Large language model smart contract code auditing method and system based on retrieval-enhanced generation and step-back prompt words

Abstract

The present invention relates to a method and system for auditing smart contract code using a large language model based on retrieval-enhanced generation and step-back prompt words. The method comprises: slicing the smart contract code to be audited and inputting it into an embedding model, calculating the cosine similarity between feature vectors and outputting a set of similar feature vectors; using retrieval-enhanced generation technology to obtain historical audit cases; identifying security risk points through a large language model to obtain a set of risk points; using the large language model using a step-back prompt word method to calculate an audit result set, and generating an audit report based on the audit result set. By slicing the smart contract code into logical units and utilizing the powerful capabilities of the large language model, potential risks can be more accurately identified and analyzed, thereby improving the security and reliability of the smart contract; combined with the step-back prompt word technology, the audit efficiency and accuracy are significantly improved, providing comprehensive security protection for the development and application of smart contracts.

Description

Technical Field

[0001] The present invention relates to the technical field of smart contract code auditing, and in particular to a method and system for smart contract code auditing based on a large language model based on retrieval-enhanced generation and one-step-back prompt words. Background Art

[0002] Smart contracts, as an application of blockchain technology, reduce the need for trusted third parties by automatically executing, controlling, or documenting related events or actions on the blockchain. With the development of blockchain technology, smart contracts are increasingly being used in finance, law, the Internet of Things, and other fields. However, security issues with smart contracts are also becoming increasingly prominent. For example, potential security vulnerabilities or logical errors in contract code can lead to significant financial losses or data leaks. Currently, security audits of smart contracts primarily rely on manual code reviews and automated tools. Manual code reviews are time-consuming and labor-intensive, and are prone to missing errors. While automated tools can quickly identify issues with known patterns, they are less able to identify complex logical errors and new attack vectors. Furthermore, existing automated tools often lack a deep understanding of issues unique to smart contracts and are not well adapted to their development and evolution.

[0003] Therefore, traditional smart contract code auditing methods have problems with low efficiency and accuracy. Summary of the Invention

[0004] Based on this, in order to solve the above technical problems, a large language model smart contract code auditing method and system based on retrieval enhanced generation and step-back prompt words is provided, which can improve the efficiency and accuracy of smart contract code auditing.

[0005] A method for auditing smart contract code using a large language model based on retrieval-enhanced generation and one-step-back prompt words, the method comprising:

[0006] The smart contract code to be audited is segmented into pieces to obtain a set of code snippets and input into the embedding model to generate feature vectors.

[0007] storing each of the feature vectors in a vector database, calculating the cosine similarity between each of the feature vectors, and outputting a set of similar feature vectors according to the calculation results;

[0008] Based on the similar feature vector set, the retrieval enhancement generation (RAG) technology is used to obtain historical audit cases corresponding to the smart contract code to be audited;

[0009] Inputting the code snippet set and historical audit cases into a large language model, identifying security risk points through the large language model, and obtaining a risk point set;

[0010] The large language model adopts a step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, and generates an audit report based on the audit result set.

[0011] In one embodiment, the smart contract code to be audited is segmented and processed, including:

[0012] Determine the code structure characteristics of the smart contract code to be audited, and extract the fragment lengths in the code structure characteristics;

[0013] The smart contract code to be audited is segmented according to the fragment length, and the smart contract code to be audited is divided into logical units.

[0014] In one embodiment, calculating the cosine similarity between each of the feature vectors and outputting a set of similar feature vectors according to the calculation result includes:

[0015] Get the dot product and binorm of the two feature vectors to be calculated for cosine similarity;

[0016] Calculate the cosine similarity between the two feature vectors based on the calculated dot product and the bi-norm;

[0017] The cosine similarity between each of the feature vectors in the vector database is calculated by calculating the dot product and the bi-norm to obtain a set of similar feature vectors.

[0018] In one embodiment, the vector database supports query and retrieval operations; and the vector database is used to store feature vectors describing code semantics and structural characteristics.

[0019] In one embodiment, based on the similar feature vector set, a retrieval-enhanced generation (RAG) technique is used to obtain historical audit cases corresponding to the smart contract code to be audited, including:

[0020] Based on the similar feature vector set, using the retrieval enhancement generation (RAG) technology to retrieve code features corresponding to the smart contract code to be audited from the vector database;

[0021] Search historical audit cases based on code features corresponding to the smart contract code to be audited.

[0022] In one embodiment, the code snippet set and historical audit cases are input into a large language model, and security risk points are identified by the large language model to obtain a risk point set, including:

[0023] Using the large language model to perform semantic interpretation based on the input code snippet set, and extracting target features and logical structures in the code;

[0024] Through the large language model, based on the target features and logical structure, combined with the historical audit cases, security risk points are identified to obtain a risk point set.

[0025] In one embodiment, the large language model uses a step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, including:

[0026] A step-back prompt word method is used to guide the large language model, and the large language model performs smart contract practice audit, security vulnerability or logic error audit, and code behavior audit based on the input code snippet set and risk point set to obtain an audit result set.

[0027] In one embodiment, generating an audit report based on the audit result set includes:

[0028] According to the audit result set, each risk is evaluated and classified based on the risk point set to obtain a risk level;

[0029] Find a risk description and improvement suggestions corresponding to the risk level, and generate an audit report based on the risk description and improvement suggestions.

[0030] In one embodiment, the method further comprises:

[0031] Feedback data generated during the audit process is collected, and parameters of the large language model are adjusted according to the feedback data to obtain an optimized large language model.

[0032] A large language model smart contract code auditing system based on retrieval-enhanced generation and one-step-back prompt words, the system comprising:

[0033] The code processing module is used to segment the smart contract code to be audited, obtain a set of code snippets, and input them into the embedding model to generate various feature vectors;

[0034] A similar feature vector calculation module is used to store each of the feature vectors in a vector database, calculate the cosine similarity between each of the feature vectors, and output a similar feature vector set according to the calculation result;

[0035] A historical audit case search module is used to obtain historical audit cases corresponding to the smart contract code to be audited based on the similar feature vector set using the retrieval enhancement generation (RAG) technology;

[0036] a risk identification module, configured to input the code snippet set and historical audit cases into a large language model, identify security risk points through the large language model, and obtain a risk point set;

[0037] The audit module is used for the large language model to adopt a step-back prompt word method, calculate an audit result set based on the input code snippet set and risk point set, and generate an audit report based on the audit result set.

[0038] The above-mentioned large language model smart contract code audit method and system based on retrieval-enhanced generation and step-back prompt words, by segmenting the smart contract code into logical units and utilizing the powerful capabilities of the large language model, can more accurately identify and analyze potential risks, thereby improving the security and reliability of the smart contract; combined with the step-back prompt word technology, it guides the large language model to abstract thinking from higher-level concepts and principles, and supports efficient feature retrieval and risk assessment, significantly improving audit efficiency and accuracy, and providing comprehensive security protection for the development and application of smart contracts. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a diagram illustrating an application environment of a large language model smart contract code auditing method based on retrieval-enhanced generation and one-step-back prompt words in one embodiment;

[0040] Figure 2 A flowchart of a method for auditing smart contract code using a large language model based on retrieval-enhanced generation and one-step-back prompt words in one embodiment is provided;

[0041] Figure 3 A schematic diagram of combining vector database retrieval and RAG technology in one embodiment;

[0042] Figure 4 The overall framework diagram of the large language model smart contract code auditing method based on retrieval-enhanced generation and step-back prompt words;

[0043] Figure 5 A block diagram of a schematic diagram of a system combining vector database retrieval and RAG technology in one embodiment;

[0044] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0046] The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1 As shown, the application environment includes a computer device 110. The computer device 110 can segment the smart contract code to be audited, obtain a set of code snippets, and input them into an embedding model to generate feature vectors. The computer device 110 can store the feature vectors in a vector database, calculate the cosine similarity between the feature vectors, and output a set of similar feature vectors based on the calculation results. Based on the set of similar feature vectors, the computer device 110 can use the retrieval enhancement generation (RAG) technique to obtain historical audit cases corresponding to the smart contract code to be audited. The computer device 110 can input the set of code snippets and historical audit cases into a large language model, identify security risk points through the large language model, and obtain a set of risk points. The large language model uses a step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, and generate an audit report based on the audit result set. The computer device 110 can be, but is not limited to, various personal computers, laptops, smartphones, robots, unmanned aerial vehicles, tablet computers, and other devices.

[0047] In one embodiment, Figure 2 As shown in FIG, a large language model smart contract code auditing method based on retrieval-enhanced generation and step-back prompt words is provided, including the following steps:

[0048] In step 202, the smart contract code to be audited is segmented to obtain a set of code fragments and input into the embedding model to generate various feature vectors.

[0049] The computer device can pre-process the smart contract code to be audited, specifically by slicing code snippets of different lengths and subdividing them into logical units. The smart contract code is then converted into feature vectors, specifically by using an embedding model to generate the feature vectors.

[0050] Specifically, the computer device can convert the smart contract code into feature vectors. These vectors are generated by the embedding model to describe the semantic and structural characteristics of the code. Specifically, first input the code fragment f∈F; then, use the embedding model f Embedding Convert the input code snippet f into a feature vector

[0051] In one embodiment, a large language model smart contract code auditing method based on retrieval-enhanced generation and step-back prompt words may also include a code processing process, specifically including: determining the code structure characteristics of the smart contract code to be audited, extracting the fragment length in the code structure characteristics; slicing the smart contract code to be audited according to the fragment length, and dividing the smart contract code to be audited into logical units.

[0052] Specifically, the computer can pre-process the smart contract code to be audited, segmenting it into logical units based on code lengths. This allows the large language model to understand and analyze the independent functions and potential risks within the code. The code segmentation process is based on the code's structural characteristics, ensuring the semantic integrity of each logical unit. The segmentation is based on factors such as function definitions, control flow statements, and the contract's state variables.

[0053] In this embodiment, a computer device preprocesses the smart contract code C to be audited, dividing the code into blocks C' based on the code's structural characteristics to ensure the semantic integrity of each logical unit. Blocks are segmented based on factors such as function definitions, control flow statements, and contract state variables. The resulting set of code snippets F facilitates the large language model's understanding and analysis of independent functions and potential risks within the code.

[0054] The computer device can use the embedding model to convert the code snippet f∈F into a feature vector These feature vectors are used to describe the semantic and structural properties of the code.

[0055] Step 204: store each feature vector in a vector database, calculate the cosine similarity between each feature vector, and output a set of similar feature vectors according to the calculation result.

[0056] In one embodiment, the vector database supports query and retrieval operations; and the vector database is used to store feature vectors that describe the semantics and structural characteristics of the code. The vector database VDB is used to store feature vectors and supports efficient query and retrieval operations. That is, the implementation of the vector database VDB adopts high-dimensional vector storage technology, supports dynamic updates, and performs similarity searches by calculating the cosine similarity between vectors. As new audit data and feedback accumulate, the vectors in the database will be continuously optimized and updated. By calculating the cosine similarity between vectors, code features related to the current audit task can be quickly retrieved. The feature vectors input into the vector database are The output is a set of similar feature vectors

[0057] A vector database is used to store feature vectors, supporting dynamic updates. By calculating the cosine similarity between vectors, code features relevant to the current audit task can be quickly retrieved. Vectorized data storage significantly improves processing efficiency. First, storing data as vectors makes it more compact, reducing storage space requirements. Second, vectorized data facilitates parallel computing, which is particularly important when processing large datasets. A key feature of vector databases is their ability to efficiently perform similarity searches, which is particularly beneficial when processing high-dimensional datasets.

[0058] The vector database supports dynamic updates. As new audit data and feedback accumulate, the stored vectors are continuously optimized and updated to reflect the latest security risks and coding practices. The design of the vector database enables efficient similarity searches when processing large amounts of data, significantly improving audit efficiency.

[0059] Among them, in one embodiment, a large language model smart contract code audit method for retrieval enhancement generation and step-back prompt words provided can also include a process of calculating a set of similar feature vectors. The specific process includes: obtaining the dot product and the second norm of the two feature vectors whose cosine similarity is to be calculated; calculating the cosine similarity between the two feature vectors based on the calculated dot product and the second norm; calculating the cosine similarity between each feature vector in the vector database by calculating the dot product and the second norm, and obtaining a set of similar feature vectors.

[0060] The similarity search of a computer device in a vector database can be achieved by calculating the cosine similarity between two vectors. The calculation formula is expressed as: Where A and B are two vectors, A·B is their dot product, and ||A||² and ||B||² are their bi-norms, i.e., lengths.

[0061] In step 206, based on the similar feature vector set, the retrieval enhancement generation RAG technology is used to obtain historical audit cases corresponding to the smart contract code to be audited.

[0062] Computer equipment can use retrieval-enhanced generation (RAG) technology, combining retrieval and generation methods, to retrieve relevant code features and historical audit cases from a vector database and incorporate this information into the generation process.

[0063] Specifically, in one embodiment, a large language model smart contract code auditing method based on retrieval-enhanced generation and step-back prompt words is provided, which can also include a process of searching for historical audit cases. The specific process includes: based on a set of similar feature vectors, using retrieval-enhanced generation RAG technology to retrieve code features corresponding to the smart contract code to be audited from a vector database; searching for historical audit cases based on the code features corresponding to the smart contract code to be audited.

[0064] During the query process, the computer first converts the smart contract to be audited into a vector, then performs efficient matching and retrieval operations within the vector database. At the final stage of the query, the matching results are converted back into a format that the user can understand and use. This approach enables the vector database to quickly and accurately retrieve code features relevant to the current audit task, significantly improving the efficiency and accuracy of smart contract code audits.

[0065] The computer equipment uses RAG (Retrieval-Augmented Generation) technology, combining retrieval and generation methods, first retrieving code features and historical audit cases related to the current audit task from the vector database, and then integrating this information into the generation process. Specifically, the input is a set of similar feature vectors Output is a collection of historical audit cases

[0066] In this embodiment, a large language model is used to interpret the smart contract code semantically, extract the key features and logical structure of the code, and combine it with a collection of historical audit cases. Identify possible security risk points, such as reentrancy attacks, integer overflows, improper permission control, etc. Specifically, the large language model in this embodiment is not limited to a specific model and can be used alone or in combination with multiple models to improve the comprehensiveness and accuracy of the analysis.

[0067] In step 208 , the code snippet set and historical audit cases are input into the large language model, and security risk points are identified through the large language model to obtain a risk point set.

[0068] In one embodiment, a large language model-based smart contract code auditing method based on retrieval-enhanced generation and step-back prompt words may also include a process of identifying security risk points. The specific process includes: using the large language model to perform semantic interpretation based on the input code snippet set, and extracting the target features and logical structure in the code; through the large language model, based on the target features and logical structure, combined with historical audit cases, identifying security risk points to obtain a risk point set.

[0069] The schematic diagram of the combination of vector database retrieval and RAG technology is as follows Figure 3 As shown in the figure, the vector database stores feature vectors that describe the semantics and structural characteristics of the code. After the query content is input, it is converted into a feature vector through the embedding model, and then the large language model LLM is used to perform semantic interpretation based on the input code snippet set.

[0070] In step 210 , the large language model uses a one-step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, and generates an audit report based on the audit result set.

[0071] The step-back prompting method, among other things, asks abstract questions to guide the large language model's focus on higher-level logic and design principles, helping it identify potential design flaws and security risks. Specifically, the step-back prompting method guides the large language model to think from a higher-level perspective. Leveraging the large language model's capabilities, it abstracts high-level concepts and fundamental principles from specific code examples. This allows the model to not only understand the literal meaning of the code but also, through abstract thinking, grasp the underlying logic and design patterns.

[0072] In this embodiment, the step-back prompt word method includes two main steps:

[0073] The first is abstraction. Rather than asking specific questions directly, this embodiment asks general, backward questions about higher-level concepts or principles and retrieves facts related to these higher-level concepts or principles. When detecting bad practices in smart contracts, abstract prompts are used to guide the large language model, exploring not only the literal meaning of the code but also its deeper structure and intent. These prompts might include questions such as "What are the possible risks of this implementation?" or "Does this approach adhere to the basic principles of secure smart contracts?"

[0074] Next comes model reasoning. A large language model can infer answers to the original question based on facts about high-level concepts or principles. This is known as abstract-based reasoning. In this embodiment, these abstract cues can be used for reasoning, attempting to analyze the code from a broader perspective, including comparing the strengths and weaknesses of different implementations and how they align with known best practices or common bad practices. This approach effectively identifies potential security risks in smart contract code and generates audit findings.

[0075] In one embodiment, a large language model smart contract code audit method based on retrieval enhancement generation and step-back prompt words is provided, which can also include a process of calculating an audit result set. The specific process includes: using the step-back prompt word method to guide the large language model, and using the large language model to perform smart contract practice audits, security vulnerability or logic error audits, and code behavior audits based on the input code snippet set and risk point set to obtain an audit result set.

[0076] That is, in this embodiment, the computer device can use the step-back prompting method to guide the large language model to think from a higher-level concept and principle. By raising abstract questions, the model is prompted to consider whether the code implementation complies with the best practices of smart contracts, whether there are potential security vulnerabilities or logical errors, and whether the code behaves as expected in specific situations. The principle of the step-back prompt is to help identify potential design flaws and security risks by guiding the model to focus on higher-level logic and design principles. The input is a risk point set {r i}, the output is the audit result set {R i}.

[0077] In one embodiment, a large language model smart contract code audit method based on retrieval-enhanced generation and step-back prompt words may also include a process for generating an audit report. The specific process includes: evaluating and classifying each risk based on a set of risk points according to an audit result set to obtain a risk level; searching for risk descriptions and improvement suggestions corresponding to the risk level, and generating an audit report based on the risk descriptions and improvement suggestions.

[0078] Computer equipment can evaluate and classify identified risks based on the audit result set, determine the severity of the risks, the scope of impact, and possible attack paths, divide the risks into three levels: high, medium, and low, and provide detailed descriptions and improvement suggestions for each risk to generate an audit report.

[0079] Among them, a detailed audit report is generated, which includes the risk ID, risk title, risk type, problem code block, code location, risk level, cause analysis, and improvement suggestions. After the audit report is generated, the developer can modify the code according to the suggestions in the report. The modified code can be input into the audit system again for iterative audit to ensure that all risks are effectively handled. That is, the input is the audit result set {R i}, and the output is the audit report R. The audit report can be output in JSON format to facilitate developers' understanding and use, and supports integration with other development tools.

[0080] In order to accurately locate bad practices in the smart contract code, first extract the JSON array containing the bad practice information from the provided session history file. These JSON arrays may be scattered in different locations in the session history, so they need to be combined into a complete array and the ID of each bad practice needs to be reassigned to ensure its uniqueness and continuity. Specifically, in order to locate the specific location of the bad practice in the code, the similarity between the target string (that is, the code block of the bad practice) and each line in the code text can be calculated. A text similarity algorithm (such as SequenceMatcher) is used to compare the target string with each line in the code, find the line with the highest similarity, and record the line number of the most similar line so that the specific location of the bad practice can be marked in the audit report. In the extracted and combined JSON array, the code line number information of each bad practice can be added. In this way, each bad practice not only has a description of its code block, but also includes its specific line number position in the code.

[0081] Next, the JSON array containing the line number information can be converted into a detailed audit report. The generated audit report will contain the following information: Risk ID (an ID that uniquely identifies each bad practice), Risk Title (a brief title describing the bad practice), Risk Type (the type of risk to which the bad practice belongs), Problem Code Block (the specific code snippet of the bad practice), Code Location (the specific line number of the bad practice in the code), Risk Level (the severity level of the bad practice), Cause Analysis (a detailed analysis of the cause of the bad practice), and Improvement Suggestions (remediation suggestions for the bad practice).

[0082] Developers can modify their code based on the recommendations in the audit report. The modified code can then be re-entered into the audit system for an iterative audit to ensure all risks are effectively addressed. This iterative process not only gradually eliminates all bad practices in the code, but also continuously improves code quality and security.

[0083] In one embodiment, a large language model smart contract code audit method based on retrieval-enhanced generation and step-back prompt words may also include a process of optimizing the large language model. The specific process includes: collecting feedback data generated during the audit process, and adjusting the parameters of the large language model based on the feedback data to obtain an optimized large language model.

[0084] In this embodiment, the computer device also includes a continuous learning mechanism that uses data and feedback collected during the audit process to continuously optimize the performance of the large language model. By analyzing historical audit results, the large language model can learn new security risk patterns and best practices, thereby improving the accuracy and efficiency of future audits.

[0085] The overall framework of the large language model smart contract code audit method based on retrieval-enhanced generation and step-back prompt words is as follows: Figure 4 As shown in the figure, the smart contract code to be audited, i.e. the source code, is cut into pieces and the feature vectors are generated by the embedding model and stored in the vector database. When searching, the retrieval enhancement generation RAG technology can be used to obtain the historical audit cases corresponding to the smart contract code to be audited. Combined with the context and prompt information, the audit report is generated by the large language model using the step-back prompt word method.

[0086] The proposed large language model smart contract code auditing method, based on retrieval-enhanced generation and step-back prompts, can effectively identify and analyze potential security risks in smart contracts and provide detailed improvement suggestions, helping developers improve code quality and security, thereby achieving safer and more reliable smart contracts. By combining the powerful semantic understanding capabilities of large language models, the efficient retrieval mechanism of vector databases, and the generation enhancement of RAG technology, this method significantly improves the efficiency and accuracy of smart contract code auditing.

[0087] The present application provides a large language model smart contract code auditing method based on retrieval-enhanced generation and step-back prompts. By subdividing the smart contract code into logical units and leveraging the powerful capabilities of the large language model, it can more accurately identify and analyze potential risks, thereby improving the security and reliability of the smart contract. Combining step-back prompts and RAG technology, it guides the large language model to abstractly think from higher-level concepts and principles, and supports efficient feature retrieval and risk assessment, significantly improving audit efficiency and accuracy, and providing comprehensive security protection for the development and application of smart contracts. The continuous learning mechanism enables the audit system to continuously adapt to new security risks and best practices, ensuring that efficient audit capabilities are maintained in a changing environment. It can not only effectively identify potential security risks in smart contracts, but also provide detailed improvement suggestions to help developers improve code quality and security, and ultimately improve the reliability and security of smart contracts.

[0088] It should be understood that, although the various steps in the above flow chart are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the above flow chart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0089] In one embodiment, Figure 5 As shown, a large language model smart contract code audit system based on retrieval enhancement generation and step-back prompt words is provided, including: a code processing module 510, a similar feature vector calculation module 520, a historical audit case search module 530, a risk identification module 540 and an audit module 550, wherein:

[0090] The code processing module 510 is used to segment the smart contract code to be audited, obtain a set of code snippets, and input them into the embedding model to generate feature vectors;

[0091] A similar feature vector calculation module 520 is used to store each feature vector in a vector database, calculate the cosine similarity between each feature vector, and output a similar feature vector set based on the calculation result;

[0092] A historical audit case search module 530 is used to obtain historical audit cases corresponding to the smart contract code to be audited based on a set of similar feature vectors using the retrieval enhancement generation (RAG) technology;

[0093] The risk identification module 540 is used to input the code snippet set and historical audit cases into the large language model, identify security risk points through the large language model, and obtain a risk point set;

[0094] The audit module 550 is used for the large language model to adopt a step-back prompt word method, calculate an audit result set based on the input code snippet set and risk point set, and generate an audit report based on the audit result set.

[0095] In one embodiment, the code processing module 510 is further used to determine the code structure characteristics of the smart contract code to be audited, extract the fragment length in the code structure characteristics; segment the smart contract code to be audited according to the fragment length, and divide the smart contract code to be audited into logical units.

[0096] In one embodiment, the similar feature vector calculation module 520 is also used to obtain the dot product and the second norm of the two feature vectors whose cosine similarity is to be calculated; calculate the cosine similarity between the two feature vectors based on the calculated dot product and the second norm; calculate the cosine similarity between each feature vector in the vector database by calculating the dot product and the second norm, and obtain a set of similar feature vectors.

[0097] In one embodiment, the vector database supports query and retrieval operations; and the vector database is used to store feature vectors that describe semantic and structural characteristics of the code.

[0098] In one embodiment, the historical audit case search module 530 is also used to retrieve code features corresponding to the smart contract code to be audited from the vector database based on a set of similar feature vectors and using retrieval enhancement generation RAG technology; and to search for historical audit cases based on the code features corresponding to the smart contract code to be audited.

[0099] In one embodiment, the risk identification module 540 is also used to use a large language model to perform semantic interpretation based on the input code snippet set, and extract the target features and logical structure in the code; through the large language model, based on the target features and logical structure, combined with historical audit cases, security risk points are identified to obtain a risk point set.

[0100] In one embodiment, the audit module 550 is also used to guide the large language model using a step-back prompt word method, and perform smart contract practice audits, security vulnerability or logic error audits, and code behavior audits based on the input code snippet set and risk point set through the large language model to obtain an audit result set.

[0101] In one embodiment, the audit module 550 is also used to evaluate and classify each risk based on the risk point set according to the audit result set to obtain a risk level; find the risk description and improvement suggestions corresponding to the risk level, and generate an audit report based on the risk description and improvement suggestions.

[0102] In one embodiment, the audit module 550 is further configured to collect feedback data generated during the audit process, and adjust parameters of the large language model based on the feedback data to obtain an optimized large language model.

[0103] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, memory, a network interface, a display screen, and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When executed by the processor, the computer program implements a large language model smart contract code audit method based on retrieval-enhanced generation and back-step prompt words. The display screen of the computer device can be a liquid crystal display or an electronic ink display screen. The input device of the computer device can be a touch layer covering the display screen, or keys, a trackball, or a touchpad provided on the computer device housing, or an external keyboard, touchpad, or mouse.

[0104] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0105] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of a large language model smart contract code audit method based on retrieval-enhanced generation and step-back prompt words.

[0106] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of a large language model smart contract code audit method based on retrieval-enhanced generation and step-back prompt words are implemented.

[0107] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0108] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A large language model smart contract code auditing method based on retrieval-enhanced generation and step-back prompt words, characterized in that: The method comprises: The smart contract code to be audited is segmented into pieces to obtain a set of code snippets and input into the embedding model to generate feature vectors. storing each of the feature vectors in a vector database, calculating the cosine similarity between each of the feature vectors, and outputting a set of similar feature vectors according to the calculation results; Based on the similar feature vector set, the retrieval enhancement generation (RAG) technology is used to obtain historical audit cases corresponding to the smart contract code to be audited; Inputting the code snippet set and historical audit cases into a large language model, identifying security risk points through the large language model, and obtaining a risk point set; The large language model adopts a step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, and generates an audit report based on the audit result set.

2. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The smart contract code to be audited is divided into sections, including: Determine the code structure characteristics of the smart contract code to be audited, and extract the fragment lengths in the code structure characteristics; The smart contract code to be audited is segmented according to the fragment length, and the smart contract code to be audited is divided into logical units.

3. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: Calculating the cosine similarity between each of the feature vectors and outputting a set of similar feature vectors according to the calculation result, including: Get the dot product and binorm of the two feature vectors to be calculated for cosine similarity; Calculate the cosine similarity between the two feature vectors based on the calculated dot product and the bi-norm; The cosine similarity between each of the feature vectors in the vector database is calculated by calculating the dot product and the bi-norm to obtain a set of similar feature vectors.

4. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The vector database supports query and retrieval operations; and the vector database is used to store feature vectors that describe code semantics and structural characteristics.

5. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: Based on the similar feature vector set, the retrieval enhancement generation (RAG) technology is used to obtain historical audit cases corresponding to the smart contract code to be audited, including: Based on the similar feature vector set, using the retrieval enhancement generation (RAG) technology to retrieve code features corresponding to the smart contract code to be audited from the vector database; Search historical audit cases based on code features corresponding to the smart contract code to be audited.

6. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The code snippet set and historical audit cases are input into a large language model, and security risk points are identified by the large language model to obtain a risk point set, including: Using the large language model to perform semantic interpretation based on the input code snippet set, and extracting target features and logical structures in the code; Through the large language model, based on the target features and logical structure, combined with the historical audit cases, security risk points are identified to obtain a risk point set.

7. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The large language model adopts a step-back prompt word method to calculate an audit result set based on the input code snippet set and risk point set, including: A step-back prompt word method is used to guide the large language model, and the large language model performs smart contract practice audit, security vulnerability or logic error audit, and code behavior audit based on the input code snippet set and risk point set to obtain an audit result set.

8. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: Generating an audit report based on the audit result set, including: According to the audit result set, each risk is evaluated and classified based on the risk point set to obtain a risk level; Find a risk description and improvement suggestions corresponding to the risk level, and generate an audit report based on the risk description and improvement suggestions.

9. The large language model smart contract code auditing method based on retrieval enhancement generation and step-back prompt words according to claim 1 is characterized in that: The method further comprises: Feedback data generated during the audit process is collected, and parameters of the large language model are adjusted according to the feedback data to obtain an optimized large language model.

10. A large language model smart contract code audit system based on retrieval-enhanced generation and step-back prompt words, characterized by: The system comprises: The code processing module is used to segment the smart contract code to be audited, obtain a set of code snippets, and input them into the embedding model to generate various feature vectors; A similar feature vector calculation module is used to store each of the feature vectors in a vector database, calculate the cosine similarity between each of the feature vectors, and output a similar feature vector set according to the calculation result; A historical audit case search module is used to obtain historical audit cases corresponding to the smart contract code to be audited based on the similar feature vector set using the retrieval enhancement generation (RAG) technology; a risk identification module, configured to input the code snippet set and historical audit cases into a large language model, identify security risk points through the large language model, and obtain a risk point set; The audit module is used for the large language model to adopt a step-back prompt word method, calculate an audit result set based on the input code snippet set and risk point set, and generate an audit report based on the audit result set.

Images