Source code vulnerability detection system based on smart contract

Abstract

The invention provides a source code vulnerability detection system based on an intelligent contract, and the system comprises a code analysis module which is used for receiving a first contract packet broadcasted in a network and extracting a source code in the first contract packet, the first contract surrounds broadcast data established based on the intelligent contract, and the source code is a to-be-detected code in the first contract packet; the vulnerability detection module is used for performing vulnerability detection on the received source code and generating a detection result; and the vulnerability report module is used for generating a vulnerability report according to the detection result, generating a second contract packet based on the vulnerability report, and broadcasting the second contract packet in the network. Through the automatic code analysis and vulnerability detection process, the system can quickly process source codes in a large number of contract packets, the code processing and vulnerability detection efficiency is remarkably improved, human intervention is reduced through automatic processing, and the problems of missing detection, false alarm and the like caused by human negligence or errors are reduced.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to the field of security analysis and vulnerability detection of smart contract source code. Background Art

[0002] With the rapid development of blockchain technology, the security issues of smart contracts, as automatically executed contracts on blockchain, are becoming increasingly prominent. Vulnerabilities in source code may lead to serious consequences such as asset loss and data leakage. Therefore, it is particularly important to develop an efficient and accurate smart contract source code vulnerability detection system. Summary of the invention

[0003] The present invention provides a source code vulnerability detection system based on smart contracts, which is used to solve the defect that vulnerabilities in source code may lead to serious consequences such as asset loss and data leakage.

[0004] According to a first aspect of the present invention, a source code vulnerability detection system based on a smart contract is provided, comprising:

[0005] A code parsing module, used to receive a first contract package broadcasted in the network, and extract source code in the first contract package, wherein the first contract encloses broadcast data established based on the smart contract, and the source code is the code to be detected in the first contract package;

[0006] A vulnerability detection module, used to perform vulnerability detection on the received source code and generate a detection result;

[0007] A vulnerability reporting module is used to generate a vulnerability report according to the detection result, generate a second contract package based on the vulnerability report, and broadcast the second contract package in the network.

[0008] According to an embodiment of the present invention, the receiving a first contract package broadcasted in a network and extracting source code in the first contract package specifically includes:

[0009] Obtain a first hash pointer of the first contract package, where the first hash pointer points to a data access end of the first contract package;

[0010] Based on the first hash pointer, the source code and the second hash pointer in the first contract package are extracted, and the second hash pointer points to the last vulnerability detection of the source code.

[0011] Specifically, this embodiment provides an implementation method for extracting the source code in the first contract package. The first hash pointer directly points to the data access end of the first contract package, so that the system can quickly locate the location of the contract package, improving the efficiency of data access; through the second hash pointer pointing to the last vulnerability detection record of the source code, the system can easily trace the historical version of the source code and its security status, which helps to quickly respond to and handle potential security issues.

[0012] Understandably, the second hash pointer not only provides information about the last vulnerability detection process of the source code, but also establishes a continuous chain of security checks. This mechanism helps ensure that the source code undergoes a strict security review after each modification, reducing the risk of security vulnerabilities being exploited.

[0013] It should be noted that in a distributed system, hash pointers can be used to achieve deduplication storage of data. If the data access end hash values ​​of two contract packages are the same, they can share the same storage resources, thereby saving storage space, and during the data transmission process, the receiver can verify the integrity and correctness of the data by comparing hash pointers without transmitting the entire data block. This helps reduce the bandwidth consumption and time cost of data transmission.

[0014] Furthermore, the hash pointer uniquely identifies the data block by generating a hash value of the data, and the hash value itself is very sensitive to changes in the data. Therefore, the first hash pointer ensures that the data access end of the first contract package has not been tampered with during transmission or storage, ensuring the integrity of the data.

[0015] According to an implementation manner of the present invention, the performing vulnerability detection on the received source code specifically includes:

[0016] Based on the first hash pointer and the second hash pointer, obtaining the grammatical structure, semantic logic, complexity and loop architecture of the source code;

[0017] Based on the grammatical structure, the semantic logic, the complexity and the loop architecture, static code vulnerability detection is performed on the source code.

[0018] Specifically, this embodiment provides an implementation method for performing vulnerability detection on the received source code, and through in-depth analysis of the grammatical structure, semantic logic, complexity and loop architecture of the source code, the function, structure and potential problems of the code can be more comprehensively understood. This in-depth analysis provides a solid foundation for subsequent vulnerability detection.

[0019] Understandably, compared with traditional rule-based or pattern-based vulnerability detection methods, the detection method based on in-depth analysis of source code can more accurately identify potential vulnerabilities because it not only considers the surface features of the code, but also the internal logic and structure of the code.

[0020] Furthermore, through comprehensive analysis of the code, false positives and false negatives caused by rule mismatches or pattern omissions can be reduced, which improves the accuracy and reliability of vulnerability detection.

[0021] In a possible embodiment, static code vulnerability detection can find potential vulnerabilities in the early stages of code writing and testing, thereby preventing the vulnerabilities from being exploited in the production environment. This helps reduce the occurrence of security incidents and related losses. In addition to discovering vulnerabilities, in-depth analysis of source code can also reveal problems such as performance bottlenecks, redundant code, and bad programming practices in the code. This helps developers optimize code quality and improve software performance and maintainability.

[0022] Furthermore, static code vulnerability detection can usually be automated, reducing the workload of developers to manually check the code. This helps developers focus more on code design and implementation, improving development efficiency.

[0023] According to an implementation manner of the present invention, the performing vulnerability detection on the received source code specifically includes:

[0024] Based on the first hash pointer and the second hash pointer, obtaining a program running environment, a standard running indicator, and a security architecture of the source code;

[0025] Based on the program running environment, the standard running indicators and the security architecture, dynamic code vulnerability detection is performed on the source code, and the dynamic code vulnerability detection at least includes memory leakage, access violation and resource leakage of the source code during operation.

[0026] Specifically, this embodiment provides an implementation method for performing vulnerability detection on the received source code. Through the first hash pointer and the second hash pointer, the operating environment of the source code can be accurately reconstructed, including the operating system, library files, dependencies, etc., to ensure the consistency between the test environment and the production environment. In the simulated operating environment, various boundary conditions and abnormal situations can be finely controlled to trigger potential vulnerabilities.

[0027] It should be noted that compared with static analysis, dynamic code vulnerability detection is closer to the actual operating environment, so it can discover more problems in actual operation. By simulating actual operation, it can eliminate some false positives that may be generated in static analysis and discover potential vulnerabilities missed by static analysis.

[0028] In a possible embodiment, dynamic code vulnerability detection can monitor the memory usage, resource access patterns, etc. of a program in real time while the program is running, thereby discovering problems that are difficult to capture with static analysis.

[0029] In a possible embodiment, by simulating the complete running process of the source code, dynamic problems such as memory leaks, access violations (such as out-of-bounds access, null pointer dereference), resource leaks (such as file handles, network connections not closed), etc. can be detected.

[0030] According to an implementation manner of the present invention, the performing vulnerability detection on the received source code specifically includes:

[0031] Based on the first hash pointer and the second hash pointer, acquiring taint information of the source code, the taint information including taint sources and taint sinks in the source code;

[0032] Based on the taint information, suspected taints in the source code are marked, and a first taint feature and a second taint feature of the source code are obtained, wherein the first taint feature points to a data propagation relationship of the suspected taint source in the source code, and the second taint source points to a control propagation relationship of the suspected taint source in the source code;

[0033] Based on the first taint feature and the second taint feature, taint vulnerability detection is performed on the source code.

[0034] Specifically, this embodiment provides an implementation method for vulnerability detection on the received source code. Through taint analysis, the system can accurately identify the taint sources and taint convergence points in the source code, that is, the potential sources of vulnerabilities and the locations where the vulnerabilities are exploited; the first taint feature and the second taint feature respectively reveal the paths of the taint in data propagation and control propagation, which helps the system to deeply understand the context environment and propagation mechanism of the vulnerability.

[0035] Furthermore, hash pointers are used to identify and exclude repeated source code processing, avoiding repeated detection of the same code, thereby optimizing resource utilization. Taint analysis can guide the system to focus on key areas in the source code (i.e., taint sources and taint convergence points), reducing the detection of irrelevant code and improving detection efficiency.

[0036] It can be understood that by using taint information to perform taint vulnerability detection on the source code, vulnerabilities can be discovered at an early stage. Taint vulnerability detection can discover potential vulnerabilities in the early stages of code development and provide developers with timely repair suggestions, thereby reducing security risks after software release. Based on the vulnerability detection results of taint analysis, developers can specifically strengthen the software's defense mechanism and improve the software's resistance to malicious attacks.

[0037] According to an embodiment of the present invention, extracting the source code and the second hash pointer in the first contract package specifically includes:

[0038] Based on the second hash pointer, if it is determined that there is a test probe in the source code and the test probe is used to detect a vulnerability in the source code, obtain a previous vulnerability detection result of the test probe, and perform vulnerability detection of the source code this time based on the previous vulnerability detection result;

[0039] When it is determined based on the second hash pointer that no test probe exists in the source code, a test probe is inserted into the source code, and vulnerability detection of the source code is performed according to the inserted test probe.

[0040] Specifically, this embodiment provides an implementation method for extracting the source code and the second hash pointer in the first contract package. By checking whether a test probe already exists in the source code, the system can dynamically adjust the vulnerability detection strategy. This flexibility makes the detection process more intelligent and can adapt to different code bases and detection requirements; when a test probe does not exist, the system can automatically insert a new test probe, which provides more possibilities and flexibility for the detection process.

[0041] It should be noted that when it is determined that test probes exist in the source code and these probes are used to detect vulnerabilities, by obtaining the previous vulnerability detection results of these probes, repeated detection of parts known to be free of vulnerabilities can be avoided, thereby significantly improving detection efficiency.

[0042] It can be understood that for source code where no test probes exist, by inserting new test probes and performing detection, it can be ensured that every part of the source code is covered, thereby improving the comprehensiveness and accuracy of the detection; the newly inserted test probes may be designed for specific vulnerability types or code areas, and can detect potential security issues more deeply.

[0043] According to an embodiment of the present invention, the receiving a first contract package broadcasted in a network and extracting source code in the first contract package specifically includes:

[0044] Based on the existence of at least two first hash pointers pointing to the same data access terminal of the first contract package in the network, obtaining a second hash pointer in the first contract package pointed to by each first hash pointer;

[0045] Extracting the last vulnerability detection information of the source code in each of the first contract packages according to the second hash pointer, the vulnerability detection information at least including the vulnerability detection type and vulnerability detection coverage of the source code;

[0046] Based on the vulnerability detection information, priority results of at least two of the first hash pointers are determined, corresponding first hash pointers are obtained according to the priority results, and the remaining first hash pointers are discarded.

[0047] Specifically, this embodiment provides an implementation method for receiving a first contract package broadcast in a network and extracting source code in the first contract package. By detecting the existence of at least two first hash pointers pointing to the same first contract package in the network, the system can identify potential data redundancy or repeated access attempts; by obtaining the second hash pointer in the first contract package pointed to by each first hash pointer, and further extracting the last vulnerability detection information of the source code, the system can verify the consistency between different data sources and ensure the accuracy of subsequent operations.

[0048] Furthermore, by determining the priority and selecting only the first hash pointer with the highest priority for subsequent processing, the system can avoid repeated processing of the same data, thereby saving computing resources and time; discarding the remaining first hash pointers reduces unnecessary computing and storage requirements, allowing the system to process valid data more efficiently.

[0049] It can be understood that by determining the priority of the first hash pointer through vulnerability detection information (such as vulnerability detection type and coverage), the system can more accurately evaluate the importance and reliability of each data source.

[0050] Furthermore, the priority-based decision-making process helps the system make more informed decisions when choosing which data access point to process, thereby improving the efficiency and accuracy of the entire processing flow.

[0051] According to an embodiment of the present invention, the receiving a first contract package broadcasted in a network and extracting source code in the first contract package specifically includes:

[0052] After extracting the source code in the first contract package, receiving the first hash pointer pointing to the same first contract package broadcasted in the network, discarding the first hash pointer, and broadcasting prompt information that the first contract package enters a compilation state to the network.

[0053] Specifically, this embodiment provides an implementation method for receiving a first contract package broadcast in a network and extracting source code in the first contract package. By discarding the first hash pointer that has been processed, the system avoids repeated extraction and compilation of the same contract package, thereby reducing the waste of computing resources and time; ensuring that each contract package is processed only once, so that the system can process other contract packages to be processed more efficiently.

[0054] Understandably, broadcasting the prompt information that the first contract package has entered the compilation state to the network can allow other network nodes or users to promptly understand the processing progress of the contract package, thereby improving the responsiveness and real-time performance of the system; for users waiting for contract package processing, this instant status update helps them better plan their operations and improve user experience.

[0055] Furthermore, by broadcasting the prompt information of the compilation status, it helps other nodes in the network to synchronously update the status information of the contract package, thereby maintaining the consistency and coordination of the entire network; avoiding resource conflicts or data inconsistencies caused by multiple nodes processing the same contract package at the same time.

[0056] Furthermore, in a highly concurrent network environment, this processing mechanism can effectively disperse processing pressure, avoid single-point overload, and improve the scalability of the system. Even if there are some node failures or delays in the network, the system can ensure that other nodes can obtain the processing status of the contract package in a timely manner through the broadcast mechanism, thereby enhancing the robustness of the system.

[0057] According to an embodiment of the present invention, before generating the second contract package based on the vulnerability report, the process specifically includes:

[0058] When prompt information indicating that the first contract package has entered a compiling state is received in the network, vulnerability detection on the source code is stopped.

[0059] Specifically, this embodiment provides an implementation method before the second contract package is generated based on the vulnerability report. When the contract package has entered the compilation state, continuing to perform vulnerability detection on it may cause resource conflicts with the compilation process, such as the use of memory, CPU and other resources. Stopping detection can avoid such conflicts, ensure the smooth progress of the compilation process, and ensure that tasks such as compilation and vulnerability detection can be completed efficiently and orderly by reasonably allocating resources, thereby improving the processing efficiency of the entire system.

[0060] Furthermore, by receiving prompt information about the compilation status, the system can understand the processing status of the contract package in real time, thereby keeping in sync with other nodes in the network. This synchronization helps to enhance the coordination and consistency of the system.

[0061] Furthermore, in a distributed system, communication and collaboration between nodes are crucial. Receiving and processing prompt information about the compilation status in a timely manner can reduce misunderstandings and conflicts caused by information asymmetry.

[0062] Understandably, for users, timely understanding of the processing status of the contract package can reduce unnecessary waiting time. When knowing that the contract package is being compiled, users can focus on other tasks or wait for the compilation to complete before performing subsequent operations.

[0063] In a possible embodiment, by receiving prompt information of the compilation status and adjusting the processing flow accordingly (such as stopping vulnerability detection), the system can form a closed-loop feedback mechanism. This mechanism helps the system to continuously optimize its processing logic and performance.

[0064] In a possible embodiment, the decision-making process (such as stopping vulnerability detection) is guided based on real-time data (such as prompt information of the compilation status), making the system more data-driven and intelligent.

[0065] According to a second aspect of the present invention, a computer program product is provided, which includes a non-transitory machine-readable medium storing a computer program, wherein the computer program is stored in the above-mentioned smart contract-based source code vulnerability detection system.

[0066] The above one or more technical solutions in the present invention have at least one of the following technical effects: the present invention provides a source code integrity detection system based on distributed ledger technology. Through automated code parsing and vulnerability detection processes, the system can quickly process source codes in a large number of contract packages, significantly improving the efficiency of code processing and vulnerability detection. Automated processing reduces human intervention and reduces problems such as missed detection and false alarms caused by human negligence or errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0068] Figure 1 It is a structural schematic diagram of a source code integrity detection system based on distributed ledger technology provided by the present invention;

[0069] Figure 2 It is a structural schematic diagram of the electronic device provided by the present invention.

[0070] Reference numerals:

[0071] 10. Code parsing module; 20. Vulnerability detection module; 30. Vulnerability reporting module;

[0072] 810, processor; 820, communication interface; 830, memory; 840, communication bus. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0074] The present invention is described in detail below in conjunction with the accompanying drawings of the specification. The specific operating method in the method embodiment can also be applied to the device embodiment or the system embodiment. In the description of the present invention, unless otherwise specified, "at least one" includes one or more. "Multiple" refers to two or more. For example, at least one of A, B and C includes: A exists alone, B exists alone, A and B exist at the same time, A and C exist at the same time, B and C exist at the same time, and A, B and C exist at the same time. In the present invention, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a kind of association relationship that describes the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0075] The present invention will be described in detail below in conjunction with specific implementation modes.

[0076] In some specific embodiments of the present invention, Figure 1 As shown, this solution provides a source code vulnerability detection system based on smart contracts, including:

[0077] A code parsing module 10 is used to receive a first contract package broadcasted in the network and extract source code in the first contract package, wherein the first contract surrounds broadcast data established based on a smart contract, and the source code is a code to be detected in the first contract package;

[0078] The vulnerability detection module 20 is used to perform vulnerability detection on the received source code and generate detection results;

[0079] The vulnerability reporting module 30 is used to generate a vulnerability report according to the detection result, generate a second contract package based on the vulnerability report, and broadcast the second contract package in the network.

[0080] In some possible implementations of the present invention, receiving a first contract package broadcasted in a network and extracting source code in the first contract package specifically includes:

[0081] Obtain a first hash pointer of the first contract package, where the first hash pointer points to a data access end of the first contract package;

[0082] Based on the first hash pointer, the source code and the second hash pointer in the first contract package are extracted, and the second hash pointer points to the last vulnerability detection of the source code.

[0083] Specifically, this embodiment provides an implementation method for extracting source code from a first contract package. The first hash pointer directly points to the data access end of the first contract package, so that the system can quickly locate the location of the contract package, thereby improving the efficiency of data access. By using the second hash pointer to point to the last vulnerability detection record of the source code, the system can easily trace the historical versions of the source code and its security status, which helps to quickly respond to and handle potential security issues.

[0084] Understandably, the second hash pointer not only provides information about the last vulnerability detection process of the source code, but also establishes a continuous chain of security checks. This mechanism helps ensure that the source code undergoes a strict security review after each modification, reducing the risk of security vulnerabilities being exploited.

[0085] It should be noted that in a distributed system, hash pointers can be used to achieve deduplication storage of data. If the data access end hash values ​​of two contract packages are the same, they can share the same storage resources, thereby saving storage space, and during the data transmission process, the receiver can verify the integrity and correctness of the data by comparing hash pointers without transmitting the entire data block. This helps reduce the bandwidth consumption and time cost of data transmission.

[0086] Furthermore, the hash pointer uniquely identifies the data block by generating a hash value of the data, and the hash value itself is very sensitive to changes in the data. Therefore, the first hash pointer ensures that the data access end of the first contract package has not been tampered with during transmission or storage, ensuring the integrity of the data.

[0087] In some possible implementations of the present invention, vulnerability detection is performed on the received source code, specifically including:

[0088] Based on the first hash pointer and the second hash pointer, obtaining the grammatical structure, semantic logic, complexity and loop architecture of the source code;

[0089] Perform static code vulnerability detection on source code based on grammatical structure, semantic logic, complexity and loop architecture.

[0090] Specifically, this embodiment provides an implementation method for vulnerability detection of received source code, and through in-depth analysis of the grammatical structure, semantic logic, complexity and loop architecture of the source code, the function, structure and potential problems of the code can be more comprehensively understood. This in-depth analysis provides a solid foundation for subsequent vulnerability detection.

[0091] Understandably, compared with traditional rule-based or pattern-based vulnerability detection methods, the detection method based on in-depth analysis of source code can more accurately identify potential vulnerabilities because it not only considers the surface features of the code, but also the internal logic and structure of the code.

[0092] Furthermore, through comprehensive analysis of the code, false positives and false negatives caused by rule mismatches or pattern omissions can be reduced, which improves the accuracy and reliability of vulnerability detection.

[0093] In a possible embodiment, static code vulnerability detection can find potential vulnerabilities in the early stages of code writing and testing, thereby preventing the vulnerabilities from being exploited in the production environment. This helps reduce the occurrence of security incidents and related losses. In addition to discovering vulnerabilities, in-depth analysis of source code can also reveal problems such as performance bottlenecks, redundant code, and bad programming practices in the code. This helps developers optimize code quality and improve software performance and maintainability.

[0094] Furthermore, static code vulnerability detection can usually be automated, reducing the workload of developers to manually check the code. This helps developers focus more on code design and implementation, improving development efficiency.

[0095] In some possible implementations of the present invention, vulnerability detection is performed on the received source code, specifically including:

[0096] Based on the first hash pointer and the second hash pointer, obtaining a program running environment, a standard running indicator, and a security architecture of the source code;

[0097] Based on the program running environment, standard running indicators and security architecture, dynamic code vulnerability detection is performed on the source code. The dynamic code vulnerability detection at least includes memory leaks, access violations and resource leaks during the running of the source code.

[0098] Specifically, this embodiment provides an implementation method for vulnerability detection on the received source code. Through the first hash pointer and the second hash pointer, the operating environment of the source code can be accurately reconstructed, including the operating system, library files, dependencies, etc., to ensure the consistency between the test environment and the production environment. In the simulated operating environment, various boundary conditions and abnormal situations can be finely controlled to trigger potential vulnerabilities.

[0099] It should be noted that compared with static analysis, dynamic code vulnerability detection is closer to the actual operating environment, so it can discover more problems in actual operation. By simulating actual operation, it can eliminate some false positives that may be generated in static analysis and discover potential vulnerabilities missed by static analysis.

[0100] In a possible embodiment, dynamic code vulnerability detection can monitor the memory usage, resource access patterns, etc. of a program in real time while the program is running, thereby discovering problems that are difficult to capture with static analysis.

[0101] In a possible embodiment, by simulating the complete running process of the source code, dynamic problems such as memory leaks, access violations (such as out-of-bounds access, null pointer dereference), resource leaks (such as file handles, network connections not closed), etc. can be detected.

[0102] In some possible implementations of the present invention, vulnerability detection is performed on the received source code, specifically including:

[0103] Based on the first hash pointer and the second hash pointer, obtaining taint information of the source code, the taint information including taint sources and taint convergence points in the source code;

[0104] Based on the taint information, the suspected taint in the source code is marked, and a first taint feature and a second taint feature of the source code are obtained, wherein the first taint feature points to the data propagation relationship of the suspected taint source in the source code, and the second taint source points to the control propagation relationship of the suspected taint source in the source code;

[0105] Based on the first taint feature and the second taint feature, taint vulnerability detection is performed on the source code.

[0106] Specifically, this embodiment provides an implementation method for vulnerability detection on the received source code. Through taint analysis, the system can accurately identify the taint sources and taint convergence points in the source code, that is, the potential sources of vulnerabilities and the locations where the vulnerabilities are exploited; the first taint feature and the second taint feature respectively reveal the paths of taint in data propagation and control propagation, which helps the system to deeply understand the context and propagation mechanism of the vulnerability.

[0107] Furthermore, hash pointers are used to identify and exclude repeated source code processing, avoiding repeated detection of the same code, thereby optimizing resource utilization. Taint analysis can guide the system to focus on key areas in the source code (i.e., taint sources and taint convergence points), reducing the detection of irrelevant code and improving detection efficiency.

[0108] It can be understood that taint vulnerability detection on source code through taint information can discover vulnerabilities at an early stage. Taint vulnerability detection can discover potential vulnerabilities in the early stages of code development and provide developers with timely repair suggestions, thereby reducing security risks after software release. Based on the vulnerability detection results of taint analysis, developers can strengthen the software's defense mechanism in a targeted manner and improve the software's resistance to malicious attacks.

[0109] In some possible implementations of the present invention, extracting the source code and the second hash pointer in the first contract package specifically includes:

[0110] Based on the second hash pointer, if it is determined that there is a test probe in the source code and the test probe is used to detect source code vulnerabilities, obtain a previous vulnerability detection result of the test probe, and perform vulnerability detection of the current source code based on the previous vulnerability detection result;

[0111] Based on the second hash pointer, when it is determined that no test probe exists in the source code, a test probe is inserted into the source code, and vulnerability detection of the current source code is performed according to the inserted test probe.

[0112] Specifically, this embodiment provides an implementation method for extracting the source code and the second hash pointer in the first contract package. By checking whether the test probe already exists in the source code, the system can dynamically adjust the vulnerability detection strategy. This flexibility makes the detection process more intelligent and can adapt to different code bases and detection requirements; when there is no test probe, the system can automatically insert a new test probe, which provides more possibilities and flexibility for the detection process.

[0113] It should be noted that when it is determined that test probes exist in the source code and these probes are used to detect vulnerabilities, by obtaining the previous vulnerability detection results of these probes, repeated detection of parts known to be free of vulnerabilities can be avoided, thereby significantly improving detection efficiency.

[0114] It can be understood that for source code where no test probes exist, by inserting new test probes and performing detection, it can be ensured that every part of the source code is covered, thereby improving the comprehensiveness and accuracy of the detection; the newly inserted test probes may be designed for specific vulnerability types or code areas, and can detect potential security issues more deeply.

[0115] In some possible implementations of the present invention, receiving a first contract package broadcasted in a network and extracting source code in the first contract package specifically includes:

[0116] Based on the existence of at least two first hash pointers pointing to the data access end of the same first contract package in the network, obtaining a second hash pointer in the first contract package pointed to by each first hash pointer;

[0117] Extract the last vulnerability detection information of the source code in each first contract package according to the second hash pointer, where the vulnerability detection information at least includes the vulnerability detection type and vulnerability detection coverage of the source code;

[0118] Based on the vulnerability detection information, priority results of at least two first hash pointers are determined, corresponding first hash pointers are obtained according to the priority results, and the remaining first hash pointers are discarded.

[0119] Specifically, this embodiment provides an implementation method for receiving a first contract package broadcast in a network and extracting source code in the first contract package. By detecting the existence of at least two first hash pointers pointing to the same first contract package in the network, the system can identify potential data redundancy or repeated access attempts; by obtaining the second hash pointer in the first contract package pointed to by each first hash pointer, and further extracting the last vulnerability detection information of the source code, the system can verify the consistency between different data sources and ensure the accuracy of subsequent operations.

[0120] Furthermore, by determining the priority and selecting only the first hash pointer with the highest priority for subsequent processing, the system can avoid repeated processing of the same data, thereby saving computing resources and time; discarding the remaining first hash pointers reduces unnecessary computing and storage requirements, allowing the system to process valid data more efficiently.

[0121] It can be understood that by determining the priority of the first hash pointer through vulnerability detection information (such as vulnerability detection type and coverage), the system can more accurately evaluate the importance and reliability of each data source.

[0122] Furthermore, the priority-based decision-making process helps the system make more informed decisions when choosing which data access point to process, thereby improving the efficiency and accuracy of the entire processing flow.

[0123] In some possible implementations of the present invention, receiving a first contract package broadcasted in a network and extracting source code in the first contract package specifically includes:

[0124] After extracting the source code in the first contract package, a first hash pointer pointing to the same first contract package broadcasted in the network is received, the first hash pointer is discarded, and a prompt message that the first contract package enters a compilation state is broadcasted to the network.

[0125] Specifically, this embodiment provides an implementation method for receiving a first contract package broadcast in a network and extracting source code in the first contract package. By discarding the first hash pointer that has been processed, the system avoids repeated extraction and compilation of the same contract package, thereby reducing the waste of computing resources and time; ensuring that each contract package is processed only once, so that the system can process other contract packages to be processed more efficiently.

[0126] Understandably, broadcasting the prompt information that the first contract package has entered the compilation state to the network can allow other network nodes or users to promptly understand the processing progress of the contract package, thereby improving the responsiveness and real-time performance of the system; for users waiting for contract package processing, this instant status update helps them better plan their operations and improve user experience.

[0127] Furthermore, by broadcasting the prompt information of the compilation status, it helps other nodes in the network to synchronously update the status information of the contract package, thereby maintaining the consistency and coordination of the entire network; avoiding resource conflicts or data inconsistencies caused by multiple nodes processing the same contract package at the same time.

[0128] Furthermore, in a highly concurrent network environment, this processing mechanism can effectively disperse processing pressure, avoid single-point overload, and improve the scalability of the system. Even if there are some node failures or delays in the network, the system can ensure that other nodes can obtain the processing status of the contract package in a timely manner through the broadcast mechanism, thereby enhancing the robustness of the system.

[0129] In some possible implementations of the present invention, before generating the second contract package based on the vulnerability report, the following steps are specifically included:

[0130] When a prompt message indicating that the first contract package has entered a compiling state is received in the network, vulnerability detection on the source code is stopped.

[0131] Specifically, this embodiment provides an implementation method before generating the second contract package based on the vulnerability report. When the contract package has entered the compilation state, continuing to perform vulnerability detection on it may cause resource conflicts with the compilation process, such as the use of memory, CPU and other resources. Stopping the detection can avoid such conflicts, ensure the smooth progress of the compilation process, and ensure that tasks such as compilation and vulnerability detection can be completed efficiently and orderly by reasonably allocating resources, thereby improving the processing efficiency of the entire system.

[0132] Furthermore, by receiving prompt information about the compilation status, the system can understand the processing status of the contract package in real time, thereby keeping in sync with other nodes in the network. This synchronization helps to enhance the coordination and consistency of the system.

[0133] Furthermore, in a distributed system, communication and collaboration between nodes are crucial. Receiving and processing prompt information about the compilation status in a timely manner can reduce misunderstandings and conflicts caused by information asymmetry.

[0134] Understandably, for users, timely understanding of the processing status of the contract package can reduce unnecessary waiting time. When knowing that the contract package is being compiled, users can focus on other tasks or wait for the compilation to complete before performing subsequent operations.

[0135] In a possible embodiment, by receiving prompt information of the compilation status and adjusting the processing flow accordingly (such as stopping vulnerability detection), the system can form a closed-loop feedback mechanism. This mechanism helps the system to continuously optimize its processing logic and performance.

[0136] In a possible embodiment, the decision-making process (such as stopping vulnerability detection) is guided based on real-time data (such as prompt information of the compilation status), making the system more data-driven and intelligent.

[0137] Figure 2 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 2 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call the logic instructions in the memory 830.

[0138] It should be noted that the electronic device in this embodiment can be a server, a PC, or other devices in specific implementation, as long as its structure includes the following: Figure 2 The processor 810, communication interface 820, memory 830 and communication bus 840 shown in the figure, wherein the processor 810, communication interface 820, memory 830 communicate with each other through the communication bus 840, and the processor 810 can call the logic instructions in the memory 830 to execute the above method. This embodiment does not limit the specific implementation form of the electronic device.

[0139] The server may be a single server or a server group. The server group may be centralized or distributed (for example, the server may be a distributed system).

[0140] In a possible embodiment, the server can be local or remote relative to the terminal. For example, the server can access information stored in the user terminal, database or any combination thereof via a network.

[0141] As another example, the server may be directly connected to at least one of the user terminal and the database to access information and / or data stored therein.

[0142] In a possible embodiment, the server may be implemented on a cloud platform; by way of example only, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an inter-cloud, a multi-cloud, etc., or any combination thereof.

[0143] In a possible embodiment, the server and the user terminal may be implemented on an electronic device having one or more components in the embodiments of the present invention.

[0144] Furthermore, the network may be used for the exchange of information and / or data.

[0145] In a possible embodiment, one or more components in the interactive scenario (eg, a server, a user terminal, and a database) may send information and / or data to other components.

[0146] In possible embodiments, the network may be any type of wired or wireless network, or a combination thereof. As examples only, the network may include a wired network, a wireless network, a fiber optic network, a telecommunications network, an intranet, the Internet, a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), a metropolitan area network (MAN), a wide area network (WAN), a public switched telephone network (PSTN), a Bluetooth network, a ZigBee network, or a near field communication (NFC) network, or any combination thereof.

[0147] In a possible embodiment, the network may include one or more network access points. For example, the network may include a wired or wireless network access point, such as a base station and / or a network switching node, through which one or more components of the interactive scene may connect to the network to exchange data and / or information.

[0148] In addition, the logic instructions in the memory 830 described above may be implemented in the form of software functional units and when sold or used as independent products, may be stored in a computer-readable storage medium.

[0149] Based on such understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., various media that can store program codes.

[0150] In a possible embodiment, the embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments.

[0151] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0152] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A source code vulnerability detection system based on smart contracts, characterized in that: include: A code parsing module (10), configured to receive a first contract package broadcasted in a network, and extract source code in the first contract package, wherein the first contract encloses broadcast data established based on the smart contract, and the source code is a code to be detected in the first contract package; A vulnerability detection module (20), used for performing vulnerability detection on the received source code and generating a detection result; A vulnerability reporting module (30) is used to generate a vulnerability report according to the detection result, generate a second contract package based on the vulnerability report, and broadcast the second contract package in the network.

2. According to claim 1, a source code vulnerability detection system based on smart contracts is characterized in that: The receiving a first contract package broadcasted in the network and extracting source code in the first contract package specifically includes: Obtain a first hash pointer of the first contract package, where the first hash pointer points to a data access end of the first contract package; Based on the first hash pointer, the source code and the second hash pointer in the first contract package are extracted, and the second hash pointer points to the last vulnerability detection of the source code.

3. According to claim 2, a source code vulnerability detection system based on smart contracts is characterized in that: The performing vulnerability detection on the received source code specifically includes: Based on the first hash pointer and the second hash pointer, obtaining the grammatical structure, semantic logic, complexity and loop architecture of the source code; Based on the grammatical structure, the semantic logic, the complexity and the loop architecture, static code vulnerability detection is performed on the source code.

4. According to claim 2, a source code vulnerability detection system based on smart contracts is characterized in that: The performing vulnerability detection on the received source code specifically includes: Based on the first hash pointer and the second hash pointer, obtaining a program running environment, a standard running indicator, and a security architecture of the source code; Based on the program running environment, the standard running indicators and the security architecture, dynamic code vulnerability detection is performed on the source code, and the dynamic code vulnerability detection at least includes memory leakage, access violation and resource leakage of the source code during operation.

5. The source code vulnerability detection system based on smart contracts according to claim 2 is characterized in that: The performing vulnerability detection on the received source code specifically includes: Based on the first hash pointer and the second hash pointer, acquiring taint information of the source code, the taint information including taint sources and taint sinks in the source code; Based on the taint information, suspected taints in the source code are marked, and a first taint feature and a second taint feature of the source code are obtained, wherein the first taint feature points to a data propagation relationship of the suspected taint source in the source code, and the second taint source points to a control propagation relationship of the suspected taint source in the source code; Based on the first taint feature and the second taint feature, taint vulnerability detection is performed on the source code.

6. A source code vulnerability detection system based on smart contracts according to any one of claims 2 to 5, characterized in that: The extracting the source code and the second hash pointer in the first contract package specifically includes: Based on the second hash pointer, if it is determined that there is a test probe in the source code and the test probe is used to detect a vulnerability in the source code, obtain a previous vulnerability detection result of the test probe, and perform vulnerability detection of the source code this time based on the previous vulnerability detection result; When it is determined based on the second hash pointer that no test probe exists in the source code, a test probe is inserted into the source code, and vulnerability detection of the source code is performed according to the inserted test probe.

7. A source code vulnerability detection system based on smart contracts according to any one of claims 2 to 5, characterized in that: The receiving a first contract package broadcasted in the network and extracting source code in the first contract package specifically includes: Based on the existence of at least two first hash pointers pointing to the same data access terminal of the first contract package in the network, obtaining a second hash pointer in the first contract package pointed to by each first hash pointer; Extracting the last vulnerability detection information of the source code in each of the first contract packages according to the second hash pointer, the vulnerability detection information at least including the vulnerability detection type and vulnerability detection coverage of the source code; Based on the vulnerability detection information, priority results of at least two of the first hash pointers are determined, corresponding first hash pointers are obtained according to the priority results, and the remaining first hash pointers are discarded.

8. A source code vulnerability detection system based on smart contracts according to any one of claims 2 to 5, characterized in that: The receiving a first contract package broadcasted in the network and extracting source code in the first contract package specifically includes: After extracting the source code in the first contract package, receiving the first hash pointer pointing to the same first contract package broadcasted in the network, discarding the first hash pointer, and broadcasting prompt information that the first contract package enters a compilation state to the network.

9. A source code vulnerability detection system based on smart contracts according to any one of claims 2 to 5, characterized in that: Before generating the second contract package based on the vulnerability report, the method specifically includes: When prompt information indicating that the first contract package has entered a compiling state is received in the network, vulnerability detection on the source code is stopped.

10. A computer program product comprising a non-transitory machine-readable medium storing a computer program, characterized in that: The computer program is stored in a source code vulnerability detection system based on a smart contract as described in any one of claims 1 to 9 above.

Images