Smart contract execution overhead vulnerability detection method and device, equipment and storage medium

Abstract

The invention discloses a smart contract execution overhead vulnerability detection method, apparatus and device, and a storage medium, which are used for solving the technical problem that the existing smart contract execution overhead vulnerability detection method is low in detection accuracy when facing a smart contract with complex logic. The method comprises the following steps: acquiring execution overhead data of a preset smart contract in a transaction execution process, and generating context information by adopting the execution overhead data; constructing an inter-contract control flow diagram based on execution overhead according to the context information; determining a to-be-analyzed smart contract in the inter-contract control flow diagram; obtaining state information of each to-be-analyzed smart contract; according to the state information, generating an in-contract control flow diagram of each to-be-analyzed smart contract based on execution overhead; performing data dependence analysis on the control flow diagram in the contract to obtain a potential execution overhead key function of the smart contract to be analyzed; and generating an execution overhead vulnerability detection result according to the potential execution overhead key function and a preset large language model.

Description

Technical Field

[0001] The present invention relates to the field of smart contract technology, and in particular to a smart contract execution overhead vulnerability detection method, device, equipment and storage medium. Background Art

[0002] The execution overhead mechanism of smart contracts is a system used in blockchain platforms such as Ethereum to check and balance and limit the resources required for contract execution. Optimizing contract code can reduce execution overhead, which not only reduces user fees but also improves execution efficiency. Therefore, understanding the execution mechanism is crucial to developing efficient and secure smart contracts. In addition, Ethereum sets an upper limit on the execution overhead spent on executing transactions in each block (i.e., the block execution limit). Therefore, when the block execution overhead limit is exceeded when executing a transaction within a block, the transaction fails and its execution is undone (i.e., the blockchain rolls back all state changes made before the transaction failed).

[0003] Common smart contract execution overhead vulnerabilities include unconstrained loops and malicious termination. Unconstrained loops mainly use infinite loops to make smart contracts run out of execution fees, resulting in execution failure. Malicious termination maliciously causes external calls to fail when smart contracts execute external calls in loops, causing execution failure of the caller's smart contract, which in turn causes blockchain state rollback and causes a denial of service attack.

[0004] In recent years, many tools have been used to detect smart contract vulnerabilities, which can be divided into two categories: static analysis and dynamic analysis. Static analysis tools mainly analyze the source code or bytecode of smart contracts to discover potential vulnerabilities. Dynamic analysis tools discover potential vulnerabilities by constructing the input of smart contracts and monitoring the behavior of the smart contract execution process.

[0005] Execution overhead vulnerability detection based on static analysis mainly predefines key data sources and data endpoints based on prior knowledge, and then analyzes the code of the smart contract to check whether such a path exists. However, since complex smart contracts often interact with other smart contracts, static analysis methods will lose key execution overhead vulnerability paths because they cannot restore the complete call chain. Research on execution overhead vulnerability detection based on dynamic analysis mainly detects execution overhead vulnerabilities by trying to generate inputs that can trigger high gas paths. However, since the vulnerability paths in complex smart contracts are often hidden very deeply, or even not on a call chain, it is difficult for fuzz testing tools to find effective vulnerability paths. Summary of the invention

[0006] The present invention provides a smart contract execution overhead vulnerability detection method, device, equipment and storage medium, which are used to solve the technical problem of low detection accuracy of existing smart contract execution overhead vulnerability detection methods when facing smart contracts with complex logic.

[0007] The present invention provides a method for detecting a smart contract execution overhead vulnerability, comprising:

[0008] Collecting execution overhead data of a preset smart contract during a transaction execution process, and using the execution overhead data to generate context information;

[0009] constructing an inter-contract control flow graph based on execution overhead according to the context information;

[0010] Determine the smart contract to be analyzed in the inter-contract control flow graph;

[0011] Obtaining status information of each of the smart contracts to be analyzed;

[0012] Generate an execution overhead-based in-contract control flow graph for each of the smart contracts to be analyzed according to the state information;

[0013] Performing data dependency analysis on the control flow graph in the contract to obtain key functions of potential execution overhead of the smart contract to be analyzed;

[0014] An execution overhead vulnerability detection result is generated according to the potential execution overhead key function and the preset large language model.

[0015] Optionally, the step of collecting execution overhead data of a preset smart contract during a transaction execution process and using the execution overhead data to generate context information includes:

[0016] Obtaining transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generating a transaction list using the transaction information;

[0017] Dynamically executing the transactions in the transaction list in sequence through a virtual machine, and obtaining execution overhead data during the transaction execution;

[0018] When the execution overhead data includes external call data and loop data, determining the transaction as a potential vulnerability-affected transaction;

[0019] Obtain call chain information and data read and write dependency information that may affect transactions due to potential vulnerabilities;

[0020] The call chain information and the data read and write dependency information are used to generate context information.

[0021] Optionally, the step of constructing an inter-contract control flow graph based on execution overhead according to the context information includes:

[0022] Get the data flow diagram during the transaction;

[0023] Constructing a smart contract full life cycle execution flow graph based on the call chain information and the data flow graph in the context information;

[0024] The intermediate execution flows that do not contain the loop data are removed from the full life cycle execution flow graph to obtain an inter-contract control flow graph based on execution overhead.

[0025] Optionally, the step of determining the smart contract to be analyzed in the inter-contract control flow graph includes:

[0026] Determine in turn whether the smart contract in the inter-contract control flow graph is consistent with the smart contract of the external transaction;

[0027] A smart contract that is consistent with the smart contract of the external transaction is determined as the smart contract to be analyzed.

[0028] Optionally, the step of generating, according to the state information, an execution overhead-based in-contract control flow graph of each of the smart contracts to be analyzed includes:

[0029] Performing control flow analysis and data flow analysis on each function in the smart contract to be analyzed according to the state information, and determining the dependency relationship between the function relationships according to the analysis results;

[0030] Construct an execution overhead-based in-contract control flow graph of the smart contract to be analyzed according to the dependency relationship.

[0031] Optionally, the step of performing data dependency analysis on the control flow graph in the contract to obtain key functions of potential execution overhead of the smart contract to be analyzed includes:

[0032] Obtain loop boundaries of each function in the control flow graph within the contract;

[0033] Determine whether there is a loop boundary into which the first external function parameter flows;

[0034] If yes, determine the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution overhead critical function of the smart contract to be analyzed;

[0035] If not, determine whether there is a target function that can be called by the second external function parameter to modify the loop boundary;

[0036] If so, determining the target function as the second potential execution overhead key function of the smart contract to be analyzed;

[0037] Integrate all of the first potential execution overhead key functions and the second potential execution overhead key functions to generate the potential execution overhead key functions of the smart contract to be analyzed.

[0038] The present invention also provides a smart contract execution overhead vulnerability detection device, comprising:

[0039] A context information generation module, used to collect execution overhead data of a preset smart contract during the transaction execution process, and use the execution overhead data to generate context information;

[0040] An inter-contract control flow graph construction module, used to construct an inter-contract control flow graph based on execution overhead according to the context information;

[0041] A module for determining a smart contract to be analyzed, used to determine the smart contract to be analyzed in the inter-contract control flow graph;

[0042] A status information acquisition module, used to obtain the status information of each smart contract to be analyzed;

[0043] An intra-contract control flow graph generation module, used to generate an intra-contract control flow graph based on execution overhead for each of the smart contracts to be analyzed according to the state information;

[0044] A potential execution overhead key function acquisition module is used to perform data dependency analysis on the control flow graph in the contract to obtain the potential execution overhead key functions of the smart contract to be analyzed;

[0045] The vulnerability detection module is used to generate an execution overhead vulnerability detection result according to the potential execution overhead key function and a preset large language model.

[0046] Optionally, the context information generating module includes:

[0047] A transaction list generation submodule, used to obtain the transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generate a transaction list using the transaction information;

[0048] An execution overhead data acquisition submodule, used to dynamically execute the transactions in the transaction list in sequence through a virtual machine, and acquire execution overhead data during the transaction execution;

[0049] A potential vulnerability impacted transaction determination submodule, configured to determine the transaction as a potential vulnerability impacted transaction when the execution overhead data includes external call data and loop data;

[0050] The call chain information and data read-write dependency information acquisition submodule is used to obtain the call chain information and data read-write dependency information of potential vulnerabilities that affect transactions;

[0051] The context information generation submodule is used to generate context information using the call chain information and the data read and write dependency information.

[0052] The present invention also provides an electronic device, the device comprising a processor and a memory:

[0053] The memory is used to store program code and transmit the program code to the processor;

[0054] The processor is used to execute the smart contract execution overhead vulnerability detection method as described in any of the above items according to the instructions in the program code.

[0055] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to execute the smart contract execution overhead vulnerability detection method as described in any of the above items.

[0056] It can be seen from the above technical scheme that the present invention has the following advantages: the present invention discloses a method for detecting execution overhead vulnerabilities of smart contracts, and specifically discloses: collecting the execution overhead data of a preset smart contract during the transaction execution process, and using the execution overhead data to generate context information; constructing an inter-contract control flow graph based on execution overhead according to the context information; determining the smart contract to be analyzed in the inter-contract control flow graph; obtaining the status information of each smart contract to be analyzed; generating an intra-contract control flow graph based on execution overhead for each smart contract to be analyzed according to the status information; performing data dependency analysis on the intra-contract control flow graph to obtain the potential execution overhead key functions of the smart contract to be analyzed; generating an execution overhead vulnerability detection result according to the potential execution overhead key functions and a preset large language model. The present invention constructs an inter-contract control flow graph based on execution overhead through the characteristics of transaction execution and execution overhead vulnerabilities, which can realize the accurate construction of the execution overhead call chain; extracts the data dependency relationship within the contract, realizes the accurate extraction of the key functions of the execution overhead vulnerability, and performs vulnerability detection through a large language model on this basis, thereby improving the accuracy of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0058] Figure 1 A flowchart of a method for detecting a smart contract execution overhead vulnerability provided by an embodiment of the present invention;

[0059] Figure 2 A flowchart of the steps of a smart contract execution overhead vulnerability detection method provided by another embodiment of the present invention;

[0060] Figure 3 A schematic diagram of the process of collecting context information based on execution cost;

[0061] Figure 4 A schematic diagram of the location flow of key functions with potential execution overhead;

[0062] Figure 5 This is a schematic diagram of the execution overhead vulnerability detection process based on a large language model;

[0063] Figure 6 A structural block diagram of a smart contract execution overhead vulnerability detection device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The embodiments of the present invention provide a smart contract execution overhead vulnerability detection method, device, equipment and storage medium, which are used to solve the technical problem of low detection accuracy of existing smart contract execution overhead vulnerability detection methods when facing smart contracts with complex logic.

[0065] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] See also Figure 1 , Figure 1 A flowchart of the steps of a smart contract execution overhead vulnerability detection method provided by an embodiment of the present invention.

[0067] The present invention provides a method for detecting a smart contract execution overhead vulnerability, which may specifically include the following steps:

[0068] Step 101, collecting execution overhead data of a preset smart contract during a transaction execution process, and using the execution overhead data to generate context information;

[0069] The smart contracts involved in the embodiments of the present invention are mainly complex logic smart contracts. Complex logic smart contracts are an automated protocol implemented using blockchain technology that can execute multiple conditions and complex logic. Compared with ordinary contracts, complex logic smart contracts involve multiple participants during execution. It will interact with other smart contracts, obtain multi-source data, and automatically execute contract terms.

[0070] Execution Overhead: The execution overhead mechanism is a system for measuring and managing the consumption of computing resources. It assigns a specific execution fee to each operation to prevent network abuse and ensure the efficient execution of transactions. Users need to set an execution price and a limit when submitting a transaction, and the transaction fee is calculated by multiplying the two. The execution overhead mechanism not only prevents logical errors such as infinite loops, but also improves network efficiency by prioritizing high-cost transactions, thereby protecting the stability of the blockchain.

[0071] In a specific implementation, for a preset smart contract, its execution overhead data during the transaction execution process can be searched in the blockchain, and the execution overhead data can be used to generate context information.

[0072] Step 102, constructing an inter-contract control flow graph based on execution overhead according to the context information;

[0073] After generating the context information, the calling relationship between different smart contracts can be obtained according to the context information, so as to construct an inter-contract control flow graph based on execution overhead.

[0074] Step 103, determining the smart contract to be analyzed in the inter-contract control flow graph;

[0075] In an embodiment of the present invention, since execution overhead vulnerabilities in complex logic smart contracts usually occur in external contracts, all smart contracts in the inter-contract control flow graph based on execution overhead can be classified, and the smart contracts to be analyzed that need to be focused on can be determined based on the classification results.

[0076] Step 104, obtaining status information of each smart contract to be analyzed;

[0077] Step 105, generating an execution overhead-based in-contract control flow graph of each smart contract to be analyzed according to the state information;

[0078] After determining the smart contract to be analyzed, the status information of the smart contract to be analyzed can be obtained, so as to perform control flow and data flow analysis on each function in the smart contract based on the status information, thereby constructing a control flow graph within the contract based on execution overhead.

[0079] Step 106, performing data dependency analysis on the control flow graph in the contract to obtain key functions of potential execution overhead of the smart contract to be analyzed;

[0080] After generating the control flow graph within the contract, data dependency analysis can be performed on it to obtain potential execution overhead key functions that have dependencies on external functions, which can be regarded as potential execution overhead vulnerability locations and subsequently analyzed.

[0081] Step 107 : generating an execution overhead vulnerability detection result according to the potential execution overhead key functions and the preset large language model.

[0082] For the collected key functions of potential execution overhead, their key information is input into the large language model for in-depth analysis, and the results of the execution overhead vulnerability detection can be output. Specifically, the key information includes the complete execution chain of the transaction, that is, the call chain, as well as the complete data source, the contract source code of the key functions of potential execution overhead and the transaction call. By providing the above content to the large language model and introducing the thinking chain mechanism, it is possible to analyze whether there are execution overhead vulnerabilities in the key functions of potential execution overhead.

[0083] The present invention constructs an inter-contract control flow graph based on execution overhead through the characteristics of transaction execution and execution overhead vulnerabilities, which can realize the accurate construction of execution overhead call chain; refines the data dependency relationship within the contract, realizes the accurate extraction of key functions of execution overhead vulnerabilities, and on this basis, performs vulnerability detection through a large language model, thereby improving the accuracy of vulnerability detection.

[0084] See also Figure 2 , Figure 2 A flowchart of a method for detecting a smart contract execution overhead vulnerability provided by another embodiment of the present invention. Specifically, the following steps may be included:

[0085] Step 201, obtaining transaction information of a preset smart contract in the blockchain where the preset smart contract is located, and generating a transaction list using the transaction information;

[0086] Step 202, dynamically executing the transactions in the transaction list in sequence through the virtual machine, and obtaining the execution overhead data during the transaction execution;

[0087] Step 203, when the execution overhead data includes external call data and loop data, the transaction is determined as a potential vulnerability-affected transaction;

[0088] Step 204, obtaining call chain information and data read and write dependency information of transactions affected by potential vulnerabilities;

[0089] Step 205, using the call chain information and the data read and write dependency information to generate context information;

[0090] In the specific implementation, Figure 3As shown in the figure, for a given smart contract, all transaction information of the smart contract can be searched in the blockchain, including transaction parameters, initiators, etc. This information is then summarized into a transaction list. Next, the transactions in the transaction list are dynamically executed one by one using a virtual machine. When the smart contract needs information from other smart contracts during execution, such as status or code information, it can find the request to the blockchain and obtain the necessary data for execution. During the execution process, the execution overhead of the transaction is collected. Specifically, during the transaction execution process, the external call status and execution control flow of the transaction are collected. When the transaction involves external calls and there is cyclic data, it is determined that the transaction is potentially affected by the execution overhead vulnerability and recorded as a potential vulnerability-affected transaction.

[0091] Then, important data from the execution process is collected and put into context information, such as call chain information and data read and write dependency information. These new types can be used to gain a deeper understanding of the specific execution of each transaction and determine the location of potential execution overhead vulnerabilities.

[0092] Step 206, constructing an inter-contract control flow graph based on execution overhead according to the context information;

[0093] After generating the context information, the calling relationship between different smart contracts can be obtained according to the context information, so as to construct an inter-contract control flow graph based on execution overhead.

[0094] In one example, step 206 may include the following sub-steps:

[0095] S61, obtaining a data flow diagram during the transaction;

[0096] S62, constructing a smart contract full life cycle execution flow diagram based on the call chain information and data flow diagram in the context information;

[0097] S63, removing the intermediate execution flow that does not contain loop data from the full life cycle execution flow graph to obtain an inter-contract control flow graph based on execution overhead.

[0098] In the specific implementation, the call chain information and data flow diagram in the transaction process can be combined to construct the execution flow diagram of the entire life cycle of the smart contract. Combined with the fact that the triggering position of the execution overhead vulnerability is usually located in the loop body, the intermediate execution flow that does not involve the loop body can be deleted, and finally an execution overhead-based inter-contract control flow graph containing only the loop body execution flow is generated.

[0099] Step 207, determining the smart contract to be analyzed in the inter-contract control flow graph;

[0100] In an embodiment of the present invention, since execution overhead vulnerabilities in complex logic smart contracts usually occur in external contracts, all smart contracts in the inter-contract control flow graph based on execution overhead can be classified, and the smart contracts to be analyzed that need to be focused on can be determined based on the classification results.

[0101] In one example, step 207 may include the following sub-steps:

[0102] S71, determining in turn whether the smart contract in the inter-contract control flow graph is consistent with the smart contract of the external transaction;

[0103] S72, determining the smart contract that is consistent with the smart contract of the external transaction as the smart contract to be analyzed.

[0104] In the specific implementation, the smart contract information can be queried by calling a third-party interface, such as Thegraph. If the smart contract information during the transaction execution is consistent with the smart contract information of the external transaction, the smart contract can be considered safe and deleted from the inter-contract control flow graph, otherwise it will be retained. Finally, the remaining smart contracts in the inter-contract control flow graph based on the execution overhead are the smart contracts to be analyzed.

[0105] Step 208, obtaining status information of each smart contract to be analyzed;

[0106] Step 209, generating an execution overhead-based in-contract control flow graph for each smart contract to be analyzed according to the state information;

[0107] After determining the smart contract to be analyzed, the status information of the smart contract to be analyzed can be obtained, so as to perform control flow and data flow analysis on each function in the smart contract based on the status information, thereby constructing a control flow graph within the contract based on execution overhead.

[0108] In one example, step 209 may include the following sub-steps:

[0109] S91, perform control flow analysis and data flow analysis on each function in the smart contract to be analyzed based on the state information, and determine the dependency relationship between the function relationships based on the analysis results;

[0110] S92, constructing an execution overhead-based in-contract control flow graph of the smart contract to be analyzed according to the dependency relationship.

[0111] For each smart contract to be analyzed, we first extract all the states in the smart contract to be analyzed, and then perform control flow analysis and data flow analysis on each function inside the smart contract to be analyzed. According to the analysis results, we build a dependency edge between mutually dependent functions, and finally construct a control flow graph within the contract based on execution overhead.

[0112] Step 210, performing data dependency analysis on the control flow graph in the contract to obtain key functions of potential execution overhead of the smart contract to be analyzed;

[0113] After generating the control flow graph within the contract, data dependency analysis can be performed on it to obtain potential execution overhead key functions that have dependencies on external functions, which can be regarded as potential execution overhead vulnerability locations and subsequently analyzed.

[0114] In one example, step 210 may include the following sub-steps:

[0115] S101, obtaining the loop boundaries of each function in the control flow graph within the contract;

[0116] S102, determining whether there is a loop boundary into which the first external function parameter flows;

[0117] S103: If yes, determine the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution overhead critical function of the smart contract to be analyzed;

[0118] S104, if not, determine whether there is a target function that can be called by the second external function parameter to modify the loop boundary;

[0119] S105, if it exists, determining the target function as the second potential execution cost key function of the smart contract to be analyzed;

[0120] S106, integrating all first potential execution overhead key functions and second potential execution overhead key functions to generate potential execution overhead key functions of the smart contract to be analyzed.

[0121] In the specific implementation, in the control flow graph within the contract based on the execution overhead, data dependency analysis is performed on all functions within the contract, and pruning is performed to determine the potential execution overhead key functions of the smart contract to be analyzed. Specifically, this can be done through the following two judgments:

[0122] a) Determine whether the first external function parameter will directly flow into the loop boundary. If the first external function parameter directly flows into the loop boundary, the function can be directly regarded as the first potential execution overhead key function, characterized as a potential execution overhead vulnerability location, and subsequent analysis can be performed.

[0123] b) Determine whether the loop boundary of the function can be indirectly modified by the second external function parameter. If the second external function parameter can call other functions inside the smart contract to be analyzed to modify the value of the loop boundary, such as starting from a target function in the control flow graph as the entry point and being able to reach the location of the function to be analyzed, then these target functions that can modify the loop boundary can be regarded as potential execution overhead vulnerability locations and marked as the second potential execution overhead key function for subsequent analysis.

[0124] By integrating the first potential execution overhead key function and the second potential execution overhead key function, the potential execution overhead key function of the smart contract to be analyzed can be obtained.

[0125] The process of locating key functions with potential execution overhead is as follows: Figure 4 shown.

[0126] Step 211 , generating an execution overhead vulnerability detection result according to potential execution overhead key functions and a preset large language model.

[0127] like Figure 5 As shown, for the collected key functions of potential execution overhead, their key information is input into the large language model for in-depth analysis, and the execution overhead vulnerability detection results can be output. Specifically, the key information includes the complete execution chain of the transaction, that is, the call chain, as well as the complete data source situation, the contract source code of the key functions of potential execution overhead and the transaction call. By providing the above content to the large language model and introducing the thinking chain mechanism, it is possible to analyze whether there is an execution overhead vulnerability in the key functions of potential execution overhead. Among them, the thinking chain mechanism decomposes the problem of determining whether there is an execution overhead vulnerability into the following three sub-problems:

[0128] (a) Determine whether there is a check for external data in the execution chain. If so, output "no", otherwise continue the analysis.

[0129] (b) Determine whether the check can filter the data source. If the check can make the data source safe, output "no", otherwise continue the analysis.

[0130] (c1) Based on the code of a given function, determine whether the data source will affect the check in the function. If so, output "yes", otherwise output "no".

[0131] (c2) Based on the code of a given function, determine whether the data source will affect the result of the function execution. If so, output "yes", otherwise output "no".

[0132] Among them, c1 and c2 are determined according to the source of the potential execution overhead key function in the previous step. When the external state can directly affect the loop boundary, the c1 subproblem is used, and if the external state indirectly affects the loop boundary, the c2 subproblem is used.

[0133] The present invention constructs an inter-contract control flow graph based on execution overhead through the characteristics of transaction execution and execution overhead vulnerabilities, which can realize the accurate construction of execution overhead call chain; refines the data dependency relationship within the contract, realizes the accurate extraction of key functions of execution overhead vulnerabilities, and on this basis, performs vulnerability detection through a large language model, thereby improving the accuracy of vulnerability detection.

[0134] See also Figure 6 , Figure 6 A structural block diagram of a smart contract execution overhead vulnerability detection device provided in an embodiment of the present invention.

[0135] An embodiment of the present invention provides a smart contract execution overhead vulnerability detection device, comprising:

[0136] The context information generation module 601 is used to collect the execution overhead data of the preset smart contract during the transaction execution process, and use the execution overhead data to generate context information;

[0137] An inter-contract control flow graph construction module 602, used to construct an inter-contract control flow graph based on execution overhead according to context information;

[0138] A smart contract to be analyzed determination module 603, used to determine the smart contract to be analyzed in the inter-contract control flow graph;

[0139] A status information acquisition module 604 is used to obtain status information of each smart contract to be analyzed;

[0140] The intra-contract control flow graph generation module 605 is used to generate an intra-contract control flow graph based on execution overhead for each smart contract to be analyzed according to the state information;

[0141] Potential execution overhead key function acquisition module 606, used to perform data dependency analysis on the control flow graph in the contract to obtain potential execution overhead key functions of the smart contract to be analyzed;

[0142] The vulnerability detection module 607 is used to generate an execution overhead vulnerability detection result according to the potential execution overhead key function and the preset large language model.

[0143] In the embodiment of the present invention, the context information generating module 601 includes:

[0144] The transaction list generation submodule is used to obtain the transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generate a transaction list using the transaction information;

[0145] An execution overhead data acquisition submodule is used to dynamically execute transactions in the transaction list in sequence through a virtual machine and obtain execution overhead data during transaction execution;

[0146] A potential vulnerability impacted transaction determination submodule, used to determine a transaction as a potential vulnerability impacted transaction when the execution overhead data includes external call data and loop data;

[0147] The call chain information and data read-write dependency information acquisition submodule is used to obtain the call chain information and data read-write dependency information of potential vulnerabilities that affect transactions;

[0148] The context information generation submodule is used to generate context information using call chain information and data read and write dependency information.

[0149] In the embodiment of the present invention, the inter-contract control flow graph construction module 602 includes:

[0150] The data flow graph acquisition submodule is used to obtain the data flow graph during the transaction process;

[0151] The smart contract full life cycle execution flow graph construction submodule is used to construct the smart contract full life cycle execution flow graph based on the call chain information and data flow graph in the context information;

[0152] The inter-contract control flow graph construction sub-module is used to remove the intermediate execution flow that does not contain loop data from the full life cycle execution flow graph to obtain the inter-contract control flow graph based on execution overhead.

[0153] In this embodiment of the present invention, the smart contract determination module 603 to be analyzed includes:

[0154] The consistency judgment submodule is used to judge whether the smart contract in the inter-contract control flow graph is consistent with the smart contract of the external transaction;

[0155] The submodule for determining the smart contract to be analyzed is used to determine the smart contract that is consistent with the smart contract of the external transaction as the smart contract to be analyzed.

[0156] In the embodiment of the present invention, the control flow graph generation module 605 in the contract includes:

[0157] The dependency determination submodule is used to perform control flow analysis and data flow analysis on each function in the smart contract to be analyzed based on the state information, and determine the dependency relationship between the function relationships based on the analysis results;

[0158] The in-contract control flow graph construction submodule is used to construct the in-contract control flow graph based on the execution cost of the smart contract to be analyzed according to the dependency relationship.

[0159] In the embodiment of the present invention, the potential execution overhead key function acquisition module 606 includes:

[0160] The loop boundary acquisition submodule is used to obtain the loop boundaries of each function in the control flow graph within the contract;

[0161] A first judgment submodule, used to judge whether there is a loop boundary into which the first external function parameter flows;

[0162] A first potential execution overhead key function determination submodule, for determining, if yes, the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution overhead key function of the smart contract to be analyzed;

[0163] A second judgment submodule is used to judge whether there is a target function that can be called by the second external function parameter to modify the loop boundary if no;

[0164] A second potential execution cost key function determination submodule, used to determine the target function as the second potential execution cost key function of the smart contract to be analyzed, if any;

[0165] The potential execution overhead key function integration submodule is used to integrate all the first potential execution overhead key functions and the second potential execution overhead key functions to generate the potential execution overhead key functions of the smart contract to be analyzed.

[0166] An embodiment of the present invention further provides an electronic device, the device comprising a processor and a memory:

[0167] The memory is used to store the program code and transmit the program code to the processor;

[0168] The processor is used to execute the smart contract execution overhead vulnerability detection method of an embodiment of the present invention according to the instructions in the program code.

[0169] An embodiment of the present invention also provides a computer-readable storage medium, which is used to store program code, and the program code is used to execute the smart contract execution overhead vulnerability detection method of the embodiment of the present invention.

[0170] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0171] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0172] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0173] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0174] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0175] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0176] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0177] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0178] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting smart contract execution overhead vulnerabilities, characterized in that: include: Collecting execution overhead data of a preset smart contract during a transaction execution process, and using the execution overhead data to generate context information; constructing an inter-contract control flow graph based on execution overhead according to the context information; Determine the smart contract to be analyzed in the inter-contract control flow graph; Obtaining status information of each of the smart contracts to be analyzed; Generate an execution overhead-based in-contract control flow graph for each of the smart contracts to be analyzed according to the state information; Performing data dependency analysis on the control flow graph in the contract to obtain key functions of potential execution overhead of the smart contract to be analyzed; An execution overhead vulnerability detection result is generated according to the potential execution overhead key function and the preset large language model.

2. The method according to claim 1, characterized in that The step of collecting execution overhead data of the preset smart contract during the transaction execution process and using the execution overhead data to generate context information includes: Obtaining transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generating a transaction list using the transaction information; Dynamically executing the transactions in the transaction list in sequence through a virtual machine, and obtaining execution overhead data during the transaction execution; When the execution overhead data includes external call data and loop data, determining the transaction as a potential vulnerability-affected transaction; Obtain call chain information and data read and write dependency information that may affect transactions due to potential vulnerabilities; The call chain information and the data read and write dependency information are used to generate context information.

3. The method according to claim 2, characterized in that The step of constructing an inter-contract control flow graph based on execution overhead according to the context information includes: Get the data flow diagram during the transaction; Constructing a smart contract full life cycle execution flow graph based on the call chain information and the data flow graph in the context information; The intermediate execution flows that do not contain the loop data are removed from the full life cycle execution flow graph to obtain an inter-contract control flow graph based on execution overhead.

4. The method according to claim 1, characterized in that The step of determining the smart contract to be analyzed in the inter-contract control flow graph includes: Determine in turn whether the smart contract in the inter-contract control flow graph is consistent with the smart contract of the external transaction; A smart contract that is consistent with the smart contract of the external transaction is determined as the smart contract to be analyzed.

5. The method according to claim 1, characterized in that The step of generating, according to the state information, an execution overhead-based in-contract control flow graph of each of the smart contracts to be analyzed includes: Performing control flow analysis and data flow analysis on each function in the smart contract to be analyzed according to the state information, and determining the dependency relationship between the function relationships according to the analysis results; Construct an execution overhead-based in-contract control flow graph of the smart contract to be analyzed according to the dependency relationship.

6. The method according to claim 1, characterized in that The step of performing data dependency analysis on the control flow graph in the contract to obtain key functions of potential execution overhead of the smart contract to be analyzed includes: Obtain loop boundaries of each function in the control flow graph within the contract; Determine whether there is a loop boundary into which the first external function parameter flows; If yes, determine the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution overhead critical function of the smart contract to be analyzed; If not, determine whether there is a target function that can be called by the second external function parameter to modify the loop boundary; If so, determining the target function as the second potential execution overhead key function of the smart contract to be analyzed; Integrate all of the first potential execution overhead key functions and the second potential execution overhead key functions to generate the potential execution overhead key functions of the smart contract to be analyzed.

7. A smart contract execution overhead vulnerability detection device, characterized in that: include: A context information generation module, used to collect execution overhead data of a preset smart contract during the transaction execution process, and use the execution overhead data to generate context information; An inter-contract control flow graph construction module, used to construct an inter-contract control flow graph based on execution overhead according to the context information; A module for determining a smart contract to be analyzed, used to determine the smart contract to be analyzed in the inter-contract control flow graph; A status information acquisition module, used to obtain the status information of each smart contract to be analyzed; An intra-contract control flow graph generation module, used to generate an intra-contract control flow graph based on execution overhead for each of the smart contracts to be analyzed according to the state information; A potential execution overhead key function acquisition module is used to perform data dependency analysis on the control flow graph in the contract to obtain the potential execution overhead key functions of the smart contract to be analyzed; The vulnerability detection module is used to generate an execution overhead vulnerability detection result according to the potential execution overhead key function and a preset large language model.

8. The device according to claim 7, characterized in that The context information generation module comprises: A transaction list generation submodule, used to obtain the transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generate a transaction list using the transaction information; An execution overhead data acquisition submodule, used to dynamically execute the transactions in the transaction list in sequence through a virtual machine, and acquire execution overhead data during the transaction execution; A potential vulnerability impacted transaction determination submodule, configured to determine the transaction as a potential vulnerability impacted transaction when the execution overhead data includes external call data and loop data; The call chain information and data read-write dependency information acquisition submodule is used to obtain the call chain information and data read-write dependency information of potential vulnerabilities that affect transactions; The context information generation submodule is used to generate context information using the call chain information and the data read and write dependency information.

9. An electronic device, characterized in that: The device comprises a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the smart contract execution overhead vulnerability detection method described in any one of claims 1-6 according to the instructions in the program code.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program code, and the program code is used to execute the smart contract execution overhead vulnerability detection method described in any one of claims 1-6.

Images