Distributed oracle machine intelligent contract security detection method based on abstract syntax tree

Abstract

The invention discloses a distributed oracle machine intelligent contract security detection method based on an abstract syntax tree, and relates to the technical field of block chain intelligent contract security detection, and the method comprises the steps: obtaining a source code, converting the source code into a Token stream, and carrying out the syntactic analysis processing of the Token stream, and obtaining the abstract syntax tree; traversing the abstract syntax tree, identifying node types and executing flow analysis processing to obtain a relation graph; and according to the relation graph, executing pattern matching detection processing through a distributed oracle machine security detection rule base to obtain a vulnerability detection result. According to the method, accurate detection and positioning of specific scene vulnerabilities such as data input verification, authority control and exception handling in the intelligent contract of the distributed oracle machine can be realized, and cross-platform compatibility and detection efficiency are improved.

Description

Technical Field

[0001] This invention relates to the field of blockchain smart contract security testing technology, and in particular to a distributed oracle smart contract security testing method based on abstract syntax trees. Background Technology

[0002] With the deepening application of blockchain technology, the deployment scale of smart contracts in distributed oracle scenarios continues to expand. Distributed oracle smart contracts need to interact frequently with off-chain data sources, which faces multiple security challenges, including data integrity verification, data source legitimacy verification, oracle node permission control, and the lack of anomaly handling mechanisms. In existing technologies, smart contract vulnerability detection mainly relies on methods such as dynamic analysis, symbolic execution, and fuzzing.

[0003] However, there are significant shortcomings in the specific scenarios of distributed oracle smart contracts. Firstly, traditional static analysis tools have platform compatibility limitations. For example, Ethereum Virtual Machine bytecode analysis tools rely on the underlying bytecode instruction set and cannot directly parse enterprise operating system smart contracts written in C or C++. Their ability to reconstruct complex syntactic features such as template metaprogramming and multiple inheritance is insufficient, leading to the loss of high-level language semantic information. Secondly, distributed oracles lack specific vulnerability detection capabilities. They lack data source signature verification rules for the oracle data input verification process, whitelist calling rules for the oracle node permission management mechanism, and timeout retry and error code completeness rules for the data anomaly handling process. This results in a high rate of false negatives for typical vulnerabilities such as data source forgery, node permission abuse, and unprocessed data timeouts. Thirdly, the accuracy of code structure analysis is insufficient. Existing tools do not fully utilize the hierarchical parsing capabilities of abstract syntax trees for function call relationships, control flow transfers, and data flow propagation. It is difficult to identify deep logic vulnerabilities such as hidden unauthorized function calls and cross-process data type overflows in nested call chains, making it difficult to meet the deep security audit requirements before deploying distributed oracle smart contracts.

[0004] In summary, existing smart contract security detection technologies suffer from insufficient data input verification, access control vulnerabilities, and anomaly handling deficiencies in distributed oracle scenarios. There is an urgent need for a static analysis method based on source code structure parsing to achieve accurate parsing and vulnerability detection of smart contracts, ensuring the security and reliability of distributed oracles during data acquisition, processing, and execution, and avoiding risks such as asset loss and data tampering caused by vulnerabilities. Summary of the Invention

[0005] The technical problem this invention aims to solve is to address the shortcomings of existing technologies, specifically the insufficient detection capabilities of smart contract security testing in distributed oracle scenarios for specific vulnerabilities such as data input verification, access control, and anomaly handling. Specifically, this invention provides a distributed oracle smart contract security testing method based on abstract syntax trees, as detailed below: 1) In a first aspect, the present invention provides a method for security detection of distributed oracle smart contracts based on abstract syntax trees, the specific technical solution of which is as follows: S1, Obtain the source code, convert the source code into a Token stream, perform syntax analysis on the Token stream, and obtain an abstract syntax tree; S2, traverse the abstract syntax tree, identify node types and perform flow analysis to obtain the relation graph; S3. Based on the relationship graph, perform pattern matching detection processing through the distributed oracle security detection rule base to obtain vulnerability detection results.

[0006] The beneficial effects of the distributed oracle smart contract security detection method based on abstract syntax trees provided by this invention are as follows: By acquiring source code and converting it into a token stream for syntax analysis, an abstract syntax tree (AST) is directly generated from the source code. This eliminates the need for a specific virtual machine bytecode format and supports blockchain platforms using smart contracts written in C or C++, overcoming the limitation of traditional tools that are only applicable to the Ethereum Virtual Machine (EVM). By traversing the AST and performing stream analysis, a relationship graph is obtained. Leveraging the AST's ability to preserve the source code's syntactic structure and logical hierarchy, it can more accurately identify function call relationships, control flow transfers, and data propagation paths compared to bytecode-based analysis methods, reducing the false negative rate of deep logic vulnerabilities. Through distributed oracle security detection rule base execution pattern matching, detection rules can cover specific business scenarios of distributed oracles, such as data input verification, access control, and exception handling, filling the gap in existing technologies for detecting specific vulnerabilities in oracle data interaction and node permission mechanisms. By converting source code into a token stream and generating an AST, combined with stream analysis and rule base pattern matching, an automated detection process is achieved. Compared to dynamic analysis, this eliminates the need to execute contract code, reducing resource consumption. By outputting vulnerability detection results, structured data support is provided for quickly locating vulnerable code and generating remediation guidance, improving overall detection and remediation efficiency.

[0007] Based on the above solution, the present invention can be further improved as follows.

[0008] Furthermore, the node types include: function declaration nodes, variable definition nodes, function call nodes, condition judgment nodes, loop control nodes, return statement nodes, and expression nodes; The flow analysis processing includes control flow tracing processing and data flow tracing processing; the control flow tracing processing is used to identify the branching and merging relationships of the program execution path; the data flow tracing processing is used to identify the flow changes of variable values ​​during assignment, transmission, and calculation, as well as the parameter transmission and return value transmission chains across process calls.

[0009] Furthermore, the distributed oracle security detection rule base includes: Data input validation detection rules, access control detection rules, and anomaly handling detection rules.

[0010] Furthermore, the data input verification and detection rules include: matching the signature verification function name pattern to detect the existence of the data source signature verification function, and matching the input data range verification expression to detect the data format legality verification logic; The access control detection rules include: matching the whitelist mapping table definition pattern to detect the oracle node address whitelist mechanism, and matching the permission modifier declaration to detect the compliance of function call permission modification. The anomaly handling detection rules include: matching the combination pattern of timeout judgment and retry logic to detect the data timeout retry mechanism, and matching the completeness of error codes to detect the completeness of error code definitions.

[0011] 2) In a second aspect, the present invention also provides a distributed oracle smart contract security detection system based on abstract syntax trees, the specific technical solution of which includes: a parsing module, a traversal module and a detection module; The parsing module is used to obtain source code, convert the source code into a token stream, perform syntax analysis on the token stream, and obtain an abstract syntax tree. The traversal module is used to traverse the abstract syntax tree, identify node types, and perform flow analysis processing to obtain a relation graph; The detection module is used to perform pattern matching detection processing based on the relationship graph and a distributed oracle security detection rule base to obtain vulnerability detection results.

[0012] Based on the above solution, the present invention can be further improved as follows.

[0013] Furthermore, the node types include: function declaration nodes, variable definition nodes, function call nodes, condition judgment nodes, loop control nodes, return statement nodes, and expression nodes; The flow analysis processing includes control flow tracing processing and data flow tracing processing; the control flow tracing processing is used to identify the branching and merging relationships of the program execution path; the data flow tracing processing is used to identify the flow changes of variable values ​​during assignment, transmission, and calculation, as well as the parameter transmission and return value transmission chains across process calls.

[0014] Furthermore, the distributed oracle security detection rule base includes: Data input validation detection rules, access control detection rules, and anomaly handling detection rules.

[0015] Furthermore, the data input verification and detection rules include: matching the signature verification function name pattern to detect the existence of the data source signature verification function, and matching the input data range verification expression to detect the data format legality verification logic; The access control detection rules include: matching the whitelist mapping table definition pattern to detect the oracle node address whitelist mechanism, and matching the permission modifier declaration to detect the compliance of function call permission modification. The anomaly handling detection rules include: matching the combination pattern of timeout judgment and retry logic to detect the data timeout retry mechanism, and matching the completeness of error codes to detect the completeness of error code definitions.

[0016] 3) In a third aspect, the present invention also provides a computer device, the computer device including a processor coupled to a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to enable the computer device to implement any of the above methods.

[0017] 4) In a fourth aspect, the present invention also provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to enable a computer to perform any of the above methods.

[0018] It should be noted that the beneficial effects of the technical solutions of the second to fourth aspects of the present invention and their corresponding possible implementations can be found in the above description of the technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0019] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating the steps of a distributed oracle smart contract security detection method based on an abstract syntax tree according to an embodiment of the present invention. Figure 2This is a schematic diagram of the abstract tree construction in an embodiment of the distributed oracle smart contract security detection method based on an abstract syntax tree according to an embodiment of the present invention; Figure 3 This is a structural block diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0021] like Figure 1 As shown in the figure, a distributed oracle smart contract security detection method based on abstract syntax trees according to an embodiment of the present invention includes the following steps: S1, obtain the source code, convert the source code into a Token stream, perform syntax analysis on the Token stream, and obtain an abstract syntax tree; S2, traverse the abstract syntax tree, identify node types and perform flow analysis to obtain the relation graph; S3, based on the relationship graph, performs pattern matching detection processing through a distributed oracle security detection rule base to obtain vulnerability detection results.

[0022] The beneficial effects of the distributed oracle smart contract security detection method based on abstract syntax trees provided by this invention are as follows: By acquiring source code and converting it into a token stream for syntax analysis, an abstract syntax tree (AST) is directly generated from the source code. This eliminates the need for a specific virtual machine bytecode format and supports blockchain platforms using smart contracts written in C or C++, overcoming the limitation of traditional tools that are only applicable to the Ethereum Virtual Machine (EVM). By traversing the AST and performing stream analysis, a relationship graph is obtained. Leveraging the AST's ability to preserve the source code's syntactic structure and logical hierarchy, it can more accurately identify function call relationships, control flow transfers, and data propagation paths compared to bytecode-based analysis methods, reducing the false negative rate of deep logic vulnerabilities. Through distributed oracle security detection rule base execution pattern matching, detection rules can cover specific business scenarios of distributed oracles, such as data input verification, access control, and exception handling, filling the gap in existing technologies for detecting specific vulnerabilities in oracle data interaction and node permission mechanisms. By converting source code into a token stream and generating an AST, combined with stream analysis and rule base pattern matching, an automated detection process is achieved. Compared to dynamic analysis, this eliminates the need to execute contract code, reducing resource consumption. By outputting vulnerability detection results, structured data support is provided for quickly locating vulnerable code and generating remediation guidance, improving overall detection and remediation efficiency.

[0023] It should be noted that, for ease of understanding, the technical terms used in this solution will be explained one by one, and will not be repeated hereafter: Source code: refers to human-readable computer program text written in a high-level programming language. In this scheme, it specifically refers to the original program code of the distributed oracle smart contract. It is usually written in C or C++ and includes complete function definitions, variable declarations, logical control structures and data interaction interfaces.

[0024] Token stream: refers to the process of converting a sequence of characters in source code into a sequence of basic units with specific syntactic meaning through lexical analysis. Each token represents elements such as keywords, identifiers, constants, operators, or delimiters in the source code. Token stream preserves the syntactic structure information of the source code but removes whitespace characters and comments.

[0025] Syntax analysis processing: refers to the process of performing structured parsing of the token stream according to the formal grammar rules of the target programming language. By identifying the syntactic relationships between tokens, a hierarchical tree data structure is constructed, and the linear token sequence is converted into an intermediate representation that can reflect the program logic structure.

[0026] Abstract Syntax Tree (AST): A AST transforms the syntactic structure of source code into a tree-like representation. Each node corresponds to a syntactic structure in the source code, ignoring irrelevant symbols but preserving the logical hierarchy and semantic information of the code. ASTs clearly display the syntactic structure and logical relationships of code, providing fine-grained node-level parsing capabilities for static analysis.

[0027] Node type: refers to the identifier classification used in the abstract syntax tree to distinguish different syntactic structure categories, which is divided according to the nature and function of the syntactic elements in the source code.

[0028] Function declaration node: This refers to the node in the abstract syntax tree that represents the starting position of the function definition and the function signature. It contains information such as function name, return type, and parameter list, and is used to identify the entry point of an independent functional unit in the program.

[0029] Variable definition node: This refers to the node in the abstract syntax tree that represents the variable declaration and initialization syntax. It contains variable name, data type, and scope information and is used to identify the data storage unit in the program.

[0030] Function call node: refers to the node in the abstract syntax tree that represents the function call expression. It contains the name of the called function, the actual parameter list, and the call location information, and is used to identify the function call behavior in the program.

[0031] Conditional decision nodes: These are nodes in the abstract syntax tree that represent branching and selection structures such as if statements and switch statements. They contain conditional expressions, true branch paths, and false branch paths, and are used to identify logical decision points in the program.

[0032] Loop control node: refers to the node in the abstract syntax tree that represents repetitive execution structures such as for loop, while loop, do-while loop, etc. It contains loop condition expression and loop body statement block information, and is used to identify the iterative logic in the program.

[0033] Return statement node: This refers to the node in the abstract syntax tree that represents the return statement. It contains return value expression information and is used to identify the end of function execution and the location of the result output.

[0034] Expression nodes: These are nodes in the abstract syntax tree that represent computational operations such as arithmetic operations, logical operations, and assignment operations. They contain operator and operand information and are used to identify numerical calculations and logical operations in the program.

[0035] Stream analysis refers to the comprehensive analysis operation that traces the program execution path and data flow during the traversal of the abstract syntax tree, revealing the behavioral characteristics of the program at runtime by resolving the relationships between nodes. Stream analysis includes control flow tracing and data flow tracing.

[0036] Control flow tracing: refers to the process of analyzing the execution order of statements and the path selection relationship during program execution, identifying the branching and merging relationships of program execution path caused by condition judgment nodes and loop control nodes, and constructing control flow dependencies.

[0037] Data flow tracing processing refers to the process of analyzing the propagation path of variable values ​​during calculation, transmission, and storage in an analysis program, identifying the numerical change trajectory of variables from the definition point to the usage point, as well as the parameter and return value transmission chains across process calls, and constructing data flow dependencies.

[0038] Relationship graph: refers to a data set that reflects the structural characteristics of a program, obtained through flow analysis. It includes control flow dependencies and data flow dependencies. It stores the syntactic structure information of the abstract syntax tree in the form of a set of node features and stores the logical relationship information between program elements in the form of a program dependency graph.

[0039] Path branching and merging relationships: These refer to the topological relationships of program execution flow branching and subsequent re-aggregation caused by conditional judgment structures and loop control structures. Branching relationships indicate that the program selects different execution paths based on the results of conditional judgments, while merging relationships indicate that different execution paths are re-aggregated into a single flow at subsequent statements.

[0040] Flow transition: refers to the complete propagation path of the data value carried by a variable from the initial assignment point, through parameter passing, return value passing, and expression operation, to the final point of use, reflecting the data flow trajectory of the variable within the program's life cycle.

[0041] Cross-procedure call: refers to the process of passing parameter values ​​from the calling point to the called function during a function call.

[0042] The propagation chain refers to the bidirectional data flow propagation link during a function call, where the actual parameter values ​​are passed from the calling point to the formal parameters of the called function, and the return value of the called function is passed back to the calling point after the function has finished executing. It reflects the data interaction relationship between different function scopes.

[0043] Distributed Oracle Security Detection Rule Base: This refers to a predefined set of rules used to identify security vulnerabilities in distributed oracle smart contracts. It includes rules for data input validation, access control, and exception handling. The Distributed Oracle Security Detection Rule Base is used to convert the node feature set obtained from abstract syntax tree traversal and the program dependency graph into vulnerability determination results.

[0044] Data input verification and detection rules: These are a subset of rules used to detect the security of external data input in distributed oracle smart contracts. By checking whether data source signature verification and data format validation logic are included, it is determined whether the contract has the ability to defend against malicious data injection.

[0045] Access control detection rules: These are a subset of rules used to detect the access control mechanism of oracle nodes in distributed oracle smart contracts. By checking whether the oracle node address whitelist and function call permission modifiers are implemented, it is determined whether the contract has the ability to restrict unauthorized node operations.

[0046] Anomaly handling detection rules: These are a subset of rules used to detect the completeness of error handling mechanisms in distributed oracle smart contracts. By checking whether they include data timeout retry logic and complete error code definitions, it is determined whether the contract has the fault tolerance capability to cope with network latency and data retrieval failures.

[0047] Pattern matching and detection processing refers to the process of comparing the relational graph (including node feature sets and program dependency graphs) obtained by traversing the abstract syntax tree with predefined patterns in the distributed oracle security detection rule base. When the node feature set or program dependency graph matches the preset conditions of a rule in the rule base, a security vulnerability is determined to exist in the corresponding code location.

[0048] Vulnerability detection results: refers to the set of structured vulnerability information output by pattern matching detection and processing. Each result record includes a vulnerability type identifier, risk level assessment value, and associated abstract syntax tree node identifier, which are used to generate vulnerability reports and remediation suggestions.

[0049] Signature verification function name pattern: refers to the naming convention pattern predefined in the data input verification detection rules for identifying signature verification function calls. It determines whether the code calls the data source signature verification function by matching the function name string in the function call node.

[0050] Data source signature verification function existence: This refers to whether there is a function call in the distributed oracle smart contract to verify the legality of the digital signature of the external data source. It is used to determine whether the contract has the ability to verify the authenticity of the data source and prevent data forgery attacks.

[0051] Input data range validation expression: refers to the conditional expression pattern used in the data input validation and detection rules to determine whether the input data conforms to the expected format. By matching the judgment logic in the condition judgment node, it verifies whether the contract performs legality checks on the value range, length, and type attributes of the input data.

[0052] Data format validity verification logic: refers to the program logic in a smart contract that checks the format of external data entering the contract. It is used to filter out malformed data that does not conform to the protocol specifications and prevent contract execution abnormalities or logic bypasses caused by data format errors.

[0053] Whitelist mapping table definition pattern: refers to the variable definition pattern predefined in the access control detection rules for identifying the whitelist data structure of oracle nodes. It determines whether the code defines a valid node address whitelist container by matching the type declaration and initial assignment in the variable definition node.

[0054] Oracle node address whitelist mechanism: This refers to an access control mechanism in distributed oracle smart contracts that restricts the identity of data submitters by predefining a list of trusted oracle node addresses. Only nodes on the whitelist are allowed to perform data reporting operations, preventing malicious nodes from forging data.

[0055] Access modifier declaration: refers to the modifier syntax element in the function declaration node used to identify the scope of callers of the function. For example, adding the onlyOracle modifier to the function declaration restricts it to be called only by the oracle node, which is used to implement fine-grained function access control.

[0056] Function call permission modifier compliance: This refers to whether critical functions in a smart contract are fitted with appropriate permission modifiers to constrain the caller's identity, preventing unauthorized entities from calling sensitive functions and causing privilege escalation or data tampering.

[0057] Timeout judgment and retry logic combination pattern: refers to the code structure pattern predefined in the exception handling detection rules to identify the data acquisition timeout handling process. By matching the combination of timeout condition judgment and retry statement in the loop control node, it is determined whether the contract has a fault tolerance mechanism to deal with network latency and unresponsive data source.

[0058] Data timeout retry mechanism: In distributed oracle smart contracts, when data is retrieved from an external data source for a period exceeding a preset time threshold, an error recovery mechanism is automatically triggered to re-request or switch to a backup data source, which is used to ensure the availability of the contract in unstable network environments.

[0059] Error code completeness: In the exception handling detection rules, this refers to whether the smart contract has defined an enumeration value set that covers all expected error scenarios. By matching the number of error code members and naming conventions in the enumeration type definition node, it verifies whether the contract has complete error classification and handling capabilities.

[0060] Error code definition completeness: This refers to whether a unique error code identifier is defined in a smart contract for various possible runtime errors, so as to accurately convey error type information when an exception occurs and support the caller in implementing targeted error handling strategies.

[0061] In another embodiment of this solution, S1 is specifically implemented as follows: Figure 2 Construct a schematic diagram for the abstract tree, such as Figure 2 As shown, the source code (written in C or C++) of a smart contract is read from the blockchain smart contract development environment. The source code contains complete function definitions, variable declarations, control flow statements, and data interaction interfaces.

[0062] The Clang compiler frontend invokes its lexical analyzer component. The frontend reads the source code, scanning each character in the character sequence from left to right. Based on the lexical rules of C and C++, it identifies basic units with independent syntactic meaning, generating a Token object for each unit. Each Token object contains a type identifier field, a string value field, and a position information field. The type identifier field distinguishes between keywords, identifiers, constants, operators, and delimiters. The string value field stores the original character content corresponding to the Token. The position information field records the Token's starting line number, starting column number, ending line number, and ending column number in the source code. Multiple Token objects form a Token stream according to the scanning order, preserving the original order relationship between adjacent Tokens in the stream.

[0063] The Clang compiler frontend invokes the parser component, which reads the token stream and performs recursive descent parsing according to C and C++ syntax rules. The parser component maintains a parsing stack structure, storing syntax symbols to be matched. It reads token objects one by one from the token stream, matching the token object's type identifier field against the syntax symbol at the top of the parsing stack. When a match is successful, a pop operation is performed, consuming the current token object; when a match fails, an error recovery mechanism is triggered or a syntax error is reported. During the matching process, abstract syntax tree (AST) node objects are created according to production rules. Each AST node object contains a node type field, a child node pointer array field, a source code location field, and additional attribute fields. The node type field stores the type name corresponding to the current syntax structure; the child node pointer array field stores a set of pointers to child node objects; the source code location field records the start and end positions of the source code corresponding to the current syntax structure; and the additional attribute fields store semantic information related to the node. Multiple AST node objects are connected through parent and child pointers to form a complete AST structure.

[0064] After traversing and matching all Token objects, an abstract syntax tree is constructed with function declaration nodes as the root node. Child nodes include variable definition nodes, function call nodes, conditional statement nodes, loop control nodes, return statement nodes, and expression nodes. Each leaf node in the abstract syntax tree corresponds to a terminal Token object in the Token sequence, and each non-leaf node corresponds to a non-terminal symbol in the syntax rules.

[0065] In another embodiment of this solution, S2 is specifically implemented as follows: The abstract syntax tree (API) traversal interface provided by the LibClang library is invoked. A depth-first traversal strategy is used to perform a complete traversal of the API. The depth-first traversal strategy starts from the root node of the API, which corresponds to the function declaration node. During the traversal, each child node object is visited sequentially along the array of child node pointers of the root node. For each non-leaf node object visited, its child node pointer array field is recursively traversed until all leaf node objects are visited. The access order of each node object is recorded during the traversal, forming a node access sequence. Each element in the node access sequence contains a pointer to the node object and a access depth value.

[0066] During the traversal of the abstract syntax tree, a node type field is extracted for each visited node object. This field stores the type name corresponding to the current syntax structure. The node's category is identified by comparing the string values ​​of the node type field. When the string value of the node type field equals `FunctionDecl`, the current node object is identified as a function declaration node, representing the entry point of a function defined in the smart contract. When the string value of the node type field equals `ParmVarDecl`, the current node object is identified as a variable definition node, representing the declaration of function parameters or local variables. When the string value of the node type field equals `CallExpr`, the current node object is identified as a function call node, representing the call operation to other functions. When the string value of the node type field equals `IfStmt` or `SwitchStmt`, the current node object is identified as a condition judgment node, representing the condition judgment operation. Nodes represent branch selection logic in the program; when the string value of the node type field is equal to ForStmt, WhileStmt, or DoStmt, the current node object is identified as a loop control node, which represents repeated execution logic; when the string value of the node type field is equal to ReturnStmt, the current node object is identified as a return statement node, which indicates the end of function execution; when the string value of the node type field is equal to BinaryOperator or UnaryOperator, the current node object is identified as an expression node, which represents arithmetic or logical operations. The identified node type information is stored in the node feature set.

[0067] Flow analysis processing includes two parts: control flow tracing and data flow tracing. The specific implementation of control flow tracing is as follows: Starting from the root node of the abstract syntax tree, the predecessor and successor node sets of each node object are analyzed sequentially according to the node access sequence. For function declaration nodes, the function entry point is determined, and the starting line number of function execution is recorded. For conditional decision nodes, the conditional expression contained in the conditional decision node is parsed. Based on the truth value of the conditional expression, the program execution path is divided into true branch paths and false branch paths. The true branch path points to the true statement block node corresponding to the conditional decision node, and the false branch path points to the false statement block node corresponding to the conditional decision node or a subsequent statement block node. For the first statement node, the merging point is identified at the end of the true and false branch paths; the merging point is the node object where the two branch paths converge again. For loop control nodes, the loop condition judgment position and the loop body entry position are identified. The loop condition judgment position corresponds to the conditional expression contained in the loop control node, and the loop body entry position corresponds to the statement block node contained in the loop control node. The loop exit point and loop continuation point are recorded. For function call nodes, the call point position and return point position are recorded. The call point position corresponds to the function call node itself, and the return point position corresponds to the first statement node after the function call node. For return statement nodes, the function execution termination position is identified. By traversing the above control flow information of all node objects, a control flow edge set is constructed, and each edge in the control flow edge set is represented as a tuple. ,in, For the predecessor node object, For the successor node object, as well as All are extracted from the node access sequence.

[0068] The specific implementation of data flow tracing is as follows: Starting from the root node of the abstract syntax tree, the variable name corresponding to each variable definition node is traced sequentially according to the node access sequence, and a variable definition table is established. Each entry in the variable definition table contains a variable name string, a definition location line number, and a variable scope identifier. For function call nodes, the list of actual parameter expression nodes contained in the function call node is parsed. Each element in the list of actual parameter expression nodes corresponds to an actual parameter expression node. The variable name referenced in each actual parameter expression node is traced, and the corresponding variable definition entry is found in the variable definition table. A data flow edge is established from the variable definition entry to the function call node, and the data flow edge represents the transfer of variable values ​​from the definition point to the function call point. For function declaration nodes, the list of formal parameters contained in the function declaration node is parsed. The list node contains multiple variable definition nodes, each corresponding to a formal parameter. A parameter passing mapping is established from the function call node to the function declaration node, representing the process of passing actual parameter values ​​to formal parameters. For return statement nodes, the return value expression nodes are parsed, tracing the variable names or calculation results referenced in the return value expression nodes. A return value passing mapping is established from the return value expression nodes to the function call point, representing the process of passing the function execution result from the called function back to the calling function. For assignment expression nodes, the lvalue variables and rvalue expressions contained within the assignment expression nodes are parsed, establishing a data flow edge from the variable definition entries referenced in the rvalue expression to the lvalue variables. This data flow edge represents the process of passing variable values ​​during the assignment operation. By integrating all data flow edges, a data flow edge set is formed.

[0069] The node feature set is combined with the program dependency graph. The node feature set contains the node type information, source code location information, and child node association information of each node object. The program dependency graph contains the control flow edge set and the data flow edge set. The graph is stored in the form of a graph data structure. The vertex set in the graph data structure corresponds to all node objects in the node access sequence. The edge set in the graph data structure corresponds to the union of the control flow edge set and the data flow dependency set. Each edge is accompanied by an edge type label, and the type label value can be either control flow type or data flow type.

[0070] In another embodiment of this solution, S3 is specifically implemented as follows: Read the predefined distributed oracle security detection rule base (hereinafter referred to as the rule base), which includes: data input validation detection rules, access control detection rules and exception handling detection rules. Each type of rule consists of multiple independent rule entries.

[0071] The process involves iterating through each rule entry in the rule base and performing a matching check between each rule entry and the relationship graph. The specific steps are as follows: For data input validation detection rules, the matching condition requires that the function name string in the additional attribute field of the function call node object matches a preset set of signature verification function name patterns. If no matching function call node object is found, the detection result is added to the result set as a data source signature verification missing vulnerability detection result. The rule identifier in this detection result is set to the data source signature verification rule identifier, the node identifier is set to the function declaration node object identifier, the risk level is set to high, and the vulnerability description is set to "No data source signature verification function call detected." The matching condition also requires that the condition judgment node object contains an input data range validation expression. The input data range validation expression can recognize binary operator nodes, the operator type of the binary operator node is a comparison operator, and the left operand node or right operand node of the comparison operator references an external input parameter variable. If no matching condition judgment node object is found, the detection result is added to the result set as a data format legality verification missing vulnerability detection result. The rule identifier in this detection result is set to the data format legality verification rule identifier, the node identifier is set to the function declaration node object identifier, the risk level is set to medium, and the vulnerability description is set to "No input data range validation logic detected."

[0072] For the access control detection rules, the matching condition requires that the variable type string in the additional attribute field of the variable definition node object matches the preset whitelist container type pattern. If no matching variable definition node object is found, the detection result is added to the result set as a whitelist mechanism missing vulnerability detection result. The rule identifier in this detection result is set to the whitelist mechanism rule identifier, the node identifier is set to the function declaration node object identifier, the risk level is set to high, and the vulnerability description is set to "No oracle node address whitelist definition detected." The matching condition also requires that the function modifier set in the additional attribute field of the function declaration node object contains the preset access modifier pattern. If no matching function declaration node object is found, the detection result is added to the result set as an access modifier missing vulnerability detection result. The rule identifier in this detection result is set to the access modifier rule identifier, the node identifier is set to the function declaration node object identifier, the risk level is set to medium, and the vulnerability description is set to "Function lacks access modifier control."

[0073] For the anomaly handling detection rules, the matching conditions require that the set of child nodes of the loop control node object contains a condition judgment node object, the condition expression of the condition judgment node object contains timeout judgment logic, and the true branch path of the condition judgment node object contains a function call node object. The function name string of the function call node object matches the set of retry function name patterns. If no matching loop control node object is found, the detection result is added to the result set as a data timeout retry mechanism missing vulnerability detection result. The rule identifier in the detection result is set to the data timeout retry mechanism rule identifier, the node identifier is set to the function declaration node object identifier, the risk level is set to medium level, and the vulnerability description is set to no data timeout retry mechanism detected. The matching condition also requires that the set of enumeration members contained in the enumeration type definition node object covers the preset standard error code set. The standard error code set includes success code, timeout code, invalid data code, permission denied code, and data source unreachable code. If any member in the standard error code set is missing from the enumeration member set, the detection result is added to the result set as an error code definition incomplete vulnerability detection result. The rule identifier in the detection result is set to the error code definition rule identifier, the node identifier is set to the enumeration type definition node object identifier, the risk level is set to low level, and the vulnerability description is set to error code definition incomplete.

[0074] After all rule entries have undergone pattern matching and detection, the resulting set contains all detected vulnerability detection results. Each vulnerability detection result record includes a rule identifier, a node object identifier, a risk level, and vulnerability description information. Based on the node object identifier, the corresponding source code location information is queried from the node feature set, and the source code file path, line number, and column number are extracted. The source code location information and vulnerability description information are combined to generate a structured vulnerability report. Based on the rule identifier, the corresponding remediation suggestion template is queried from the rule table, and the remediation suggestion template is combined with the code snippet corresponding to the node object identifier to generate a remediation suggestion document. The vulnerability report document and the remediation suggestion document are then output.

[0075] Furthermore, the node types include: function declaration nodes, variable definition nodes, function call nodes, conditional judgment nodes, loop control nodes, return statement nodes, and expression nodes; Flow analysis processing includes control flow tracing and data flow tracing. Control flow tracing is used to identify branching and merging relationships in the program execution path. Data flow tracing is used to identify the flow changes of variable values ​​during assignment, passing, and calculation, as well as the parameter passing and return value passing chains across procedure calls.

[0076] Furthermore, the distributed oracle security detection rule base includes: Data input validation detection rules, access control detection rules, and anomaly handling detection rules.

[0077] Furthermore, the data input verification and detection rules include: matching the signature verification function name pattern to detect the existence of the data source signature verification function, and matching the input data range verification expression to detect the data format legality verification logic; The access control detection rules include: matching the whitelist mapping table definition pattern to detect the oracle node address whitelist mechanism, and matching the permission modifier declaration to detect the compliance of function call permission modifiers; The exception handling detection rules include: matching the combination pattern of timeout judgment and retry logic to detect the data timeout retry mechanism, and matching the completeness of error codes to detect the completeness of error code definitions.

[0078] Example 1: Detecting the EOS oracle contract.

[0079] The input source code is described as follows: The first function is the submitData function. The function declaration contains two formal parameters: the first formal parameter is a timestamp variable of type uint64_t, and the second formal parameter is a data variable of type string. The function body performs data storage operations, storing the value of the data variable into the dataTable mapping container, using the timestamp variable as the mapping key. The function body does not contain any data source signature verification logic, and does not call the signature verification function to verify the source of the externally input data variable.

[0080] The second function is the updateConfig function. The function declaration contains two formal parameters: the first formal parameter is a string type key variable, and the second formal parameter is a string type value variable. The function body performs a configuration update operation, stores the value of the value variable into the configTable mapping container, and uses the key variable as the mapping key. The function declaration does not have any permission modifiers attached, allowing any caller to perform configuration modification operations. It does not implement oracle node address whitelist access control.

[0081] The third function is `fetchData`. The function declaration has no formal parameters and returns a string. Within the function body, it calls the `getFromURL` function to send a data retrieval request to the address `api.com / data` and returns the result directly. However, the function body does not include timeout logic, does not set a timeout threshold constant, and does not implement a retry mechanism. It cannot automatically retry when the `getFromURL` function call fails. Furthermore, it does not define an error code enumeration type to categorize and handle possible timeouts, invalid data, and permission denial exceptions.

[0082] The testing process is as follows: The Clang compiler frontend is invoked to perform lexical and syntactic analysis, converting the source code into an abstract syntax tree object. The node type field records the syntax structure of function declarations, variable definitions, and function calls, while the source code location field records the row and column numbers.

[0083] The LibClang library interface is called to perform a depth-first traversal of the abstract syntax tree, identify the type of each node, construct a control flow edge set to record the branches of the program execution path, construct a data flow dependency set to record the variable passing chain, and output the relationship graph.

[0084] Load the distributed oracle security detection rule library and perform pattern matching detection: if no signature verification function is found in the function call node, generate a vulnerability result indicating missing data source signature verification; if no permission modifier is found in the function declaration node, generate a vulnerability result indicating missing access control; if no combination of timeout judgment and retry logic is found in the loop control node, generate a vulnerability result indicating missing exception handling.

[0085] The output module summarizes the vulnerability detection results, queries the node feature set to obtain the source code location, generates a vulnerability report, points out the three defect locations and risk levels, and generates a remediation suggestion document that includes supplementary signature verification, adding permission modifiers, and adding a timeout retry mechanism.

[0086] In the above embodiments, although the steps are numbered S1, S2, etc., they are only specific embodiments given by the present invention. Those skilled in the art can adjust the execution order of S1, S2, etc. according to the actual situation, and these situations are also within the protection scope of the present invention. It can be understood that in some embodiments, some or all of the above embodiments may be included.

[0087] This invention also provides a distributed oracle smart contract security detection system based on abstract syntax trees, the specific technical solution of which includes: a parsing module, a traversal module, and a detection module; The parsing module is used to obtain the source code, convert the source code into a token stream, perform syntax analysis on the token stream, and obtain an abstract syntax tree. The traversal module is used to traverse the abstract syntax tree, identify node types, and perform flow analysis to obtain the relation graph. The detection module is used to perform pattern matching detection processing based on the relationship graph and the distributed oracle security detection rule base to obtain vulnerability detection results.

[0088] Furthermore, the node types include: function declaration nodes, variable definition nodes, function call nodes, conditional judgment nodes, loop control nodes, return statement nodes, and expression nodes; Flow analysis processing includes control flow tracing and data flow tracing. Control flow tracing is used to identify branching and merging relationships in the program execution path. Data flow tracing is used to identify the flow changes of variable values ​​during assignment, passing, and calculation, as well as the parameter passing and return value passing chains across procedure calls.

[0089] Furthermore, the distributed oracle security detection rule base includes: Data input validation detection rules, access control detection rules, and anomaly handling detection rules.

[0090] Furthermore, the data input verification and detection rules include: matching the signature verification function name pattern to detect the existence of the data source signature verification function, and matching the input data range verification expression to detect the data format legality verification logic; The access control detection rules include: matching the whitelist mapping table definition pattern to detect the oracle node address whitelist mechanism, and matching the permission modifier declaration to detect the compliance of function call permission modifiers; The exception handling detection rules include: matching the combination pattern of timeout judgment and retry logic to detect the data timeout retry mechanism, and matching the completeness of error codes to detect the completeness of error code definitions.

[0091] It should be noted that the beneficial effects of the distributed oracle smart contract security detection system based on abstract syntax trees provided in the above embodiments are the same as those of the distributed oracle smart contract security detection method based on abstract syntax trees, and will not be repeated here. Furthermore, the system provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to the actual situation to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiments, and will not be repeated here.

[0092] like Figure 3 As shown, an embodiment of the present invention provides a computer device 300, which includes a processor 320 coupled to a memory 310. The memory 310 stores at least one computer program 330, which is loaded and executed by the processor 320 to enable the computer device 300 to implement any of the above-described methods. Specifically: The computer device 300 can vary considerably due to differences in configuration or performance. It may include one or more processors 320 (Central Processing Units, CPUs) and one or more memories 310. The one or more memories 310 store at least one computer program 330, which is loaded and executed by the one or more processors 320 to enable the computer device 300 to implement the distributed oracle smart contract security detection method based on abstract syntax trees provided in the above embodiments. Of course, the computer device 300 may also have wired or wireless network interfaces, a keyboard, and input / output interfaces for input and output. The computer device 300 may also include other components for implementing device functions, which will not be elaborated upon here.

[0093] An embodiment of the present invention provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to enable a computer to implement any of the above-described methods.

[0094] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0095] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the above-described distributed oracle smart contract security detection methods based on abstract syntax trees.

[0096] It should be noted that the terms "first," "second," etc., used in the specification of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown in the figures or description.

[0097] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, the invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0098] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0099] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for security detection of distributed oracle smart contracts based on abstract syntax trees, characterized in that, include: S1, Obtain the source code, convert the source code into a Token stream, perform syntax analysis on the Token stream, and obtain an abstract syntax tree; S2, traverse the abstract syntax tree, identify node types and perform flow analysis to obtain the relation graph; S3. Based on the relationship graph, perform pattern matching detection processing through the distributed oracle security detection rule base to obtain vulnerability detection results.

2. The method for security detection of distributed oracle smart contracts based on abstract syntax trees according to claim 1, characterized in that, The node types include: function declaration nodes, variable definition nodes, function call nodes, conditional judgment nodes, loop control nodes, return statement nodes, and expression nodes; The flow analysis processing includes control flow tracing processing and data flow tracing processing; the control flow tracing processing is used to identify the branching and merging relationships of the program execution path; the data flow tracing processing is used to identify the flow changes of variable values ​​during assignment, transmission, and calculation, as well as the parameter transmission and return value transmission chains across process calls.

3. The method for security detection of distributed oracle smart contracts based on abstract syntax trees according to claim 1, characterized in that, The distributed oracle security detection rule base includes: Data input validation detection rules, access control detection rules, and anomaly handling detection rules.

4. The method for security detection of distributed oracle smart contracts based on abstract syntax trees according to claim 3, characterized in that, The data input verification and detection rules include: matching the signature verification function name pattern to detect the existence of the data source signature verification function, and matching the input data range verification expression to detect the data format legality verification logic; The access control detection rules include: matching the whitelist mapping table definition pattern to detect the oracle node address whitelist mechanism, and matching the permission modifier declaration to detect the compliance of function call permission modification. The anomaly handling detection rules include: matching the combination pattern of timeout judgment and retry logic to detect the data timeout retry mechanism, and matching the completeness of error codes to detect the completeness of error code definitions.

5. A distributed oracle smart contract security detection system based on abstract syntax trees, characterized in that, include: The module consists of a parsing module, a traversal module, and a detection module. The parsing module is used to obtain source code, convert the source code into a token stream, perform syntax analysis on the token stream, and obtain an abstract syntax tree. The traversal module is used to traverse the abstract syntax tree, identify node types, and perform flow analysis processing to obtain a relation graph; The detection module is used to perform pattern matching detection processing based on the relationship graph and a distributed oracle security detection rule base to obtain vulnerability detection results.

6. The distributed oracle smart contract security detection system based on abstract syntax trees according to claim 5, characterized in that, The node types include: function declaration nodes, variable definition nodes, function call nodes, conditional judgment nodes, loop control nodes, return statement nodes, and expression nodes; The flow analysis processing includes control flow tracing processing and data flow tracing processing; the control flow tracing processing is used to identify the branching and merging relationships of the program execution path; the data flow tracing processing is used to identify the flow changes of variable values ​​during assignment, transmission, and calculation, as well as the parameter transmission and return value transmission chains across process calls.

7. A distributed oracle smart contract security detection system based on abstract syntax trees according to claim 5, characterized in that, The distributed oracle security detection rule base includes: Data input validation detection rules, access control detection rules, and anomaly handling detection rules.

8. A distributed oracle smart contract security detection system based on abstract syntax trees according to claim 7, characterized in that, The data input verification and detection rules include: matching the signature verification function name pattern to detect the existence of the data source signature verification function, and matching the input data range verification expression to detect the data format legality verification logic; The access control detection rules include: matching the whitelist mapping table definition pattern to detect the oracle node address whitelist mechanism, and matching the permission modifier declaration to detect the compliance of function call permission modification. The anomaly handling detection rules include: matching the combination pattern of timeout judgment and retry logic to detect the data timeout retry mechanism, and matching the completeness of error codes to detect the completeness of error code definitions.

9. A computer device, characterized in that, The computer device includes a processor coupled to a memory, the memory storing at least one computer program, which is loaded and executed by the processor to enable the computer device to implement a distributed oracle smart contract security detection method based on an abstract syntax tree as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to enable the computer to implement a distributed oracle smart contract security detection method based on an abstract syntax tree as described in any one of claims 1 to 4.

Images