Smart contract reentrant vulnerability detection method and system based on control flow graph slicing

Abstract

The application discloses a smart contract reentrant vulnerability detection method and system based on a control flow graph slice, and belongs to the technical field of blockchain security. The method comprises the following steps: a control flow graph of a smart contract is constructed; after the control flow graph is sliced with a transaction-related operation code as a key point, the sliced control flow graphs are merged; and based on the merged control flow graph, a reentrant vulnerability detection result of the smart contract is generated. The application can effectively detect the reentrant vulnerability before the smart contract is deployed.

Description

TECHNICAL FIELD

[0001] The application relates to a smart contract reentrant vulnerability detection method and system based on a control flow graph slice, and belongs to the technical field of blockchain security. BACKGROUND

[0002] Blockchain technology is widely used in modern information technology due to its key characteristics such as tamper resistance and decentralization. As one of the core components of blockchain technology, smart contracts are also widely used in modern information technology, such as finance, gaming, and medical treatment. A smart contract is a pre-defined logic segment that can automatically execute, record and control related events in the blockchain when the trigger condition is met.

[0003] Although the application of smart contracts is very wide, the lack of execution standards in smart contracts often serves as a vulnerability for penetrating the blockchain system. Reentrant vulnerability is one of the most destructive vulnerabilities in the blockchain system. Reentrant vulnerability: an attacker recursively calls the contract internal transaction function until all the contract internal funds are transferred. In the real world, 'The DAO' contract was stolen 3600000 ETH due to reentrant vulnerability. Therefore, reentrant vulnerability is a serious threat to the blockchain.

[0004] In order to detect reentrant vulnerabilities before deploying smart contracts to the blockchain, an efficient vulnerability detection method must be designed.

[0005] Currently, the methods for detecting reentrant vulnerabilities in smart contracts include the following:

[0006] Scheme 1: Reentrant vulnerability detection of smart contract based on symbolic execution. By converting the code of the smart contract into a symbolic representation, the system explores all possible execution paths to analyze the program logic and detect potential vulnerabilities and security issues.

[0007] However, this scheme has problems such as dependence on expert rules, path explosion and difficulty in constraint solving, and is a very time-consuming and error-prone process.

[0008] Scheme 2: Reentrant vulnerability detection of smart contract based on fuzzy testing. By inputting randomly generated parameters and abnormal data to the smart contract, simulating scenarios that attackers may exploit, and observing the response of the smart contract under reentrant attack to detect whether there is a reentrant vulnerability.

[0009] However, this scheme has problems such as dependence on input generation and randomness limitation, and it is difficult to cover all potential attack paths, which may cause false positives or false negatives, affecting the accuracy of reentrant vulnerability detection.

[0010] Scheme 3: Formal verification-based smart contract reentrant vulnerability detection. Through mathematical models and logical reasoning, the behavior of the smart contract is accurately described and analyzed to verify its security in the context of a reentrant attack.

[0011] However, this scheme has the problems of high complexity and dependence on expert rules, and is a very time-consuming and error-prone process.

[0012] Scheme 4: Machine learning-based smart contract reentrant vulnerability detection. First, a large number of smart contract code samples are collected and labeled. Then, the features of the smart contract code are extracted. Finally, a machine learning model is trained using these features to learn to recognize patterns of reentrant vulnerabilities.

[0013] However, the existing scheme has certain limitations, namely 1) mainly focuses on using a single machine learning model as a reentrant vulnerability identification model. The disadvantage is that the model has poor robustness and low accuracy. 2) Little consideration is given to the impact of large control flow graph size on reentrant vulnerability detection efficiency. Therefore, there is an urgent need for a technology to overcome the technical defects of existing smart contract reentrant vulnerability detection methods, such as low accuracy, poor model robustness, and slow detection efficiency. SUMMARY

[0014] The present application discloses a smart contract reentrant vulnerability detection method and system based on control flow graph slicing, which can effectively detect reentrant vulnerabilities before deploying smart contracts.

[0015] To achieve the above-mentioned purpose, the technical scheme of the present application includes the following contents.

[0016] A smart contract reentrant vulnerability detection method based on control flow graph slicing, the method comprising:

[0017] constructing a control flow graph of the smart contract;

[0018] After slicing the control flow graph with transaction-related operation codes as key points, merging the sliced control flow graphs;

[0019] Based on the merged control flow graph, generating the reentrant vulnerability detection result of the smart contract.

[0020] Further, the construction of the control flow graph of the smart contract comprises:

[0021] Obtaining the source code of the smart contract and performing denoising processing on the source code;

[0022] Using the py-solc package to parse the denoised source code into bytecode;

[0023] Extracting the running code in the bytecode;

[0024] The running code is parsed into a control flow graph using the EVM-CFG-BUILDER package.

[0025] Further, the transaction-related operation codes include: a CALL operation code, a CALLCODE operation code, and a DELEGATECALL operation code.

[0026] The control flow graph is sliced based on the transaction-related operation codes as key points, including:

[0027] A control flow graph node containing a CALL operation code is taken as a core node, and forward slicing and reverse slicing are performed along the directed edges to obtain a control flow graph slice A.

[0028] A control flow graph node containing a CALLCODE operation code is taken as a core node, and forward slicing and reverse slicing are performed along the directed edges to obtain a control flow graph slice B.

[0029] A control flow graph node containing a DELEGATECALL operation code is taken as a core node, and forward slicing and reverse slicing are performed along the directed edges to obtain a control flow graph slice C.

[0030] Further, based on the merged control flow graph, a reentrant vulnerability detection result of the smart contract is generated, including:

[0031] For the merged control flow graph, nodes, edges, and operation codes corresponding to the nodes are mapped into digital vectors to obtain node vectors, edge vectors, and node semantic vectors.

[0032] The node semantic vectors, node vectors, and edge vectors are fused.

[0033] Based on a vulnerability detection model, the fused vectors are classified to obtain the reentrant vulnerability detection result of the smart contract; wherein the vulnerability detection model is constructed based on a machine learning algorithm.

[0034] Further, for the merged control flow graph, nodes, edges, and operation codes corresponding to the nodes are mapped into digital vectors, including:

[0035] Based on the Node2Vec tool, the nodes and edges in the merged control flow graph are mapped into node vectors and edge vectors.

[0036] After the operation codes in the nodes in the merged control flow graph are mapped into digital vectors based on the FastText tool, summation processing and normalization processing are performed to obtain node semantic vectors.

[0037] Further, the machine learning algorithm includes one or more of a random forest algorithm, a decision tree algorithm, a Naive Bayes algorithm, a support vector machine algorithm, and a linear classification algorithm.

[0038] A control flow graph slicing-based smart contract reentrant vulnerability detection system, the system comprising:

[0039] A construction module for constructing a control flow graph of a smart contract;

[0040] A slicing module for slicing the control flow graph with transaction-related operation codes as key points, and merging the sliced control flow graphs;

[0041] A detection module for generating a reentrant vulnerability detection result of the smart contract based on the merged control flow graph.

[0042] An electronic device, characterized in that the electronic device comprises a processor and a memory storing computer program instructions; the processor implements the control flow graph slicing-based smart contract reentrant vulnerability detection method of any one of the above when executing the computer program instructions.

[0043] A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, and the computer program instructions are executed by a processor to implement the control flow graph slicing-based smart contract reentrant vulnerability detection method of any one of the above.

[0044] Compared with the prior art, the present application has the following beneficial effects:

[0045] 1. The method has good accuracy. Specifically, the influence of noise data on the accuracy of reentrant vulnerability detection is reduced through denoising processing; only the relevant context information of the reentrant vulnerability is retained to improve the accuracy of reentrant vulnerability detection; and the prediction results of multiple machine learning algorithms are integrated to improve the accuracy of reentrant vulnerability detection.

[0046] 2. The method has good reentrant vulnerability detection efficiency. Specifically, only the relevant context information of the reentrant vulnerability is retained through slicing technology, and the size of the control flow graph is reduced to improve the reentrant vulnerability detection efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 A control flow graph slicing-based smart contract reentrant vulnerability detection method. DETAILED DESCRIPTION

[0048] The method of the present application will be described in detail below in combination with the method schematic diagram and the specific implementation.

[0049] As Figure 1 shown, a control flow graph slicing-based smart contract reentrant vulnerability detection method comprises the following steps:

[0050] Step 1: Perform denoising processing on the smart contract source code.

[0051] Specifically, Step 1 includes the following steps:

[0052] Step 1.1: Delete blank lines and comments, and extra spaces.

[0053] Step 2: Parse the smart contract source code into running code.

[0054] Specifically, Step 2 includes the following steps:

[0055] Step 2.1: Use the py-solc package to parse the smart contract source code into bytecode;

[0056] Step 2.2: The bytecode is composed of deployment code, running code, and auxdata code. The running code and auxdata code are stored on the blockchain after the deployment code runs. The auxdata code contains some auxiliary information of the smart contract, such as compilation version information, etc. These information and vulnerability features are irrelevant. Therefore, delete the deployment code and auxdata code, and only keep the running code.

[0057] Step 3: Parse the running code into a control flow graph.

[0058] Specifically, Step 3 includes the following steps:

[0059] Step 3.1: Use the EVM-CFG-BUILDER package to parse the smart contract running code into a control flow graph.

[0060] Step 4: Slice the control flow graph with transaction-related opcodes as key points.

[0061] Specifically, Step 4 includes the following steps:

[0062] Step 4.1: Traverse all nodes of the control flow graph, and extract nodes containing "CALL", "CALLCODE", and "DELEGATECALL" opcodes;

[0063] Step 4.2: Take the control flow graph node containing the "CALL" opcode as the core node, and perform forward slicing and reverse slicing along the directed edges to obtain control flow graph slice A;

[0064] Step 4.3: Take the control flow graph node containing the "CALLCODE" opcode as the core node, and perform forward slicing and reverse slicing along the directed edges to obtain control flow graph slice B;

[0065] Step 4.4: Take the control flow graph node containing the "DELEGATECALL" opcode as the core node, and perform forward slicing and reverse slicing along the directed edges to obtain control flow graph slice C.

[0066] Step 5: merging the slice control flow graph.

[0067] Specifically, step 5 includes the following steps:

[0068] Step 5.1: merging control flow graph slice A, control flow graph slice B and control flow graph slice C to form a complete control flow graph.

[0069] Step 6: mapping control flow graph node internal operation code, control flow graph node, control flow graph edge into digital vectors through code embedding technology and graph embedding technology.

[0070] Specifically, step 6 includes the following steps:

[0071] Step 6.1: mapping the merged control flow graph node and control flow graph edge into node vectors and edge vectors based on the Node2Vec tool;

[0072] Step 6.2: mapping the operation code within the merged control flow graph node into a digital vector based on the FastText tool;

[0073] Step 6.3: summing and normalizing all operation code vectors within the node to obtain a node semantic vector.

[0074] Step 7: fusing control flow graph node internal operation code vector, control flow graph node vector and control flow graph edge vector.

[0075] Specifically, step 7 includes the following steps:

[0076] Step 7.1: summing and normalizing the node semantic vector, node vector and edge vector to obtain an intelligent contract vector.

[0077] Step 8: learning the latent features of the fused vector through machine learning algorithms and performing reentrant vulnerability detection.

[0078] Specifically, step 8 includes the following steps:

[0079] Step 8.1: using random forest algorithm, decision tree algorithm, naive Bayes algorithm, support vector machine algorithm and linear classification algorithm respectively to predict reentrant vulnerability.

[0080] Step 9: fusing the prediction results of multiple machine learning algorithms through ensemble learning method, so as to improve the accuracy and robustness of reentrant vulnerability detection.

[0081] Specifically, step 9 includes the following steps:

[0082] Step 9.1: Use the integrated learning method to integrate the prediction results of the random forest algorithm, decision tree algorithm, naive Bayes algorithm, support vector machine algorithm and linear classification algorithm, so as to improve the accuracy of the reentrant vulnerability detection.

[0083] Next, a specific experiment is used to illustrate the intelligent contract reentrant vulnerability detection method based on control flow graph slicing provided by the present application.

[0084] Hardware configuration: we use Python (v3.7) in Pychar IDE to implement our model. The hardware platform is Lenovo ideapad 300-15ISK notebook computer, equipped with Windows 10 operating system, 2.3GHz CPU, i5 version kernel and 8GB 2691MHz LPDDR3 memory.

[0085] Software configuration: the code is written in Python 3.7.3, and the third-party libraries used in the process include Numpy, sk-learn, etc.

[0086] Experimental data:

[0087]

[0088] Among them, the ablation experiment refers to not performing the control flow graph slicing process, but directly using the control flow graph for detection. Literature 1 is an advanced fraud detection method in blockchain transactions (Taher SS, Ameen SY, Ahmed JA (2024) Advanced fraud detection in blockchain transactions: An ensemble learning and explainable ai approach. Engineering, Technology & Applied Science Research 14(1): 12822-12830) disclosed by Taher et al.

[0089] The above is one of the embodiments of the present application, and the present application should not be limited to the content disclosed in the embodiment and the drawings. Any equivalent or modification made without departing from the spirit of the present application falls within the scope of protection of the present application.

Claims

1. A method for detecting reentrancy vulnerabilities in smart contracts based on control flow graph slicing, characterized in that, The method includes: Construct the control flow graph of the smart contract; After slicing the control flow graph using transaction-related opcodes as key points, the sliced ​​control flow graphs are merged; wherein, the transaction-related opcodes include: CALL opcode, CALLCODE opcode, and DELEGATECALL opcode; Based on the merged control flow graph, the reentrancy vulnerability detection results of the smart contract are generated. The step of slicing the control flow graph using transaction-related opcodes as key points includes: Using the control flow graph node containing the CALL opcode as the core node, perform forward and reverse slicing along the directed edges to obtain control flow graph slice A; Using the control flow graph node containing the CALLCODE opcode as the core node, perform forward and reverse slicing along the directed edges to obtain control flow graph slice B; Using the control flow graph node containing the DELEGATECALL opcode as the core node, perform forward and reverse slicing along the directed edges to obtain control flow graph slice C; The process of generating reentrancy vulnerability detection results for the smart contract based on the merged control flow graph includes: For the merged control flow graph, the nodes, edges and the opcodes corresponding to the nodes are mapped to digital vectors to obtain node vectors, edge vectors and node semantic vectors. Integrate node semantic vectors, node vectors, and edge vectors; The fused vector is classified based on the vulnerability detection model to obtain the reentrancy vulnerability detection result of the smart contract; wherein, the vulnerability detection model is constructed based on machine learning algorithm.

2. The method according to claim 1, characterized in that, The control flow graph for constructing the smart contract includes: Obtain the source code of the smart contract and perform noise reduction processing on the source code; Use the py-solc package to parse the denoised source code into bytecode; Extract the executable code from the bytecode; Use the EVM-CFG-BUILDER package to parse the running code into a control flow graph.

3. The method according to claim 1, characterized in that, For the merged control flow graph, nodes, edges, and the opcodes corresponding to those nodes are mapped to digital vectors, including: The nodes and edges in the merged control flow graph are mapped to node vectors and edge vectors using the Node2Vec tool. After mapping the opcodes within nodes in the merged control flow graph to numerical vectors using the FastText tool, summation and normalization are performed to obtain the node semantic vectors.

4. The method according to claim 1, characterized in that, The machine learning algorithms include one or more of the following: random forest algorithm, decision tree algorithm, Naive Bayes algorithm, support vector machine algorithm, and linear classification algorithm.

5. A smart contract reentrancy vulnerability detection system based on control flow graph slicing, characterized in that, The system includes: The building block is used to construct the control flow graph of smart contracts; The slicing module is used to slice the control flow graph using transaction-related opcodes as key points, and then merge the sliced ​​control flow graphs; wherein, the transaction-related opcodes include: CALL opcode, CALLCODE opcode, and DELEGATECALL opcode; The detection module is used to generate reentrancy vulnerability detection results for the smart contract based on the merged control flow graph. The step of slicing the control flow graph using transaction-related opcodes as key points includes: Using the control flow graph node containing the CALL opcode as the core node, perform forward and reverse slicing along the directed edges to obtain control flow graph slice A; Using the control flow graph node containing the CALLCODE opcode as the core node, perform forward and reverse slicing along the directed edges to obtain control flow graph slice B; Using the control flow graph node containing the DELEGATECALL opcode as the core node, perform forward and reverse slicing along the directed edges to obtain control flow graph slice C; The process of generating reentrancy vulnerability detection results for the smart contract based on the merged control flow graph includes: For the merged control flow graph, the nodes, edges and the opcodes corresponding to the nodes are mapped to digital vectors to obtain node vectors, edge vectors and node semantic vectors. Integrate node semantic vectors, node vectors, and edge vectors; The fused vector is classified based on the vulnerability detection model to obtain the reentrancy vulnerability detection result of the smart contract; wherein, the vulnerability detection model is constructed based on machine learning algorithm.

6. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the smart contract reentrancy vulnerability detection method based on control flow graph slicing as described in any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the smart contract reentrancy vulnerability detection method based on control flow graph slicing as described in any one of claims 1-5.

Images