Dynamic and static combined intelligent contract vulnerability detection method

Abstract

The invention discloses a dynamic and static combined intelligent contract vulnerability detection method, and belongs to the fields of software testing, vulnerability detection, intelligent contract security and the like. When intelligent contract vulnerability detection ignores mutual influence and calling paths among a plurality of intelligent contracts in a cross-contract scene, a large amount of false alarms and missing alarms are generated, and the vulnerability detection accuracy is reduced. According to the method, cross-contract calling dependency is defined on the basis of data flow dependency and control flow dependency, and then an intelligent contract dependency graph ICDG (Inter-Control Dependent Graph, ICDG) in a cross-contract scene is constructed, so that the dependency relationship among multiple intelligent contracts and the interaction logic of a complex intelligent contract application are completely represented. According to the method, cross-contract call mining and evaluation are carried out based on historical transaction information, a heuristic reverse search strategy and a genetic algorithm are designed, and vulnerability detection is carried out based on ICDG. The method is feasible and effective in single smart contract vulnerability detection, and the smart contract vulnerability detection effect in a cross-contract scene can be improved.

Description

Technical Field

[0001] The present invention is a smart contract vulnerability detection method that combines dynamic and static methods, and belongs to the fields of software testing, vulnerability detection, and smart contract security. Background Art

[0002] The security and reliability of smart contracts is a key issue to ensure the healthy development of blockchain. In blockchain security incidents, the exploitation of smart contract vulnerabilities is the most frequent and costly attack method. Using program analysis technology to discover security vulnerabilities in smart contracts - vulnerability detection has always been an important research direction.

[0003] In the field of smart contract vulnerability detection, there are two main methods: static analysis and dynamic testing. The former discovers vulnerabilities by performing syntax and semantic analysis on the program source code; the latter discovers vulnerabilities by simulating various data and situations during the execution process. Symbolic execution is a static analysis method based on program path exploration. It builds a complete program model by exploring each path of the program and detects vulnerabilities based on it. Fuzz testing is the main dynamic analysis method. It provides random or abnormal input data to the program, observes its runtime behavior, and detects whether there are vulnerabilities such as crashes, exceptions, or logical errors.

[0004] Traditional static / dynamic vulnerability detection methods often ignore the mutual influence and call paths between multiple smart contracts in cross-contract scenarios, which will generate a large number of false positives and missed positives, reducing the accuracy of vulnerability detection. Summary of the invention

[0005] The purpose of the present invention is to propose a smart contract vulnerability detection method that combines dynamic and static methods to reduce false positives and missed positives caused by ignoring cross-contract calls and improve the accuracy of vulnerability detection.

[0006] The present invention proposes for the first time the smart contract dependency graph ICDG (Inter-Contract Dependency Graph, ICDG) in a cross-contract scenario. Based on data flow dependency and control flow dependency, the present invention defines cross-contract call dependency, which is used to represent the dependency relationship between multi-party smart contracts and the interaction logic of complex smart contract applications. To identify call dependencies, the present invention provides for the first time a cross-contract call function mining algorithm based on smart contract historical transactions, and designs evaluation indicators to evaluate the accuracy and availability of the called functions obtained based on historical transaction analysis, thereby identifying call dependencies and constructing ICDG. This method combines static and dynamic vulnerability detection methods, constructs ICDG to describe the smart contract interaction model in a cross-contract scenario, and applies fuzzy testing methods to perform vulnerability detection on the constructed ICDG.

[0007] The core of the present invention is the proposal and construction of ICDG, which is mainly divided into the following parts:

[0008] First, the control flow dependency, data flow dependency and call dependency analysis of smart contracts. Dependency is an important manifestation of the contextual information between smart contracts. Accurate and specific dependency can play a key role in vulnerability detection. This paper analyzes the control flow dependency and data flow dependency of smart contracts in cross-contract scenarios, as well as the call dependency between smart contracts, and gives a formal definition.

[0009] Control flow dependency is a constraint caused by process control flow, which means that whether a basic block can be executed depends on the execution result of another basic block, and describes the conditional dependency between instructions in the program; data flow dependency represents the data transfer relationship between variables in the smart contract, which is mainly characterized by storing and reading variables; the present invention defines cross-contract call dependency, which describes the information transfer and data interaction between smart contracts through function calls.

[0010] Second, cross-contract call mining based on historical transactions. Normally, when there is a function call relationship between smart contracts, the address of the smart contract to which the called function belongs will be specified and placed in the stack. Therefore, during simulated execution, the address of the smart contract to which the called function belongs can be obtained from the stack. However, when actually writing a smart contract, it can be passed in as a function parameter instead of hard-coding it into the smart contract. In summary, the address of the smart contract to which the called function belongs cannot be obtained only by static analysis of the smart contract, and thus the cross-contract call dependency cannot be analyzed. To solve this problem, the present invention proposes a cross-contract call mining algorithm based on historical transactions, and then analyzes the call dependency to fully characterize the interactive behavior and interactive characteristics of multi-party smart contracts in cross-contract scenarios.

[0011] Third, the evaluation of cross-contract calls based on historical transactions. (1) Occurrence frequency: In historical transaction records, the smart contract with higher frequency of occurrence means that the contract is used more frequently, and the call dependency is stronger, so it is given a higher priority; (2) Occurrence time: In historical transaction records, the contract call appears in the latest transaction, which means that the contract has more opportunities to be used and is an active contract, while those contracts that exist in earlier transaction records are more likely to represent abandoned old contracts, that is, inactive contracts. (3) Contract size: The larger the size of the smart contract, the more likely it is to be a critical contract. The larger the contract size, the more gas it consumes. The cost of a single transaction can be intuitively detected in the transaction record. The more complex the contract, the more important the functions it carries. Prioritizing the detection of such contracts is conducive to preventing major economic losses, so such contracts are given a higher priority.

[0012] Fourth, ICDG construction. ICDG is a comprehensive graphical structure built based on the smart contract control flow graph, combining smart contract control flow, data flow and cross-contract call dependencies to comprehensively describe the interactive logic of complex smart contract applications. The nodes in ICDG are smart contract basic blocks, and each basic block represents a continuous instruction sequence consisting of no branch or jump instructions; the edges in ICDG are a collection of various directed edges between basic blocks obtained based on control flow analysis, including basic jump control flow edges, control flow dependency edges, data flow dependency edges and cross-contract call dependency edges. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a flow chart for implementing the method of the present invention. DETAILED DESCRIPTION

[0014] The present invention is an efficient smart contract vulnerability detection method, which aims to improve the accuracy of vulnerability detection and detect vulnerabilities in cross-contract scenarios. It reduces the false positive and false negative rates of vulnerability detection tools. The specific implementation process of the present invention can be divided into the following stages: including four modules: input, ICDG construction, ICDG-based vulnerability detection and output.

[0015] The first stage is input. The detection objects of this method include grouped smart contracts that already contain cross-contract calls. At the same time, it can detect a single smart contract to be tested, and mine the smart contracts called by it through transaction records, and then detect smart contract vulnerabilities in cross-contract scenarios. Therefore, the input module contains the bytecode and address of the smart contract to be tested. The purpose is to obtain transaction records through the address and blockchain browser to mine the smart contract called by it.

[0016] In the second stage, ICDG construction, we first propose a call contract mining strategy based on historical transaction records to fully describe the interactive behavior of multi-party smart contracts in cross-contract scenarios; at the same time, we build CFG based on smart contract bytecode, and analyze the control flow dependency, data flow dependency and cross-contract dependency of smart contracts to build ICDG.

[0017] The third stage is smart contract vulnerability detection based on ICDG. First, based on the vulnerability feature analysis in cross-contract scenarios, the definition of smart contract vulnerability trigger points for ICDG is given, and then the vulnerability trigger point selection and priority sorting criteria in ICDG are studied, and high-risk vulnerability points are detected first to improve vulnerability detection efficiency; then a heuristic reverse search strategy is designed to generate vulnerability trigger key paths for vulnerability trigger points, and test data is generated based on genetic algorithms to detect and trigger vulnerabilities, completing smart contract vulnerability detection in cross-contract scenarios.

[0018] The fourth stage is output. Generate a vulnerability detection report based on the detection results, clarify the vulnerability type, vulnerability trigger point, vulnerability trigger path, and related test data that triggers the vulnerability, to provide support for users to repair the vulnerability.

[0019] This paper adopts a combination of dynamic and static methods to detect smart contract vulnerabilities. Aiming at the problem of security vulnerability detection of smart contracts in cross-contract scenarios, it defines a smart contract dependency graph ICDG that can fully characterize the interactive behavior of smart contracts in cross-contract scenarios; on this basis, it proposes a smart contract vulnerability detection method in cross-contract scenarios starting from bytecode. Its single smart contract vulnerability detection is feasible and effective, and improves the smart contract vulnerability detection effect in cross-contract scenarios.

Claims

1. A dynamic and static combined smart contract vulnerability detection method introduces cross-contract call dependencies into the vulnerability detection method and constructs an Inter-Contract Dependency Graph (ICDG) that integrates control dependency, data dependency and call dependency.

2. According to the dynamic and static combined smart contract vulnerability detection method of claim 1, for the calling contract in the process of building ICDG, when it is created in the transaction or its address is passed through function parameters, it is obtained by analyzing the historical transactions of the smart contract.

3. According to the dynamic and static combined smart contract vulnerability detection method of claim 1, the accuracy of cross-smart contract calls is comprehensively evaluated based on the frequency, time and scale of occurrence of smart contracts.

4. According to the dynamic and static combined smart contract vulnerability detection method of claim 1, when facing ICDG vulnerability detection, the vulnerability points are defined based on the vulnerability characteristics, and the heuristic reverse search strategy and genetic algorithm are applied to preferentially generate test data for the key paths of high-risk vulnerability points for vulnerability detection.

Images