Intelligent contract vulnerability automatic detection method and system based on variable snapshots

Abstract

The invention discloses an intelligent contract vulnerability automatic detection method and system based on a variable snapshot, and the method comprises the steps: compiling a target contract, generating a byte code, and transmitting the byte code, the snapshot and a transaction to an Ethereum virtual machine EVM for instrumentation processing; then, a contract state and variation constraint conditions in a block chain environment are collected through symbol taint analysis, and a snapshot check point is set at an execution branch; then, for each snapshot check point, performing variation on a contract execution state and a block chain environment to generate a new variation snapshot; the variation snapshot is used for starting a bifurcation process, and the contract is tested in different execution contexts; and finally, based on a predefined fuzzy test judgment method, analyzing execution tracks of the host process and the bifurcation process, and identifying and reporting potential contract vulnerabilities. According to the method, directional testing is adopted, and static analysis and fuzzy testing are combined, so that quick and accurate detection of the vulnerability of the smart contract is realized.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology in computer science, and relates to a smart contract vulnerability detection method and system, specifically, an automatic smart contract vulnerability detection method and system based on mutable snapshots. Background Art

[0002] Smart contracts, as computer programs that automatically execute contract terms, are widely used with the support of blockchain technology. However, due to the immutability of smart contracts and the high value of digital assets, vulnerabilities in contracts may lead to serious security issues. Traditional vulnerability detection methods have problems such as insufficient coverage and high false positive rates. Therefore, a more efficient and accurate vulnerability detection technology is needed to ensure the security and reliability of smart contracts. Summary of the invention

[0003] In order to solve the problems of insufficient vulnerability detection coverage and high false alarm rate in the prior art, the present invention proposes an automatic detection method for smart contract vulnerabilities based on mutable snapshots by combining symbolic taint analysis and fuzzy testing technology.

[0004] The technical solution adopted by the method of the present invention is: a method for automatically detecting smart contract vulnerabilities based on mutable snapshots, comprising the following steps:

[0005] Step 1: Compile the target contract, generate bytecode, and pass the bytecode together with the snapshot and transaction to the Ethereum virtual machine EVM for instrumentation processing;

[0006] Step 2: Collect mutation constraints in the contract state and blockchain environment through symbolic taint analysis, and set snapshot checkpoints at the execution branches;

[0007] Step 3: For each snapshot checkpoint, mutate the contract execution state and blockchain environment to generate a new mutated snapshot; use the mutated snapshot to start the fork process and test the contract in different execution contexts;

[0008] Step 4: Based on the predefined fuzz testing judgment method, analyze the execution traces of the main process and forked process to identify and report potential contract vulnerabilities.

[0009] Preferably, in step 2, the symbolic taint analysis is performed by symbolizing the execution path of the contract to collect symbolic expressions and path constraints about the contract state and blockchain environment.

[0010] Preferably, in step 3, the components of the mutation snapshot consist of two parts; the first part is a smart contract state variable consisting of a key-value pair, wherein the key represents the slot where the state variable is stored in the smart contract persistent storage structure (storage), and the value represents the specific value of the state variable in the slot; the second part consists of a blockchain environment, including the blockchain environment on which the smart contract execution depends, including timestamp, block number, account balance, GAS price and transaction incoming funds.

[0011] As a preferred method, in step 3, the collected contract state and the constraints in the blockchain environment are used as the constraints of the snapshot mutation, and the constraint solver Solve is used to solve the constraints. The obtained results are used as the mutation results of the snapshot and used as the input of the fuzzy testing phase; specifically, for the mutation of the contract state, the mutation constraint set of the state variable X is first defined Among them, i represents different execution paths during fuzz testing, state[X] i represents the mutation constraint generated on execution path i. Different execution paths will generate different mutation constraints. The final set of mutation constraints is the union of all these constraints. Then a constraint is randomly selected from MC[X], and the constraint solver Solve is used to solve a series of feasible values ​​of X as the mutation result X′=Solve(state[X] i ), state[X] i ∈MC[X].

[0012] Preferably, in step 3, a snapshot checkpoint mechanism is used to determine the timing of snapshot taking, recovery and mutation; specifically, first, multiple checkpoints are defined and set during the contract execution process, which are specific locations where program state variables or blockchain environment variables can affect contract execution; the checkpoints are selected based on the program encountering key instructions (such as SSTORE, TIMESTAMP, NUMBER, etc.), at which the system will take the current snapshot; then, the snapshot is mutated at each checkpoint, and a fork execution is performed to test the behavior of the contract under the mutated snapshot; during the fork execution process, the consistency of the main execution path is retained until the checkpoint, and snapshots are mutated at these checkpoints to trigger potential new paths.

[0013] Preferably, in step 4, the fuzz test is divided into two stages: a main execution stage and a branch execution stage; in the main execution stage, a snapshot selected from a snapshot corpus is used as the execution environment, and mutation constraints are collected during this period; in the branch execution stage, the snapshot used is the mutation result, and mutation constraints are collected during this period; in a fuzz test stage, the main execution is performed only once, while the branch execution is performed multiple times according to the mutation results.

[0014] As a preferred method, further feedback information is fed back to the seed library and snapshot library to optimize the fuzz testing cycle;

[0015] The specific implementation includes the following steps:

[0016] Step 5.1: Initialize the seed corpus and snapshot corpus;

[0017] Initialize the seed corpus, which contains the seed of a single transaction, including the encoded function selector, function parameters and call value; initialize the snapshot corpus, including the locally deployed blockchain environment and the initial state of the contract; the seed obtains the ABI (application binary interface) by compiling the smart contract, generates the function selector, and randomly selects valid function parameters and call values; the snapshot stores the initial state of the contract and is updated as needed during execution;

[0018] Step 5.2: Seed corpus and snapshot corpus update;

[0019] The seed corpus is updated through a genetic algorithm, including selection, crossover, and mutation; the fitness score of the seed is calculated based on the coverage feedback and data dependency executed by the Ethereum Virtual Machine (EVM);

[0020] Fitness=α×S branch +(1-α)×S dep ;

[0021] Among them, S branch is the branch score calculated based on the newly covered branch edges, S dep is a data dependency score calculated based on the number of state modifications during execution, and α is a constant less than 1; seeds with high selection probability P are preferentially selected for crossover and mutation;

[0022]

[0023] Where n is the total number of seeds in the fuzz test generation; in the crossover operation, two seeds are selected as parents, their function parameters and call values ​​are split, and these components are exchanged to generate two new offspring; in the offspring, function parameters are mutated with a certain probability; through taint analysis, a mutation pool is maintained to collect the values ​​encountered in the branch predicate; parameters are mutated randomly or values ​​are selected from the mutation pool for mutation;

[0024] Updates to the snapshot corpus,from new snapshots generated by the main execution, and only verified,snapshots are added to the corpus;

[0025] Step 5.3: Scheduling of seeds and snapshots;

[0026] Fuzz testing is performed using a genetic algorithm. At the beginning of each generation, transactions are randomly selected from the seed corpus for testing, and snapshots are selected in the order they were saved. The snapshots are added to the corpus after the main execution modifies the state or blockchain environment and are used in the next execution.

[0027] Step 5.4: Test the oracle.

[0028] By analyzing the execution traces of the main and forked executions, potential vulnerabilities are detected using predefined test oracles.

[0029] As a preference, further on-chain fuzz testing is performed through API calls; by integrating the API provided by the blockchain node service provider, the information on the blockchain is recorded as an on-chain snapshot.

[0030] The technical solution adopted by the system of the present invention is: a smart contract vulnerability automatic detection system based on variable snapshots, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the smart contract vulnerability automatic detection method based on variable snapshots when executing the program.

[0031] Compared with the prior art, the beneficial effects of the present invention can include:

[0032] (1) The detection method provided by the present invention combines symbolic taint analysis and mutation snapshot technology. Compared with the traditional fuzz testing method, it can more effectively cover the different states of contract execution and improve the coverage and accuracy of vulnerability detection.

[0033] (2) The present invention further reduces the false alarm rate and improves the efficiency of vulnerability detection through feedback of detection results and seed optimization. The dynamically updated snapshot and seed library ensure the accuracy and effectiveness of the test data.

[0034] (3) The present invention supports on-chain fuzzy testing, which enables the detection tool to verify the security of the contract in a real blockchain environment, further enhancing the reliability and practicality of the detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0036] Figure 1 It is the principle framework of the method of the embodiment of the present invention;

[0037] Figure 2 This is a flowchart of symbol stain analysis in an embodiment of the present invention;

[0038] Figure 3 A flowchart of snapshot mutation and fork execution in an embodiment of the present invention;

[0039] Figure 4 This is a flowchart of genetic algorithm optimization and on-chain testing in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to facilitate ordinary technicians in the field to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0041] Please see Figure 1 , this embodiment provides a method for automatically detecting smart contract vulnerabilities based on mutable snapshots, comprising the following steps:

[0042] Step 1: Compile the target contract and convert it into bytecode, and pass the bytecode together with the snapshots and transactions provided by the snapshot library and seed library respectively to the instrumented Ethereum Virtual Machine (EVM). The snapshot serves as the baseline for the initial state of the contract and provides a locally deployed blockchain environment. In the initial stage of contract execution, symbolic taint analysis is used to collect mutation constraints in the contract state and blockchain environment.

[0043] Step 2: Set snapshot checkpoints at execution branches that depend on the contract state or blockchain environment to facilitate detailed analysis and testing in subsequent steps.

[0044] Please see Figure 2 In one embodiment, the symbolic taint analysis is performed by symbolizing the execution path of the contract to collect symbolic expressions and path constraints about the contract state and blockchain environment.

[0045] Step 3: During the detection process, for each checkpoint, the system mutates the state and blockchain environment related to the contract execution, generating a series of new snapshots. These mutated snapshots are used to start a new forked process to test the contract in a different execution context. The execution of the forked process is consistent with the main process, based on the same input transactions, unmutated contract state and blockchain environment, but the only difference is the application of mutated elements. In order to ensure the validity of the mutated constraints, symbolic taint analysis is continued in the forked process to ensure that all constraints can be updated in real time and reflect the latest execution.

[0046] In one embodiment, the components of the mutation snapshot consist of two parts; the first part is the smart contract state variable composed of key-value pairs, where the key represents the slot where the state variable is stored in the smart contract persistent storage structure (storage), and the value represents the specific value of the state variable in the slot; the second part consists of the blockchain environment, which mainly includes the blockchain environment on which the smart contract execution depends, including timestamp (TIMESTAMP), block number (BLOCKNUMBER), account balance (BALANCE), GAS price (GASPRICE) and transaction incoming funds (CALLVALUE).

[0047] In one implementation, the collected contract states and constraints in the blockchain environment are used as constraints for snapshot mutation, and the constraint solver Solve is used to solve the constraints. The obtained results are used as snapshot mutation results for input in the fuzzy testing phase. Specifically, for the mutation of the contract state, the mutation constraint set of the state variable X is first defined. Among them, i represents different execution paths during fuzz testing, state[X] i represents the mutation constraint generated on execution path i. Different execution paths will generate different mutation constraints. The final set of mutation constraints is the union of all these constraints. Then a constraint is randomly selected from MC[X], and the constraint solver Solve is used to solve a series of feasible values ​​of X as the mutation result X′=Solve(state[X] i ), state[X] i ∈MC[X].

[0048] Please see Figure 3 In one embodiment, a snapshot checkpoint mechanism is used to determine the timing of snapshot taking, recovery, and mutation; specifically, first, multiple checkpoints are defined and set during the contract execution process, which are specific locations where program state variables or blockchain environment variables can affect the contract execution; the checkpoints are selected based on the program encountering key instructions (such as SSTORE, TIMESTAMP, NUMBER, etc.), at which the system will take the current snapshot; then, the snapshot is mutated at each checkpoint, and a fork execution is performed to test the behavior of the contract under the mutated snapshot; during the fork execution process, the consistency of the main execution path is retained until the checkpoint, and snapshots are mutated at these checkpoints to trigger potential new paths.

[0049] Step 4: Based on the pre-defined test judgment method (Test Oracles), the system conducts a comprehensive analysis of the execution traces of the main process and the forked process to identify and report potential contract vulnerabilities. In this process, the execution results will be fed back to the seed library and snapshot library as feedback information, thereby providing guidance and optimization for subsequent fuzz testing cycles.

[0050] In one embodiment, the fuzz test is divided into two stages: a main execution stage and a branch execution stage; in the main execution stage, a snapshot selected from a snapshot corpus is used as the execution environment, and mutation constraints are collected during this period; in the branch execution stage, the snapshot used is the mutation result, and mutation constraints are collected during this period; in a fuzz test stage, the main execution is performed only once, while the branch execution is performed multiple times according to the mutation results.

[0051] To further enhance the effectiveness of the test, the seed library optimizes and updates the seeds based on the feedback of coverage and data dependency by applying a genetic algorithm. At the same time, the snapshot library saves the latest state and blockchain environment generated by the contract execution to ensure the accuracy and integrity of the state and environment data during the test. In addition, to expand the functionality of on-chain fuzz testing, the system receives real-time data on the on-chain state and blockchain environment through the API provided by the blockchain node service provider, thereby supporting fuzz testing in a real blockchain environment.

[0052] Please see Figure 4 , the specific implementation includes the following steps:

[0053] Step 5.1: Initialize the seed corpus and snapshot corpus;

[0054] Initialize the seed corpus, which contains the seed of a single transaction, including the encoded function selector, function parameters and call value; initialize the snapshot corpus, including the locally deployed blockchain environment and the initial state of the contract; the seed obtains the ABI (application binary interface) by compiling the smart contract, generates the function selector, and randomly selects valid function parameters and call values; the snapshot stores the initial state of the contract and is updated as needed during execution;

[0055] Step 5.2: Seed corpus and snapshot corpus update;

[0056] The seed corpus is updated through a genetic algorithm, including selection, crossover, and mutation; the fitness score of the seed is calculated based on the coverage feedback and data dependency executed by the Ethereum Virtual Machine (EVM);

[0057] Fitness=α×S branch +(1-α)×S dep ;

[0058] Among them, S branch is the branch score calculated based on the newly covered branch edges, S dep is a data dependency score calculated based on the number of state modifications during execution, and α is a constant less than 1; seeds with high selection probability P are preferentially selected for crossover and mutation;

[0059]

[0060] Where n is the total number of seeds in the fuzz test generation; in the crossover operation, two seeds are selected as parents, their function parameters and call values ​​are split, and these components are exchanged to generate two new offspring; in the offspring, function parameters are mutated with a certain probability; through taint analysis, a mutation pool is maintained to collect the values ​​encountered in the branch predicate; parameters are mutated randomly or values ​​are selected from the mutation pool for mutation;

[0061] Updates to the snapshot corpus mainly come from new snapshots generated by the main execution, and only verified snapshots will be added to the corpus;

[0062] Step 5.3: Scheduling of seeds and snapshots;

[0063] Fuzz testing is performed using a genetic algorithm. At the beginning of each generation, transactions are randomly selected from the seed corpus for testing, and snapshots are selected in the order in which they are saved. The snapshots are added to the corpus after the main execution modifies the state or blockchain environment and are used in the next execution. This approach ensures continuous exploration of the contract state and resets the state when the contract is complex to improve testing efficiency.

[0064] Step 5.4: Test the oracle.

[0065] By analyzing the execution traces of the main execution and forked execution, predefined test oracles are used to detect potential vulnerabilities; the system's test oracle can detect vulnerabilities such as Ethereum leakage, reentry attacks, control delegate calls, dangerous delegate calls, suicide attacks, and locked Ethereum.

[0066] In one implementation, on-chain fuzz testing is supported via simple API calls;

[0067] By integrating the API provided by the blockchain node service provider, the information on the blockchain is recorded as a snapshot on the chain. This method enables the system to perform fuzz testing in a real blockchain environment and further verify the security of the contract.

[0068] This embodiment also provides an automatic smart contract vulnerability detection system based on mutable snapshots, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the automatic smart contract vulnerability detection method based on mutable snapshots is implemented.

[0069] The computer program can efficiently and automatically detect various vulnerabilities in smart contracts, including Ethereum leakage, reentrancy attacks, control delegate calls, dangerous delegate calls, suicide attacks, and locked Ethereum vulnerabilities. The program implements its functions through the following steps: First, initialize the seed and snapshot corpus, where the seed contains the encoded function selector, function parameters, and call values, and the snapshot saves the initial state of the contract and the blockchain environment. Secondly, the seed corpus is updated using a genetic algorithm, the seed is optimized through selection, crossover, and mutation, and the fitness score of the seed is calculated based on the coverage feedback and data dependency of the EVM execution. At the same time, the new snapshot generated by the main execution will be verified and added to the snapshot corpus. Third, the scheduling process of seeds and snapshots is carried out in generations using a genetic algorithm, and each generation randomly selects transactions from the seed corpus for testing, and uses snapshots in sequence. The system detects potential vulnerabilities by analyzing the execution traces of the main execution and fork execution using a predefined test oracle. Finally, the system supports on-chain fuzz testing through API calls, integrates the API provided by the blockchain node service provider to record on-chain snapshots, and realizes testing support in a real blockchain environment.

[0070] The present invention is further described below through specific experiments.

[0071] According to the scheme of the present invention, a corresponding smart contract vulnerability detection tool was written for experiment. The experimental data set of the present invention is combined on the basis of data sets constructed by multiple related works, and the duplicate contracts and contracts lacking compiler version information are removed, and finally a data set of 1012 marked contracts with 6 types of vulnerabilities is obtained. For comparison, 5 mainstream smart contract vulnerability detection tools in this field are selected, namely ITYFuzz, sFuzz, Smartian, IR-Fuzz and ConFuzzius.

[0072] The tool of the present invention and the comparative tools were run on the data set, and the number of true positive and false negative reports of each tool was counted. The tool of the present invention detected the largest number of vulnerabilities, detecting 957 out of 1012 vulnerable contracts, 94 more than the second place and 358 more than the last place, which shows the comprehensiveness of the present invention in detecting contract vulnerabilities.

[0073] The time and number of transactions required for each task to detect the corresponding number of vulnerabilities were counted on the data set. The tool of the present invention detected the most vulnerabilities in the shortest time, of which 500 vulnerabilities were detected within 10 seconds. The present invention also had the highest transaction utilization rate when detecting vulnerabilities, detecting 600 vulnerabilities using 1,000 transactions, while other tasks generally required 20,000 transactions.

[0074] The time and transaction number distribution required for detecting each vulnerability are statistically analyzed on the data set. The mean and median of the time and transaction number required for detecting vulnerabilities in the present invention are the lowest among all the tasks. The detection time is 4.8 times faster than the second fastest task and 20.2 times faster than the slowest task.

[0075] The above experiment compares the tool of the present invention with related work on a labeled data set, which shows that the vulnerability detection recall rate of the present invention is higher than that of the comparison work, and the time and number of transactions required for vulnerability detection are lower than those of the related work, further proving the effectiveness and superiority of the present invention in the task of smart contract vulnerability detection.

[0076] The present invention combines mutable snapshots with the cyclic process of fuzz testing to save, restore and mutate the state of smart contracts and blockchain environment. The present invention performs symbolic taint analysis on smart contracts, obtains mutation constraints, generates mutation snapshots, and performs multiple tests in the Ethereum virtual machine, and finally detects potential vulnerabilities through comprehensive analysis. The present invention uses directional testing, combined with static analysis and fuzz testing, to achieve rapid and accurate detection of smart contract vulnerabilities.

[0077] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0078] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A method for automatically detecting smart contract vulnerabilities based on mutable snapshots, characterized in that: The following steps are involved: Step 1: Compile the target contract, generate bytecode, and pass the bytecode together with the snapshot and transaction to the Ethereum virtual machine EVM for instrumentation processing; Step 2: Collect mutation constraints in the contract state and blockchain environment through symbolic taint analysis, and set snapshot checkpoints at the execution branches; Step 3: For each snapshot checkpoint, mutate the contract execution state and blockchain environment to generate a new mutated snapshot; use the mutated snapshot to start the fork process and test the contract in different execution contexts; Step 4: Based on the predefined fuzz testing judgment method, analyze the execution traces of the main process and forked process to identify and report potential contract vulnerabilities.

2. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 2, the symbolic taint analysis is performed by symbolizing the execution path of the contract to collect symbolic expressions and path constraints about the contract status and blockchain environment.

3. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 3, the components of the mutation snapshot consist of two parts; the first part is the smart contract state variable composed of key-value pairs, where the key represents the slot where the state variable is stored in the smart contract persistent storage structure, and the value represents the specific value of the state variable in the slot; the second part consists of the blockchain environment, including the blockchain environment that the smart contract execution depends on, including timestamp, block number, account balance, GAS price and transaction incoming funds.

4. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 3, the collected contract states and constraints in the blockchain environment are used as constraints for snapshot mutation, and the constraint solver Solve is used to solve the constraints. The obtained results are used as the mutation results of the snapshot and used as the input of the fuzzy testing phase. Specifically, for the mutation of the contract state, the mutation constraint set of the state variable X is first defined. Among them, i represents different execution paths during fuzz testing, state[X] i represents the mutation constraint generated on execution path i. Different execution paths will generate different mutation constraints. The final set of mutation constraints is the union of all these constraints. Then a constraint is randomly selected from MC[X], and the constraint solver Solve is used to solve a series of feasible values ​​of X as the mutation result X′=Solve(state[X] i ),state[X] i ∈MC[X].

5. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 3, the snapshot checkpoint mechanism is used to determine the timing of snapshot taking, recovery, and mutation. Specifically, first, multiple checkpoints are defined and set during the contract execution process. These checkpoints are specific locations where program state variables or blockchain environment variables can affect contract execution. The checkpoints are selected based on when the program encounters critical instructions, at which the system takes the current snapshot. Next, snapshot mutation is performed at each checkpoint, and fork execution is performed to test the behavior of the contract under the mutated snapshot. During the fork execution process, the consistency of the main execution path is retained until the checkpoint, and snapshot mutations are performed at these checkpoints to trigger potential new paths.

6. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 4, the fuzz test is divided into two stages: the main execution stage and the branch execution stage; In the main execution phase, a snapshot selected from the snapshot corpus is used as the execution environment, and mutation constraints are collected during this period; in the branch execution phase, the snapshot used is the mutation result, and mutation constraints are collected during this period; in a fuzz testing phase, the main execution is performed only once, while the branch execution is performed multiple times according to the mutation results.

7. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to any one of claims 1 to 6, characterized in that: Further feedback information is fed back to the seed library and snapshot library to optimize the fuzz testing cycle; The specific implementation includes the following steps: Step 5.1: Initialize the seed corpus and snapshot corpus; Initialize the seed corpus, which contains the seed of a single transaction, including the encoded function selector, function parameters, and call value; initialize the snapshot corpus, including the locally deployed blockchain environment and the initial state of the contract; the seed obtains the ABI by compiling the smart contract, generates the function selector, and randomly selects valid function parameters and call values; the snapshot stores the initial state of the contract and is updated as needed during execution; Step 5.2: Seed corpus and snapshot corpus update; The seed corpus is updated through a genetic algorithm, including selection, crossover, and mutation; the fitness score of the seed is calculated based on the coverage feedback and data dependency executed by the Ethereum Virtual Machine (EVM); Fitness=α×S branch +(1-α)×S dep ; Among them, S branch is the branch score calculated based on the newly covered branch edges, S dep is a data dependency score calculated based on the number of state modifications during execution, and α is a constant less than 1; seeds with high selection probability P are preferentially selected for crossover and mutation; Where n is the total number of seeds in the fuzz test generation; in the crossover operation, two seeds are selected as parents, their function parameters and call values ​​are split, and these components are exchanged to generate two new offspring; in the offspring, function parameters are mutated with a certain probability; through taint analysis, a mutation pool is maintained to collect the values ​​encountered in the branch predicate; parameters are mutated randomly or values ​​are selected from the mutation pool for mutation; Updates to the snapshot corpus,come from new snapshots generated by the main execution, and only,validated snapshots are added to the corpus; Step 5.3: Scheduling of seeds and snapshots; Fuzz testing is performed using a genetic algorithm. At the beginning of each generation, transactions are randomly selected from the seed corpus for testing, and snapshots are selected in the order they were saved. The snapshots are added to the corpus after the main execution modifies the state or blockchain environment and are used in the next execution. Step 5.4: Test the oracle. By analyzing the execution traces of the main and forked executions, potential vulnerabilities are detected using predefined test oracles.

8. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to any one of claims 1 to 6, characterized in that: Further on-chain fuzz testing is performed through API calls; by integrating the API provided by the blockchain node service provider, the information on the blockchain is recorded as an on-chain snapshot.

9. A smart contract vulnerability automatic detection system based on mutable snapshots, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method for automatically detecting smart contract vulnerabilities based on mutable snapshots as described in any one of claims 1 to 8 is implemented.

Images