Smart contract Ponzi scheme source code detection method and system based on large model

Abstract

The present invention discloses a method and system for detecting Ponzi scheme source code in smart contracts based on a large model. The method first compiles the contract to obtain an abstract syntax tree (AST) of the smart contract code. The AST is then parsed to generate an intermediate representation (IR) of the contract code and a contract object containing the contract's structured information. The IR of the smart contract code is used to model the smart contract as a hypernode graph. A mapping is established between each node and the contract source code. The funds sent to the contract and the sender's address are used as taint sources to perform static taint analysis on the contract and track the flow of incoming funds within the contract. A taint variable propagation graph is generated. The vertices in the IR graph are then divided into three levels: contracts, functions, and expressions. Based on the smart contract IR graph and its subgraphs, the code corresponding to the function nodes involved in tainted variable propagation is sliced. Finally, the IR is used to detect Ponzi schemes. The present invention achieves rapid and accurate Ponzi scheme contract detection.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology in computer science, and relates to a method and system for analyzing and detecting source code of smart contracts, and more specifically to a method and system for accurately analyzing and detecting source code of smart contracts and Ponzi schemes. Background Art

[0002] Smart contracts, self-executing agreements that encode the terms of an agreement directly into code, are fundamental to decentralized finance and Web3. However, their widespread adoption has also fostered the emergence of Ponzi schemes—fraudulent investment operations that use funds from new investors to pay returns to earlier investors. These scams exploit the transparency and automation of smart contracts, promising high returns with minimal risk to attract new investors. These new investors' funds are then used to pay earlier investors, creating a false sense of profitability. As the influx of new investors wanes, the scheme inevitably collapses, resulting in significant financial losses for most participants. Ponzi schemes erode trust in the DeFi and Web3 ecosystems, causing significant financial losses and hindering wider adoption. Therefore, research on smart contract Ponzi schemes is crucial. Summary of the Invention

[0003] This paper aims to provide an accurate and efficient solution for analyzing and detecting Ponzi schemes in smart contracts. This paper focuses on the flow of funds in smart contracts and the code associated with Ponzi scheme logic. By leveraging the ability of large language models to understand both natural language and program code, this paper provides a deep understanding and analysis of this information, resulting in a Ponzi smart contract detection technology and tool.

[0004] The technical solution adopted by the method of the present invention is: a method for detecting smart contract Ponzi scheme source code based on a large model, comprising the following steps:

[0005] Step 1: Compile the contract to obtain the abstract syntax tree of the smart contract code; then parse the abstract syntax tree to generate the intermediate representation of the contract code and the contract containing the contract structure information;

[0006] Step 2: Model the smart contract as a hypernode using the intermediate representation of the smart contract code. Use the funds sent to the contract and the sender address as taint sources. Perform static taint analysis on the contract to track the flow of incoming funds within the contract. Generate a taint variable propagation graph.

[0007] Step 3: Divide the vertices in the supernode into three levels: contracts, functions, and expressions. Then, using the results of the taint analysis, construct a subgraph of function nodes related to the propagation of tainted variables. Slice the code corresponding to the function nodes so that the sliced ​​code contains the entire logic of the smart contract processing the income flow.

[0008] Step 4: Use the big model to detect Ponzi contracts.

[0009] Preferably, in step 1, the node in the abstract syntax tree of the smart contract code includes: a node name, a child node of the node, and a member variable of the node.

[0010] Preferably, in step 1, the intermediate representation of the contract code includes: a mapping of the intermediate representations of various components of the smart contract and the contract source code, an intermediate representation of the smart contract state variables, the smart contract type, and an intermediate representation of the functions in the smart contract.

[0011] Preferably, in step 2, the smart contract is modeled as a supernode, which is a directed unweighted graph G, which is a triple of a graph label, a vertex set, and an edge set; the supernode is recursively defined by allowing nodes in the vertex set of the graph to be basic nodes or supernodes; the vertex set of the supernode is composed of all function supernodes in the smart contract, and the edge set is determined by the function call relationship in the smart contract; the vertex set of the function supernode is all basic nodes, representing the local variables of the function and the state variables of the contract; the edge set is determined by the expression in the function;

[0012] All the information needed to construct a given supernode is obtained through three operations, including:

[0013] The first operation: graph(G) operation, obtains the triple of label name, vertex set and edge set of graph G;

[0014] The second operation: nodes(G) operation, which obtains the vertex set of graph G, where the vertex is a basic node or a super node;

[0015] The third operation: edge(G) operation, obtains the edge set of graph G, where the two vertices of each edge are basic nodes or super nodes.

[0016] Preferably, in step 2, the static taint analysis of the contract is a subgraph construction process for the smart contract supernode model, in which the funds sent to the contract and the sender address are used as taint sources, and the vertex set of the subgraph is initialized as a set of tainted variables; then, through three operations, the set of nodes and edges related to the tainted variables in the modeled smart contract supernode graph is obtained;

[0017] The three operations described above are used to obtain all the information needed to construct a given supernode, including:

[0018] The first operation: graph(G) operation, obtains the triple of label name, vertex set and edge set of graph G;

[0019] The second operation: nodes(G) operation, which obtains the vertex set of graph G, where the vertex is a basic node or a super node;

[0020] The third operation: edge(G) operation, obtains the edge set of graph G, where the two vertices of each edge are basic nodes or super nodes.

[0021] Preferably, in step 4, the code snippets and the taint propagation graph are first organized into prompt words, and the analysis report of the single function logic and the overall contract logic is output through the large model; then the overall contract logic and the definition of the Ponzi scheme are combined into prompt words, and the detection results are output through the large model.

[0022] The technical solution adopted by the system of the present invention is: a smart contract Ponzi scheme source code detection system based on a large model, comprising:

[0023] one or more processors;

[0024] A storage device is used to store one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement the smart contract Ponzi scheme source code detection method based on the large model.

[0025] The technical solution adopted by the system of the present invention is: a smart contract Ponzi scheme source code detection product based on a large model, including computer program instructions. When the computer program instructions are run on a computer, the computer executes the smart contract Ponzi scheme source code detection method based on the large model.

[0026] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0027] (1) This paper proposes a method for detecting Ponzi schemes driven by a large language model, which uses two-step zero-shot prompting implemented by contextual learning and thought chain reasoning without the need for additional labeled data.

[0028] (2) This paper proposes a novel two-stage zero-shot thought chain prompting method to enhance large language models through static taint analysis and automatic code slicing to effectively detect Ponzi schemes, understand complex fraud patterns, track tainted data, and focus on relevant code segments without extensive retraining.

[0029] (3) We conduct a comprehensive evaluation of PonziSleuth in various settings, including extensive comparisons with existing methods, real-world testing, and overhead evaluation. The results show that it significantly outperforms current methods, especially in detecting unknown Ponzi contracts. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The technical solution of the present invention is further illustrated below using embodiments and specific implementation methods. In addition, some drawings are also used in the process of illustrating the technical solution. For those skilled in the art, other drawings and the intention of the present invention can be obtained based on these drawings without making any creative efforts.

[0031] Figure 1 A schematic diagram of a method according to an embodiment of the present invention;

[0032] Figure 2 A taint variable propagation graph constructed in an embodiment of the present invention;

[0033] Figure 3 This is an example of a prompt project and a large language model detection constructed in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to facilitate ordinary technicians in this field to understand and implement the present invention, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0035] Please see Figure 1 This embodiment provides a method for detecting smart contract Ponzi scheme source code based on a large model, comprising the following steps:

[0036] Step 1: Compile the contract to obtain the abstract syntax tree of the smart contract code. The abstract syntax tree is then parsed to generate an easy-to-analyze intermediate representation (IR) of the contract code and a contract object containing contract structured information, providing information for subsequent processing and analysis.

[0037] In one embodiment, a node in the abstract syntax tree of the smart contract code includes: a node name, a child node of the node, and a member variable of the node.

[0038] In one embodiment, the intermediate representation of the smart contract code generated by the smart contract abstract syntax tree includes: a mapping of the intermediate representations of various components of the smart contract and the contract source code, an intermediate representation of the smart contract state variables, the smart contract type, and an intermediate representation of the functions in the smart contract.

[0039] In one embodiment, the Solidity compiler generates a smart contract abstract syntax tree (AST). First, the Solidity compiler solc output settings include the AST option, which generates the smart contract AST information simultaneously after compiling the smart contract. Then, the smart contract static analysis tool Slither is used to generate an intermediate representation (IR) of the smart contract. Slither's API is used to convert the ART to an IR. The IR is then used to model the smart contract and generate the graph and node type data structures within the supernode.

[0040] Step 2: Model the smart contract as a hypernode using the intermediate representation of the smart contract code. Use the funds sent to the contract and the sender address as taint sources to perform static taint analysis on the contract and track the flow of incoming funds within the contract. Generate a taint variable propagation graph and use it as auxiliary information for input into the larger model. Figure 2 , which is a taint variable propagation graph constructed in an embodiment of the present invention.

[0041] In one embodiment, the smart contract is modeled as a supernode, which is a directed unweighted graph G, which is a triple of a graph label, a vertex set, and an edge set. A supernode is recursively defined by allowing nodes in the vertex set of the graph to be either base nodes or supernodes. The vertex set of the supernode is composed of all function supernodes in the smart contract, and the edge set is determined by the function call relationship in the smart contract. The vertex set of the function supernode is all base nodes, representing the local variables of the function and the state variables of the contract; the edge set is determined by the expression in the function.

[0042] All the information needed to construct a given supernode can be obtained through three operations, including:

[0043] The first operation: graph(G) operation, obtains the triple of label name, vertex set and edge set of graph G;

[0044] The second operation: nodes(G) operation, which obtains the vertex set of graph G, where the vertex is a basic node or a super node;

[0045] The third operation: edge(G) operation, obtains the edge set of graph G, where the two vertices of each edge are basic nodes or super nodes.

[0046] In one embodiment, the static taint analysis of the contract is equivalent to the subgraph construction process of the smart contract supernode model, taking the funds sent to the contract and the sender address as the taint source, and initializing the vertex set of the subgraph to the taint variable set; then through the above three operations, the set of nodes and edges related to the taint variables in the modeled smart contract supernode graph is obtained.

[0047] In one embodiment, taint analysis and slicing of smart contracts begins by setting variables related to funds as tainted sources. The propagation of tainted variables is recursively calculated using the contract-generated graph and node-type data structures. This process repeats until no new variables are marked as tainted. The taint propagation graph is used to record the dependencies between variables, generating tainted sink variables and functions. The functions through which the taint flows are then mapped to the source code to obtain contract code slices containing the tainted variables.

[0048] Step 3: First, using the smart contract supernode in contract analysis, we divide the vertices in the supernode into three levels: contract, function, and expression. Considering that the code snippets should be as short as possible while maintaining the integrity of the contract logic, we choose to slice the contract at the function level.

[0049] Then, using the generated smart contract supernode subgraph, the code corresponding to the function node is sliced, so that the sliced ​​code contains all the logic of the smart contract processing income fund flow, ensuring that the sliced ​​code is worth being tested.

[0050] Step 4: Utilize the large model to detect Ponzi schemes using a two-step zero-shot chaining approach. The first step organizes code snippets and taint propagation graphs into prompts, allowing the model to output analysis reports on individual function logic and the overall contract logic. The second step combines the contract output from the previous step and the definition of a Ponzi scheme into prompts, allowing the model to output detection results in this step.

[0051] In one embodiment, the two-step zero-sample thought chain prompting method includes:

[0052] (1) Analyze contract logic: In the first step, code slices and taint propagation graphs are organized into prompts designed to guide the large language model to analyze the logic of individual functions and the entire contract. These prompts include specific questions and instructions to help the large language model decompose the code, understand the flow of funds, and identify any anomalies.

[0053] (2) Detecting Ponzi Schemes: In the second step, the analysis results from the first step are combined with the formal definition of a Ponzi scheme. This combined hint is then fed into a large language model to determine whether the analyzed contract exhibits Ponzi scheme characteristics. The large language model uses its understanding of the contract behavior and the provided definition to make a decision. The output is a detection report indicating whether the contract is likely to be a Ponzi scheme.

[0054] This embodiment also provides a smart contract Ponzi scheme source code detection system based on a large model, including:

[0055] one or more processors;

[0056] A storage device is used to store one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement the smart contract Ponzi scheme source code detection method based on the large model.

[0057] This embodiment also provides a smart contract Ponzi scheme source code detection product based on a large model, including computer program instructions. When the computer program instructions are run on a computer, the computer executes the smart contract Ponzi scheme source code detection method based on the large model.

[0058] In one embodiment, the computer program instructions are a smart contract detection tool called PonziSleuth, implemented in Python. The tool utilizes the Solidity compiler and Slither, a static analysis tool for smart contracts, to generate and parse the smart contract's abstract syntax tree. Within the contract analysis and slicing module, a static taint analysis module targeting smart contract Ponzi schemes was developed to track the flow of funds within smart contracts. Finally, Ponzi contract detection was achieved through a two-step zero-shot thought chain prompt and a large language model.

[0059] The present invention is further described below through specific experiments.

[0060] Please see Figure 3 , which is an example of the prompt project and large language model detection constructed in the embodiments of the present invention.

[0061] Through experiments, we comprehensively evaluate PonziSleuth in various environments, including extensive comparisons with existing methods, real-world testing, and overhead evaluation. The results show that it significantly outperforms current methods, especially in detecting unknown Ponzi contracts.

[0062] Please see Table 1 for an extensive comparison of the present invention with existing methods on benchmark datasets widely used in current research.

[0063] Table 1

[0064]

[0065] Please see Table 2 for the real-world test results of the present invention.

[0066] Table 2

[0067]

[0068] Please see Table 3, which shows the average cost evaluation of each contract detection of the present invention on the same dataset.

[0069] Table 3

[0070]

[0071] It should be understood that the embodiments described above are only some of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention may be arbitrarily combined with each other to form a feasible technical solution. Such combination is not restricted by the order of steps and / or structural composition mode, but must be based on the ability of ordinary technicians in this field to implement it. When the combination of technical solutions is mutually inconsistent or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0072] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of protection of the patent of the present invention. Under the guidance of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested by the present invention shall be based on the attached claims.

Claims

1. A method for detecting smart contract Ponzi scheme source code based on a large model, characterized by: The following steps are involved: Step 1: Compile the contract to obtain the abstract syntax tree of the smart contract code; then parse the abstract syntax tree to generate the intermediate representation of the contract code and the contract object containing the contract structure information; Step 2: Model the smart contract as a hypernode graph using the intermediate representation of the smart contract code. Use the funds sent to the contract and the sender address as taint sources to perform static taint analysis on the contract and track the flow of incoming funds within the contract. Generate a taint variable propagation graph. The smart contract is modeled as a supernode graph, which is a directed unweighted graph G, which is a triple of graph label, vertex set and edge set. The supernode graph is recursively defined by allowing the nodes in the vertex set of the graph to be basic nodes or supernode graphs. Step 3: Divide the vertices in the supernode graph into three levels: contracts, functions, and expressions. Then, using the results of the taint analysis, construct a subgraph of function nodes related to the propagation of tainted variables. Slice the code corresponding to the nodes in this graph so that the sliced ​​code contains the entire logic of the smart contract processing the income flow. Step 4: Use the big model to detect Ponzi contracts; First, the code snippets and taint propagation graphs are organized into prompt words, and the large model outputs an analysis report on the logic of a single function and the overall logic of the contract. Then, the overall logic of the contract and the definition of a Ponzi scheme are combined into prompt words, and the large model outputs the detection results.

2. The method for detecting smart contract Ponzi scheme source code based on a large model according to claim 1 is characterized by: In step 1, the node in the abstract syntax tree of the smart contract code includes: the node name, the node's child nodes, and the node's member variables.

3. The method for detecting smart contract Ponzi scheme source code based on a large model according to claim 1 is characterized by: In step 1, the intermediate representation of the contract code includes: a mapping between the intermediate representations of various components of the smart contract and the contract source code, an intermediate representation of the smart contract state variables, the smart contract type, and an intermediate representation of the functions in the smart contract.

4. The method for detecting smart contract Ponzi scheme source code based on a large model according to claim 1 is characterized by: In step 2, all the information needed to construct a given hypernode graph is obtained through three operations, including: The first operation: graph(G) operation, obtains the triple of label name, vertex set and edge set of graph G; The second operation: nodes(G) operation, obtains the vertex set of graph G, where the vertex is a basic node or a supernode graph; The third operation: edge(G) operation, obtains the edge set of graph G, where the two vertices of each edge are basic nodes or supernodes.

5. The method for detecting smart contract Ponzi scheme source code based on a large model according to claim 1 is characterized by: In step 2, the static taint analysis of the contract is performed to construct a subgraph of the smart contract supernode graph model. The funds sent to the contract and the sender address are used as taint sources, and the vertex set of the subgraph is initialized as a set of tainted variables. Then, through three operations, the set of nodes and edges related to the tainted variables in the modeled smart contract supernode graph is obtained. The three operations are used to obtain all the information needed to construct a given hypernode graph, including: The first operation: graph(G) operation, obtains the triple of label name, vertex set and edge set of graph G; The second operation: nodes(G) operation, obtains the vertex set of graph G, where the vertex is a basic node or a supernode graph; The third operation: edge(G) operation, obtains the edge set of graph G, where the two vertices of each edge are basic nodes or supernodes.

6. A smart contract Ponzi scheme source code detection system based on a large model, characterized by: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the smart contract Ponzi scheme source code detection method based on a large model as described in any one of claims 1 to 5.

7. A smart contract Ponzi scheme source code detection product based on a large model, including computer program instructions, characterized by: When the computer program instructions are executed on a computer, the computer is caused to execute the smart contract Ponzi scheme source code detection method based on a large model as claimed in any one of claims 1 to 5.

Images