A vulnerability report-based smart contract vulnerability automatic repair method and system
By constructing a slice data dictionary and performing static analysis of a large language model (LLM), patch code is generated and optimized, solving the problem of fixing smart contract logic vulnerabilities in existing technologies. This achieves efficient repair at the source code level and improves the security of smart contracts.
Patent Information
- Application Number
- CN202411476604.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-22
- Publication Date
- 2026-02-27
- Estimated Expiration
- 2044-10-22
AI Technical Summary
Existing smart contract vulnerability remediation methods mainly target traditional vulnerabilities, making it difficult to fix issues involving business logic and lacking the ability to remediate vulnerabilities at the source code level, especially for complex contract logic vulnerabilities.
By constructing a slice data dictionary of key contract elements and vulnerable code slices, and combining it with a Large Language Model (LLM) for entity identification and static analysis of vulnerability descriptions, patch code is generated and optimized, ultimately fixing the logical vulnerabilities of smart contracts at the source code level.
It achieves efficient and automated repair of smart contract logic vulnerabilities, improves the repair rate and the generalization ability of the repair, reduces the workload of developers, and is applicable to the field of smart contract security auditing.
Smart Images
Figure CN119597326B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of blockchain, and particularly relates to a vulnerability report-based smart contract vulnerability automatic repair method and system. BACKGROUND
[0002] Blockchain technology is a new application mode of computer technologies such as distributed computing, P2P network, cryptography, consensus mechanism, data is combined into blocks in the form of transactions, and is connected in a chain structure to form a consensus in a distributed network. Due to its tamper-proof, traceable and other characteristics, it has been widely concerned and applied in many fields such as finance, credit investigation, product traceability and the like.
[0003] A smart contract is executable code on a blockchain, and a developer can implement complex functions through a smart contract. The smart contract runs in a specific environment, and the Ethereum Virtual Machine (hereinafter referred to as EVM) is the most common one, which is applied in many blockchain platforms such as Ethereum, Hyperledger Burrow and the like.
[0004] Since the blockchain often involves financial asset transactions and other activities, in order to prevent the smart contract from being attacked by hackers, the developer will ask a third-party code auditing agency to detect the smart contract. For example, Code4Rena is a professional smart contract auditing platform. However, based on third-party vulnerability reports, repairing the code is a complex and time-consuming task. Although there are many automatic repair tools for traditional program codes, there are few existing methods and tools for repairing smart contract vulnerabilities, mainly including the following:
[0005] 1. SGUARD, proposed by the National University of Singapore, which first analyzes the control flow and data flow of the smart contract to detect contract vulnerabilities, and then automatically repairs the contract vulnerabilities by inserting security patches. However, SGUARD can only repair four relatively traditional vulnerabilities: function internal re-entry vulnerability, cross-function re-entry vulnerability, access control, and arithmetic overflow vulnerability.
[0006] 2. EVMPatch, proposed by the University of Duisburg-Essen, which is a bytecode-level repair rather than a source code-level repair. It uses a bytecode rewriting engine to repair security vulnerabilities in deployed contracts. First, the vulnerability is detected by static analysis, and then a predefined patch template is used to rewrite the bytecode to complete the insertion of the patch. Similarly, this tool can only repair underlying code problems such as access control and integer overflow.
[0007] In fact, many current contract vulnerability problems are not code implementation problems, but business logic problems. The repair of such problems cannot be achieved by simple static analysis. The following difficulties exist:
[0008] 1. The vulnerabilities in the contract logic cannot be repaired by bytecode, because the source code needs to be rewritten;
[0009] 2. The repair of contract logic vulnerabilities requires understanding the entire contract business logic, and there is no fixed template that can be applied;
[0010] 3. The repair of contract logic vulnerabilities requires the combination of code logic and business logic, so static analysis and deep learning need to be combined; SUMMARY
[0011] The technical problem solved by the present application is to overcome the deficiencies of the prior art, and to provide a vulnerability report-based smart contract vulnerability automatic repair method and system, so as to achieve the purpose of repairing the logical vulnerabilities commonly seen in the real world at the source code level, and having a high and complete repair rate.
[0012] To solve the above technical problems, the technical solution adopted by the present application includes the following contents.
[0013] A vulnerability report-based smart contract vulnerability automatic repair method, the method comprising:
[0014] Constructing a slice data dictionary containing contract key elements and vulnerability code slices;
[0015] For a smart contract, obtaining the contract key elements involved in the structured repair based on the vulnerability description of the smart contract, and combining the slice data dictionary to obtain the relevant vulnerability code slices;
[0016] Generating patch code for the relevant vulnerability code slices;
[0017] Optimizing the patch code, and repairing the smart contract using the optimized patch code to obtain the repair result of the smart contract.
[0018] Further, the construction of the slice data dictionary containing contract key elements and vulnerability code slices comprises:
[0019] Collecting smart contract samples containing vulnerabilities and third-party vulnerability detection reports of the smart contract samples, and obtaining the source code of the smart contract samples;
[0020] Compiling and detecting the source code of the smart contract samples to obtain the compiled version and environment of the smart contract samples;
[0021] perform entity recognition on the third-party vulnerability detection report based on the large language model to obtain vulnerability description and vulnerability location information;
[0022] based on the vulnerability description and the vulnerability location information, all source code associated with the vulnerability function in the source code of the smart contract sample is screened out, and the corresponding source code is cut into function-level code slice data;
[0023] In combination with the compiled version and the environment in which the smart contract sample runs, the source code of the smart contract sample is statically analyzed, and a contract key element dependency graph of the smart contract containing the vulnerability is constructed according to the static analysis result;
[0024] In combination with the function-level code slice data and the contract key element dependency graph, an original slice data dictionary is constructed;
[0025] According to the vulnerability description and the vulnerability location information, the original slice data dictionary is filtered to obtain a slice data dictionary containing contract key elements and vulnerability code slices.
[0026] Further, for a smart contract, the contract key elements involved in the structured repair are obtained based on the vulnerability description of the smart contract, including:
[0027] The vulnerability description of the smart contract is embedded into a domain prompt word template, and a large language model is combined to obtain the attack steps and scope of the corresponding vulnerability;
[0028] According to the attack steps and scope of the corresponding vulnerability, the contract key elements involved in the structured repair are generated.
[0029] Further, the patch code of the related vulnerability code slice is generated, including:
[0030] The related vulnerability code slice is embedded into a domain code repair prompt word template, and a large language model is combined to obtain the patch code of the related vulnerability code slice; wherein the prompt word module of the domain code repair prompt word template includes role playing, task description, external structured information and expected output, and the content of the external structured information includes attack process, repair strategy, code interaction structure diagram and code slice.
[0031] Further, the patch code is optimized, including:
[0032] embed the patch code and the vulnerability description of the smart contract into a code verification / optimization prompt template, and verify the patch code; wherein the prompt module of the code verification / optimization prompt template includes role playing, task description, external structured information and expected output, and the content of the external structured information includes attack process, repair strategy, code interaction structure diagram, code slice and patch code;
[0033] in the case that the verification result is that the patch code has no vulnerability, the patch code is taken as the optimized patch code;
[0034] in the case that the verification result is that the patch code has a vulnerability, the optimization result of the patch code is output.
[0035] Further, the smart contract is repaired using the optimized patch code, and a repair result of the smart contract is obtained, including:
[0036] The source code of the smart contract is compiled and detected to obtain a compiled version and an environment for running the smart contract;
[0037] After the corresponding related vulnerability code slice is replaced by the optimized patch code, a compilation verification is performed based on the compiled version and the environment for running the smart contract;
[0038] After the compilation verification is passed, the repair result of the smart contract is obtained.
[0039] Further, after the repair result of the smart contract is obtained by using the optimized patch code to repair the smart contract, the system further includes:
[0040] The repair result of the smart contract is detected by a vulnerability detector; wherein the vulnerability detector includes Slither or GPTScan;
[0041] If no vulnerability is detected in the repair result of the smart contract by the vulnerability detector, it is output that the repair task is completed.
[0042] A smart contract vulnerability automatic repair system based on a vulnerability report, the system comprising:
[0043] A dictionary construction module for constructing a slice data dictionary containing contract key elements and vulnerability code slices;
[0044] A vulnerability code acquisition module for, for a smart contract, acquiring contract key elements involved in structured repair based on a vulnerability description of the smart contract, and obtaining related vulnerability code slices in combination with the slice data dictionary;
[0045] The patch code generation module is used to generate patch code for the relevant vulnerability code slices;
[0046] The vulnerability repair module is used to optimize the patch code and use the optimized patch code to repair the smart contract, thereby obtaining the repair result of the smart contract.
[0047] An electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the above-described method for automatically repairing smart contract vulnerabilities based on vulnerability reports.
[0048] A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the aforementioned method for automatically repairing smart contract vulnerabilities based on vulnerability reports.
[0049] Compared to existing technologies, this invention addresses real-world vulnerabilities in contracts through static analysis at the source code level, dependency relationships and slice construction of contract code elements, LLM-based code semantic understanding and vulnerability attack analysis, vulnerability patch generation, and code verification. Static analysis of the contract code effectively analyzes its structure, identifying relevant and valid code and enhancing LLM's understanding of the contract code structure, reducing illusions. Traditional symbolic execution and patch template-based repair methods are limited in their applicability and scope; therefore, LLM-based contract vulnerability repair significantly improves the generalization of repair capabilities. Particularly in fixing business logic vulnerabilities, this method is well-suited for smart contract security auditing, helping developers automate vulnerability repair and greatly reducing their workload. Attached Figure Description
[0050] Figure 1 This is a source code form of a smart contract and its vulnerability detection report fragment provided for an embodiment of the present invention.
[0051] Figure 2 This is a schematic diagram illustrating the process of an automated smart contract vulnerability repair method based on vulnerability reports, provided in an embodiment of the present invention.
[0052] Figure 3 This is an example diagram of function-level code slicing provided in an embodiment of the present invention.
[0053] Figure 4 This is a domain code repair prompt template provided for embodiments of the present invention.
[0054] Figure 5A code verification / optimization prompt word template provided for an embodiment of the present application.
[0055] Figure 6 A patch code for repairing a vulnerability provided for an embodiment of the present application. DETAILED DESCRIPTION
[0056] The specific embodiments of the present application are described in further detail below in conjunction with the accompanying drawings and embodiments. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.
[0057] This embodiment takes the combination of three smart contract code fragments and their corresponding vulnerability detection report related contents as shown in Figure 1 The present application uses a vulnerability report based smart contract vulnerability automatic repair method to automatically repair the vulnerabilities of this smart contract.
[0058] As shown in Figure 2 The technical solution of the present application includes a dictionary construction phase, a vulnerability positioning phase, a patch generation phase, and a patch optimization phase.
[0059] I. Dictionary construction phase.
[0060] The dictionary construction phase is used to construct a slice data dictionary based on the smart contract sample and its third-party vulnerability detection report. The construction process of the slice data dictionary includes the following steps 1.1-1.5.
[0061] Step 1.1: Obtain the smart contract sample and the third-party vulnerability detection report, and perform compilation detection on the code of the smart contract sample, and automatically configure the compilation version and environment for running the smart contract sample.
[0062] Step 1.2: Document analysis is performed on the third-party vulnerability detection report. Among them, for the contract vulnerability report, entity recognition is performed using LLM to extract vulnerability description and vulnerability location information.
[0063] In Figure 1 the embodiment, the vulnerability detection report shows that the vulnerability is associated with the crossSwapExactTokensForTokens, getAmountsOut, registerTrade, _swapExactT4T, _swap, and other functions, and is associated with the MarginRouter, UniswapStyleLib contracts.
[0064] Step 1.3: Filter the code files to be detected in the folder of the smart contract sample, and screen out all code files associated with the vulnerability functions, and divide all the codes into function level. Among them, Figure 3 For Figure 1The function-level code slice example of the embodiment. The _swap function is the vulnerability code found by the tool that is closely related to the vulnerability, and in addition, it can also be found by Figure 1 Code search associated code slice.
[0065] Step 1.4: Based on the compiled version and the environment in which the smart contract sample runs, the source code of the smart contract sample is statically analyzed to build an abstract syntax tree, a function call graph, and a data flow graph. Based on all the static analysis results, a contract key element dependency graph of the smart contract file is constructed.
[0066] Step 1.5: Based on the function-level code slice data of step 1.3 and the contract key element dependency graph of step 1.4, a slice data dictionary of key elements and corresponding code slices is constructed. Then, according to the vulnerability description and vulnerability location information of step 1.2, an effective subset of the code slice data dictionary required to fix the vulnerability is filtered out.
[0067] II. Vulnerability positioning phase.
[0068] For a smart contract to be repaired, the vulnerability description of the smart contract is input into the LLM (such as GPT-4) by embedding the designed field prompt word template, to analyze the specific attack steps and scope of the corresponding vulnerability. And generate structured repair elements involved in the repair according to the attack steps and scope. Among them, the vulnerability description of the smart contract can also be generated based on step 1.2 LLM.
[0069] III. Patch generation phase.
[0070] According to the generated structured repair element data, all code slices associated with the vulnerability are extracted from the code context slice data dictionary. Then, embed the associated code slices into the field code repair prompt word template of Figure 4 to generate repair code.
[0071] IV. Patch optimization phase.
[0072] This embodiment sets up an LLM-based vulnerability repair verifier, and inputs the generated repair code and vulnerability description into the verifier. Figure 5 The code verification / optimization prompt word template for the vulnerability repair verifier.
[0073] If the verifier outputs the repaired code without vulnerabilities, it will enter the compilation checksum and rule verification.
[0074] If the verifier outputs the repaired code still has defects, the verifier will repair the patch code again.
[0075] If the verifier outputs that the patched code has no defects, the patched code (or optimized patched code) is replaced with the original code, and then compilation and verification are performed. After the compilation and verification pass, vulnerability detectors such as Slither and GPTScan are used to re-detect the vulnerability. If the verification passes, the patching task is complete.
[0076] Figure 6 The code in the yellow box is the code patch generated in this embodiment, used to fix smart contract vulnerabilities.
[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.
Claims
1. A method for automatically remediating smart contract vulnerabilities based on vulnerability reports, characterized in that, The method includes: Construct a slice data dictionary containing key contract elements and vulnerability code slices; For a smart contract, the key contract elements involved in the structured remediation are obtained based on the vulnerability description of the smart contract, and the relevant vulnerability code slices are obtained by combining the slice data dictionary. Generate patch code for the relevant vulnerability code slices; The patch code is optimized, and the optimized patch code is used to repair the smart contract, resulting in the repaired smart contract. The construction of the slice data dictionary, which includes key contract elements and vulnerability code slices, includes: Collect smart contract samples containing vulnerabilities and third-party vulnerability detection reports for those smart contract samples, and obtain the source code of the smart contract samples; The source code of the smart contract sample is compiled and tested to obtain the compiled version and environment in which the smart contract sample runs; Based on a large language model, entity recognition is performed on the third-party vulnerability detection report to obtain vulnerability descriptions and vulnerability location information; Based on the vulnerability description and the vulnerability location information, all source code associated with the vulnerable function is filtered out from the source code of the smart contract sample, and the corresponding source code is divided into function-level code slice data. Based on the compiled version and environment in which the smart contract sample runs, static analysis is performed on the source code of the smart contract sample, and based on the static analysis results, a dependency graph of the key contract elements of the smart contract containing the vulnerability is constructed. By combining function-level code slice data and contract key element dependency graphs, a raw slice data dictionary is constructed; The original slice data dictionary is filtered according to the vulnerability description and the vulnerability location information to obtain a slice data dictionary containing key contract elements and vulnerability code slices; The patch code that generates the relevant vulnerability code slice includes: The relevant vulnerability code slices are embedded into the domain code repair prompt word template, and combined with the large language model to obtain the patch code of the relevant vulnerability code slices; wherein, the prompt word module of the domain code repair prompt word template includes: role-playing, task description, external structured information and expected output, and the content of the external structured information includes: attack process, repair strategy, code interaction structure diagram and code slices; The process of repairing the smart contract using the optimized patch code and obtaining the repair result further includes: The smart contract's repair results are subjected to vulnerability detection using a vulnerability detector, which may include Slither or GPTScan. If the vulnerability detector does not detect any vulnerability in the smart contract's repair results, the repair task is output as complete.
2. The method according to claim 1, characterized in that, For a smart contract, the key contract elements involved in structured remediation are obtained based on the vulnerability description of the smart contract, including: By embedding the vulnerability description of smart contracts into the domain prompt word template and combining it with a large language model, the attack steps and scope of the corresponding vulnerability can be obtained. Based on the attack steps and scope of the corresponding vulnerability, generate the key contract elements involved in the structured remediation.
3. The method according to claim 1, characterized in that, The patch code has been optimized, including: The patch code and the vulnerability description of the smart contract are embedded into the code verification / optimization prompt template to verify the patch code; wherein, the prompt module of the code verification / optimization prompt template includes: role-playing, task description, external structured information and expected output, and the content of the external structured information includes: attack process, repair strategy, code interaction structure diagram, code slice and patch code; If the verification result shows that the patch code has no vulnerabilities, the patch code will be used as the optimized patch code; If the verification result indicates that the patch code has a vulnerability, the optimized patch code will be output.
4. The method according to claim 1, characterized in that, The smart contract is repaired using the optimized patch code, and the repair result of the smart contract is obtained, including: The source code of the smart contract is compiled and tested to obtain the compiled version and environment in which the smart contract runs; After replacing the corresponding vulnerability code slices with the optimized patch code, a compilation verification is performed based on the compiled version and environment in which the smart contract runs; After successful compilation and verification, the repair result of the smart contract is obtained.
5. An automated smart contract vulnerability remediation system based on vulnerability reports, characterized in that, The system includes: The dictionary building module is used to build a slice data dictionary containing key contract elements and vulnerability code slices; The vulnerability location module is used to obtain the key contract elements involved in the structured remediation based on the vulnerability description of a smart contract, and to obtain the relevant vulnerability code slices by combining the slice data dictionary. The patch generation module is used to generate patch code for the relevant vulnerability code slices; The patch optimization module is used to optimize the patch code and use the optimized patch code to repair the smart contract, thereby obtaining the repair result of the smart contract. The construction of the slice data dictionary, which includes key contract elements and vulnerability code slices, includes: Collect smart contract samples containing vulnerabilities and third-party vulnerability detection reports for those smart contract samples, and obtain the source code of the smart contract samples; The source code of the smart contract sample is compiled and tested to obtain the compiled version and environment in which the smart contract sample runs; Based on a large language model, entity recognition is performed on the third-party vulnerability detection report to obtain vulnerability descriptions and vulnerability location information; Based on the vulnerability description and the vulnerability location information, all source code associated with the vulnerable function is filtered out from the source code of the smart contract sample, and the corresponding source code is divided into function-level code slice data. Based on the compiled version and environment in which the smart contract sample runs, static analysis is performed on the source code of the smart contract sample, and based on the static analysis results, a dependency graph of the key contract elements of the smart contract containing the vulnerability is constructed. By combining function-level code slice data and contract key element dependency graphs, a raw slice data dictionary is constructed; The original slice data dictionary is filtered according to the vulnerability description and the vulnerability location information to obtain a slice data dictionary containing key contract elements and vulnerability code slices; The patch code that generates the relevant vulnerability code slice includes: The relevant vulnerability code slices are embedded into the domain code repair prompt word template, and combined with the large language model to obtain the patch code of the relevant vulnerability code slices; wherein, the prompt word module of the domain code repair prompt word template includes: role-playing, task description, external structured information and expected output, and the content of the external structured information includes: attack process, repair strategy, code interaction structure diagram and code slices; The process of repairing the smart contract using the optimized patch code and obtaining the repair result further includes: The smart contract's repair results are subjected to vulnerability detection using a vulnerability detector, which may include Slither or GPTScan. If the vulnerability detector does not detect any vulnerability in the smart contract's repair results, the repair task is output as complete.
6. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements an automated smart contract vulnerability repair method based on vulnerability reports as described in any one of claims 1-4.
7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement an automated smart contract vulnerability repair method based on vulnerability reports as described in any one of claims 1-4.