Smart contract test method and device, electronic equipment and storage medium

Abstract

The invention discloses an intelligent contract test method and device, electronic equipment and a storage medium, and aims to solve the problems that an existing security detection tool seriously depends on expert knowledge to define a detection rule, so that the expansibility is poor, the detection of annotated code snippets is neglected, and the detection efficiency is poor. And potential safety risks caused by wrong annotations cannot be identified. The method comprises the following steps: identifying annotated annotation codes from contract source codes of an intelligent contract; determining an annotation code statement of the annotation code, and obtaining an influenced function influenced by the annotation code statement and a program path of the influenced function; performing control flow analysis according to the influenced function and the program path; when it is judged that the annotation code statement changes the control flow of code execution, obtaining a path constraint condition for changing the control flow; obtaining a key operation statement influenced by the path constraint condition; judging whether the key operation statement is influenced by the annotation code statement or not; and if yes, generating a safety early warning.

Description

Technical Field

[0001] The present invention relates to the field of smart contract technology, and in particular to a smart contract testing method, device, electronic device and storage medium. Background Art

[0002] Comments may be generated during the development of smart contracts. Different from natural languages ​​that describe the functions of the code, some comments are commented-out codes, which are usually generated during the development process and debugging code. For example, the developer believes that some identified codes can be omitted and only retained in the source file through comments (so that the code can be rolled back by uncommenting in the future), or the developer directly copies a contract with commented code, etc. However, mistakenly annotating some key codes will affect the security of the contract. At the same time, since all users can view the contract after the contract source code is published on the chain, malicious users can attack the contract after identifying and locating the vulnerable code (marked with commented code).

[0003] At present, the security research related to smart contract comments and codes mainly focuses on the consistency check between natural language comments and codes, mainly including static analysis and dynamic analysis. These methods usually take the source code or bytecode of the smart contract as input and detect the security of the contract according to predefined rules. For example, based on the smart contract source code AST, sourcemap and other information and the contract bytecode, a symbolic execution tool is built to detect whether there are security vulnerabilities in the contract code based on the expert knowledge obtained through manual analysis for different types of security vulnerabilities and pre-define the detection mode.

[0004] However, the prior art has the following technical defects:

[0005] Security detection relies on predefined vulnerability patterns and has poor scalability: Existing security detection tools rely heavily on expert knowledge to define detection rules, resulting in poor scalability. When faced with unknown vulnerabilities, manual participation and the definition of more vulnerability patterns are required.

[0006] Ignoring incorrect code comments that affect security during software development: During smart contract development, developers may mistakenly comment out key code snippets when debugging or modifying code. These commented codes may contain important logic or security checks, and incorrectly commenting out these codes may affect the security of the contract. Common situations include developers commenting out some code to facilitate debugging, but these commented codes may be left in the source code and ignored during deployment, allowing malicious users to exploit the vulnerability to attack. However, existing detection tools ignore the detection of commented-out code snippets and cannot identify potential security risks caused by incorrect comments. Summary of the invention

[0007] The present invention provides a smart contract testing method, device, electronic device and storage medium, which are used to solve the technical problems that existing security detection tools rely heavily on expert knowledge to define detection rules, resulting in poor scalability, and ignore the detection of commented out code fragments, and cannot identify potential security risks caused by erroneous comments.

[0008] The present invention provides a smart contract testing method, comprising:

[0009] Identify commented out code from the contract source code of the smart contract;

[0010] Determine an annotation code statement of the annotation code, and obtain an affected function affected by the annotation code statement and a program path of the affected function;

[0011] Perform control flow analysis according to the affected function and the program path;

[0012] When it is determined that the comment code statement changes the control flow of code execution, obtaining a path constraint condition for changing the control flow;

[0013] Obtaining key operation statements affected by the path constraint condition;

[0014] Determining whether the key operation statement is affected by the comment code statement;

[0015] If so, a security alert is generated.

[0016] Optionally, the step of identifying commented-out comment code from the contract source code of the smart contract includes:

[0017] The commented-out comment code is identified from the contract source code of the smart contract through regular matching.

[0018] Optionally, the step of determining the comment code statement of the comment code, and obtaining the affected function affected by the comment code statement and the program path of the affected function includes:

[0019] Determining an annotation code statement of the annotation code, and identifying a function to which the annotation code statement belongs;

[0020] A call graph of the function is generated, and an affected function affected by the comment code statement and a program path of the affected function are obtained from the call graph.

[0021] Optionally, the step of obtaining key operation statements affected by the path constraint condition includes:

[0022] According to the call graph and the path constraint condition, determining whether there is a modification statement after the comment code statement;

[0023] If so, the modification statement is determined as a key operation statement affected by the path constraint condition.

[0024] Optionally, the step of determining whether the key operation statement is affected by the comment code statement includes:

[0025] Acquire dependent variables of the key operation statement according to the call graph;

[0026] Determine whether the comment code statement performs constraint determination on the dependent variable;

[0027] If not, it is determined that the key operation statement is not affected by the comment code statement;

[0028] If so, it is determined that the key operation statement is affected by the comment code statement.

[0029] The present invention also provides a smart contract testing device, comprising:

[0030] The comment code identification module is used to identify commented-out comment codes from the contract source code of the smart contract;

[0031] An affected function and program path acquisition module, used for determining the comment code statement of the comment code, and acquiring the affected function affected by the comment code statement and the program path of the affected function;

[0032] A control flow analysis module, used for performing control flow analysis according to the affected function and the program path;

[0033] A path constraint condition acquisition module, used for acquiring a path constraint condition for changing the control flow when it is determined that the comment code statement changes the control flow of code execution;

[0034] A key operation statement acquisition module, used to acquire the key operation statement affected by the path constraint condition;

[0035] An impact judgment module, used to judge whether the key operation statement is affected by the comment code statement;

[0036] The safety warning generation module is used to generate a safety warning if so.

[0037] Optionally, the annotation code recognition module includes:

[0038] The comment code identification submodule is used to identify commented-out comment codes from the contract source code of the smart contract through regular matching.

[0039] Optionally, the affected function and program path acquisition module includes:

[0040] A function identification submodule, used for determining an annotation code statement of the annotation code, and identifying the function to which the annotation code statement belongs;

[0041] The affected function and program path acquisition submodule is used to generate a call graph of the function and acquire the affected function affected by the annotated code statement and the program path of the affected function from the call graph.

[0042] The present invention also provides an electronic device, the device comprising a processor and a memory:

[0043] The memory is used to store program codes and transmit the program codes to the processor;

[0044] The processor is used to execute the smart contract testing method as described in any one of the above items according to the instructions in the program code.

[0045] The present invention also provides a computer-readable storage medium, which is used to store program code, and the program code is used to execute the smart contract testing method as described in any one of the above items.

[0046] It can be seen from the above technical solutions that the present invention has the following advantages: The present invention discloses a smart contract testing method, and specifically discloses: identifying commented out comment code from the contract source code of the smart contract; determining the comment code statement of the comment code, and obtaining the affected function affected by the comment code statement and the program path of the affected function; performing control flow analysis according to the affected function and the program path; when it is determined that the comment code statement changes the control flow of code execution, obtaining the path constraint condition that changes the control flow; obtaining the key operation statement affected by the path constraint condition; judging whether the key operation statement is affected by the comment code statement; if so, generating a security warning. The present invention can detect unknown types of logical vulnerabilities by comparing the differences between the codes before and after the comments, without the need to predefine the vulnerability mode, thereby enhancing the scalability of vulnerability detection. The present invention also determines whether these codes involve key security checks or logical operations by analyzing the code fragments that are commented out during the development process, thereby preventing security issues caused by developer negligence or incorrect comments from being ignored. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 A flowchart of a smart contract testing method provided by an embodiment of the present invention;

[0049] Figure 2 An example diagram of path constraint extraction provided by an embodiment of the present invention;

[0050] Figure 3 An architecture diagram of a smart contract testing method provided by an embodiment of the present invention;

[0051] Figure 4 A flowchart of a smart contract testing method provided by another embodiment of the present invention;

[0052] Figure 5 A contract example diagram including Commented-out code provided for an embodiment of the present invention;

[0053] Figure 6 A schematic diagram of call graph analysis provided by an embodiment of the present invention;

[0054] Figure 7 A structural block diagram of a smart contract testing device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The embodiments of the present invention provide a smart contract testing method, device, electronic device and storage medium, which are used to solve the technical problems that existing security detection tools rely heavily on expert knowledge to define detection rules, resulting in poor scalability, and ignore the detection of commented out code fragments, and cannot identify potential security risks caused by erroneous comments.

[0056] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] See also Figure 1 , Figure 1A flowchart of the steps of a smart contract testing method provided by an embodiment of the present invention.

[0058] The present invention provides a smart contract testing method, which may specifically include the following steps:

[0059] Step 101, identifying commented out comment codes from the contract source code of the smart contract;

[0060] Smart contracts: Smart contracts are a major feature of the blockchain 2.0 era. By storing code in the blockchain and being tamper-proof once deployed, smart contracts have Turing-complete characteristics and can run code to complete pre-defined behaviors when certain conditions are met, including transfers, decision-making, and interaction with other contracts. Based on the characteristics of blockchain, the results of smart contracts are run and verified by a large number of computers to ensure credibility. Solidity is currently the most popular smart contract language. The embodiments of the present invention only target the Solidity language and the EVM (Ethereum Virtual Machine) that supports the operation of Solidity smart contracts.

[0061] Commented-out Code: Source code comments are a common practice in software development to improve code readability. Although comments are usually composed of descriptive natural language, there are still a considerable number of comments that are actually code statements rather than natural language describing the code, that is, commented-out code.

[0062] In an embodiment of the present invention, commented-out comment codes can be identified from the contract code of the smart contract, so as to facilitate subsequent analysis of whether the commented-out comment codes will have an adverse effect on the execution of the smart contract.

[0063] Step 102, determining the comment code statement of the comment code, and obtaining the affected function affected by the comment code statement and the program path of the affected function;

[0064] In the embodiment of the present invention, a specific statement in the comment code statement may be identified to analyze the affected function where the comment code statement is located and its corresponding program path.

[0065] Step 103, performing control flow analysis according to the affected functions and program paths;

[0066] Step 104, when it is determined that the comment code statement changes the control flow of code execution, a path constraint condition for changing the control flow is obtained;

[0067] In the embodiment of the present invention, according to the role of the comment code statement in the program path, it can be analyzed whether its commenting out will affect the normal execution path of the corresponding function. For example, require or if statements will affect the conditions for code execution. The corresponding judgment conditions can be extracted and used as constraints that affect the execution of smart contracts.

[0068] like Figure 2 As shown in the figure, when the first line of the _erc721toErc20 function is analyzed, it contains comment code, and the comment code is a require statement, which is a constraint to determine whether the owner of tokenId is msg.sender. Since the code for this conditional determination is commented, it can be clearly seen that the comment code changes the control flow of the code execution path.

[0069] Step 105, obtaining key operation statements affected by the path constraint conditions;

[0070] Step 106, determining whether the key operation statement is affected by the comment code statement;

[0071] Step 107: If yes, generate a security warning.

[0072] After obtaining the path constraint conditions, we can analyze whether the path constraint conditions are key operations that affect the modification of key operation statements. If so, we can determine whether the key operation statements are affected by the commented code statements. If so, it means that after the commented code is commented out, the constraints for reaching the key operation are looser than the constraints before the commented out. At this time, we can report the problem and generate a security warning.

[0073] The present invention can detect unknown types of logical vulnerabilities by comparing the differences between the codes before and after the comments, without pre-defining the vulnerability mode, thereby enhancing the scalability of vulnerability detection. The present invention also determines whether the commented-out code fragments during the development process involve key security checks or logical operations by analyzing them, thereby preventing security issues caused by developer negligence or incorrect comments from being ignored.

[0074] See also Figure 3 and Figure 4 , Figure 3 An architecture diagram of a smart contract testing method provided by an embodiment of the present invention; Figure 4 A flowchart of a smart contract testing method provided by another embodiment of the present invention. Specifically, the following steps may be included:

[0075] Step 401, identifying commented out comment codes from the contract source code of the smart contract through regular matching;

[0076] In an embodiment of the present invention, the contract source code of a smart contract can be used as input, and regular matching can be used to analyze whether the smart contract contains commented-out code. Figure 5 If there is comment code, execute step 402.

[0077] Step 402, determining the comment code statement of the comment code, and identifying the function to which the comment code statement belongs;

[0078] Step 403, generating a function call graph, and obtaining the affected functions affected by the commented code statements and the program path of the affected functions from the call graph;

[0079] In the embodiment of the present invention, the contract AST information can be used to extract the statements in the code that are external calls, and a call graph can be constructed based on the contract functions. Figure 6 As shown, the comment code statement S is included in the function F, and F is in the foo->F->bar path of the call graph of the smart contract. Through the Call Graph, inter-procedural analysis can be performed to determine the affected functions and program paths affected by the comment code statement S.

[0080] Step 404, performing control flow analysis based on the affected functions and program paths;

[0081] Step 405, when it is determined that the comment code statement changes the control flow of code execution, a path constraint condition for changing the control flow is obtained;

[0082] In the embodiment of the present invention, according to the role of the comment code statement in the program path, it can be analyzed whether its commenting out will affect the normal execution path of the corresponding function. For example, require or if statements will affect the conditions for code execution. The corresponding judgment conditions can be extracted and used as constraints that affect the execution of smart contracts.

[0083] like Figure 2 As shown in the figure, when the first line of the _erc721toErc20 function is analyzed, it contains comment code, and the comment code is a require statement, which is a constraint to determine whether the owner of tokenId is msg.sender. Since the code for this conditional determination is commented, it can be clearly seen that the comment code changes the control flow of the code execution path.

[0084] Step 406, obtaining key operation statements affected by the path constraint conditions;

[0085] In one example, step 406 may include the following sub-steps:

[0086] S61, judging whether there is a modification statement after the comment code statement according to the call graph and the path constraint condition;

[0087] S62: If yes, determine the modification statement as a key operation statement affected by the path constraint condition.

[0088] In the specific implementation, according to the information obtained in the above steps, the path constraint C can be obtained: ownerOf(_tokenId)==msg.sender, that is, the current code cancels the permission check for msgsender. Based on the extracted path constraint C and Call Graph, it can be determined whether the key operation statement S2 for modifying balance is in the path reachable by the path constraint C. The specific implementation is: scan the call graph to which function F belongs, and identify whether the modification statement S2 of the variable balance is included after the comment code statement S, such as balance[from] += amount. If included, the modification statement S2 is determined to be a key operation statement affected by the path constraint C.

[0089] Step 407, determining whether the key operation statement is affected by the comment code statement;

[0090] In the embodiment of the present invention, step 407 may include the following sub-steps:

[0091] S71, obtaining dependent variables of key operation statements according to the call graph;

[0092] S72, determining whether the comment code statement performs constraint determination on the dependent variable;

[0093] S73, if not, determining that the key operation statement is not affected by the comment code statement;

[0094] S74: If yes, determine whether the key operation statement is affected by the comment code statement.

[0095] In the specific implementation, the dependent variables that the key and value of the S2 statement depend on, namely from, amount and its data dependency msg.sender, can be obtained through data flow analysis. Figure 2In the example shown, the call graph identifies that the modification operation of the S2 statement balance is located in the _mint function, that is, the calling function of _erc721ToErc20. At the same time, the msg.sender of the function will enter the key of the balance variable as the parameter from, and perform a value modification operation on the key with balance[from]. Based on this, it can be determined that the commented-out statement S has made a constraint judgment on the dependent variables of the key operation, but due to the comment of the require statement, the burn operation has lost the permission check related to the key variable, allowing any user to operate. That is, the constraints on reaching the key operation after the code is commented are looser than the constraints before the comment. Specifically, the lack of verification of msg.sender may cause anyone's balance to be reduced by others. This means that the commented code statement affects the key operation.

[0096] Step 408: If yes, generate a security warning.

[0097] When it is determined that a critical operation statement is affected by a comment code statement, a corresponding security warning can be generated.

[0098] The present invention can detect unknown types of logical vulnerabilities by comparing the differences between the codes before and after the comments, without pre-defining the vulnerability mode, thereby enhancing the scalability of vulnerability detection. The present invention also determines whether the commented-out code fragments during the development process involve key security checks or logical operations by analyzing them, thereby preventing security issues caused by developer negligence or incorrect comments from being ignored.

[0099] See also Figure 7 , Figure 7 A structural block diagram of a smart contract testing device provided in an embodiment of the present invention.

[0100] An embodiment of the present invention provides a smart contract testing device, including:

[0101] A comment code identification module 701, used to identify commented-out comment codes from the contract source code of the smart contract;

[0102] An affected function and program path acquisition module 702 is used to determine the comment code statement of the comment code, and obtain the affected function affected by the comment code statement and the program path of the affected function;

[0103] A control flow analysis module 703, used to perform control flow analysis based on the affected functions and program paths;

[0104] A path constraint condition acquisition module 704 is used to acquire the path constraint condition for changing the control flow when it is determined that the comment code statement changes the control flow of the code execution;

[0105] The key operation statement acquisition module 705 is used to acquire the key operation statement affected by the path constraint condition;

[0106] An impact determination module 706 is used to determine whether a key operation statement is affected by a comment code statement;

[0107] The safety warning generation module 707 is used to generate a safety warning if yes.

[0108] In the embodiment of the present invention, the annotation code identification module 701 includes:

[0109] The comment code identification submodule is used to identify commented-out comment codes from the contract source code of the smart contract through regular matching.

[0110] In the embodiment of the present invention, the affected function and program path acquisition module 702 includes:

[0111] A function identification submodule, for determining an annotated code statement of the annotated code and identifying the function to which the annotated code statement belongs;

[0112] The affected function and program path acquisition submodule is used to generate a function call graph and obtain the affected functions affected by the annotated code statements and the program paths of the affected functions from the call graph.

[0113] In the embodiment of the present invention, the key operation statement acquisition module 705 includes:

[0114] The modification statement judgment submodule is used to judge whether there is a modification statement after the comment code statement according to the call graph and path constraints;

[0115] The key operation statement determination submodule is used to determine the modification statement as the key operation statement affected by the path constraint condition.

[0116] In the embodiment of the present invention, the impact determination module 706 includes:

[0117] The dependent variable acquisition submodule is used to obtain the dependent variables of key operation statements according to the call graph;

[0118] The constraint judgment submodule is used to judge whether the annotation code statement performs constraint judgment on the dependent variables;

[0119] A first determination submodule, for determining, if no, that the key operation statement is not affected by the comment code statement;

[0120] The second determination submodule is used to determine whether the key operation statement is affected by the comment code statement.

[0121] An embodiment of the present invention further provides an electronic device, the device comprising a processor and a memory:

[0122] The memory is used to store the program code and transmit the program code to the processor;

[0123] The processor is used to execute the smart contract testing method of an embodiment of the present invention according to the instructions in the program code.

[0124] An embodiment of the present invention also provides a computer-readable storage medium, which is used to store program code, and the program code is used to execute the smart contract testing method of the embodiment of the present invention.

[0125] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0126] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0127] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0128] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0129] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0130] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0131] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0132] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0133] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A smart contract testing method, characterized in that: include: Identify commented out code from the contract source code of the smart contract; Determine an annotation code statement of the annotation code, and obtain an affected function affected by the annotation code statement and a program path of the affected function; Perform control flow analysis according to the affected function and the program path; When it is determined that the comment code statement changes the control flow of code execution, obtaining a path constraint condition for changing the control flow; Obtaining key operation statements affected by the path constraint condition; Determining whether the key operation statement is affected by the comment code statement; If so, a security alert is generated.

2. The method according to claim 1, characterized in that The step of identifying commented-out comment code from the contract source code of the smart contract includes: The commented-out comment code is identified from the contract source code of the smart contract through regular matching.

3. The method according to claim 1, characterized in that: The step of determining the comment code statement of the comment code, and obtaining the affected function affected by the comment code statement and the program path of the affected function includes: Determining an annotation code statement of the annotation code, and identifying a function to which the annotation code statement belongs; A call graph of the function is generated, and an affected function affected by the comment code statement and a program path of the affected function are obtained from the call graph.

4. The method according to claim 3, characterized in that The step of obtaining the key operation statements affected by the path constraint condition includes: According to the call graph and the path constraint condition, determining whether there is a modification statement after the comment code statement; If so, the modification statement is determined as a key operation statement affected by the path constraint condition.

5. The method according to claim 3, characterized in that: The step of determining whether the key operation statement is affected by the comment code statement comprises: Acquire dependent variables of the key operation statement according to the call graph; Determine whether the comment code statement performs constraint determination on the dependent variable; If not, it is determined that the key operation statement is not affected by the comment code statement; If so, it is determined that the key operation statement is affected by the comment code statement.

6. A smart contract testing device, characterized in that: include: The comment code identification module is used to identify commented-out comment codes from the contract source code of the smart contract; An affected function and program path acquisition module, used for determining the comment code statement of the comment code, and acquiring the affected function affected by the comment code statement and the program path of the affected function; A control flow analysis module, used for performing control flow analysis according to the affected function and the program path; A path constraint condition acquisition module, used for acquiring a path constraint condition for changing the control flow when it is determined that the comment code statement changes the control flow of code execution; A key operation statement acquisition module, used to acquire the key operation statement affected by the path constraint condition; An impact judgment module, used to judge whether the key operation statement is affected by the comment code statement; The safety warning generation module is used to generate a safety warning if so.

7. The device according to claim 6, characterized in that The annotation code recognition module includes: The comment code identification submodule is used to identify commented-out comment codes from the contract source code of the smart contract through regular matching.

8. The device according to claim 6, characterized in that The affected function and program path acquisition module includes: A function identification submodule, used for determining an annotation code statement of the annotation code, and identifying the function to which the annotation code statement belongs; The affected function and program path acquisition submodule is used to generate a call graph of the function and acquire the affected function affected by the annotated code statement and the program path of the affected function from the call graph.

9. An electronic device, characterized in that: The device comprises a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the smart contract testing method described in any one of claims 1-5 according to the instructions in the program code.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program code, and the program code is used to execute the smart contract testing method described in any one of claims 1-5.

Images