A smart contract testing method and device, an electronic device, and a storage medium

Abstract

The application discloses a smart contract testing method and device, electronic equipment and storage medium, and is used to solve the technical problem that the existing security detection tool seriously depends on expert knowledge to define detection rules, which leads to poor expansibility and ignores the detection of the annotated code segments, and cannot identify potential security risks caused by error annotations. The method comprises the following steps: identifying the annotated code in the contract source code of the smart contract; determining the annotated code statements of the annotated code, and obtaining the affected functions and program paths of the affected functions affected by the annotated code statements; performing control flow analysis according to the affected functions and the program paths; when it is determined that the annotated code statements change the control flow of code execution, obtaining the path constraint conditions for changing the control flow; obtaining the key operation statements affected by the path constraint conditions; determining whether the key operation statements are affected by the annotated code statements; and if yes, generating a security warning.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of smart contract, and in particular to a smart contract testing method and device, an electronic device and a storage medium. BACKGROUND

[0002] In the development process of a smart contract, annotations may be generated, which are different from natural language describing the function of the code. Some annotations are commented-out code, which is usually generated in the process of development and debugging code and the like. For example, a developer considers that some code can be omitted, and is only retained in the source file through annotation (to facilitate future rollback of the code by un-commenting), or the developer directly copies a contract with commented-out code and the like. However, incorrectly annotating some key code will itself affect the security of the contract. At the same time, since the contract source code is published on the chain and can be viewed by all users, a malicious user can attack the contract after identifying and locating the vulnerability code (annotated code).

[0003] Current security research on the annotations of smart contracts and the related code mainly focuses on the consistency check of natural language annotations and the code, mainly including static analysis and dynamic analysis and the like. These methods usually take the source code or bytecode of the smart contract as input, and detect the security of the contract according to pre-defined rules. For example, based on the AST, sourcemap and the like of the source code of the smart contract and the contract bytecode, a symbolic execution tool is constructed, different types of security vulnerabilities are analyzed by experts, pre-defined detection modes are defined, and it is detected whether there is a security vulnerability in the contract code.

[0004] However, the prior art has the following technical defects:

[0005] Security detection depends on pre-defined vulnerability modes, and has poor scalability: the existing security detection tools seriously depend on expert knowledge to define detection rules, resulting in poor scalability, and requiring human intervention and defining more vulnerability modes to face unknown vulnerabilities.

[0006] Ignoring error code annotations that affect security in the software development process: in the development process of a smart contract, a developer may incorrectly annotate key code fragments when debugging or modifying the code. These annotated code may contain important logic or security checks, and incorrectly annotating these code may affect the security of the contract. Common situations include developers annotating some code to facilitate debugging, but these annotated code may be left in the source code and ignored when deployed, allowing malicious users to exploit the vulnerability for attacks. However, the existing detection tools ignore the detection of annotated code fragments, and cannot identify potential security risks caused by incorrect annotations. SUMMARY

[0007] The application provides a smart contract testing method and device, electronic equipment and a storage medium, and aims at solving the technical problem that the existing security detection tool seriously depends on expert knowledge to define detection rules, resulting in poor expansibility, and ignoring the detection of commented code segments, and being unable to identify potential security risks caused by error annotations.

[0008] The application provides a smart contract testing method, which comprises the following steps:

[0009] Identifying the annotated code that is commented out from the contract source code of the smart contract;

[0010] Determining the annotated code statements of the annotated code, and obtaining the affected function affected by the annotated code statements and the program path of the affected function;

[0011] Performing control flow analysis according to the affected function and the program path;

[0012] When it is determined that the annotated code statements change the control flow of code execution, obtaining the path constraint condition that changes the control flow;

[0013] Obtaining the key operation statements affected by the path constraint condition;

[0014] Determining whether the key operation statements are affected by the annotated code statements;

[0015] If yes, generating a security warning.

[0016] Optionally, the step of identifying the annotated code that is commented out from the contract source code of the smart contract comprises the following steps:

[0017] Identifying the annotated code that is commented out from the contract source code of the smart contract through regular matching.

[0018] Optionally, the step of determining the annotated code statements of the annotated code, and obtaining the affected function affected by the annotated code statements and the program path of the affected function comprises the following steps:

[0019] Determining the annotated code statements of the annotated code, and identifying the function to which the annotated code statements belong;

[0020] Generating a call graph of the function, and obtaining the affected function affected by the annotated code statements and the program path of the affected function from the call graph.

[0021] Optionally, the step of obtaining the key operation statements affected by the path constraint condition comprises the following steps:

[0022] determine whether a modification statement exists after the annotated code statement according to the call graph and the path constraint condition;

[0023] if yes, determine the modification statement as a key operation statement affected by the path constraint condition.

[0024] Optionally, the step of determining whether the key operation statement is affected by the annotated code statement comprises:

[0025] acquiring dependent variables of the key operation statement according to the call graph;

[0026] determining whether the annotated code statement makes constraint judgment on the dependent variables;

[0027] if no, determine that the key operation statement is not affected by the annotated code statement;

[0028] if yes, determine that the key operation statement is affected by the annotated code statement.

[0029] The application further provides a smart contract testing device, comprising:

[0030] an annotated code identification module configured to identify annotated code that is annotated out from contract source code of a smart contract;

[0031] an affected function and program path acquisition module configured to determine an annotated code statement of the annotated code and acquire an affected function affected by the annotated code statement and a program path of the affected function;

[0032] a control flow analysis module configured to perform control flow analysis according to the affected function and the program path;

[0033] a path constraint condition acquisition module configured to acquire a path constraint condition that changes a control flow of code execution when it is determined that the annotated code statement changes the control flow of code execution;

[0034] a key operation statement acquisition module configured to acquire a key operation statement affected by the path constraint condition;

[0035] an influence determination module configured to determine whether the key operation statement is affected by the annotated code statement;

[0036] a security warning generation module configured to generate a security warning if yes.

[0037] Optionally, the annotated code identification module comprises:

[0038] an annotated code identification submodule configured to identify annotated code that is annotated out from the contract source code of the smart contract through regular matching.

[0039] Optionally, the affected function and program path acquisition module comprises:

[0040] a function identification sub-module, configured to determine an annotated code statement of the annotated code and identify a function to which the annotated code statement belongs;

[0041] an affected function and program path acquisition sub-module, configured to generate a call graph of the function and acquire, from the call graph, an affected function affected by the annotated code statement and a program path of the affected function.

[0042] The application further provides an electronic device, which comprises a processor and a memory:

[0043] The memory is configured to store program code and transmit the program code to the processor;

[0044] The processor is configured to execute the smart contract testing method according to the instructions in the program code.

[0045] The application further provides a computer readable storage medium, which is configured to store program code, and the program code is configured to execute the smart contract testing method.

[0046] As can be seen from the above technical solutions, the application has the following advantages: the application discloses a smart contract testing method, and specifically discloses the following: identifying annotated code that is annotated out from contract source code of a smart contract; determining an annotated code statement of the annotated code and acquiring an affected function affected by the annotated code statement and a program path of the affected function; performing control flow analysis according to the affected function and the program path; when it is determined that the annotated code statement changes a control flow of code execution, acquiring a path constraint condition that changes the control flow; acquiring a key operation statement affected by the path constraint condition; determining whether the key operation statement is affected by the annotated code statement; if yes, generating a safety warning. The application can detect unknown types of logic vulnerabilities by comparing differences between codes before and after annotation, without the need to define a vulnerability mode in advance, thereby enhancing the expansibility of vulnerability detection. The application further analyzes code segments that are annotated out during development, determines whether the code segments involve key safety checks or logic operations, and prevents safety problems caused by negligence or incorrect annotation of developers from being ignored. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0048] Figure 1 A step flow chart of a smart contract testing method provided for an embodiment of the present application is shown in FIG. 1.

[0049] Figure 2 An example diagram of path constraint extraction provided for an embodiment of the present application is shown in FIG. 2.

[0050] Figure 3 An architecture diagram of a smart contract testing method provided for an embodiment of the present application is shown in FIG. 3.

[0051] Figure 4 A step flow chart of a smart contract testing method provided for another embodiment of the present application is shown in FIG. 4.

[0052] Figure 5 A contract instance diagram containing commented-out code provided for an embodiment of the present application is shown in FIG. 5.

[0053] Figure 6 A call graph analysis schematic diagram provided for an embodiment of the present application is shown in FIG. 6.

[0054] Figure 7 A structural block diagram of a smart contract testing device provided for an embodiment of the present application is shown in FIG. 7. DETAILED DESCRIPTION

[0055] The embodiments of the present application provide a smart contract testing method, device, electronic equipment and storage medium, which are used to solve the technical problem that the existing security detection tool seriously depends on expert knowledge to define detection rules, which leads to poor scalability, and ignores the detection of commented-out code segments, and cannot identify potential security risks caused by error annotations.

[0056] In order to make the purposes, features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the embodiments described below are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0057] Please refer to Figure 1 , Figure 1A step flow chart of a smart contract testing method provided by an embodiment of the present application.

[0058] The smart contract testing method provided by the present application can specifically include the following steps:

[0059] Step 101, identifying the commented-out code from the contract source code of the smart contract;

[0060] Smart contract: The smart contract is a big feature of the era of blockchain 2.0. By storing the code in the blockchain and being unable to tamper once deployed, it has the Turing complete feature and can run the code to complete the previously defined behavior when certain conditions are met, including transferring accounts, making decisions, interacting with other contracts, etc. Based on the characteristics of the blockchain, the running result of the smart contract is run and verified by a large number of computers to ensure credibility. Solidity is the most popular smart contract language at present, and the embodiments of the present application are only for Solidity language and EVM (Ethereum Virtual Machine) supporting Solidity smart contract running.

[0061] Commented-out code: Source code comments are a common practice in software development to improve code readability. Although the comments are usually composed of descriptive natural language, there is still a considerable part of the comments that are actually code statements rather than descriptive natural language, that is, the commented-out code.

[0062] In the embodiments of the present application, the commented-out code can be identified from the contract code of the smart contract, so as to analyze whether the commented-out code will have adverse effects on the execution of the smart contract in the subsequent analysis.

[0063] Step 102, determining the commented-out code statements of the comment code and obtaining the affected functions and program paths of the affected functions affected by the commented-out code statements;

[0064] In the embodiments of the present application, specific statements in the comment code statements can be identified to analyze the affected functions in which the comment code statements are located and the corresponding program paths.

[0065] Step 103, performing control flow analysis according to the affected functions and program paths;

[0066] Step 104, when it is determined that the comment code statements change the control flow of code execution, obtaining the path constraint conditions of changing the control flow;

[0067] In this embodiment of the invention, based on the role of commented code statements in the program path, it can be analyzed whether commenting them out will affect the normal execution path of the corresponding function. For example, require or if statements will affect the conditions under which code execution continues. Extracting the corresponding decision conditions can serve as constraints affecting the execution of smart contracts.

[0068] like Figure 2 As shown, the analysis reveals that the first line of the `_erc721toErc20` function contains commented-out code, specifically a `require` statement that checks if the owner of `tokenId` is `msg.sender`. Because this conditional statement is commented out, it's clear that this comment alters the control flow of the code execution path.

[0069] Step 105: Obtain the key operation statements affected by the path constraints;

[0070] Step 106: Determine whether the critical operation statement is affected by the commented code statement;

[0071] Step 107: If yes, generate a security alert.

[0072] After obtaining the path constraints, we can analyze whether the path constraints are critical operations that affect the modification of critical operation statements. If so, we can determine whether the critical operation statements are affected by the commented code statements. If so, it means that after the commented code is commented out, the constraints to reach the critical operation are more relaxed than before the comments are commented out. At this time, we can report the problem and generate a security warning.

[0073] This invention can detect unknown types of logical vulnerabilities by comparing the differences between code before and after comments, without requiring predefined vulnerability patterns, thus enhancing the scalability of vulnerability detection. Furthermore, this invention analyzes commented-out code snippets during development to determine whether these snippets involve critical security checks or logical operations, preventing security issues caused by developer negligence or incorrect comments from being overlooked.

[0074] Please see Figure 3 and Figure 4 , Figure 3 An architecture diagram of a smart contract testing method provided in an embodiment of the present invention; Figure 4 A flowchart illustrating the steps of a smart contract testing method according to another embodiment of the present invention. Specifically, it may include the following steps:

[0075] Step 401: Identify commented-out code from the smart contract's source code using regular expression matching;

[0076] In the embodiments of the present application, the contract source code of the smart contract can be taken as input, and it is analyzed by regular matching whether the smart contract contains commented-out code. For example, the require() line in Figure 5 If the commented-out code exists, step 402 is performed.

[0077] In step 402, the commented-out code statement of the commented-out code is determined, and the function to which the commented-out code statement belongs is identified.

[0078] In step 403, a call graph of the function is generated, and the affected function and the program path of the affected function affected by the commented-out code statement are obtained from the call graph.

[0079] In the embodiments of the present application, the statement statement for external call in the code can be extracted based on the contract AST information, and the call graph (Call Graph) is constructed based on the function of the contract. As shown in Figure 6 The commented-out code statement S is included in the function F, and F is in the foo->F->bar path of the call graph of the smart contract. Through the Call Graph, inter-process analysis can be performed, and the affected function and its program path affected by the commented-out code statement S can be determined.

[0080] In step 404, control flow analysis is performed according to the affected function and the program path.

[0081] In step 405, when it is determined that the commented-out code statement changes the control flow of code execution, the path constraint condition changing the control flow is obtained.

[0082] In the embodiments of the present application, according to the role of the commented-out code statement in the program path, it can be analyzed whether the commented-out code will affect the normal execution path of the corresponding function. For example, the require or if statement will affect the condition of code execution. The corresponding judgment condition is extracted, which can be used as a constraint affecting the execution of the smart contract.

[0083] As shown in Figure 2 When the first line of the _erc721toErc20 function contains the commented-out code, and the commented-out code is the require statement, that is, the constraint that the owner of the tokenId is msg.sender is determined. Since the code of the condition judgment is commented out, it can be determined that the commented-out code changes the control flow of the code execution path.

[0084] In step 406, the key operation statement affected by the path constraint condition is obtained.

[0085] In one example, step 406 can include the following sub-steps:

[0086] S61, determining whether there is a modified statement after the annotated code statement according to the call graph and the path constraint condition;

[0087] S62, if yes, determining the modified statement as the key operation statement affected by the path constraint condition.

[0088] In a specific implementation, according to the information obtained by the above steps, the path constraint condition C: ownerOf(_tokenId)==msg.sender can be obtained, that is, the current code cancels the permission verification of msg.sender. Based on the path constraint condition C and the Call Graph extracted by the judgment, it can be determined whether the key operation statement S2 modifying the balance is in the path reachable by the path constraint condition C. The specific implementation is as follows: scanning the call graph to which the function F belongs, identifying whether the modified statement S2 of the variable balance is included after the annotated code statement S, for example, balance[from] += amount, if yes, determining that the modified statement S2 is the key operation statement affected by the path constraint condition C.

[0089] Step 407, determining whether the key operation statement is affected by the annotated code statement;

[0090] In the embodiment of the present application, step 407 can include the following sub-steps:

[0091] S71, obtaining the dependent variable of the key operation statement according to the call graph;

[0092] S72, determining whether the annotated code statement performs constraint judgment on the dependent variable;

[0093] S73, if no, determining that the key operation statement is not affected by the annotated code statement;

[0094] S74, if yes, determining that the key operation statement is affected by the annotated code statement.

[0095] In a specific implementation, the dependent variable on which the key and value of the S2 statement depend can be obtained by data flow analysis, that is, from, amount and its data dependency msg.sender. Figure 2In the example, the modification operation of the S2 statement balance is identified by the call graph to be located in the _mint function, that is, the calling function of _erc721ToErc20. Meanwhile, the msg.sender of the function will be as a parameter from, enter the key of the balance variable, and the numerical modification operation of the key is performed. According to this, it can be determined that the commented statement S performs constraint judgment on the dependent variable of the key operation, but due to the annotation of the require statement, the burn operation loses the permission verification related to the key variable, and any user can operate. That is, the constraint of the key operation after the code annotation is looser than that before the code annotation, and specifically, the lack of msg.sender verification can cause the balance of any person to be reduced by others. Therefore, it is indicated that the annotated code statement affects the key operation.

[0096] If yes, a security warning is generated in step 408.

[0097] When it is determined that the key operation statement is affected by the annotated code statement, a corresponding security warning can be generated.

[0098] The present application can detect unknown types of logic vulnerabilities by comparing the differences between the code before and after annotation, without the need to define the vulnerability mode in advance, thereby enhancing the expansibility of vulnerability detection. The present application can also analyze the code segments that are annotated during development to determine whether these code segments involve key security checks or logic operations, thereby preventing security problems caused by developer negligence or incorrect annotation from being ignored.

[0099] Please refer to Figure 7 , Figure 7 A structural block diagram of an intelligent contract testing device provided by an embodiment of the present application.

[0100] An intelligent contract testing device is provided by an embodiment of the present application, which comprises:

[0101] An annotated code identification module 701 is configured to identify annotated code that is annotated from the contract source code of the intelligent contract;

[0102] An affected function and program path acquisition module 702 is configured to determine the annotated code statement of the annotated code and acquire an affected function affected by the annotated code statement and a program path of the affected function;

[0103] A control flow analysis module 703 is configured to perform control flow analysis according to the affected function and the program path;

[0104] A path constraint condition acquisition module 704 is configured to acquire a path constraint condition that changes the control flow when it is determined that the annotated code statement changes the control flow of the code.

[0105] The key operation statement acquisition module 705 is configured to acquire a key operation statement affected by the path constraint condition.

[0106] The influence judgment module 706 is configured to judge whether the key operation statement is affected by the commented code statement.

[0107] The safety warning generation module 707 is configured to generate a safety warning if the key operation statement is affected by the commented code statement.

[0108] In the embodiment of the present application, the commented code identification module 701 comprises:

[0109] The commented code identification sub-module is configured to identify the commented code from the contract source code of the smart contract through regular matching.

[0110] In the embodiment of the present application, the affected function and program path acquisition module 702 comprises:

[0111] The function identification sub-module is configured to determine the commented code statement of the commented code and identify the function to which the commented code statement belongs.

[0112] The affected function and program path acquisition sub-module is configured to generate a call graph of the function and acquire the affected function and the program path of the affected function affected by the commented code statement from the call graph.

[0113] In the embodiment of the present application, the key operation statement acquisition module 705 comprises:

[0114] The modified statement judgment sub-module is configured to judge whether there is a modified statement after the commented code statement according to the call graph and the path constraint condition.

[0115] The key operation statement determination sub-module is configured to determine the modified statement as the key operation statement affected by the path constraint condition if there is the modified statement.

[0116] In the embodiment of the present application, the influence judgment module 706 comprises:

[0117] The dependent variable acquisition sub-module is configured to acquire a dependent variable of the key operation statement according to the call graph.

[0118] The constraint judgment judgment sub-module is configured to judge whether the dependent variable is subjected to constraint judgment by the commented code statement.

[0119] The first judgment sub-module is configured to judge that the key operation statement is not affected by the commented code statement if the dependent variable is not subjected to constraint judgment by the commented code statement.

[0120] The second judgment sub-module is configured to judge that the key operation statement is affected by the commented code statement if the dependent variable is subjected to constraint judgment by the commented code statement.

[0121] The embodiment of the present application also provides an electronic device, the device comprising a processor and a memory:

[0122] The memory is used for storing program code and transmitting the program code to the processor.

[0123] The processor is used for executing the smart contract testing method of the embodiment of the present application according to instructions in the program code.

[0124] The embodiment of the present application also provides a computer readable storage medium, the computer readable storage medium is used for storing program code, and the program code is used for executing the smart contract testing method of the embodiment of the present application.

[0125] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and will not be repeated here.

[0126] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same and similar parts between each embodiment can be referred to each other.

[0127] Those skilled in the art should understand that the embodiments of the embodiment of the present application can be provided as a method, a device or a computer program product. Therefore, the embodiment of the present application can adopt a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the embodiment of the present application can adopt the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0128] The embodiments of the present application are described with reference to flowcharts and / or block diagrams according to the method, terminal device (system) and computer program product of the embodiments of the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine, so that the instructions executed by the computer or other programmable data processing terminal device produce a machine that implements the functions specified in the flowchart and / or block diagram. Figure 1 The device for realizing the functions specified in one flow or multiple flows and / or blocks Figure 1 The device for realizing the functions specified in one flow or multiple flows and / or blocks

[0129] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0130] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the function specified in the flow or flows and / or blocks Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0131] While preferred embodiments of the present application have been described, modifications and variations can be effected to such embodiments by those of ordinary skill in the art once the necessary conceptual underpinnings have been imparted. Accordingly, it is to be understood that it is intended to include the described preferred embodiments as well as those alternatives and modifications which fall within the scope of the embodiments of the present application.

[0132] Finally, it should be noted that the terms "first", "second", and the like, herein do not denote any order, quantity, combination, or importance, but rather are used to distinguish one element from another, and do not imply singular or plural. Also, the terms "comprises", "comprising", or other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0133] The above described embodiments are merely intended to illustrate the technical solutions of the present application, but not to limit the same; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for testing a smart contract, characterized in that, The method comprises the following steps: identifying the commented-out comment code from the contract source code of the smart contract; determining the comment code statement of the comment code, and obtaining the affected function affected by the comment code statement and the program path of the affected function; performing control flow analysis according to the affected function and the program path; when it is determined that the comment code statement changes the control flow of code execution, obtaining the path constraint condition that changes the control flow; obtaining the key operation statement affected by the path constraint condition; determining whether the key operation statement is affected by the comment code statement; if yes, generating a security warning; wherein the step of obtaining the key operation statement affected by the path constraint condition comprises: determining whether there is a modification statement after the comment code statement according to the call graph and the path constraint condition; if yes, determining the modification statement as the key operation statement affected by the path constraint condition.

2. The method of claim 1, wherein, The step of identifying the commented-out comment code from the contract source code of the smart contract comprises: identifying the commented-out comment code from the contract source code of the smart contract through regular matching.

3. The method of claim 1, wherein, The step of determining the comment code statement of the comment code and obtaining the affected function affected by the comment code statement and the program path of the affected function comprises: determining the comment code statement of the comment code, and identifying the function to which the comment code statement belongs; generating a call graph of the function, and obtaining the affected function affected by the comment code statement and the program path of the affected function from the call graph.

4. The method of claim 3, wherein, The step of determining whether the key operation statement is affected by the comment code statement comprises: obtaining the dependent variable of the key operation statement according to the call graph; determining whether the comment code statement makes a constraint judgment on the dependent variable; if no, it is determined that the key operation statement is not affected by the comment code statement; if yes, it is determined that the key operation statement is affected by the comment code statement.

5. An apparatus for testing a smart contract, the apparatus comprising: The method comprises the following steps: an comment code identification module for identifying the commented-out comment code from the contract source code of the smart contract; an affected function and program path obtaining module for determining the comment code statement of the comment code, and obtaining the affected function affected by the comment code statement and the program path of the affected function; a control flow analysis module for performing control flow analysis according to the affected function and the program path; a path constraint condition obtaining module for obtaining the path constraint condition that changes the control flow when it is determined that the comment code statement changes the control flow of code execution; a key operation statement obtaining module for obtaining the key operation statement affected by the path constraint condition; an influence determination module for determining whether the key operation statement is affected by the comment code statement; a security warning generation module for generating a security warning if yes; wherein the key operation statement obtaining module comprises: a modification statement determination sub-module for determining whether there is a modification statement after the comment code statement according to the call graph and the path constraint condition. The key operation statement determination submodule is configured to determine the modified statement as a key operation statement affected by the path constraint condition if yes.

6. The apparatus of claim 5, wherein, The annotation code identification module comprises: The annotation code identification submodule is configured to identify the annotated annotation code from the contract source code of the smart contract through regular matching.

7. The apparatus of claim 5, wherein, The affected function and program path acquisition module comprises: The function identification submodule is configured to determine the annotation code statement of the annotation code and identify the function to which the annotation code statement belongs. The affected function and program path acquisition submodule is configured to generate a call graph of the function and acquire, from the call graph, an affected function affected by the annotation code statement and a program path of the affected function.

8. An electronic device, comprising: The device comprises a processor and a memory: The memory is configured to store program code and transmit the program code to the processor; The processor is configured to execute the smart contract testing method according to the instructions in the program code.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium is configured to store program code, and the program code is configured to execute the smart contract testing method.

Images