Smart contract execution overhead vulnerability detection method, device, equipment and storage medium

Abstract

The present invention discloses a method, apparatus, device, and storage medium for detecting smart contract execution overhead vulnerabilities, which are used to address the technical problem of low detection accuracy in existing smart contract execution overhead vulnerability detection methods when dealing with smart contracts with complex logic. The method includes: collecting execution overhead data of a preset smart contract during transaction execution, and using the execution overhead data to generate context information; constructing an inter-contract control flow graph based on execution overhead based on the context information; determining the smart contract to be analyzed in the inter-contract control flow graph; obtaining status information of each smart contract to be analyzed; generating an intra-contract control flow graph based on execution overhead for each smart contract to be analyzed based on the status information; performing data dependency analysis on the intra-contract control flow graph to obtain potential execution overhead key functions of the smart contract to be analyzed; and generating an execution overhead vulnerability detection result based on the potential execution overhead key functions and a preset large language model.

Description

Technical Field

[0001] The present invention relates to the field of smart contract technology, and in particular to a method, apparatus, device, and storage medium for detecting smart contract execution overhead vulnerabilities. Background Art

[0002] The execution overhead mechanism of smart contracts is a system used in blockchain platforms like Ethereum to check and balance the resources required to execute contracts. Optimizing contract code can reduce execution overhead, which not only lowers user fees but also improves execution efficiency. Therefore, understanding the execution mechanism is crucial to developing efficient and secure smart contracts. Furthermore, Ethereum imposes a cap on the execution overhead of executing transactions within each block (i.e., the block execution limit). Therefore, if the block execution limit is exceeded while executing a transaction within a block, the transaction fails and its execution is undone (i.e., the blockchain rolls back all state changes made prior to the transaction failure).

[0003] Common smart contract execution overhead vulnerabilities include unconstrained loops and malicious termination. Unconstrained loops primarily cause smart contracts to exhaust execution fees through infinite loops, resulting in execution failure. Malicious termination occurs when a smart contract executes an external call within a loop, maliciously causing the call to fail. This causes the caller's smart contract to fail, leading to a blockchain state rollback and a denial of service attack.

[0004] In recent years, a wide range of tools have been used to detect smart contract vulnerabilities. These can be categorized into two main types: static analysis and dynamic analysis. Static analysis tools primarily analyze the source code or bytecode of smart contracts to uncover potential vulnerabilities. Dynamic analysis tools uncover potential vulnerabilities by constructing smart contract inputs and monitoring the behavior of the smart contract's execution.

[0005] Static analysis-based execution overhead vulnerability detection primarily predefines key data sources and data endpoints based on prior knowledge, then analyzes the smart contract code to check for such paths. However, since complex smart contracts often interact with other smart contracts, static analysis methods cannot recover the complete call chain and will miss the key execution overhead vulnerability path. Research on dynamic analysis-based execution overhead vulnerability detection primarily attempts to detect execution overhead vulnerabilities by attempting to generate inputs that trigger high-gas paths. However, since vulnerability paths in complex smart contracts are often deeply hidden, even outside of a single call chain, fuzz testing tools struggle to find effective vulnerability paths. Summary of the Invention

[0006] The present invention provides a method, apparatus, device and storage medium for detecting smart contract execution overhead vulnerabilities, which are used to solve the technical problem of low detection accuracy in existing smart contract execution overhead vulnerability detection methods when facing smart contracts with complex logic.

[0007] The present invention provides a method for detecting smart contract execution overhead vulnerabilities, comprising:

[0008] Collecting execution overhead data of a preset smart contract during a transaction execution process, and using the execution overhead data to generate context information;

[0009] constructing an inter-contract control flow graph based on execution overhead according to the context information;

[0010] Determining a smart contract to be analyzed in the inter-contract control flow graph;

[0011] Obtaining status information of each of the smart contracts to be analyzed;

[0012] Generate an execution overhead-based intra-contract control flow graph for each of the smart contracts to be analyzed according to the state information;

[0013] Performing data dependency analysis on the control flow graph within the contract to obtain key functions with potential execution overhead for the smart contract to be analyzed;

[0014] An execution overhead vulnerability detection result is generated according to the potential execution overhead key function and a preset large language model.

[0015] Optionally, the step of collecting execution overhead data of a preset smart contract during a transaction execution process and generating context information using the execution overhead data includes:

[0016] Obtaining transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generating a transaction list using the transaction information;

[0017] Dynamically executing transactions in the transaction list in sequence through a virtual machine, and obtaining execution overhead data during transaction execution;

[0018] When the execution overhead data includes external call data and loop data, determining the transaction as a potential vulnerability-affected transaction;

[0019] Obtain call chain information and data read and write dependency information that may affect transactions due to potential vulnerabilities;

[0020] The call chain information and the data read and write dependency information are used to generate context information.

[0021] Optionally, the step of constructing an inter-contract control flow graph based on execution overhead according to the context information includes:

[0022] Get the data flow diagram during the transaction;

[0023] Constructing a smart contract full lifecycle execution flow diagram based on the call chain information and the data flow diagram in the context information;

[0024] The intermediate execution flows that do not contain the loop data are removed from the full lifecycle execution flow graph to obtain an inter-contract control flow graph based on execution overhead.

[0025] Optionally, the step of determining the smart contract to be analyzed in the inter-contract control flow graph includes:

[0026] Determine in sequence whether the smart contract in the inter-contract control flow graph is consistent with the smart contract of the external transaction;

[0027] A smart contract that is consistent with the smart contract of the external transaction is determined as a smart contract to be analyzed.

[0028] Optionally, the step of generating an execution overhead-based intra-contract control flow graph of each of the smart contracts to be analyzed according to the state information includes:

[0029] Performing control flow analysis and data flow analysis on each function within the smart contract to be analyzed based on the state information, and determining the dependency relationships between the functions based on the analysis results;

[0030] Construct an execution overhead-based intra-contract control flow graph of the smart contract to be analyzed according to the dependency relationship.

[0031] Optionally, the step of performing data dependency analysis on the control flow graph within the contract to obtain key functions of potential execution overhead of the smart contract to be analyzed includes:

[0032] Obtain loop boundaries for each function in the control flow graph within the contract;

[0033] Determining whether there is a loop boundary into which the first external function parameter flows;

[0034] If so, determining the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution overhead critical function of the smart contract to be analyzed;

[0035] If not, determine whether there is a target function that can be called by the second external function parameter to modify the loop boundary;

[0036] If so, determining the target function as the second potential execution cost key function of the smart contract to be analyzed;

[0037] Integrate all of the first potential execution overhead key functions and the second potential execution overhead key functions to generate the potential execution overhead key functions of the smart contract to be analyzed.

[0038] The present invention also provides a smart contract execution overhead vulnerability detection device, comprising:

[0039] A context information generation module, configured to collect execution overhead data of a preset smart contract during transaction execution and generate context information using the execution overhead data;

[0040] an inter-contract control flow graph construction module, configured to construct an inter-contract control flow graph based on execution overhead according to the context information;

[0041] A module for determining a smart contract to be analyzed, configured to determine a smart contract to be analyzed in the inter-contract control flow graph;

[0042] A status information acquisition module, used to obtain the status information of each smart contract to be analyzed;

[0043] An intra-contract control flow graph generation module, configured to generate an intra-contract control flow graph based on execution overhead for each of the smart contracts to be analyzed according to the state information;

[0044] A potential execution overhead key function acquisition module is used to perform data dependency analysis on the control flow graph within the contract to obtain the potential execution overhead key functions of the smart contract to be analyzed;

[0045] The vulnerability detection module is used to generate an execution overhead vulnerability detection result based on the potential execution overhead key function and a preset large language model.

[0046] Optionally, the context information generation module includes:

[0047] A transaction list generation submodule, configured to obtain transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generate a transaction list using the transaction information;

[0048] An execution overhead data acquisition submodule, configured to dynamically execute transactions in the transaction list in sequence through a virtual machine and acquire execution overhead data during the transaction execution;

[0049] a potential vulnerability-affected transaction determination submodule, configured to determine the transaction as a potential vulnerability-affected transaction when the execution overhead data includes external call data and loop data;

[0050] The call chain information and data read / write dependency information acquisition submodule is used to obtain call chain information and data read / write dependency information that may affect transactions due to potential vulnerabilities;

[0051] The context information generation submodule is used to generate context information using the call chain information and the data read and write dependency information.

[0052] The present invention further provides an electronic device, comprising a processor and a memory:

[0053] The memory is used to store program code and transmit the program code to the processor;

[0054] The processor is configured to execute the smart contract execution overhead vulnerability detection method as described in any one of the above items according to the instructions in the program code.

[0055] The present invention also provides a computer-readable storage medium, which is used to store program code, and the program code is used to execute the smart contract execution overhead vulnerability detection method as described in any of the above items.

[0056] From the above technical solutions, it can be seen that the present invention has the following advantages: the present invention discloses a method for detecting execution overhead vulnerabilities in smart contracts, and specifically discloses: collecting execution overhead data of a preset smart contract during transaction execution, and using the execution overhead data to generate context information; constructing an inter-contract control flow graph based on execution overhead according to the context information; determining the smart contract to be analyzed in the inter-contract control flow graph; obtaining the status information of each smart contract to be analyzed; generating an intra-contract control flow graph based on execution overhead for each smart contract to be analyzed according to the status information; performing data dependency analysis on the intra-contract control flow graph to obtain the potential execution overhead key functions of the smart contract to be analyzed; generating an execution overhead vulnerability detection result based on the potential execution overhead key functions and a preset large language model. The present invention constructs an inter-contract control flow graph based on execution overhead through the characteristics of transaction execution and execution overhead vulnerabilities, which can realize the accurate construction of the execution overhead call chain; extracts the data dependency relationship within the contract to realize the accurate extraction of the key functions of the execution overhead vulnerability, and on this basis, performs vulnerability detection through the large language model, thereby improving the accuracy of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0058] Figure 1 A flowchart of a method for detecting smart contract execution overhead vulnerabilities provided by an embodiment of the present invention;

[0059] Figure 2 A flowchart of a method for detecting smart contract execution overhead vulnerabilities according to another embodiment of the present invention;

[0060] Figure 3 A schematic diagram of the process of collecting context information based on execution cost;

[0061] Figure 4 A flowchart for locating key functions with potential execution overhead;

[0062] Figure 5 This is a flowchart of the execution overhead vulnerability detection process based on a large language model;

[0063] Figure 6 This is a structural block diagram of a smart contract execution overhead vulnerability detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0064] Embodiments of the present invention provide a method, apparatus, device, and storage medium for detecting smart contract execution overhead vulnerabilities, which are used to address the technical problem of low detection accuracy in existing smart contract execution overhead vulnerability detection methods when faced with smart contracts with complex logic.

[0065] In order to make the purpose, features, and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0066] See also Figure 1 , Figure 1 A flowchart of the steps of a method for detecting smart contract execution overhead vulnerabilities provided by an embodiment of the present invention.

[0067] The present invention provides a method for detecting smart contract execution overhead vulnerabilities, which may include the following steps:

[0068] Step 101: Collect execution overhead data of a preset smart contract during a transaction execution process, and use the execution overhead data to generate context information;

[0069] The smart contracts involved in the embodiments of this invention are primarily complex logic smart contracts. These are automated protocols implemented using blockchain technology, capable of executing multiple conditions and complex logic. Compared to ordinary contracts, complex logic smart contracts involve multiple participants during execution. They interact with other smart contracts, acquire data from multiple sources, and automatically execute contract terms.

[0070] Execution Overhead: The execution overhead mechanism is a system for measuring and managing the consumption of computing resources. It assigns a specific execution fee to each operation to prevent network abuse and ensure efficient transaction execution. Users submit transactions by setting an execution price and a limit, which are multiplied together to determine the transaction fee. The execution overhead mechanism not only prevents logical errors such as infinite loops but also improves network efficiency by prioritizing high-fee transactions, thereby protecting the stability of the blockchain.

[0071] In a specific implementation, for a preset smart contract, its execution overhead data during the transaction execution process can be searched in the blockchain, and the execution overhead data can be used to generate context information.

[0072] Step 102: construct an inter-contract control flow graph based on execution overhead according to the context information;

[0073] After generating the context information, the calling relationship between different smart contracts can be obtained based on the context information, thereby constructing an inter-contract control flow graph based on execution overhead.

[0074] Step 103: Determine the smart contract to be analyzed in the inter-contract control flow graph;

[0075] In an embodiment of the present invention, since execution overhead vulnerabilities in complex logic smart contracts usually occur in external contracts, all smart contracts in the inter-contract control flow graph based on execution overhead can be classified, and the smart contracts to be analyzed that need to be focused on can be determined based on the classification results.

[0076] Step 104: Obtain status information of each smart contract to be analyzed;

[0077] Step 105: Generate an execution cost-based control flow graph for each smart contract to be analyzed based on the state information;

[0078] After determining the smart contract to be analyzed, the state information of the smart contract to be analyzed can be obtained, and then the control flow and data flow analysis of each function in the smart contract can be performed based on the state information, thereby constructing a control flow graph within the contract based on the execution overhead.

[0079] Step 106: Perform data dependency analysis on the control flow graph within the contract to obtain key functions with potential execution overheads for the smart contract to be analyzed.

[0080] After generating the control flow graph within the contract, data dependency analysis can be performed on it to obtain potential execution overhead key functions that have dependencies on external functions. These functions can be considered as potential execution overhead vulnerability locations and subsequently analyzed.

[0081] Step 107 : Generate an execution overhead vulnerability detection result based on the potential execution overhead key functions and the preset large language model.

[0082] Key information collected from potential execution overhead key functions is fed into a large language model for in-depth analysis, which then outputs execution overhead vulnerability detection results. Specifically, this key information includes the complete transaction execution chain (i.e., the call chain), along with complete data source information, the potential execution overhead key functions, and the contract source code invoked by the transaction. By feeding this information into the large language model and introducing a thought chain mechanism, we can analyze whether these potential execution overhead key functions contain execution overhead vulnerabilities.

[0083] By leveraging the characteristics of transaction execution and execution overhead vulnerabilities, the present invention constructs an inter-contract control flow graph based on execution overhead, which can achieve accurate construction of the execution overhead call chain; it refines the data dependencies within the contract to achieve accurate extraction of key functions of execution overhead vulnerabilities, and on this basis, performs vulnerability detection through a large language model, thereby improving the accuracy of vulnerability detection.

[0084] See also Figure 2 , Figure 2 This is a flowchart of a method for detecting smart contract execution overhead vulnerabilities according to another embodiment of the present invention. Specifically, the method may include the following steps:

[0085] Step 201: Obtain transaction information of a preset smart contract in the blockchain where the preset smart contract is located, and generate a transaction list using the transaction information;

[0086] Step 202: Dynamically execute the transactions in the transaction list in sequence through the virtual machine, and obtain execution overhead data during the transaction execution;

[0087] Step 203: When the execution overhead data includes external call data and loop data, the transaction is determined to be a potential vulnerability-affected transaction;

[0088] Step 204: Obtain call chain information and data read / write dependency information of transactions affected by potential vulnerabilities;

[0089] Step 205: Generate context information using the call chain information and data read / write dependency information;

[0090] In the specific implementation, such as Figure 3As shown, for a given smart contract, the blockchain can be searched for all transaction information related to that smart contract, including transaction parameters, initiators, and so on. This information is then aggregated into a transaction list. Next, each transaction in the transaction list is dynamically executed using a virtual machine. When a smart contract requires information from other smart contracts, such as status or code, it can request the blockchain and obtain the necessary data for execution. During execution, the transaction's execution overhead is collected. Specifically, during transaction execution, the transaction's external calls and execution control flow are collected. If a transaction involves external calls and contains circular data, the transaction is determined to be potentially vulnerable to an execution overhead vulnerability and is recorded as a potentially vulnerable transaction.

[0091] Then, important data from the execution process is collected and placed into contextual information, such as call chain information and data read and write dependency information. These new types can be used to gain a deeper understanding of the specific execution of each transaction and determine the location of potential execution overhead vulnerabilities.

[0092] Step 206: construct an inter-contract control flow graph based on execution overhead according to the context information;

[0093] After generating the context information, the calling relationship between different smart contracts can be obtained according to the context information, thereby constructing an inter-contract control flow graph based on execution overhead.

[0094] In one example, step 206 may include the following sub-steps:

[0095] S61, obtaining a data flow diagram during the transaction;

[0096] S62: Construct a smart contract execution flow chart for the entire life cycle based on the call chain information and data flow chart in the context information.

[0097] S63, removing the intermediate execution flows that do not contain loop data from the full lifecycle execution flow graph to obtain an inter-contract control flow graph based on execution overhead.

[0098] In the specific implementation, the call chain information and data flow diagram in the transaction process can be combined to construct the execution flow diagram of the entire life cycle of the smart contract. Combined with the fact that the triggering position of the execution overhead vulnerability is usually located in the loop body, the intermediate execution flow that does not involve the loop body can be deleted, and finally an inter-contract control flow graph based on execution overhead that only contains the loop body execution flow is generated.

[0099] Step 207: Determine the smart contract to be analyzed in the inter-contract control flow graph;

[0100] In an embodiment of the present invention, since execution overhead vulnerabilities in complex logic smart contracts usually occur in external contracts, all smart contracts in the inter-contract control flow graph based on execution overhead can be classified, and the smart contracts to be analyzed that need to be focused on can be determined based on the classification results.

[0101] In one example, step 207 may include the following sub-steps:

[0102] S71, determine in sequence whether the smart contract in the inter-contract control flow graph is consistent with the smart contract of the external transaction;

[0103] S72: Determine the smart contract that is consistent with the smart contract of the external transaction as the smart contract to be analyzed.

[0104] In practice, you can query smart contract information by calling a third-party interface, such as Thegraph. If the smart contract information during transaction execution is consistent with the external transaction's smart contract information, the smart contract is considered safe and deleted from the inter-contract control flow graph. Otherwise, it is retained. Ultimately, the remaining smart contracts in the inter-contract control flow graph based on execution overhead are the ones that require focused analysis.

[0105] Step 208: Obtain status information of each smart contract to be analyzed;

[0106] Step 209: Generate an execution cost-based control flow graph for each smart contract to be analyzed based on the state information;

[0107] After determining the smart contract to be analyzed, the state information of the smart contract to be analyzed can be obtained, and then the control flow and data flow analysis of each function in the smart contract can be performed based on the state information, thereby constructing a control flow graph within the contract based on the execution overhead.

[0108] In one example, step 209 may include the following sub-steps:

[0109] S91, perform control flow analysis and data flow analysis on each function within the smart contract to be analyzed based on the state information, and determine the dependency relationship between the functions based on the analysis results;

[0110] S92: Construct an execution overhead-based control flow graph of the smart contract to be analyzed based on the dependency relationship.

[0111] For each smart contract to be analyzed, we first extract all the states in the smart contract to be analyzed, then perform control flow analysis and data flow analysis on each function within the smart contract to be analyzed. Based on the analysis results, we build a dependency edge between mutually dependent functions, and finally construct a control flow graph within the contract based on execution overhead.

[0112] Step 210: Perform data dependency analysis on the control flow graph within the contract to obtain key functions with potential execution overheads for the smart contract to be analyzed.

[0113] After generating the control flow graph within the contract, data dependency analysis can be performed on it to obtain potential execution overhead key functions that have dependencies on external functions. These functions can be considered as potential execution overhead vulnerability locations and subsequently analyzed.

[0114] In one example, step 210 may include the following sub-steps:

[0115] S101, obtain the loop boundaries of each function in the control flow graph within the contract;

[0116] S102, determining whether there is a loop boundary into which the first external function parameter flows;

[0117] S103: If yes, determine the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution overhead critical function of the smart contract to be analyzed;

[0118] S104, if not, determining whether there is a target function that can be called by the second external function parameter to modify the loop boundary;

[0119] S105: If so, determine the target function as the second potential execution cost key function of the smart contract to be analyzed;

[0120] S106: Integrate all first potential execution overhead key functions and second potential execution overhead key functions to generate potential execution overhead key functions of the smart contract to be analyzed.

[0121] In the specific implementation, in the control flow graph within the contract based on execution overhead, data dependency analysis is performed on all functions within the contract, and pruning is performed to determine the key functions with potential execution overhead of the smart contract to be analyzed. Specifically, this can be done through the following two judgments:

[0122] a) Determine whether the first external function parameter directly flows into the loop boundary. If the first external function parameter directly flows into the loop boundary, the function can be directly considered as the first potential execution overhead critical function, indicating that the function is a potential execution overhead vulnerability location and can be further analyzed.

[0123] b) Determine whether the function's loop boundary can be indirectly modified by a second external function parameter. If the second external function parameter can call other functions within the smart contract to modify the loop boundary value, for example, starting from a target function in the control flow graph as the entry point, the target function that can modify the loop boundary can be considered a potential execution overhead vulnerability location and marked as the second potential execution overhead critical function for subsequent analysis.

[0124] By integrating the first potential execution overhead key function and the second potential execution overhead key function, the potential execution overhead key function of the smart contract to be analyzed can be obtained.

[0125] The process of locating key functions with potential execution overhead is as follows: Figure 4 shown.

[0126] Step 211 : Generate an execution overhead vulnerability detection result based on potential execution overhead key functions and a preset large language model.

[0127] like Figure 5 As shown, the key information collected from potential execution overhead key functions is input into the large language model for in-depth analysis, which can output the execution overhead vulnerability detection results. Specifically, the key information includes the complete transaction execution chain, namely the call chain, as well as the complete data source, the potential execution overhead key functions, and the contract source code called by the transaction. By feeding this information into the large language model and introducing the thought chain mechanism, we can analyze whether the potential execution overhead key functions contain execution overhead vulnerabilities. The thought chain mechanism decomposes the problem of determining whether an execution overhead vulnerability exists into the following three sub-problems:

[0128] (a) Determine whether there is a check for external data in the execution chain. If so, output "no", otherwise continue analysis.

[0129] (b) Determine whether the check can filter the data source. If the check can make the data source safe, output "no", otherwise continue analysis.

[0130] (c1) Based on the code of a given function, determine whether the data source will affect the check in the function. If so, output "yes", otherwise output "no".

[0131] (c2) Based on the code of a given function, determine whether the data source will affect the result of the function execution. If so, output "yes", otherwise output "no".

[0132] Where c1 and c2 are determined based on the potential sources of critical functions with execution overhead in the previous step. When external state can directly affect the loop bounds, use c1 subproblem; if external state indirectly affects the loop bounds, use c2 subproblem.

[0133] By leveraging the characteristics of transaction execution and execution overhead vulnerabilities, the present invention constructs an inter-contract control flow graph based on execution overhead, which can achieve accurate construction of the execution overhead call chain; it refines the data dependencies within the contract to achieve accurate extraction of key functions of execution overhead vulnerabilities, and on this basis, performs vulnerability detection through a large language model, thereby improving the accuracy of vulnerability detection.

[0134] See also Figure 6 , Figure 6 This is a structural block diagram of a smart contract execution overhead vulnerability detection device provided by an embodiment of the present invention.

[0135] An embodiment of the present invention provides a device for detecting smart contract execution overhead vulnerabilities, comprising:

[0136] The context information generation module 601 is used to collect execution overhead data of a preset smart contract during the transaction execution process and generate context information using the execution overhead data;

[0137] An inter-contract control flow graph construction module 602 is configured to construct an inter-contract control flow graph based on execution overhead according to context information;

[0138] A smart contract to be analyzed determination module 603 is used to determine the smart contract to be analyzed in the inter-contract control flow graph;

[0139] Status information acquisition module 604, used to obtain status information of each smart contract to be analyzed;

[0140] The intra-contract control flow graph generation module 605 is used to generate an intra-contract control flow graph based on execution overhead for each smart contract to be analyzed according to the state information;

[0141] Potential execution cost key function acquisition module 606 is used to perform data dependency analysis on the control flow graph within the contract to obtain the potential execution cost key functions of the smart contract to be analyzed;

[0142] The vulnerability detection module 607 is used to generate an execution overhead vulnerability detection result based on potential execution overhead key functions and a preset large language model.

[0143] In this embodiment of the present invention, the context information generation module 601 includes:

[0144] The transaction list generation submodule is used to obtain the transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and use the transaction information to generate a transaction list;

[0145] An execution overhead data acquisition submodule is used to dynamically execute transactions in the transaction list in sequence through a virtual machine and obtain execution overhead data during transaction execution;

[0146] a potential vulnerability-affected transaction determination submodule, configured to determine a transaction as a potential vulnerability-affected transaction when the execution overhead data includes external call data and loop data;

[0147] The call chain information and data read / write dependency information acquisition submodule is used to obtain call chain information and data read / write dependency information that may affect transactions due to potential vulnerabilities;

[0148] The context information generation submodule is used to generate context information using call chain information and data read and write dependency information.

[0149] In an embodiment of the present invention, the inter-contract control flow graph construction module 602 includes:

[0150] The data flow graph acquisition submodule is used to obtain the data flow graph during the transaction process;

[0151] The smart contract full life cycle execution flow graph construction submodule is used to construct the smart contract full life cycle execution flow graph based on the call chain information and data flow graph in the context information;

[0152] The inter-contract control flow graph construction sub-module is used to remove the intermediate execution flows that do not contain loop data from the full life cycle execution flow graph to obtain the inter-contract control flow graph based on execution overhead.

[0153] In this embodiment of the present invention, the smart contract determination module 603 to be analyzed includes:

[0154] The consistency judgment submodule is used to sequentially judge whether the smart contract in the inter-contract control flow graph is consistent with the smart contract of the external transaction;

[0155] The submodule for determining the smart contract to be analyzed is used to determine the smart contract that is consistent with the smart contract of the external transaction as the smart contract to be analyzed.

[0156] In this embodiment of the present invention, the in-contract control flow graph generation module 605 includes:

[0157] The dependency determination submodule is used to perform control flow analysis and data flow analysis on each function within the smart contract to be analyzed based on the state information, and determine the dependency relationships between functions based on the analysis results;

[0158] The in-contract control flow graph construction sub-module is used to construct the in-contract control flow graph based on the execution cost of the smart contract to be analyzed according to the dependency relationship.

[0159] In this embodiment of the present invention, the potential execution overhead key function acquisition module 606 includes:

[0160] The loop boundary acquisition submodule is used to obtain the loop boundaries of each function in the control flow graph within the contract;

[0161] A first judgment submodule is used to judge whether there is a loop boundary into which the first external function parameter flows;

[0162] A first potential execution cost key function determination submodule, configured to, if yes, determine the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution cost key function of the smart contract to be analyzed;

[0163] a second judging submodule, for judging, if not, whether there is a target function that can be called by the second external function parameter to modify the loop boundary;

[0164] A second potential execution cost key function determination submodule, configured to determine the target function as the second potential execution cost key function of the smart contract to be analyzed, if any;

[0165] The potential execution overhead key function integration submodule is used to integrate all first potential execution overhead key functions and second potential execution overhead key functions to generate the potential execution overhead key function of the smart contract to be analyzed.

[0166] An embodiment of the present invention further provides an electronic device, the device including a processor and a memory:

[0167] The memory is used to store program codes and transmit the program codes to the processor;

[0168] The processor is used to execute the smart contract execution overhead vulnerability detection method of an embodiment of the present invention according to the instructions in the program code.

[0169] An embodiment of the present invention also provides a computer-readable storage medium, which is used to store program code, and the program code is used to execute the smart contract execution overhead vulnerability detection method of an embodiment of the present invention.

[0170] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0171] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0172] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, embodiments of the present invention may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0173] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0174] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0175] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0176] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0177] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0178] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting smart contract execution overhead vulnerabilities, characterized in that: include: Collecting execution overhead data of a preset smart contract during a transaction execution process, and using the execution overhead data to generate context information; constructing an inter-contract control flow graph based on execution overhead according to the context information; Determining a smart contract to be analyzed in the inter-contract control flow graph; Obtaining status information of each of the smart contracts to be analyzed; Generate an execution overhead-based intra-contract control flow graph for each of the smart contracts to be analyzed according to the state information; Performing data dependency analysis on the control flow graph within the contract to obtain key functions with potential execution overhead for the smart contract to be analyzed; Generate an execution overhead vulnerability detection result according to the potential execution overhead key function and a preset large language model; The step of collecting execution overhead data of a preset smart contract during a transaction execution process and generating context information using the execution overhead data includes: Obtaining transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generating a transaction list using the transaction information; Dynamically executing transactions in the transaction list in sequence through a virtual machine, and obtaining execution overhead data during transaction execution; When the execution overhead data includes external call data and loop data, determining the transaction as a potential vulnerability-affected transaction; Obtain call chain information and data read and write dependency information that may affect transactions due to potential vulnerabilities; Generate context information using the call chain information and the data read and write dependency information; The step of performing data dependency analysis on the control flow graph within the contract to obtain key functions of potential execution overhead of the smart contract to be analyzed includes: Obtain loop boundaries for each function in the control flow graph within the contract; Determining whether there is a loop boundary into which the first external function parameter flows; If so, determining the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution overhead critical function of the smart contract to be analyzed; If not, determine whether there is a target function that can be called by the second external function parameter to modify the loop boundary; If so, determining the target function as the second potential execution cost key function of the smart contract to be analyzed; Integrate all of the first potential execution overhead key functions and the second potential execution overhead key functions to generate the potential execution overhead key functions of the smart contract to be analyzed.

2. The method according to claim 1, characterized in that The step of constructing an inter-contract control flow graph based on execution overhead according to the context information includes: Get the data flow diagram during the transaction; Constructing a smart contract full lifecycle execution flow diagram based on the call chain information and the data flow diagram in the context information; The intermediate execution flows that do not contain the loop data are removed from the full lifecycle execution flow graph to obtain an inter-contract control flow graph based on execution overhead.

3. The method according to claim 1, characterized in that The step of determining the smart contract to be analyzed in the inter-contract control flow graph includes: Determine in sequence whether the smart contract in the inter-contract control flow graph is consistent with the smart contract of the external transaction; A smart contract that is consistent with the smart contract of the external transaction is determined as a smart contract to be analyzed.

4. The method according to claim 1, wherein The step of generating an execution overhead-based intra-contract control flow graph for each of the smart contracts to be analyzed according to the state information includes: Performing control flow analysis and data flow analysis on each function within the smart contract to be analyzed based on the state information, and determining the dependency relationships between the functions based on the analysis results; Construct an execution overhead-based intra-contract control flow graph of the smart contract to be analyzed according to the dependency relationship.

5. A smart contract execution overhead vulnerability detection device, characterized in that: include: A context information generation module, configured to collect execution overhead data of a preset smart contract during transaction execution and generate context information using the execution overhead data; an inter-contract control flow graph construction module, configured to construct an inter-contract control flow graph based on execution overhead according to the context information; A module for determining a smart contract to be analyzed, configured to determine a smart contract to be analyzed in the inter-contract control flow graph; A status information acquisition module, used to obtain the status information of each smart contract to be analyzed; An intra-contract control flow graph generation module, configured to generate an intra-contract control flow graph based on execution overhead for each of the smart contracts to be analyzed according to the state information; A potential execution overhead key function acquisition module is used to perform data dependency analysis on the control flow graph within the contract to obtain the potential execution overhead key functions of the smart contract to be analyzed; A vulnerability detection module is configured to generate an execution overhead vulnerability detection result based on the potential execution overhead key function and a preset large language model, wherein the context information generation module includes: A transaction list generation submodule, configured to obtain transaction information of the preset smart contract in the blockchain where the preset smart contract is located, and generate a transaction list using the transaction information; An execution overhead data acquisition submodule, configured to dynamically execute transactions in the transaction list in sequence through a virtual machine and acquire execution overhead data during the transaction execution; a potential vulnerability-affected transaction determination submodule, configured to determine the transaction as a potential vulnerability-affected transaction when the execution overhead data includes external call data and loop data; The call chain information and data read / write dependency information acquisition submodule is used to obtain call chain information and data read / write dependency information that may affect transactions due to potential vulnerabilities; A context information generation submodule, configured to generate context information using the call chain information and the data read and write dependency information; Among them, the potential execution overhead key function acquisition module includes: The loop boundary acquisition submodule is used to obtain the loop boundaries of each function in the control flow graph within the contract; A first judgment submodule is used to judge whether there is a loop boundary into which the first external function parameter flows; A first potential execution cost key function determination submodule, configured to, if yes, determine the function corresponding to the loop boundary into which the first external function parameter flows as the first potential execution cost key function of the smart contract to be analyzed; a second judging submodule, for judging, if not, whether there is a target function that can be called by the second external function parameter to modify the loop boundary; A second potential execution cost key function determination submodule, configured to determine the target function as the second potential execution cost key function of the smart contract to be analyzed, if any; The potential execution overhead key function integration submodule is used to integrate all first potential execution overhead key functions and second potential execution overhead key functions to generate the potential execution overhead key function of the smart contract to be analyzed.

6. An electronic device, characterized in that: The device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the smart contract execution overhead vulnerability detection method according to any one of claims 1 to 4 according to the instructions in the program code.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store program code, and the program code is used to execute the smart contract execution overhead vulnerability detection method according to any one of claims 1 to 4.

Images