Smart contract reentrant vulnerability detection method and system based on control flow graph slices

Abstract

The invention discloses a smart contract reentrant vulnerability detection method and system based on control flow graph slices, and belongs to the technical field of block chain security. The method comprises the following steps: constructing a control flow diagram of a smart contract; after the control flow diagrams are sliced with transaction-related operation codes as key points, the sliced control flow diagrams are combined; and based on the combined control flow diagram, generating a reentrant vulnerability detection result of the smart contract. According to the method, the reentrant vulnerability can be effectively detected before the smart contract is deployed.

Description

Technical Field

[0001] The present invention relates to a smart contract reentrant vulnerability detection method and system based on control flow graph slicing, belonging to the technical field of blockchain security. Background Art

[0002] Blockchain technology is widely used in modern information technology due to its key features such as anti-tampering and decentralization. As one of the core components of blockchain technology, smart contracts are also widely used in modern information technology, such as finance, games, and medical care. A smart contract is a predefined logic segment that can automatically execute, record, and control related events in the blockchain when the trigger conditions are met.

[0003] Although smart contracts are widely used, the lack of execution standards in smart contracts often makes them vulnerable to infiltrating blockchain systems. Reentrancy vulnerabilities are one of the most destructive vulnerabilities in blockchain systems. Reentrancy vulnerabilities: attackers recursively call transaction functions inside a contract until all funds inside the contract are transferred. In the real world, 3,600,000 ETH were stolen from the 'The DAO' contract due to a reentrancy vulnerability. Therefore, reentrancy vulnerabilities are seriously harmful to blockchains.

[0004] In order to detect reentrancy vulnerabilities before deploying smart contracts to the blockchain, an efficient vulnerability detection method must be designed.

[0005] Currently, there are several methods for detecting reentrancy vulnerabilities in smart contracts:

[0006] Solution 1: Smart contract reentrancy vulnerability detection based on symbolic execution. By converting the code of the smart contract into symbolic representation, all possible execution paths are systematically explored to analyze the program logic and detect potential vulnerabilities and security issues.

[0007] However, this scheme has problems such as reliance on expert rules, path explosion and difficulty in solving constraints, making it a very time-consuming and error-prone process.

[0008] Solution 2: Detection of reentrancy vulnerabilities in smart contracts based on fuzz testing. By inputting randomly generated parameters and abnormal data into smart contracts, simulating scenarios that attackers may exploit, and observing the response of smart contracts under reentrancy attacks, we can detect whether there are reentrancy vulnerabilities.

[0009] However, this scheme has problems such as dependence on input generation and randomness limitations. It is difficult to cover all potential attack paths, which may lead to false positives or false negatives, affecting the accuracy of reentrant vulnerability detection.

[0010] Solution 3: Smart contract reentrancy vulnerability detection based on formal verification. Through mathematical models and logical reasoning, the behavior of smart contracts is accurately described and analyzed to verify its security in reentrancy attack scenarios.

[0011] However, this approach suffers from high complexity and reliance on expert rules, making it a very time-consuming and error-prone process.

[0012] Solution 4: Smart contract reentrancy vulnerability detection based on machine learning. First, collect and annotate a large number of smart contract code samples. Then, extract smart contract code features. Finally, use these features to train a machine learning model so that it can learn to identify patterns of reentrancy vulnerabilities.

[0013] However, existing solutions have certain limitations, namely 1) they mainly focus on using a single machine learning model as a reentrancy vulnerability identification model. The disadvantages are poor model robustness and low accuracy. 2) They rarely consider the impact of large control flow graphs on the efficiency of reentrancy vulnerability detection. Therefore, there is an urgent need for a technology to overcome the technical defects of existing smart contract reentrancy vulnerability detection methods, such as low accuracy, poor model robustness, and slow detection efficiency. Summary of the invention

[0014] The present invention discloses a smart contract reentrancy vulnerability detection method and system based on control flow graph slicing, which can effectively detect reentrancy vulnerabilities before deploying smart contracts.

[0015] To achieve the above objectives, the technical solution of the present invention includes the following contents.

[0016] A method for detecting reentrancy vulnerabilities in smart contracts based on control flow graph slicing, the method comprising:

[0017] Build the control flow graph of the smart contract;

[0018] After slicing the control flow graph using the transaction-related operation codes as key points, merging the sliced ​​control flow graphs;

[0019] Based on the merged control flow graph, the reentrancy vulnerability detection results of the smart contract are generated.

[0020] Furthermore, the control flow graph of building a smart contract includes:

[0021] Obtaining the source code of the smart contract and performing denoising processing on the source code;

[0022] Use the py-solc package to parse the denoised source code into bytecode;

[0023] Extracting the running code in the bytecode;

[0024] Use the EVM-CFG-BUILDER package to parse the running code into a control flow graph.

[0025] Furthermore, the transaction-related operation codes include: CALL operation code, CALLCODE operation code and DELEGATECALL operation code;

[0026] The slicing of the control flow graph using transaction-related operation codes as key points includes:

[0027] Taking the control flow graph node containing the CALL opcode as the core node, perform forward slicing and reverse slicing along the directed edges to obtain control flow graph slice A;

[0028] Taking the control flow graph node containing the CALLCODE opcode as the core node, perform forward slicing and reverse slicing along the directed edge to obtain control flow graph slice B;

[0029] Taking the control flow graph node containing the DELEGATECALL opcode as the core node, forward slicing and reverse slicing are performed along the directed edges to obtain the control flow graph slice C.

[0030] Furthermore, the reentrancy vulnerability detection result of the smart contract is generated based on the merged control flow graph, including:

[0031] For the merged control flow graph, the nodes, edges and the operation codes corresponding to the nodes are mapped into digital vectors to obtain node vectors, edge vectors and node semantic vectors;

[0032] Fusion of node semantic vector, node vector and edge vector;

[0033] The fusion vectors are classified based on a vulnerability detection model to obtain a reentrant vulnerability detection result of the smart contract; wherein the vulnerability detection model is constructed based on a machine learning algorithm.

[0034] Furthermore, for the merged control flow graph, mapping nodes, edges and operation codes corresponding to the nodes into digital vectors respectively includes:

[0035] Map the nodes and edges in the merged control flow graph into node vectors and edge vectors based on the Node2Vec tool;

[0036] Based on the FastText tool, the opcodes in the nodes in the merged control flow graph are mapped into digital vectors, and then summed and normalized to obtain the node semantic vector.

[0037] Furthermore, the machine learning algorithm includes: one or more of a random forest algorithm, a decision tree algorithm, a naive Bayes algorithm, a support vector machine algorithm and a linear classification algorithm.

[0038] A smart contract reentrant vulnerability detection system based on control flow graph slicing, the system comprising:

[0039] Building modules for building control flow graphs of smart contracts;

[0040] A slicing module, used for slicing the control flow graph based on the transaction-related operation code as a key point, and then merging the sliced ​​control flow graph;

[0041] The detection module is used to generate a reentrancy vulnerability detection result of the smart contract based on the merged control flow graph.

[0042] An electronic device, characterized in that the electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements any of the above-mentioned smart contract reentrancy vulnerability detection methods based on control flow graph slicing.

[0043] A computer-readable storage medium, characterized in that computer program instructions are stored on the computer-readable storage medium, and when the computer program instructions are executed by a processor, any of the above-mentioned smart contract reentrancy vulnerability detection methods based on control flow graph slicing is implemented.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] 1. This method has good accuracy. Specifically: through denoising, the influence of noise data on the accuracy of reentrancy vulnerability detection is reduced; only relevant context information of reentrancy vulnerabilities is retained to improve the accuracy of reentrancy vulnerability detection; the prediction results of multiple machine learning algorithms are integrated to improve the accuracy of reentrancy vulnerability detection.

[0046] 2. This method has good reentrancy vulnerability detection efficiency. Specifically, the slicing technology is used to retain only the relevant context information of the reentrancy vulnerability and reduce the size of the control flow graph to improve the reentrancy vulnerability detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a schematic diagram of a smart contract reentrancy vulnerability detection method based on control flow graph slicing according to the present invention. DETAILED DESCRIPTION

[0048] The method of the present invention is described in detail below in conjunction with a method schematic diagram and a specific implementation method.

[0049] like Figure 1 As shown, a smart contract reentrancy vulnerability detection method based on control flow graph slicing includes the following steps:

[0050] Step 1: Perform denoising on the smart contract source code.

[0051] Specifically, step 1 includes the following steps:

[0052] Step 1.1: Delete blank lines and comments, as well as extra spaces.

[0053] Step 2: Parse the smart contract source code into running code.

[0054] Specifically, step 2 includes the following steps:

[0055] Step 2.1: Use the py-solc package to parse the smart contract source code into bytecode;

[0056] Step 2.2: The bytecode consists of deployment code, running code, and auxdata code. After the deployment code is run, the running code and auxdata code are stored on the blockchain. The auxdata code contains some auxiliary information of the smart contract, such as compiled version information, etc. This information is irrelevant to the vulnerability characteristics. Therefore, the deployment code and auxdata code are deleted, and only the running code is retained.

[0057] Step 3: Parse the running code into a control flow graph.

[0058] Specifically, step 3 includes the following steps:

[0059] Step 3.1: Use the EVM-CFG-BUILDER package to parse the smart contract execution code into a control flow graph.

[0060] Step 4: Slice the control flow graph using transaction-related opcodes as key points.

[0061] Specifically, step 4 includes the following steps:

[0062] Step 4.1: Traverse all nodes of the control flow graph and extract nodes containing "CALL", "CALLCODE" and "DELEGATECALL" opcodes;

[0063] Step 4.2: Take the control flow graph node containing the "CALL" opcode as the core node, perform forward slicing and reverse slicing along the directed edges, and obtain control flow graph slice A;

[0064] Step 4.3: Take the control flow graph node containing the "CALLCODE" opcode as the core node, perform forward slicing and reverse slicing along the directed edge, and obtain control flow graph slice B;

[0065] Step 4.4: Take the control flow graph node containing the "DELEGATECALL" operation code as the core node, perform forward slicing and reverse slicing along the directed edges, and obtain the control flow graph slice C.

[0066] Step 5: Merge the slice control flow graph.

[0067] Specifically, step 5 includes the following steps:

[0068] Step 5.1: Merge control flow graph slice A, control flow graph slice B, and control flow graph slice C to form a complete control flow graph.

[0069] Step 6: Map the internal opcodes of the control flow graph nodes, control flow graph nodes, and control flow graph edges into digital vectors through code embedding technology and graph embedding technology.

[0070] Specifically, step 6 includes the following steps:

[0071] Step 6.1: Map the merged control flow graph nodes and control flow graph edges into node vectors and edge vectors based on the Node2Vec tool;

[0072] Step 6.2: Map the opcodes in the merged control flow graph nodes into digital vectors based on the FastText tool;

[0073] Step 6.3: Sum and normalize all the opcode vectors in the node to obtain the node semantic vector.

[0074] Step 7: Fusion of the control flow graph node internal opcode vector, control flow graph node vector and control flow graph edge vector.

[0075] Specifically, step 7 includes the following steps:

[0076] Step 7.1: Sum and normalize the node semantic vector, node vector, and edge vector to obtain the smart contract vector.

[0077] Step 8: Learn the potential features of the fusion vector through machine learning algorithms and perform reentrancy vulnerability detection on it.

[0078] Specifically, step 8 includes the following steps:

[0079] Step 8.1: Use the random forest algorithm, decision tree algorithm, naive Bayes algorithm, support vector machine algorithm and linear classification algorithm to predict reentrancy vulnerabilities.

[0080] Step 9: Fusion the prediction results of multiple machine learning algorithms through ensemble learning methods to improve the accuracy and robustness of reentrancy vulnerability detection.

[0081] Specifically, step 9 includes the following steps:

[0082] Step 9.1: Use the ensemble learning method to integrate the prediction results of the random forest algorithm, decision tree algorithm, naive Bayes algorithm, support vector machine algorithm, and linear classification algorithm to improve the accuracy of reentrancy vulnerability detection.

[0083] Below, a specific experiment is used to illustrate the smart contract reentrancy vulnerability detection method based on control flow graph slicing provided by the present invention.

[0084] Hardware configuration: We use Python (v3.7) in Pychar IDE to implement our model. The hardware platform is Lenovo's ideapad 300-15ISK laptop, equipped with Windows 10 operating system, 2.3GHz CPU, i5 version core and 8GB 2691MHz LPDDR3 memory.

[0085] Software configuration: The code is written in Python 3.7.3, and the third-party libraries used in the process include Numpy, sk-learn, etc.

[0086] Experimental data:

[0087]

[0088] Among them, the ablation experiment refers to directly using the control flow graph for detection without executing the control flow graph slicing process. Reference 1 is the advanced fraud detection method in blockchain transactions disclosed by Taher et al. (Taher SS, Ameen SY, Ahmed JA (2024) Advanced fraud detection in blockchain transactions: An ensemble learning and explainable ai approach. Engineering, Technology & Applied Science Research 14 (1): 12822–12830).

[0089] The above is one of the embodiments of the present invention, and the present invention should not be limited to the contents disclosed in the embodiment and the drawings. Any equivalent or modification completed without departing from the spirit disclosed in the present invention shall fall within the scope of protection of the present invention.

Claims

1. A smart contract reentrancy vulnerability detection method based on control flow graph slicing, characterized in that: The method includes: constructing a control flow graph of a smart contract; After slicing the control flow graph using the transaction-related operation codes as key points, merging the sliced ​​control flow graphs; Based on the merged control flow graph, the reentrancy vulnerability detection results of the smart contract are generated.

2. The method according to claim 1, characterized in that The control flow graph of building a smart contract includes: Obtaining the source code of the smart contract and performing denoising processing on the source code; Use the py-solc package to parse the denoised source code into bytecode; Extracting the running code in the bytecode; Use the EVM-CFG-BUILDER package to parse the running code into a control flow graph.

3. The method according to claim 1, characterized in that The transaction-related operation codes include: CALL operation code, CALLCODE operation code and DELEGATECALL operation code; The slicing of the control flow graph using transaction-related operation codes as key points includes: Taking the control flow graph node containing the CALL opcode as the core node, perform forward slicing and reverse slicing along the directed edges to obtain control flow graph slice A; Taking the control flow graph node containing the CALLCODE opcode as the core node, perform forward slicing and reverse slicing along the directed edge to obtain control flow graph slice B; Taking the control flow graph node containing the DELEGATECALL opcode as the core node, forward slicing and reverse slicing are performed along the directed edges to obtain the control flow graph slice C.

4. The method according to claim 1, characterized in that: The reentrancy vulnerability detection result of the smart contract is generated based on the merged control flow graph, including: For the merged control flow graph, the nodes, edges and the operation codes corresponding to the nodes are mapped into digital vectors to obtain node vectors, edge vectors and node semantic vectors; Fusion of node semantic vector, node vector and edge vector; The fusion vectors are classified based on a vulnerability detection model to obtain a reentrant vulnerability detection result of the smart contract; wherein the vulnerability detection model is constructed based on a machine learning algorithm.

5. The method according to claim 4, characterized in that For the merged control flow graph, the nodes, edges and operation codes corresponding to the nodes are mapped into digital vectors respectively, including: Map the nodes and edges in the merged control flow graph into node vectors and edge vectors based on the Node2Vec tool; Based on the FastText tool, the opcodes in the nodes in the merged control flow graph are mapped into digital vectors, and then summed and normalized to obtain the node semantic vector.

6. The method according to claim 4, characterized in that The machine learning algorithm includes: one or more of a random forest algorithm, a decision tree algorithm, a naive Bayes algorithm, a support vector machine algorithm and a linear classification algorithm.

7. A smart contract reentrant vulnerability detection system based on control flow graph slicing, characterized in that: The system includes: a construction module for constructing a control flow graph of a smart contract; A slicing module, used for slicing the control flow graph based on the transaction-related operation code as a key point, and then merging the sliced ​​control flow graph; The detection module is used to generate a reentrancy vulnerability detection result of the smart contract based on the merged control flow graph.

8. An electronic device, characterized in that: The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the smart contract reentrant vulnerability detection method based on control flow graph slicing as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the smart contract reentrancy vulnerability detection method based on control flow graph slicing as described in any one of claims 1 to 7.

Images