A method and system for automatically detecting smart contract vulnerabilities based on mutable snapshots

Abstract

The present invention discloses a method and system for automatically detecting smart contract vulnerabilities based on mutable snapshots. First, the target contract is compiled to generate bytecode, which is then passed along with the snapshot and transaction to the Ethereum virtual machine (EVM) for instrumentation processing. Symbolic taint analysis is then used to collect mutation constraints in the contract state and blockchain environment, and snapshot checkpoints are set at execution branches. For each snapshot checkpoint, the contract execution state and blockchain environment are mutated to generate new mutation snapshots. The mutation snapshots are used to start a forked process and test the contract in different execution contexts. Finally, based on a predefined fuzz testing judgment method, the execution trajectories of the main process and forked process are analyzed to identify and report potential contract vulnerabilities. The present invention uses targeted testing, combined with static analysis and fuzz testing, to achieve rapid and accurate detection of smart contract vulnerabilities.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology in computer science, and relates to a smart contract vulnerability detection method and system, specifically a smart contract vulnerability automatic detection method and system based on mutable snapshots. Background Art

[0002] Smart contracts, computer programs that automatically execute contract terms, have gained widespread adoption thanks to blockchain technology. However, due to the immutability of smart contracts and the high value of digital assets, vulnerabilities in these contracts can lead to serious security issues. Traditional vulnerability detection methods suffer from insufficient coverage and high false positive rates. Therefore, a more efficient and accurate vulnerability detection technology is needed to ensure the security and reliability of smart contracts. Summary of the Invention

[0003] In order to solve the problems of insufficient vulnerability detection coverage and high false alarm rate in the existing technology, the present invention proposes an automatic detection method for smart contract vulnerabilities based on mutable snapshots by combining symbolic taint analysis and fuzz testing technology.

[0004] The technical solution adopted by the method of the present invention is: a method for automatically detecting smart contract vulnerabilities based on mutable snapshots, comprising the following steps:

[0005] Step 1: Compile the target contract to generate bytecode, and pass the bytecode along with the snapshot and transaction to the Ethereum Virtual Machine (EVM) for instrumentation processing;

[0006] Step 2: Collect mutation constraints in the contract state and blockchain environment through symbolic taint analysis, and set snapshot checkpoints at the execution branches;

[0007] Step 3: For each snapshot checkpoint, mutate the contract execution state and blockchain environment to generate a new mutated snapshot. Use the mutated snapshot to initiate a fork process and test the contract in a different execution context.

[0008] Step 4: Based on the predefined fuzz testing judgment method, analyze the execution traces of the main process and forked processes to identify and report potential contract vulnerabilities.

[0009] Preferably, in step 2, the symbolic taint analysis is performed by symbolizing the execution path of the contract to collect symbolic expressions and path constraints about the contract state and blockchain environment.

[0010] Preferably, in step 3, the components of the mutation snapshot consist of two parts; the first part is the smart contract state variable consisting of a key-value pair, where the key represents the slot where the state variable is stored in the smart contract persistent storage structure (storage), and the value represents the specific value of the state variable in the slot; the second part consists of the blockchain environment, including the blockchain environment that the smart contract execution depends on, including timestamp, block number, account balance, GAS price and transaction incoming funds.

[0011] As a preference, in step 3, the collected contract state and the constraints in the blockchain environment are used as the constraints for snapshot mutation, and the constraint solver Solve is used to solve the constraints. The obtained results are used as the mutation results of the snapshot and used as the input of the fuzz testing phase. Specifically, for the mutation of the contract state, the mutation constraint set of the state variable X is first defined. Among them, i represents different execution paths during the fuzz testing process, state[X] i represents the mutation constraints generated on execution path i. Different execution paths will generate different mutation constraints. The final set of mutation constraints is the union of all these constraints. Then a constraint is randomly selected from MC[X] and the constraint solver Solve is used to solve a series of feasible values ​​of X as the mutation result X′=Solve(state[X] i ), state[X] i ∈MC[X].

[0012] Preferably, in step 3, a snapshot checkpoint mechanism is used to determine the timing of snapshot taking, restoration, and mutation; specifically, first, multiple checkpoints are defined and set during the contract execution process. These checkpoints are specific locations where program state variables or blockchain environment variables can affect contract execution; the selection of checkpoints is based on when the program encounters key instructions (such as SSTORE, TIMESTAMP, NUMBER, etc.), at which the system will take the current snapshot; then, the snapshot is mutated at each checkpoint, and a forked execution is performed to test the behavior of the contract under the mutated snapshot; during the forked execution process, the consistency of the main execution path is retained until the checkpoint, and snapshots are mutated at these checkpoints to trigger potential new paths.

[0013] Preferably, in step 4, the fuzz test is divided into two stages: a main execution stage and a branch execution stage; in the main execution stage, a snapshot selected from a snapshot corpus is used as the execution environment, and mutation constraints are collected during this period; in the branch execution stage, the snapshot used is the mutation result, and mutation constraints are collected during this period; in a fuzz test stage, the main execution is performed only once, while the branch execution is performed multiple times according to the mutation results.

[0014] As a preference, further feedback information is fed back to the seed library and snapshot library to optimize the fuzz testing cycle;

[0015] The specific implementation includes the following steps:

[0016] Step 5.1: Initialize the seed corpus and snapshot corpus;

[0017] Initialize the seed corpus, which contains the seed of a single transaction, including the encoded function selector, function parameters, and call value; initialize the snapshot corpus, including the locally deployed blockchain environment and the initial state of the contract; the seed obtains the ABI (Application Binary Interface) by compiling the smart contract, generates the function selector, and randomly selects valid function parameters and call values; the snapshot stores the initial state of the contract and is updated as needed during execution;

[0018] Step 5.2: Update the seed corpus and snapshot corpus;

[0019] The seed corpus is updated through a genetic algorithm, including selection, crossover, and mutation. The fitness score of the seed is calculated based on coverage feedback and data dependencies executed by the Ethereum Virtual Machine (EVM).

[0020] Fitness=α×S branch +(1-α)×S dep ;

[0021] Among them, S branch is the branch score calculated based on the newly covered branch edges, S dep is a data dependency score calculated based on the number of state modifications during execution, and α is a constant less than 1; seeds with high selection probability P are preferentially selected for crossover and mutation;

[0022]

[0023] Where n is the total number of seeds in the fuzz test generation. In the crossover operation, two seeds are selected as parents, their function parameters and call values ​​are split, and these components are exchanged to generate two new offspring. In the offspring, function parameters are mutated with a certain probability. Through taint analysis, a mutation pool is maintained to collect values ​​encountered in branch predicates. Parameters are mutated randomly or values ​​are selected from the mutation pool.

[0024] Updates to the snapshot corpus,come from new snapshots generated by the main execution, and only,validated snapshots will be added to the corpus;

[0025] Step 5.3: Scheduling of seeds and snapshots;

[0026] Fuzz testing is performed using a genetic algorithm. At the beginning of each generation, transactions are randomly selected from the seed corpus for testing, and snapshots are selected in the order they were saved. After the main execution modifies the state or blockchain environment, the snapshot is added to the corpus and used in the next execution.

[0027] Step 5.4: Test the oracle;

[0028] By analyzing the execution traces of the main and forked executions, potential vulnerabilities are detected using predefined test oracles.

[0029] As a preference, further on-chain fuzz testing is performed through API calls; by integrating the API provided by the blockchain node service provider, the information on the blockchain is recorded as an on-chain snapshot.

[0030] The technical solution adopted by the system of the present invention is: a smart contract vulnerability automatic detection system based on variable snapshots, including a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the program, the smart contract vulnerability automatic detection method based on variable snapshots is implemented.

[0031] Compared with the prior art, the beneficial effects of the present invention include:

[0032] (1) The detection method provided by the present invention combines symbolic taint analysis and mutation snapshot technology. Compared with traditional fuzz testing methods, it can more effectively cover different states of contract execution and improve the coverage and accuracy of vulnerability detection.

[0033] (2) This invention further reduces the false positive rate and improves the efficiency of vulnerability detection through feedback on test results and seed optimization. Dynamically updated snapshots and seed libraries ensure the accuracy and effectiveness of test data.

[0034] (3) The present invention supports on-chain fuzz testing, which enables the detection tool to verify the security of the contract in a real blockchain environment, further enhancing the reliability and practicality of the detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The technical solution of the present invention is further illustrated below using embodiments and specific implementation methods. In addition, some drawings are also used in the process of illustrating the technical solution. For those skilled in the art, other drawings and the intention of the present invention can be obtained based on these drawings without making any creative efforts.

[0036] Figure 1 The method principle framework of the embodiment of the present invention;

[0037] Figure 2 This is a flowchart of symbol stain analysis in an embodiment of the present invention;

[0038] Figure 3 This is a flowchart of snapshot mutation and fork execution in an embodiment of the present invention;

[0039] Figure 4 This is a flowchart of genetic algorithm optimization and on-chain testing in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to facilitate ordinary technicians in this field to understand and implement the present invention, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the implementation examples described here are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0041] Please see Figure 1 This embodiment provides a method for automatically detecting smart contract vulnerabilities based on mutable snapshots, comprising the following steps:

[0042] Step 1: Compile the target contract into bytecode. This bytecode, along with snapshots and transactions provided by the snapshot and seed repositories, is passed to the instrumented Ethereum Virtual Machine (EVM). This snapshot serves as a baseline for the contract's initial state and provides a locally deployed blockchain environment. During the initial phase of contract execution, symbolic taint analysis is performed to collect mutation constraints within the contract state and blockchain environment.

[0043] Step 2: Set snapshot checkpoints at execution branches that depend on the contract state or blockchain environment to facilitate detailed analysis and testing in subsequent steps.

[0044] Please see Figure 2 In one embodiment, the symbolic taint analysis is performed by symbolizing the execution path of the contract to collect symbolic expressions and path constraints about the contract status and blockchain environment.

[0045] Step 3: During the testing process, at each checkpoint, the system mutates the state and blockchain environment related to the contract execution, generating a series of new snapshots. These mutated snapshots are used to launch a new forked process to test the contract in a different execution context. The forked process executes identically to the main process, based on the same input transactions, unmutated contract state, and blockchain environment, but differs only in the application of mutated elements. To ensure the validity of the mutated constraints, symbolic taint analysis continues within the forked process, ensuring that all constraints are updated in real time and reflect the latest execution status.

[0046] In one embodiment, the components of the mutation snapshot consist of two parts; the first part is the smart contract state variable consisting of key-value pairs, where the key represents the slot where the state variable is stored in the smart contract persistent storage structure (storage), and the value represents the specific value of the state variable in the slot; the second part is composed of the blockchain environment, which mainly includes the blockchain environment that the smart contract execution depends on, including the timestamp (TIMESTAMP), block number (BLOCKNUMBER), account balance (BALANCE), GAS price (GASPRICE) and transaction incoming funds (CALLVALUE).

[0047] In one embodiment, the collected contract state and the constraints in the blockchain environment are used as the constraints for snapshot mutation, and the constraint solver Solve is used to solve the constraints. The obtained results are used as the mutation results of the snapshot and used as the input of the fuzz testing phase. Specifically, for the mutation of the contract state, the mutation constraint set of the state variable X is first defined. Among them, i represents different execution paths during the fuzz testing process, state[X] i represents the mutation constraints generated on execution path i. Different execution paths will generate different mutation constraints. The final set of mutation constraints is the union of all these constraints. Then a constraint is randomly selected from MC[X] and the constraint solver Solve is used to solve a series of feasible values ​​of X as the mutation result X′=Solve(state[X] i ), state[X] i ∈MC[X].

[0048] Please see Figure 3 In one embodiment, a snapshot checkpoint mechanism is used to determine the timing of snapshot taking, restoration, and mutation. Specifically, first, multiple checkpoints are defined and set during the contract execution process. These checkpoints are specific locations where program state variables or blockchain environment variables can affect contract execution. The checkpoints are selected based on when the program encounters key instructions (such as SSTORE, TIMESTAMP, NUMBER, etc.). At these instructions, the system takes the current snapshot. Then, the snapshot is mutated at each checkpoint, and a forked execution is performed to test the behavior of the contract under the mutated snapshot. During the forked execution process, the consistency of the main execution path is retained until the checkpoint, and snapshots are mutated at these checkpoints to trigger potential new paths.

[0049] Step 4: Based on pre-defined test oracles, the system conducts a comprehensive analysis of the execution traces of the main and forked processes, identifying and reporting potential contract vulnerabilities. During this process, the execution results are fed back to the seed and snapshot repositories as feedback, providing guidance and optimization for subsequent fuzz testing cycles.

[0050] In one embodiment, the fuzz testing is divided into two phases: a main execution phase and a branch execution phase; in the main execution phase, a snapshot selected from a snapshot corpus is used as the execution environment, and mutation constraints are collected during this period; in the branch execution phase, the snapshot used is the mutation result, and mutation constraints are collected during this period; in a fuzz testing phase, the main execution is performed only once, while the branch execution is performed multiple times based on the mutation results.

[0051] To further enhance testing effectiveness, the seed library applies a genetic algorithm to optimize and update seeds based on coverage and data dependency feedback. Simultaneously, a snapshot library stores the latest state and blockchain environment generated by contract execution, ensuring the accuracy and integrity of state and environment data during testing. Furthermore, to expand the capabilities of on-chain fuzz testing, the system receives real-time data on the on-chain state and blockchain environment through an API provided by blockchain node service providers, enabling fuzz testing in a real-world blockchain environment.

[0052] Please see Figure 4 , the specific implementation includes the following steps:

[0053] Step 5.1: Initialize the seed corpus and snapshot corpus;

[0054] Initialize the seed corpus, which contains the seed of a single transaction, including the encoded function selector, function parameters, and call value; initialize the snapshot corpus, including the locally deployed blockchain environment and the initial state of the contract; the seed obtains the ABI (Application Binary Interface) by compiling the smart contract, generates the function selector, and randomly selects valid function parameters and call values; the snapshot stores the initial state of the contract and is updated as needed during execution;

[0055] Step 5.2: Update the seed corpus and snapshot corpus;

[0056] The seed corpus is updated through a genetic algorithm, including selection, crossover, and mutation. The fitness score of the seed is calculated based on coverage feedback and data dependencies executed by the Ethereum Virtual Machine (EVM).

[0057] Fitness=α×S branch +(1-α)×S dep ;

[0058] Among them, S branch is the branch score calculated based on the newly covered branch edges, S dep is a data dependency score calculated based on the number of state modifications during execution, and α is a constant less than 1; seeds with high selection probability P are preferentially selected for crossover and mutation;

[0059]

[0060] Where n is the total number of seeds in the fuzz test generation. In the crossover operation, two seeds are selected as parents, their function parameters and call values ​​are split, and these components are exchanged to generate two new offspring. In the offspring, function parameters are mutated with a certain probability. Through taint analysis, a mutation pool is maintained to collect values ​​encountered in branch predicates. Parameters are mutated randomly or values ​​are selected from the mutation pool.

[0061] Updates to the snapshot corpus mainly come from new snapshots generated by the main execution, and only verified snapshots will be added to the corpus;

[0062] Step 5.3: Scheduling of seeds and snapshots;

[0063] Fuzz testing is performed using a genetic algorithm. At the beginning of each generation, transactions are randomly selected from the seed corpus for testing, and snapshots are selected in the order they were saved. After the main execution modifies the state or blockchain environment, the snapshot is added to the corpus and used in the next execution. This approach ensures continuous exploration of the contract state and resets the state when the contract is complex to improve testing efficiency.

[0064] Step 5.4: Test the oracle;

[0065] By analyzing the execution traces of the main execution and forked execution, predefined test oracles are used to detect potential vulnerabilities; the system's test oracles can detect vulnerabilities such as Ethereum leakage, reentrancy attacks, control delegate calls, dangerous delegate calls, suicide attacks, and locked Ethereum.

[0066] In one implementation, support for on-chain fuzz testing via simple API calls;

[0067] By integrating the API provided by the blockchain node service provider, the information on the blockchain is recorded as an on-chain snapshot. This method enables the system to perform fuzz testing in a real blockchain environment, further verifying the security of the contract.

[0068] This embodiment also provides a system for automatically detecting smart contract vulnerabilities based on mutable snapshots, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method for automatically detecting smart contract vulnerabilities based on mutable snapshots is implemented.

[0069] The computer program efficiently and automatically detects various vulnerabilities in smart contracts, including ether leakage, reentrancy attacks, control delegate calls, dangerous delegate calls, suicide attacks, and ether lock-up vulnerabilities. The program implements its functionality through the following steps: First, it initializes a seed and snapshot corpus. The seed contains encoded function selectors, function parameters, and call values, while the snapshot stores the initial state of the contract and the blockchain environment. Second, it updates the seed corpus using a genetic algorithm, optimizing the seed through selection, crossover, and mutation. The fitness score of the seed is calculated based on coverage feedback and data dependencies from EVM execution. Simultaneously, new snapshots generated by the main execution are verified and added to the snapshot corpus. Third, the seed and snapshot scheduling process is performed in generations using a genetic algorithm. Each generation randomly selects transactions from the seed corpus for testing and sequentially uses snapshots. The system analyzes the execution traces of the main and forked executions and uses predefined test oracles to detect potential vulnerabilities. Finally, the system supports on-chain fuzz testing through API calls and integrates with the API provided by blockchain node service providers to record on-chain snapshots, enabling testing in a real-world blockchain environment.

[0070] The present invention is further described below through specific experiments.

[0071] Based on the present invention's solution, we developed a corresponding smart contract vulnerability detection tool for experimental testing. Our experimental dataset was constructed by combining datasets constructed from multiple related works, removing duplicate contracts and contracts lacking compiler version information. The resulting dataset includes 1,012 flagged contracts across six vulnerability types. For comparison, we selected five mainstream smart contract vulnerability detection tools in the field: ITYFuzz, sFuzz, Smartian, IR-Fuzz, and ConFuzzius.

[0072] The tool of the present invention and the comparative tools were run on the dataset, and the number of true positive and false negative reports of each tool was counted. The tool of the present invention detected the largest number of vulnerabilities, detecting 957 out of 1012 vulnerable contracts, 94 more than the second place and 358 more than the last place, which shows the comprehensiveness of the present invention in detecting contract vulnerabilities.

[0073] The time and number of transactions required for each task to detect the corresponding number of vulnerabilities in this dataset were counted. The tool of the present invention detected the most vulnerabilities in the shortest time, with 500 vulnerabilities detected within 10 seconds. The present invention also had the highest utilization rate of transactions when detecting vulnerabilities, detecting 600 vulnerabilities using 1,000 transactions, while other tasks generally required 20,000 transactions.

[0074] The distribution of the time and number of transactions required to detect each vulnerability in this data set was statistically analyzed. The mean and median of the time and number of transactions required for vulnerability detection by the present invention were the lowest among all the tasks. The detection time was 4.8 times faster than the second fastest task and 20.2 times faster than the slowest task.

[0075] The above experiment compared the tool of the present invention with related work on a labeled dataset, showing that the vulnerability detection recall rate of the present invention is higher than that of the comparison work, and the time and number of transactions required for vulnerability detection are lower than those of the related work, further demonstrating the effectiveness and superiority of the present invention in the task of smart contract vulnerability detection.

[0076] This paper combines mutable snapshots with a fuzz testing cycle to preserve, restore, and mutate the state of smart contracts and the blockchain environment. By performing symbolic taint analysis on smart contracts to obtain mutation constraints, the paper generates mutation snapshots, performs multiple tests within the Ethereum Virtual Machine, and ultimately detects potential vulnerabilities through comprehensive analysis. This paper employs targeted testing, combining static analysis with fuzz testing, to achieve rapid and accurate detection of smart contract vulnerabilities.

[0077] It should be understood that the embodiments described above are only some of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention may be arbitrarily combined with each other to form a feasible technical solution. Such combination is not restricted by the order of steps and / or structural composition mode, but must be based on the ability of ordinary technicians in this field to implement it. When the combination of technical solutions is mutually inconsistent or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0078] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of protection of the patent of the present invention. Under the guidance of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested by the present invention shall be based on the attached claims.

Claims

1. A method for automatically detecting smart contract vulnerabilities based on mutable snapshots, characterized in that: The following steps are involved: Step 1: Compile the target contract to generate bytecode, and pass the bytecode along with the snapshot and transaction to the Ethereum Virtual Machine (EVM) for instrumentation processing; Step 2: Collect mutation constraints in the contract state and blockchain environment through symbolic taint analysis, and set snapshot checkpoints at the execution branches; Step 3: For each snapshot checkpoint, mutate the contract execution state and blockchain environment to generate a new mutated snapshot. Use the mutated snapshot to initiate a fork process and test the contract in a different execution context. Step 4: Based on the predefined fuzz testing judgment method, analyze the execution traces of the main process and forked processes to identify and report potential contract vulnerabilities; Step 5: Feedback information is fed back to the seed library and snapshot library to optimize the fuzz testing loop; The specific implementation includes the following steps: Step 5.1: Initialize the seed corpus and snapshot corpus; Initialize the seed corpus, which contains the seed of a single transaction, including the encoded function selector, function parameters, and call value; initialize the snapshot corpus, including the locally deployed blockchain environment and the initial state of the contract; the seed obtains the ABI by compiling the smart contract, generates the function selector, and randomly selects valid function parameters and call values; the snapshot stores the initial state of the contract and is updated as needed during execution; Step 5.2: Update the seed corpus and snapshot corpus; The seed corpus is updated through a genetic algorithm, including selection, crossover, and mutation. The fitness score of the seed is calculated based on the coverage feedback and data dependency executed by the Ethereum Virtual Machine. Seed selection, seeds with high probability P are preferentially selected for crossover and mutation; ； in, n are all seeds used in fuzz test generation; in the crossover operation, two seeds are selected as parents, their function parameters and call values ​​are split, and these components are exchanged to generate two new offspring; in the offspring, function parameters are mutated with a certain probability; through taint analysis, a mutation pool is maintained to collect values ​​encountered in branch predicates; parameters are mutated randomly or values ​​are selected from the mutation pool for mutation; Updates to the snapshot corpus,come from new snapshots generated by the main execution, and only,validated snapshots will be added to the corpus; Step 5.3: Scheduling of seeds and snapshots; Fuzz testing is performed using a genetic algorithm. At the beginning of each generation, transactions are randomly selected from the seed corpus for testing, and snapshots are selected in the order they were saved. After the main execution modifies the state or blockchain environment, the snapshot is added to the corpus and used in the next execution. Step 5.4: Test the oracle; By analyzing the execution traces of the main and forked executions, potential vulnerabilities are detected using predefined test oracles.

2. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 2, the symbolic taint analysis is performed by symbolizing the execution path of the contract to collect symbolic expressions and path constraints about the contract state and blockchain environment.

3. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 3, the components of the mutation snapshot consist of two parts. The first part is the smart contract state variable consisting of a key-value pair, where the key represents the slot where the state variable is stored in the smart contract's persistent storage structure, and the value represents the specific value of the state variable in that slot. The second part consists of the blockchain environment, which includes the blockchain environment that the smart contract execution depends on, including timestamps, block numbers, account balances, gas prices, and transaction incoming funds.

4. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1, characterized in that: In step 3, the collected contract state and the constraints in the blockchain environment are used as the constraints for snapshot mutation, and the constraint solver Solve is used to solve the constraints. The obtained results are used as the mutation results of the snapshot and used as the input of the fuzz testing phase. Specifically, for the mutation of the contract state, the mutation constraint set of the state variable X is first defined. ,in, i Represents different execution paths during fuzz testing, Indicates the execution path i The mutation constraints generated above, different execution paths will produce different mutation constraints, and the final mutation constraint set is the union of all these constraints; then randomly select a constraint from MC[X] and use the constraint solver Solve to solve a series of feasible values ​​of X as the mutation result .

5. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 3, the snapshot checkpoint mechanism is used to determine the timing of snapshot taking, restoration, and mutation. Specifically, first, multiple checkpoints are defined and set during the contract execution process. These checkpoints are specific locations where program state variables or blockchain environment variables can affect contract execution. Checkpoints are selected based on when the program encounters critical instructions, at which the system takes the current snapshot. Then, snapshots are mutated at each checkpoint, and forked execution is performed to test the contract's behavior under the mutated snapshot. During the forked execution process, the consistency of the main execution path is retained until the checkpoint, and snapshots are mutated at these checkpoints to trigger potential new paths.

6. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to claim 1 is characterized in that: In step 4, the fuzz test is divided into two phases: the main execution phase and the branch execution phase; In the main execution phase, a snapshot selected from the snapshot corpus is used as the execution environment, and mutation constraints are collected during this period; in the branch execution phase, the snapshot used is the mutation result, and mutation constraints are collected during this period; in a fuzz testing phase, the main execution is performed only once, while the branch execution is performed multiple times according to the mutation results.

7. The method for automatically detecting smart contract vulnerabilities based on mutable snapshots according to any one of claims 1 to 6, characterized in that: Further on-chain fuzz testing is performed through API calls; by integrating the API provided by the blockchain node service provider, the information on the blockchain is recorded as an on-chain snapshot.

8. A smart contract vulnerability automatic detection system based on mutable snapshots, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method for automatically detecting smart contract vulnerabilities based on mutable snapshots as described in any one of claims 1 to 7 is implemented.

Images