Agent-based code access control vulnerability detection method and device

Abstract

The invention discloses an Agent-based code access control vulnerability detection method and device, and the method comprises the steps: selecting all functions, which relate to state modification and can be called by the outside, in a target smart contract based on an Astro framework; screening out a plurality of smart contracts which are closest to the logic characteristics and access control of the target smart contract from a retrieval database of the audit contracts; and jointly inputting the target smart contract and a plurality of smart contracts closest to the target smart contract logic features and access control implementation into a large language model to detect whether the target smart contract has access control vulnerabilities. The technical problems that the validity of an existing tool for detecting the access control vulnerability in the smart contract is influenced by a predefined access control mode and key operation universality limitation, and the application scene is limited by historical transaction data are solved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to an agent-based code access control vulnerability detection method and device. Background Art

[0002] Smart contracts are programs that run on blockchains and are suitable for a variety of application scenarios, such as decentralized finance, lottery games, and non-fungible tokens. Due to the decentralized nature of blockchains, anyone can interact with deployed smart contracts. To address this, developers implement access control policies within smart contracts by setting function visibility or introducing conditional checks. Access control is considered a mechanism that restricts whether specific users can interact with certain functions. Improper access control policy design or implementation can lead to security vulnerabilities. For example, critical operations within smart contracts, such as contract destruction, permission modifications, and critical configuration changes, are typically restricted to the contract owner. To manage these operations, developers create and enforce access control policies. However, if the implemented code deviates from the intended design, access control vulnerabilities can occur. Attackers can exploit these vulnerabilities to gain unauthorized access and potentially even obtain additional assets.

[0003] While some existing tools can be used to detect access control vulnerabilities in smart contracts, their inherent nature, coupled with the complexity and diversity of smart contracts, leads to certain limitations. For example, their effectiveness is limited by the availability of predefined access control patterns and key operations, and their application scenarios are constrained by historical transaction data. Overcoming these limitations presents a pressing technical challenge for those skilled in the art. Summary of the Invention

[0004] The present invention provides an agent-based code access control vulnerability detection method and device, which are used to solve the technical problems that the effectiveness of existing tools for detecting access control vulnerabilities in smart contracts is affected by the limitations of predefined access control modes and the universality of key operations, and the application scenarios are limited by historical transaction data.

[0005] In view of this, a first aspect of the present invention provides an agent-based code access control vulnerability detection method, comprising:

[0006] Based on the Astro framework, select all functions in the target smart contract that involve state modification and can be called externally;

[0007] Select a function from the audited database that has the same name and parameters as the selected function in the target smart contract;

[0008] Based on the Astro framework, generate attribute control flow graphs for all selected functions;

[0009] Based on the agent, the attribute control flow graph is converted into a semantic vector to build a retrieval database for audit contracts;

[0010] Based on semantic similarity, several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation are selected from the audit contract retrieval database;

[0011] The target smart contract and several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation are input into the large language model.

[0012] Determine whether the target smart contract has access control vulnerabilities based on the output results of the large language model.

[0013] Optionally, based on the Astro framework, generate attribute control flow graphs for all selected functions, including:

[0014] Generate interprocedural control flow graphs for all selected functions;

[0015] Prune irrelevant nodes in the inter-procedural control flow graph based on the Astro framework;

[0016] Standardize various access control statements and modifiers for interprocedural control flow graphs;

[0017] The inter-procedural control flow graph is converted into an attributed control flow graph used by the similarity detection algorithm.

[0018] Optionally, a pruning strategy for pruning irrelevant nodes in an inter-procedural control flow graph based on the Astro framework is:

[0019] Prune out functions used for safe mathematical calculations;

[0020] Prune Solidity's event mechanism;

[0021] Trim away modifiers that do not involve state variable modification and control statements.

[0022] Optionally, based on the agent, the attribute control flow graph is converted into a semantic vector to build a retrieval database for audit contracts, including:

[0023] The Astro framework calls the LlamaIndex framework and uses a deep encoder to convert attribute control flow graphs that satisfy a similarity greater than a threshold into high-dimensional semantic vectors, which are stored in the retrieval database of the audit contract.

[0024] Optionally, based on semantic similarity, several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation are selected from the audit contract retrieval database, including:

[0025] Based on the Astro framework, a preliminary similarity comparison is performed between each target function in the target smart contract and the corresponding function selected from the retrieval database of audit contracts;

[0026] Based on the results of the preliminary similarity comparison, IFNG is added at the identified differences to modify the target function and generate an updated function version;

[0027] Compare the updated function version with the corresponding function selected from the retrieval database of the audit contract to obtain a similarity comparison result;

[0028] Filter out several smart contracts with the greatest similarity from the similarity comparison results.

[0029] A second aspect of the present invention provides an agent-based code access control vulnerability detection device, comprising:

[0030] The first selection module is used to select all functions in the target smart contract that involve state modification and can be called externally based on the Astro framework;

[0031] A second selection module is used to select a function from the audited database that has the same name and parameters as the selected function in the target smart contract;

[0032] Graph generation module, used to generate attribute control flow graphs for all selected functions based on the Astro framework;

[0033] The semantic conversion module is used to convert the attribute control flow graph into a semantic vector based on the agent and build a retrieval database for audit contracts;

[0034] The third selection module is used to screen out several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation from the audit contract retrieval database based on semantic similarity;

[0035] The input module is used to input the target smart contract and several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation into the large language model;

[0036] The result output module is used to determine whether the target smart contract has access control vulnerabilities based on the output results of the large language model.

[0037] Optionally, the graph generation module is specifically used to:

[0038] Generate interprocedural control flow graphs for all selected functions;

[0039] Prune irrelevant nodes in the inter-procedural control flow graph based on the Astro framework;

[0040] Standardize various access control statements and modifiers for interprocedural control flow graphs;

[0041] The inter-procedural control flow graph is converted into an attributed control flow graph used by the similarity detection algorithm.

[0042] Optionally, a pruning strategy for pruning irrelevant nodes in an inter-procedural control flow graph based on the Astro framework is:

[0043] Prune out functions used for safe mathematical calculations;

[0044] Prune Solidity's event mechanism;

[0045] Trim away modifiers that do not involve state variable modification and control statements.

[0046] Optionally, the semantic conversion module is specifically used to:

[0047] The Astro framework calls the LlamaIndex framework and uses a deep encoder to convert attribute control flow graphs that satisfy a similarity greater than a threshold into high-dimensional semantic vectors, which are stored in the retrieval database of the audit contract.

[0048] Optionally, the third selection module is specifically configured to:

[0049] Based on the Astro framework, a preliminary similarity comparison is performed between each target function in the target smart contract and the corresponding function selected from the retrieval database of audit contracts;

[0050] Based on the results of the preliminary similarity comparison, IFNG is added at the identified differences to modify the target function and generate an updated function version;

[0051] Compare the updated function version with the corresponding function selected from the retrieval database of the audit contract to obtain a similarity comparison result;

[0052] Filter out several smart contracts with the greatest similarity from the similarity comparison results.

[0053] From the above technical solutions, it can be seen that the agent-based code access control vulnerability detection method provided by the present invention has the following advantages:

[0054] The agent-based code access control vulnerability detection method provided by the present invention selects all functions in the target smart contract that involve state modification and can be called externally based on the Astro framework, and screens out several smart contracts that are closest to the target smart contract's logical characteristics and access control implementation from the retrieval database of the audit contract based on semantic similarity. The target smart contract and several smart contracts that are closest to the target smart contract's logical characteristics and access control implementation are input into a large language model to detect whether the target smart contract has access control vulnerabilities. This method effectively eliminates the differences caused by language characteristics and coding style characteristics, does not need to rely on limited predefined patterns, and achieves high coverage detection of smart contract functions. It solves the technical problems that the effectiveness of existing tools for detecting access control vulnerabilities in smart contracts is affected by the limitations of predefined access control patterns and the versatility of key operations, and the application scenarios are limited by historical transaction data. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0056] Figure 1 A schematic diagram of a flow chart of an agent-based code access control vulnerability detection method provided in an embodiment of the present invention;

[0057] Figure 2 This is an example diagram of event pruning in the TransferOwnership function provided in an embodiment of the present invention;

[0058] Figure 3 The figure is a schematic diagram of the structure of an agent-based code access control vulnerability detection device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0060] For easier understanding, see Figure 1The present invention provides an embodiment of an agent-based code access control vulnerability detection method, comprising:

[0061] Step 101: Based on the Astro framework, select all functions in the target smart contract that involve state modification and can be called externally.

[0062] It should be noted that the Astro framework identifies all functions in the target smart contract that involve state modification and can be called externally, denoted as , T is the number of externally callable functions in the target smart contract that modify state. Regarding function visibility, the Astro framework focuses on externally callable functions, particularly those marked "public" or "external." Functions marked "private" or "internal" are not directly accessible from outside the contract, so internal access control vulnerabilities could still be exploited through externally callable functions they call. Regarding state mutability (a keyword in Solidity used to specify function state mutability, which determines whether a function reads or modifies the blockchain state during execution), only functions that modify state variables are considered. In Ethereum-compatible smart contract platforms, only functions that modify state variables pose a potential risk of access control vulnerabilities. Functions marked "view" or "pure" do not modify state variables and are therefore not considered.

[0063] Step 102: Select a function from the audited database that has the same name and parameters as the selected function in the target smart contract.

[0064] It's important to note that the Audited Contract Database (hereinafter referred to as the "Audited Database") is a dataset compiled from publicly audited smart contracts by blockchain security companies or relevant communities. These contracts have undergone thorough inspection and remediation by professional teams and generally demonstrate high security and reliability. This database not only contains contract code and vulnerability fix records, but also summarizes common vulnerability patterns and best practices, providing a valuable reference for developers and auditors, helping them quickly identify potential issues in new contracts and improve overall code quality.

[0065] After selecting the function to be checked in the target smart contract, the Astro framework then identifies the appropriate comparison function from the audited database for each specific function. The corresponding contrast function is expressed as (in, , , T is the number of functions in the target smart contract that involve state modification and can be called externally, and N is the number of functions in the audited database that can be compared with the target function). In this process, priority is given to Functions with the same name and parameters. Function name and parameters were selected as screening criteria because functions with similar functionality typically have consistent naming. As a development platform, blockchain aims to improve user understanding and ease of use, so callable functions with similar functionality typically follow consistent naming conventions. Furthermore, many smart contracts adhere to EIP (Ethereum Improvement Proposal) and ERC (Ethereum Request for Comment) standards, which also emphasize consistent naming. Identical function parameters require identical function implementations; therefore, when function names are consistent, their parameters must also be identical. Different function parameters represent different inputs, which can lead to discrepancies in function implementation and evaluation.

[0066] Step 103: Generate attribute control flow graphs for all selected functions based on the Astro framework.

[0067] It should be noted that the Astro framework analyzes and processes contracts at the contract granularity, generating an Attributed Control Flow Graph (ACFG) for all selected functions. This process begins with pruning and normalizing the interprocedural control-flow graph (ICFG), ultimately constructing the ACFG and integrating node information from the abstract syntax tree (AST) into the ACFG. By selecting standard functions with identical names and parameters, business logic consistency is ensured, avoiding situations where state variable modifications have identical behavior but different required access controls. During this phase, ICFG pruning removes the impact of irrelevant functions and statements, while ICFG normalization eliminates inconsistencies caused by differences in control statements and different implementations of the same access control checks, which can affect the accuracy of similarity matching. The Astro framework first generates an interprocedural control flow graph (ICFG) for all selected functions. It then prunes irrelevant nodes from the ICFG, normalizes the various access control statements and modifiers within the ICFG, and transforms the ICFG into an attributed control flow graph for use in similarity detection algorithms.

[0068] Specifically, the Astro framework removes statements unrelated to access control to improve the accuracy of similarity assessments. In smart contracts, certain statements do not affect the logic of a function and are not necessarily consistent across similar functions. Therefore, these statements may affect the results of access control analysis and should be removed. Examples of such statements include safe mathematical calculations to prevent integer overflow and underflow vulnerabilities, as well as Solidity's event mechanism, which enhances transparency and facilitates retrieval of key operations.

[0069] The Astro framework removes these types of statements based on the following criteria: When detecting access control vulnerabilities, modifications to critical state variables and conditional statements in the code are key targets. However, identifying all critical state variables can be challenging, or even impossible. Therefore, when performing ICFG pruning, the Astro framework primarily focuses on determining which statements are not relevant to access control. However, while temporary variables used for calculations may appear unrelated to access control, they are critical elements in representing function logic and should not be removed. Specifically, the pruning strategy defined in this embodiment of the present invention is to: prune functions used for safe mathematical calculations, prune Solidity's event mechanism, and prune modifiers that do not involve state variable modifications and control statements. Functions used for safe mathematical calculations effectively prevent integer underflow and overflow vulnerabilities. However, the use of these safe mathematical functions is unrelated to access control, and implementation differences (such as usage and syntax) may affect similarity judgments. Secondly, Solidity's event mechanism enhances transparency and facilitates the retrieval of key operations on the blockchain, but it is unrelated to access control. Finally, modifiers that do not involve state variable modification and control statements can be used for purposes such as logging, which are not related to access control. The reason for retaining functions that do not involve state variable modification and control statements is that they may contain important logic, similar to the role of temporary variables. The pruning process is: first locate the graph nodes that meet the pruning criteria and delete them, and then determine whether the nodes before and after the deleted nodes should be merged or reconnected. The decision to merge or reconnect is based on the goal of aligning the ICFG of the pruned function with the version that does not contain the pruned nodes. The merging and reconnecting of nodes is crucial to ensure consistency. As Figure 2 As shown, the present invention provides an example of event pruning in the TransferOwnership function. Figure 2 This figure shows the pruning process of the TransferOwnership function. The Astro framework removes the event node OwnershipTransferred(_owner, newOwner) and obtains an ICFG that only contains state variable modifications and control statements.

[0070] Control statements in smart contracts can take various forms, and the same access control check can be implemented in different ways, which can hinder similarity matching. This paper proposes two normalization techniques to unify the ICFG nodes of functions as much as possible: function-level normalization and statement-level normalization.

[0071] Function-level normalization. Nested function calls and modifier calls significantly impact the detection performance of the Astro framework, necessitating normalization. These nested calls and modifier calls increase the number of function nodes and complicate the ICFG structure, thereby increasing the complexity of cross-procedural analysis. This complexity negatively impacts the detection capabilities of the Astro framework. To mitigate this issue, the Astro framework employs ICFG-based function inlining technology for all called functions and modifiers. The Astro framework achieves inlining by removing function call points and embedding the valid nodes of the called function into the calling function. In other words, the function entry point, parameter map, and return value map of the called function are not added to the calling function's ICFG. Specifically, since the return statement of the called function assigns a value to the original function and the calling function already has an assignment statement, the return statement of the called function is also removed. It is worth noting that when performing ICFG-based function inlining on modifiers, the "_" symbol in the modifier, indicating the location where the function should be inserted, is also removed.

[0072] Normalization at the statement level: Smart contracts contain multiple types of control statements, which need to be normalized to ensure consistency at the ICFG level. However, at the ICFG level, their similarity is low, which will have an adverse effect on the results of code similarity analysis. To solve this problem, the Astro framework normalizes all access control statements into "if" statements. The reason for choosing this method is that access control statements in the form of if statements have a unique structure and contain two unique child nodes, which is crucial for distinguishing these statements when performing access control similarity comparisons. In contrast, other types of access control statements are merely function calls, which are not easily identified and distinguished in similarity comparisons. Specifically, the Astro framework locates the nodes related to the control statements that need to be normalized and performs merge / connection operations on them. In the present invention, a node group consisting of an "if" node and its two child nodes is called an "if node group" (if-form nodegroup, IFNG).

[0073] The Astro framework constructs a fusion graph structure called ACFG, in which the information of AST nodes is embedded in ICFG nodes. This ACFG combines the structural advantages of ICFG variants with the semantic advantages of AST function representation. In ACFG, the syntactic features of nodes are integrated into basic blocks. Most node features come from Slither, a widely used static analysis framework for Solidity smart contract auditing built on Python 3. To clearly handle the revert() function, which is a child of the if node, the Astro framework customizes a dedicated node to represent this expression. This approach ensures that the child nodes of the if node are distinguishable from other types of statements, thereby improving the clarity of the features. As a result, this enables more accurate matching of different IFNGs in code similarity comparison algorithms.

[0074] Step 104: Based on the agent, the attribute control flow graph is converted into a semantic vector to build a retrieval database for the audit contract.

[0075] It's important to note that to accurately assess whether a target function and its counterpart in the audit database require the same access control mechanisms, the Astro framework employs a two-step code similarity comparison process based on RAG (Retrieval-augmented Generation) and Agent (Intelligent Agent). This approach first compares the similarity between the target function and its counterpart to identify structural differences. Then, after adding IFNG to the target function, the target function is re-evaluated to determine whether the additional access control resolves the identified differences. By using this dual comparison approach, the Astro framework is able to more effectively determine whether access control differences exist between the target function and its counterpart.

[0076] Intelligent agents are intelligent systems specifically designed to independently perform tasks and make decisions within a computing environment. Unlike traditional auxiliary tools, AI agents not only respond to user commands but also act autonomously in specific tasks, possessing the ability to independently think, make decisions, and execute. By integrating large-scale pre-trained language models with efficient information retrieval mechanisms, these agents can implement multi-step task processing for predetermined goals, ranging from simple question-and-answer to complex business process automation. Systems such as LangChain and LlamaIndex significantly simplify data interaction and information integration between large models and external knowledge bases by providing comprehensive tool chains and interfaces. LangChain is committed to building a scalable application framework that enables developers to efficiently construct complex dialogue systems and task processing pipelines; while LlamaIndex focuses on knowledge preprocessing, index construction, and efficient retrieval, helping to build applications based on the combination of retrieval-enhanced generation and intelligent agents.

[0077] First, the Astro framework performs a with the corresponding function selected from the audited database Perform a preliminary similarity comparison. This comparison uses a bidirectional graph matching algorithm to generate a similarity score. , these scores serve as a benchmark for identifying structural differences between functions. Through pruning and normalization, the Astro framework ensures that the target function that lacks an access control mechanism has at least one missing IFNG with the corresponding function. Based on the preliminary results, the Astro framework modifies the target function by adding IFNG at the identified difference points, thereby generating an updated function version, denoted as Then, a second comparison is performed, and Compare and get similarity results .

[0078] When the similarity result or When the threshold α is exceeded, it means or Should have the same access controls as functions in the audit database. If Less than , then the target function needs access control; otherwise, it does not.

[0079] The Astro framework first utilizes the LlamaIndex framework to convert ACFG into high-dimensional semantic vectors through a deep encoder. This conversion not only preserves the structural characteristics of the code but also captures fine-grained semantics related to access control, such as key variables, permission checks, and conditional judgments. Contracts in the audit library that meet a similarity greater than α will be stored in the retrieval database. It is worth noting that only ACFG versions with a similarity greater than α will be converted into high-dimensional semantic vectors and stored in the audit contract retrieval database. The audit contract retrieval database relies on efficient vector indexing technologies (such as approximate nearest neighbor search algorithms such as FAISS) to achieve rapid retrieval within large-scale datasets, providing accurate and quantifiable basic data for subsequent comparisons based on semantic similarity.

[0080] Step 105: Based on semantic similarity, select several smart contracts from the audit contract retrieval database that are closest to the target smart contract in terms of logical features and access control implementation.

[0081] It should be noted that the ACFG construction and semantic vector conversion are also performed for the target smart contract to be tested. The resulting target contract vector is used as the query condition, and the semantic similarity between the target smart contract and each contract in the audit contract retrieval database is calculated (usually using indicators such as semantic similarity) in the pre-built audit contract retrieval database. By comparing the similarity of the semantic vectors, the top-k contracts that most closely match the logical features and access control implementation of the target smart contract are selected. These contracts are considered representative in terms of security design and serve as reference templates for subsequent comparisons. This step ensures that only templates that highly match the target contract at the semantic level are selected, thereby improving the relevance and accuracy of subsequent analysis.

[0082] Step 106: The target smart contract and several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation are input into the large language model.

[0083] It should be noted that a large language model is a type of language model consisting of an artificial neural network with a large number of parameters (usually billions of weights or more), which is trained on a large amount of unlabeled text using self-supervised learning or semi-supervised learning.

[0084] After completing the contract search, the target smart contract and the selected top-k searched contracts are simultaneously fed into the Astro framework's large language model. Using RAG and Agent technology, the large language model deeply analyzes each contract's access control logic, including key elements such as conditionals, permission checks, and function calls. The large language model performs a comprehensive comparative analysis of the input multi-contract information, identifying subtle differences between the target contract and the reference template. It then uses contextual semantics to determine whether there are any code access control vulnerabilities caused by missing or improperly implemented code.

[0085] Step 107: Determine whether the target smart contract has an access control vulnerability based on the output result of the large language model.

[0086] It should be noted that after the large language model conducts a comprehensive comparative analysis of the input multi-contract information, it determines whether there are code access control vulnerabilities caused by missing or improper implementation, that is, it determines whether the target smart contract has an access control vulnerability, so as to provide corresponding risk assessment and rectification suggestions for the target smart contract with access control vulnerabilities.

[0087] The agent-based code access control vulnerability detection method provided by the present invention selects all functions in the target smart contract that involve state modification and can be called externally based on the Astro framework, and screens out several smart contracts that are closest to the target smart contract's logical characteristics and access control implementation from the retrieval database of the audit contract based on semantic similarity. The target smart contract and several smart contracts that are closest to the target smart contract's logical characteristics and access control implementation are input into a large language model to detect whether the target smart contract has access control vulnerabilities. This method effectively eliminates the differences caused by language characteristics and coding style characteristics, does not need to rely on limited predefined patterns, and achieves high coverage detection of smart contract functions. It solves the technical problems that the effectiveness of existing tools for detecting access control vulnerabilities in smart contracts is affected by the limitations of predefined access control patterns and the versatility of key operations, and the application scenarios are limited by historical transaction data.

[0088] At the same time, the present invention avoids the tedious manual labor of manually verifying and summarizing the access control policies of smart contracts by comparing the target smart contract with the smart contracts in the retrieval database of the audit contract, thereby reducing labor costs and time consumption.

[0089] For easier understanding, see Figure 3 The present invention provides an embodiment of an agent-based code access control vulnerability detection device, comprising:

[0090] The first selection module is used to select all functions in the target smart contract that involve state modification and can be called externally based on the Astro framework;

[0091] A second selection module is used to select a function from the audited database that has the same name and parameters as the selected function in the target smart contract;

[0092] Graph generation module, used to generate attribute control flow graphs for all selected functions based on the Astro framework;

[0093] The semantic conversion module is used to convert the attribute control flow graph into a semantic vector based on the agent and build a retrieval database for audit contracts;

[0094] The third selection module is used to screen out several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation from the audit contract retrieval database based on semantic similarity;

[0095] The input module is used to input the target smart contract and several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation into the large language model;

[0096] The result output module is used to determine whether the target smart contract has access control vulnerabilities based on the output results of the large language model.

[0097] In one embodiment, the graph generation module is specifically configured to:

[0098] Generate interprocedural control flow graphs for all selected functions;

[0099] Prune irrelevant nodes in the inter-procedural control flow graph based on the Astro framework;

[0100] Standardize various access control statements and modifiers for interprocedural control flow graphs;

[0101] The inter-procedural control flow graph is converted into an attributed control flow graph used by the similarity detection algorithm.

[0102] In one embodiment, the pruning strategy for pruning irrelevant nodes in the inter-procedural control flow graph based on the Astro framework is:

[0103] Prune out functions used for safe mathematical calculations;

[0104] Prune Solidity's event mechanism;

[0105] Trim away modifiers that do not involve state variable modification and control statements.

[0106] In one embodiment, the semantic conversion module is specifically used to:

[0107] The Astro framework calls the LlamaIndex framework and uses a deep encoder to convert attribute control flow graphs that satisfy a similarity greater than a threshold into high-dimensional semantic vectors, which are stored in the retrieval database of the audit contract.

[0108] In one embodiment, the third selection module is specifically configured to:

[0109] Based on the Astro framework, a preliminary similarity comparison is performed between each target function in the target smart contract and the corresponding function selected from the retrieval database of audit contracts;

[0110] Based on the results of the preliminary similarity comparison, IFNG is added at the identified differences to modify the target function and generate an updated function version;

[0111] Compare the updated function version with the corresponding function selected from the retrieval database of the audit contract to obtain a similarity comparison result;

[0112] Filter out several smart contracts with the greatest similarity from the similarity comparison results.

[0113] The Agent-based code access control vulnerability detection device provided in the present invention is used to execute the Agent-based code access control vulnerability detection method provided in the present invention. Its principles and technical effects are the same as those of the Agent-based code access control vulnerability detection method provided in the present invention, and will not be repeated here.

[0114] The terms "first," "second," "third," and the like in the present invention are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present invention described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having," as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products, or apparatus.

[0115] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An Agent-based code access control vulnerability detection method, characterized in that: include: Based on the Astro framework, select all functions in the target smart contract that involve state modification and can be called externally; Select a function from the audited database that has the same name and parameters as the selected function in the target smart contract; Based on the Astro framework, generate attribute control flow graphs for all selected functions; Based on the agent, the attribute control flow graph is converted into a semantic vector to build a retrieval database for audit contracts; Based on semantic similarity, several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation are selected from the audit contract retrieval database; The target smart contract and several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation are input into the large language model. Determine whether the target smart contract has access control vulnerabilities based on the output results of the large language model.

2. The Agent-based code access control vulnerability detection method according to claim 1 is characterized in that: Based on the Astro framework, a property control flow graph is generated for all selected functions, including: Generate interprocedural control flow graphs for all selected functions; Prune irrelevant nodes in the inter-procedural control flow graph based on the Astro framework; Standardize various access control statements and modifiers for interprocedural control flow graphs; The inter-procedural control flow graph is converted into an attributed control flow graph used by the similarity detection algorithm.

3. The Agent-based code access control vulnerability detection method according to claim 2, characterized in that: The pruning strategy for irrelevant nodes in the inter-procedural control flow graph based on the Astro framework is: Prune out functions used for safe mathematical calculations; Prune Solidity's event mechanism; Trim away modifiers that do not involve state variable modification and control statements.

4. The method for detecting code access control vulnerabilities based on an agent according to claim 2, characterized in that: Based on the agent, the attribute control flow graph is converted into a semantic vector and a retrieval database for audit contracts is constructed, including: The Astro framework calls the LlamaIndex framework and uses a deep encoder to convert attribute control flow graphs that satisfy a similarity greater than a threshold into high-dimensional semantic vectors, which are stored in the retrieval database of the audit contract.

5. The method for detecting code access control vulnerabilities based on an agent according to claim 1, wherein: Based on semantic similarity, several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation are selected from the audit contract retrieval database, including: Based on the Astro framework, a preliminary similarity comparison is performed between each target function in the target smart contract and the corresponding function selected from the retrieval database of audit contracts; Based on the results of the preliminary similarity comparison, IFNG is added at the identified differences to modify the target function and generate an updated function version; Compare the updated function version with the corresponding function selected from the retrieval database of the audit contract to obtain a similarity comparison result; Filter out several smart contracts with the greatest similarity from the similarity comparison results.

6. An Agent-based code access control vulnerability detection device, characterized in that: include: The first selection module is used to select all functions in the target smart contract that involve state modification and can be called externally based on the Astro framework; A second selection module is used to select a function from the audited database that has the same name and parameters as the selected function in the target smart contract; Graph generation module, used to generate attribute control flow graphs for all selected functions based on the Astro framework; The semantic conversion module is used to convert the attribute control flow graph into a semantic vector based on the agent and build a retrieval database for audit contracts; The third selection module is used to screen out several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation from the audit contract retrieval database based on semantic similarity; The input module is used to input the target smart contract and several smart contracts that are closest to the target smart contract in terms of logical features and access control implementation into the large language model; The result output module is used to determine whether the target smart contract has access control vulnerabilities based on the output results of the large language model.

7. The Agent-based code access control vulnerability detection device according to claim 6, characterized in that: The graph generation module is specifically used for: Generate interprocedural control flow graphs for all selected functions; Prune irrelevant nodes in the inter-procedural control flow graph based on the Astro framework; Standardize various access control statements and modifiers for interprocedural control flow graphs; The inter-procedural control flow graph is converted into an attributed control flow graph used by the similarity detection algorithm.

8. The Agent-based code access control vulnerability detection device according to claim 7, characterized in that: The pruning strategy for irrelevant nodes in the inter-procedural control flow graph based on the Astro framework is: Prune out functions used for safe mathematical calculations; Prune Solidity's event mechanism; Trim away modifiers that do not involve state variable modification and control statements.

9. The Agent-based code access control vulnerability detection device according to claim 7, characterized in that: The semantic conversion module is specifically used for: The Astro framework calls the LlamaIndex framework and uses a deep encoder to convert attribute control flow graphs that satisfy a similarity greater than a threshold into high-dimensional semantic vectors, which are stored in the retrieval database of the audit contract.

10. The device for detecting code access control vulnerabilities based on an agent according to claim 6, characterized in that: The third selection module is specifically used for: Based on the Astro framework, a preliminary similarity comparison is performed between each target function in the target smart contract and the corresponding function selected from the retrieval database of audit contracts; Based on the results of the preliminary similarity comparison, IFNG is added at the identified differences to modify the target function and generate an updated function version; Compare the updated function version with the corresponding function selected from the retrieval database of the audit contract to obtain a similarity comparison result; Filter out several smart contracts with the greatest similarity from the similarity comparison results.

Images