the target string (i.e., the code block of the bad practice) and each line in the code text can be calculated, and a text similarity algorithm (such as SequenceMatcher) can be used to compare the target string with each line in the code, find the line with the highest similarity, and record the line number of the most similar line, so as to mark the specific location of the bad practice in the audit report. In the extracted and combined JSON array, the code line number information of each bad practice can be added. In this way, each bad practice not only has a description of its code block, but also includes its specific line number position in the code.

[0081] Next, the JSON array containing the line number information can be converted into a detailed audit report. The generated audit report will contain the following information: Risk ID (an ID that uniquely identifies each bad practice), Risk Title (a brief title describing the bad practice), Risk Type (the type of risk to which the bad practice belongs), Problem Code Block (the specific code snippet of the bad practice), Code Location (the specific line number of the bad practice in the code), Risk Level (the severity level of the bad practice), Cause Analysis (a detailed analysis of the reasons for the occurrence of the bad practice), and Improvement Suggestions (repair suggestions for bad practices).

[0082] Developers can modify the code based on the recommendations in the audit report. The modified code can be input into the audit system again for iterative audit to ensure that all risks are effectively addressed. Through this iterative process, not only can all bad practices in the code be gradually eliminated, but the code quality and security can also be continuously improved.

[0083] In one embodiment, a large language model smart contract code audit method based on retrieval enhanced generation and step-back prompt words provided may also include a process of optimizing the large language model. The specific process includes: collecting feedback data generated during the audit process, and adjusting the parameters of the large language model according to the feedback data to obtain an optimized large language model.

[0084] In this embodiment, the computer device also includes a continuous learning mechanism that uses the data and feedback collected during the audit process to continuously optimize the performance of the large language model. By analyzing historical audit results, the large language model can learn new security risk patterns and best practices, thereby improving the accuracy and efficiency of future audits.

[0085] The overall framework of the large language model smart contract code audit method based on retrieval enhancement generation and step-back prompt words is as follows: Figure 4 As shown, the smart contract code to be audited, i.e., the source code, is cut into pieces, and feature vectors are generated through the embedding model and stored in the vector database; when performing retrieval, the retrieval enhancement generation RAG technology can be used to obtain historical audit cases corresponding to the smart contract code to be audited, and the audit report is generated through the large language model using the step-back prompt word method in combination with the context and prompt information.

[0086] The provided large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words can effectively identify and analyze potential security risks in smart contracts, and provide detailed improvement suggestions to help developers improve code quality and security, thereby achieving safer and more reliable smart contracts. This method significantly improves the efficiency and accuracy of smart contract code auditing by combining the powerful semantic understanding ability of the large language model, the efficient retrieval mechanism of the vector database, and the generation enhancement of RAG technology.

[0087] The present application provides a large language model smart contract code auditing method based on retrieval enhanced generation and step-back prompt words. By subdividing the smart contract code into logical units and utilizing the powerful capabilities of the large language model, it can more accurately identify and analyze potential risks, thereby improving the security and reliability of the smart contract. It combines step-back prompt words and RAG technology to guide the large language model to abstractly think from higher-level concepts and principles, and supports efficient feature retrieval and risk assessment, which significantly improves audit efficiency and accuracy, and provides comprehensive security protection for the development and application of smart contracts. The continuous learning mechanism enables the audit system to continuously adapt to new security risks and best practices, ensuring that efficient audit capabilities are maintained in a changing environment. It can not only effectively identify potential security risks in smart contracts, but also provide detailed improvement suggestions to help developers improve code quality and security, and ultimately improve the reliability and security of smart contracts.

[0088] It should be understood that, although the various steps in the above-mentioned flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flow chart may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0089] In one embodiment, Figure 5 As shown, a large language model smart contract code audit system based on retrieval enhancement generation and one-step-back prompt words is provided, including: a code processing module 510, a similar feature vector calculation module 520, a historical audit case search module 530, a risk identification module 540 and an audit module 550, wherein:

[0090] The code processing module 510 is used to segment the smart contract code to be audited, obtain a set of code fragments and input them into the embedding model to generate each feature vector;

[0091] A similar feature vector calculation module 520 is used to store each feature vector in a vector database, calculate the cosine similarity between each feature vector, and output a similar feature vector set according to the calculation result;

[0092] A historical audit case search module 530 is used to obtain historical audit cases corresponding to the smart contract code to be audited based on a set of similar feature vectors by using the retrieval enhancement generation RAG technology;

[0093] The risk identification module 540 is used to input the code snippet set and the historical audit cases into the large language model, identify the security risk points through the large language model, and obtain the risk point set;

[0094] The audit module 550 is used for the large language model to adopt a step-back prompt word method, calculate an audit result set according to the input code snippet set and risk point set, and generate an audit report according to the audit result set.

[0095] In one embodiment, the code processing module 510 is also used to determine the code structure characteristics of the smart contract code to be audited, extract the fragment length in the code structure characteristics; cut the smart contract code to be audited into blocks according to the fragment length, and divide the smart contract code to be audited into logical units.

[0096] In one embodiment, the similar feature vector calculation module 520 is also used to obtain the dot product and the second norm of the two feature vectors whose cosine similarity is to be calculated; calculate the cosine similarity between the two feature vectors based on the calculated dot product and the second norm; calculate the cosine similarity between each feature vector in the vector database by calculating the dot product and the second norm, and obtain a set of similar feature vectors.

[0097] In one embodiment, the vector database supports query and retrieval operations; and the vector database is used to store feature vectors describing the semantic and structural characteristics of the code.

[0098] In one embodiment, the historical audit case search module 530 is also used to retrieve code features corresponding to the smart contract code to be audited from the vector database based on a set of similar feature vectors and using retrieval enhancement generation RAG technology; and to search for historical audit cases based on the code features corresponding to the smart contract code to be audited.

[0099] In one embodiment, the risk identification module 540 is also used to use a large language model to perform semantic interpretation based on a set of input code snippets, and extract target features and logical structures in the code; through the large language model, based on the target features and logical structures, combined with historical audit cases, security risk points are identified to obtain a set of risk points.

[0100] In one embodiment, the audit module 550 is also used to guide the large language model using a step-back prompt word method, and perform smart contract practice audits, security vulnerability or logic error audits, and code behavior audits based on the input code snippet set and risk point set through the large language model to obtain an audit result set.

[0101] In one embodiment, the audit module 550 is also used to evaluate and classify each risk based on the risk point set according to the audit result set to obtain a risk level; find the risk description and improvement suggestions corresponding to the risk level, and generate an audit report based on the risk description and improvement suggestions.

[0102] In one embodiment, the audit module 550 is also used to collect feedback data generated during the audit process, and adjust parameters of the large language model according to the feedback data to obtain an optimized large language model.

[0103] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a large language model smart contract code audit method based on retrieval enhancement generation and back-step prompt words is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0104] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0105] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of a large language model smart contract code audit method based on retrieval enhanced generation and step-back prompt words are implemented.

[0106] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of a large language model smart contract code audit method based on retrieval enhanced generation and step-back prompt words are implemented.

[0107] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0108] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A large language model smart contract code audit method based on retrieval enhancement generation and step-back prompt words, characterized in that: The method comprises: The smart contract code to be audited is segmented into pieces to obtain a set of code snippets and input into the embedding model to generate each feature vector; The feature vectors are stored in a vector database, the cosine similarity between the feature vectors is calculated, and a set of similar feature vectors is output according to the calculation results; Based on the similar feature vector set, the retrieval enhancement generation RAG technology is used to obtain the historical audit cases corresponding to the smart contract code to be audited; Inputting the code snippet set and historical audit cases into a large language model, identifying security risk points through the large language model, and obtaining a risk point set; The large language model adopts a one-step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, and generates an audit report based on the audit result set.

2. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The smart contract code to be audited is divided into blocks, including: Determine the code structure features of the smart contract code to be audited, and extract the fragment length in the code structure features; The smart contract code to be audited is segmented according to the fragment length, and the smart contract code to be audited is divided into logical units.

3. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: Calculate the cosine similarity between each of the feature vectors, and output a set of similar feature vectors according to the calculation result, including: Get the dot product and bi-norm of the two feature vectors to be calculated for cosine similarity; Calculate the cosine similarity between two feature vectors according to the calculated dot product and bi-norm; The cosine similarity between each of the feature vectors in the vector database is calculated by calculating the dot product and the bi-norm, and a set of similar feature vectors is obtained.

4. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The vector database supports query and retrieval operations; and the vector database is used to store feature vectors that describe code semantics and structural characteristics.

5. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: Based on the similar feature vector set, the retrieval enhancement generation RAG technology is used to obtain the historical audit cases corresponding to the smart contract code to be audited, including: Based on the similar feature vector set, the code features corresponding to the smart contract code to be audited are retrieved from the vector database using the retrieval enhancement generation RAG technology; Search historical audit cases based on code features corresponding to the smart contract code to be audited.

6. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The code snippet set and historical audit cases are input into a large language model, and security risk points are identified by the large language model to obtain a risk point set, including: Using the large language model to perform semantic interpretation based on the input code snippet set, and extracting target features and logical structures in the code; Through the large language model, based on the target features and logical structure, combined with the historical audit cases, security risk points are identified to obtain a risk point set.

7. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The large language model adopts a step-back prompt word method to calculate the audit result set according to the input code snippet set and risk point set, including: The large language model is guided by a step-back prompt word method, and the large language model performs smart contract practice audit, security vulnerability or logic error audit, and code behavior audit according to the input code snippet set and risk point set to obtain an audit result set.

8. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: Generating an audit report according to the audit result set, including: According to the audit result set, each risk is evaluated and classified based on the risk point set to obtain a risk level; Find the risk description and improvement suggestions corresponding to the risk level, and generate an audit report based on the risk description and improvement suggestions.

9. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The method further comprises: Feedback data generated during the audit process is collected, and parameters of the large language model are adjusted according to the feedback data to obtain an optimized large language model.

10. A large language model smart contract code audit system based on retrieval enhancement generation and step-back prompt words, characterized in that: The system comprises: The code processing module is used to slice and dice the smart contract code to be audited, obtain a set of code fragments and input them into the embedding model to generate various feature vectors; A similar feature vector calculation module is used to store each of the feature vectors in a vector database, calculate the cosine similarity between each of the feature vectors, and output a similar feature vector set according to the calculation result; A historical audit case search module, used to obtain historical audit cases corresponding to the smart contract code to be audited based on the similar feature vector set and using the retrieval enhancement generation RAG technology; A risk identification module, used for inputting the code snippet set and historical audit cases into a large language model, identifying security risk points through the large language model, and obtaining a risk point set; The audit module is used for the large language model to adopt a step-back prompt word method, calculate an audit result set according to the input code snippet set and risk point set, and generate an audit report according to the audit result set.

Images