Vulnerability availability verification method and device and electronic equipment
By combining static program analysis and large language models to generate customized attack scripts, a vulnerability exploitability verification framework is constructed. This solves the problem that existing tools cannot verify vulnerability exploitability in real-world environments, and enables accurate judgment and reliable assessment of vulnerabilities in real-world environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SUN YAT SEN UNIV
- Filing Date
- 2026-01-30
- Publication Date
- 2026-05-08
AI Technical Summary
Existing smart contract vulnerability detection tools cannot verify the exploitability of vulnerabilities in real-world environments, resulting in a high false positive rate and an inability to accurately assess the triggerability and security impact of vulnerabilities.
By identifying vulnerability entry points through static program analysis, generating customized attack and exploit verification scripts by combining large language models, and constructing a vulnerability exploitability verification framework based on execution feedback, the exploitability of vulnerabilities in a systematic way is evaluated.
It enables accurate identification of vulnerabilities in real-world environments, improves the accuracy and reliability of vulnerability exploitability verification, and reduces the false positive rate.
Smart Images
Figure CN121997345A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of vulnerability detection technology, and in particular to a vulnerability exploitability verification method, apparatus, and electronic device. Background Technology
[0002] Current mainstream smart contract vulnerability detection tools generally suffer from an excessively high false positive rate. The root cause lies in the fact that most of these tools remain at the level of "potential vulnerability pattern recognition," failing to further determine whether the vulnerability possesses triggerable preconditions in a real on-chain environment, or to verify whether it can cause actual and observable security impact. Lacking a comprehensive assessment of the contract's runtime state, external dependencies, and multi-transaction execution sequences, these tools often directly classify "theoretically potentially risky code snippets" as vulnerabilities, resulting in numerous false positives that are unusable, unreproducible, or have limited impact in actual attack scenarios. This inability to distinguish between "existing defects" and "exploitable vulnerabilities causing substantial harm" has become a core bottleneck restricting the engineering practicality and risk assessment accuracy of smart contract vulnerability detection tools.
[0003] Smart contract vulnerability exploitability verification refers to constructing attack transaction sequences based on contract source code, on-chain state, and transaction context in a simulated real-world environment (such as a testnet or auditing environment) to verify whether a certain type of vulnerability (such as reentrancy, access control errors, price oracle manipulation, arithmetic / authorization flaws, etc.) can actually be triggered and produce quantifiable security consequences (such as fund transfer). It not only focuses on "whether the vulnerability exists," but also emphasizes clearly defining the preconditions for exploitation, the required permissions / resources, and the boundaries of economic gains, thereby providing a chain of evidence for risk classification, remediation strategy selection, and regression verification after remediation.
[0004] Existing vulnerability exploitation analysis includes smart contract vulnerability exploit generation based on program analysis and smart contract vulnerability exploit generation based on large language models.
[0005] However, the above solution has the following problems: 1. Existing research cannot automate the generation or optimization of attack verification scripts for specific vulnerabilities, resulting in generated scripts that are difficult to cover the real preconditions and execution sequences required to trigger vulnerabilities, thus making it impossible to accurately and systematically assess the exploitability of vulnerabilities.
[0006] 2. Existing research cannot automatically verify the effectiveness of attack scripts, making it impossible to determine whether the script can successfully trigger vulnerabilities and produce the expected security impact in a real execution environment, thus affecting the accuracy of the assessment. Summary of the Invention
[0007] This invention provides a vulnerability exploitability verification method, apparatus, and electronic device to solve the technical problem that existing research cannot automatically generate or optimize attack verification scripts for specific vulnerabilities, cannot automatically evaluate the effectiveness of scripts, and thus finds it difficult to accurately determine whether a vulnerability can be exploited in a real environment.
[0008] This invention provides a vulnerability exploitability verification method, comprising: Obtain the function to be tested, and retrieve the vulnerability paths that affect the execution state of the function to be tested from the preset smart contract; Obtain the smart contract and its deployment parameters, input the smart contract, the deployment parameters, and the vulnerability path into a pre-trained large language model, and generate an attack exploit verification script; The attack exploit verification script is executed, and the triggerability of the vulnerability corresponding to the vulnerability path is determined based on the execution result to obtain the trigger result; The attack was analyzed using a verification script to determine the profit outcome. The vulnerability can be exploited based on the triggering result and the profit result.
[0009] Optionally, the step of obtaining the function to be tested and obtaining the vulnerability path affecting the execution state of the function to be tested from a preset smart contract includes: Obtain the function to be tested, and obtain the state read set and state write set of the function to be tested; A state dependency model is generated based on the state read set and the state write set; The set of entry functions that affect the execution state of the function under test is retrieved according to the state dependency model, and the set of entry functions includes several entry functions; Determine whether each of the aforementioned entry functions contains an access control modifier; If so, the entry function containing the access control modifier is identified as a restricted entry function, and the restricted entry function is removed from the set of entry functions to obtain the vulnerability path that affects the execution state of the function under test.
[0010] Optionally, the step of executing the attack using the verification script and determining the triggerability of the vulnerability corresponding to the vulnerability path based on the execution result to obtain the triggering result includes: The attack utilizes a verification script to obtain the system's final instructions. The system's final instructions are used to validate the attack using a verification script. If the verification passes, record the attack call chain, execution stack state, and PC state changes; Based on the attack call chain, the execution stack state, and the PC state changes, it is detected whether the vulnerability corresponding to the preset triggering rule is triggered, and the triggering result is obtained.
[0011] Optionally, the step of executing the attack using the verification script to obtain the final system instruction includes: According to the preset execution process, the attack exploit verification script is executed in the preset virtual machine to obtain the final system instruction.
[0012] Optionally, the step of performing profit analysis on the attack using a verification script to obtain a profit result includes: Based on the execution results, obtain the changes in the attacker's assets before and after executing the attack exploit verification script; The profit result is determined based on the changes in the assets.
[0013] Optionally, the step of determining whether the vulnerability can be exploited based on the triggering result and the profit result includes: When the triggering result is triggering a vulnerability and the profit result is obtaining a benefit, the vulnerability is determined to be exploitable. If the triggering result is a vulnerability being triggered and the profit result is no profit, then the vulnerability is determined to be unexploitable. If the triggering result is that the vulnerability is not triggered and the profit result is that a profit is obtained, then the vulnerability is determined to be unexploitable. If the triggering result is that the vulnerability is not triggered and the profit result is that there is no profit within the preset timeout period, then the vulnerability is determined to be unexploitable.
[0014] Optionally, it also includes: When the attack fails to execute the verification script, the complete bytecode sequence during the execution process is collected, and the semantic information that caused the execution failure is obtained. The execution path of the verification script used in the attack is determined based on the complete bytecode sequence. Based on the execution path and the semantic information, locate the code location and function location where execution failed; Identify the core failure statement and the target function corresponding to the core failure statement at the code location and the function location, and determine the cause of failure; Obtain the execution context of the core statement that failed; The attack exploit verification script is updated based on the failed core statement, the reason for failure, and the execution context to obtain the updated script.
[0015] Optionally, it also includes: When the attack completes the execution of the verification script but fails to successfully trigger the vulnerability or achieve the attack's profit, the vulnerability type and the failure stage of the attack script are obtained. Obtain the primitive operations corresponding to the vulnerability type and the failure stage of the attack script, and use the primitive operations to enhance and optimize the attack exploit verification script to obtain an updated script.
[0016] The present invention also provides a vulnerability exploitability verification device, comprising: The vulnerability path acquisition module is used to acquire the function under test and obtain the vulnerability paths that affect the execution state of the function under test from a preset smart contract; The attack utilizes a verification script generation module to obtain the smart contract and its deployment parameters. The smart contract, deployment parameters, and vulnerability path are then input into a pre-trained large language model to generate an attack exploit verification script. The triggerability determination module is used to execute the attack exploit verification script and determine the triggerability of the vulnerability corresponding to the vulnerability path based on the execution result, so as to obtain the triggering result; The profit analysis module is used to perform profit analysis on the attack using a verification script to obtain the profit result; The exploitability assessment module is used to determine whether the vulnerability can be exploited based on the triggering result and the profit result.
[0017] The present invention also provides an electronic device, the device comprising a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute the vulnerability exploitability verification method as described above, according to instructions in the program code.
[0018] As can be seen from the above technical solutions, the present invention has the following advantages: The present invention first uses static program analysis technology to identify vulnerability entry points and construct potential vulnerability execution paths, and automatically generates customized attack exploitation verification scripts by combining vulnerability characteristics and contract deployment constraints; then it constructs a vulnerability exploitability verification framework based on execution feedback, and systematically evaluates the vulnerability triggering capability and actual attack impact of the attack exploitation verification script, thereby accurately determining whether the vulnerability can be exploited in a real environment. Attached Figure Description
[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0020] Figure 1 A flowchart illustrating the steps of a vulnerability exploitability verification method provided in an embodiment of the present invention; Figure 2 A flowchart illustrating the steps of a vulnerability exploitability verification method provided in another embodiment of the present invention; Figure 3 This is a schematic diagram of a prompt template provided in an embodiment of the present invention; Figure 4 A flowchart illustrating the vulnerability exploitability verification method provided in this embodiment of the invention; Figure 5 This is a structural block diagram of a vulnerability exploitability verification device provided in an embodiment of the present invention. Detailed Implementation
[0021] Existing vulnerability exploitation analysis includes smart contract vulnerability exploit generation based on program analysis and smart contract vulnerability exploit generation based on large language models.
[0022] 1. Generation of smart contract vulnerability exploits based on program analysis: Currently, vulnerability generation based on program analysis mainly focuses on two major technical approaches: symbolic execution and fuzzing. In symbolic execution, the core idea is to transform the execution path of a contract into mathematical constraints. Symbolic execution techniques are used to analyze Ethereum bytecode, key state variables are located through slicing, and SMT solvers are used to reverse-engineer path constraints that could lead to fund leakage, thus automatically generating attack constraints. However, pure symbolic execution faces a severe path explosion problem and is inefficient when handling complex constraints such as hash functions. To address scalability issues, research based on fuzzing has gradually emerged. Ethploit first proposed a fuzzing framework for Ethereum smart contracts, triggering potential vulnerabilities by defining a test language and generating random inputs. However, these methods lack fine-grained analysis of the execution state, making it impossible to assess the severity of vulnerabilities, resulting in insufficient accuracy in exploitability detection results.
[0023] 2. Generation of smart contract vulnerabilities based on large language models: Current research on smart contract security is beginning to explore the use of Large Language Models (LLMs) to generate automated exploit code or proof-of-concept scripts for specific vulnerabilities, serving as a supplement and extension to program analysis techniques. A representative approach proposes integrating LLMs with testing toolchains (such as Foundries) to build an end-to-end exploit generation and verification framework. This framework enables the model to automatically synthesize and execute exploits based on contract behavior understanding, generating executable Proof-of-Concept (PoC) scenarios for various vulnerability types and evaluating their effectiveness. Some experiments show a high success rate on real contracts, demonstrating the significant potential of modern LLMs in program understanding and exploit synthesis. However, these initial explorations still face challenges such as the effectiveness of generated code, real-world environment verification, and context-dependent modeling, indicating that LLM-based exploit generation research is still in its early stages.
[0024] In view of this, embodiments of the present invention provide a vulnerability exploitability verification method, apparatus and electronic device to solve the technical problem that existing research cannot automatically generate or optimize attack verification scripts for specific vulnerabilities, cannot automatically evaluate the effectiveness of scripts, and thus it is difficult to accurately determine whether a vulnerability can be exploited in a real environment.
[0025] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.
[0026] Please see Figure 1 , Figure 1 A flowchart illustrating the steps of a vulnerability exploitability verification method provided in an embodiment of the present invention.
[0027] The present invention provides a vulnerability exploitability verification method, which may specifically include the following steps: Step 101: Obtain the function to be tested and retrieve the vulnerability paths that affect the execution state of the function to be tested from the preset smart contract; Vulnerability exploitability verification: This involves constructing minimal attack inputs or scripts to confirm whether a vulnerability can actually be triggered by an attacker and cause observable security impacts (such as privilege escalation, information disclosure, denial of service, remote code execution, or asset transfer). Its goal is not to "prove the code is flawed," but rather to move beyond the "theoretical existence" of vulnerabilities to "whether they can be exploited under realistic threat models, what the exploitation conditions are, and the extent of their impact," thereby providing a reliable basis for vulnerability prioritization, remediation verification, and risk mitigation.
[0028] Smart contracts: A smart contract is an automated protocol implemented using blockchain technology. It can execute various conditions and complex logic, and its execution typically involves multiple participants. It interacts with other smart contracts, obtains data from multiple sources, and automatically executes the contract terms.
[0029] Blockchain: Blockchain is a distributed ledger technology that ensures the security and immutability of information by linking data together in the form of blocks. Each block contains a set of transaction data, a timestamp, and the hash value of the previous block, forming a continuous chain. The decentralized nature of blockchain allows data to be stored across multiple nodes, meaning that the failure or malicious behavior of any single node cannot affect the integrity of the entire network. This makes blockchain a promising technology for applications in finance, supply chain management, identity verification, and many other fields, as it provides transparent, secure, and traceable transaction records.
[0030] In this embodiment of the invention, the function to be tested can be obtained, and the vulnerability path affecting the execution state of the function to be tested can be obtained from the preset smart contract, so as to perform subsequent vulnerability exploitability verification through the vulnerability path.
[0031] Step 102: Obtain the smart contract and its deployment parameters. Input the smart contract, deployment parameters, and vulnerability path into the pre-trained large language model to generate an attack exploit verification script. Large Language Models (LLMs) are general-purpose generative models trained on massive amounts of text data, typically employing the Transformer architecture. By learning statistical patterns and contextual dependencies in language, they can perform text understanding and generation tasks, such as question answering, summarizing, translation, code generation, and reasoning assistance, given prompts. The core capability of LLMs stems from their training objective of "predicting the next word / symbol in context" and the generalization ability brought by large-scale parameters and data. Therefore, they can reuse learned knowledge for expression and perform multi-step reasoning and tool-calling task planning to a certain extent. However, their output may still exhibit illusions, biases, or uncertainties, requiring the integration of retrieval, constraint, validation, and security mechanisms to improve reliability.
[0032] In this embodiment of the invention, after determining the vulnerability path, the vulnerability path, smart contract, and smart contract deployment parameters can be input into a pre-trained large language model to generate an attack exploitation verification script.
[0033] It should be noted that the embodiments of the present invention do not impose specific limitations on the training process of the large language model. Those skilled in the art can use conventional training methods for large language models to train the large language model proposed in the embodiments of the present invention.
[0034] Step 103: Execute the attack exploit verification script, and determine the triggerability of the vulnerability corresponding to the vulnerability path based on the execution result to obtain the trigger result; In this embodiment of the invention, an attack exploitation verification script can be executed to determine whether the attacker's attack will trigger the vulnerability corresponding to the vulnerability path. The triggering result can be used for subsequent vulnerability exploitability verification.
[0035] Step 104: Perform a profit analysis on the attack using a verification script to obtain the profit results; In this embodiment of the invention, after the execution and triggering judgment of the attack exploitation verification script are completed, the degree of harm of the vulnerability can be further judged based on profit analysis in order to determine whether the vulnerability has real attack value.
[0036] Step 105: Determine whether the vulnerability can be exploited based on the triggering result and the profit result.
[0037] In this embodiment of the invention, the vulnerability can be determined based on the triggering result and the profit result.
[0038] This invention first uses static program analysis technology to identify vulnerability entry points and construct potential vulnerability execution paths. It then automatically generates customized attack exploitation verification scripts by combining vulnerability characteristics with contract deployment constraints. Subsequently, it constructs a vulnerability exploitability verification framework based on execution feedback to systematically evaluate the vulnerability triggering capability and actual attack impact of the attack exploitation verification scripts, thereby accurately determining whether the vulnerability can be exploited in a real environment.
[0039] Please see Figure 2 , Figure 2 A flowchart illustrating the steps of a vulnerability exploitability verification method according to another embodiment of the present invention. Specifically, it may include the following steps: Step 201: Obtain the function to be tested, and obtain the state read set and state write set of the function to be tested; Step 202: Generate a state dependency model based on the state read set and the state write set; Step 203: Retrieve the set of entry functions that affect the execution state of the function under test according to the state dependency model. The set of entry functions includes several entry functions. Step 204: Determine whether each entry function has an access control modifier; Step 205: If yes, identify the entry function with the access control modifier as a restricted entry function and remove the restricted entry function from the entry function set to obtain the vulnerability path that affects the execution state of the function under test; In this embodiment of the invention, the vulnerability path can first be identified and deduced using fine-grained static program analysis technology to guide the construction of subsequent attack exploit verification scripts. For the function under test, a state dependency model can be established using the state read set and state write set of the function under test, and the dependency formula (1) can be used to automatically retrieve vulnerability paths in the smart contract that may affect the execution state of the function.
[0040] (1)
[0041] in, Represents the function to be tested. The set of dependent functions is used to record potential attack entry points; C represents the scope of the smart contract currently being analyzed; Write represents the set of state variables that the function under test can modify; Read represents the set of state variables that the function depends on; and Access is used to determine whether the function under test has access restrictions such as onlyOwner. This analysis process consists of two core mechanisms: First, based on the derivation of potential triggerable paths according to state read-write dependencies, this involves identifying all update points that share state variables with the function under test, thus constructing a sequence of functions that could potentially trigger the vulnerability. An update point refers to a function that can modify the state variables that the function under test depends on. Once the update points are identified, combining them with the function under test reveals the potential sequence of function triggers for the vulnerability.
[0042] Second, based on access control mechanism filtering word analysis, by parsing whether there are permission control modifiers in the function, restricted entry functions that cannot be called by ordinary attackers are excluded, thereby obtaining the vulnerability path that affects the execution state of the function under test.
[0043] Based on the above analysis, the embodiments of the present invention can determine the real triggerable paths that vulnerabilities may exist without human intervention, and provide semantically complete path-level constraint information for the automated generation of attack exploitation verification scripts.
[0044] Step 206: Obtain the smart contract and its deployment parameters. Input the smart contract, deployment parameters, and vulnerability path into the pre-trained large language model to generate an attack exploit verification script. After obtaining potential vulnerability paths, this embodiment of the invention further constructs a mechanism for generating attack exploit verification scripts based on a large language model. To ensure the generated attack exploit verification scripts possess completeness, executability, and verifiability, this embodiment of the invention designs a dedicated prompt template, which consists of three parts: system prompts, specific attack steps, and script construction constraints. The system prompts are used to define the role and task of the large language model, enabling it to generate structured and executable attack scripts based on the vulnerability paths. The specific attack steps section guides the large language model, following a preset process, to first generate a contract deployment environment based on the contract constructor and deployment parameters, then automatically deduce the attack steps based on the vulnerability paths and vulnerability characteristics, and finally generate a directly executable script. The script construction constraints section specifies the unified structural requirements for the scripts, including the setUp initialization function based on the Foundry framework, the testExploit vulnerability trigger entry function, and additional constraint information that may be required for different vulnerability types, such as contract invariants, block height, or transaction context. All generated scripts are stored in a script corpus for subsequent execution analysis, effect verification, and script optimization, thereby forming a stable, scalable, and sustainably iterative script generation system.
[0045] For ease of understanding, such as Figure 3 As shown, an example of a prompt template is provided, including: Character setup phase: [System Prompt]: You are a smart contract security expert. Your task is to analyze the smart contract I provide and generate a valid exploit verification script to verify vulnerabilities. You must follow user-defined rules. You can only output one executable exploit verification script; no explanation or marking is required.
[0046] The specific steps involved in generating the attack: [Contract Initialization]: [Constructor] is the contract's constructor. You need to analyze the purpose of each parameter in the constructor and generate appropriate initialization values to deploy the contract.
[0047] [Vulnerability Path]: Functions in [Function] may have vulnerabilities in [Vulnerability]. [RelatedFunction] can modify the state variables that [Function] depends on. Please combine these functions with the additional information I have provided to try to exploit the vulnerabilities in the contract and obtain benefits.
[0048] [Vulnerability Characteristics]: One characteristic of this vulnerability is...
[0049] Synthesis constraints: [Generation Requirements]: You need to use forge-std / Test.sol and the setUp function to initialize the environment, and exploit the vulnerability using testExploit.
[0050] [Additional Information]: Block information, related status information.
[0051] This invention proposes for the first time to combine fine-grained static program analysis with a large language model. Through vulnerability path guidance, constraint strengthening, and context injection, it enables the automatic generation and continuous optimization of customized attack scripts for specific vulnerabilities, effectively solving the problems of unstable and uncontrollable script generation in existing technologies.
[0052] Step 207: Execute the attack exploit verification script, and determine the triggerability of the vulnerability corresponding to the vulnerability path based on the execution result to obtain the trigger result; In this embodiment of the invention, the effectiveness of the attack exploitation verification script can be analyzed based on triggerability and exploitability. First, the triggerability of the vulnerability is determined.
[0053] In one example, the steps to determine the triggerability of a vulnerability and obtain the trigger result are as follows: S71 executes an attack exploiting a verification script to obtain the system's final instructions; In the specific implementation, the attack exploit verification script is first analyzed for execution effectiveness through a customized execution environment to determine whether the attack exploit verification script can complete basic execution.
[0054] In one example, S71 may specifically include: executing an attack exploit verification script in a preset virtual machine according to a preset execution flow to obtain the final system instructions.
[0055] In its implementation, the system inputs each exploit verification script into a customized virtual machine for execution. The execution flow consists of the `setUp` and `testExploit` functions within the exploit verification script. `setUp` is used to deploy the vulnerable contract, prepare assets, or initialize the global state. The system ignores all actions in this process during the analysis phase to ensure the results are not interfered with by auxiliary logic in the setup steps. After execution, the system determines whether the exploit verification script executed successfully based on whether the final instruction is `revert`. If `revert` occurs, it is considered a failure. If execution completes successfully, the system further checks whether the script actually triggers the vulnerable behavior according to the triggering rules of the vulnerability type.
[0056] S72 verifies the validity of the attack exploit verification script according to the system's final instructions; S73, if the verification passes, record the attack call chain, execution stack state and PC state changes; S74 detects whether the vulnerability corresponding to the preset triggering rule is triggered based on the attack call chain, execution stack state, and PC state changes, and obtains the triggering result.
[0057] During the attack trigger verification phase, the system automatically records the attack call chain, execution stack state, and PC state changes, while ignoring control flow or data flow changes injected by testing tools such as cheatcode, ensuring that execution analysis is based solely on the actual behavior of the contract. The triggering rules are independently defined by the system for different vulnerabilities, such as detecting unprotected fund transfers, self-destruct calls, reentrancy paths formed by nested function calls, sequential storage read / write chains, or calls to random opcodes related to block attributes. If the corresponding characteristics are observed, the vulnerability is considered successfully triggered. This step, through precise execution judgment and matching with vulnerability triggering rules, achieves an assessment of the attack script's triggering capability at the real semantic level.
[0058] Step 208: Perform profit analysis on the attack using the verification script to obtain the profit results; After completing the execution and triggering judgments, the severity of the vulnerability can be further assessed based on profit analysis to ensure that the vulnerability has real attack value.
[0059] In one example, step 208 may include the following sub-steps: S81, based on the execution result, obtain the changes in the attacker's assets before and after executing the attack exploit verification script; S82, determine the profit result based on changes in assets.
[0060] In the implementation, by embedding event outputs in the execution script, the attacker's asset changes before and after the attack are automatically obtained, including the holding status of the original asset balance. To ensure accurate interpretation of the results, these assets can be subjected to semantic judgment by a large language model to determine whether the attack actually generated economic benefits.
[0061] Step 209: Determine whether the vulnerability can be exploited based on the triggering result and the profit result.
[0062] After collecting all the trigger results and profit results of the attack exploit verification scripts, the final vulnerability exploitability judgment can be given according to the preset decision rules.
[0063] In one example, step 209 may include the following sub-steps: S91: When the trigger result is triggering a vulnerability and the profit result is obtaining a benefit, the vulnerability is determined to be exploitable. S92, if the trigger result is triggering a vulnerability and the profit result is no profit, then the vulnerability is determined to be unexploitable; S93: If the trigger result is that the vulnerability is not triggered and the profit result is that a profit is obtained, then the vulnerability is determined to be unexploitable. S94: If the result of triggering within the preset timeout period is that the vulnerability is not triggered and the result of gaining profit is no gain, then the vulnerability is determined to be unexploitable.
[0064] In a specific implementation, the preset decision rules may include: 1) When an attack can exploit the verification script to simultaneously trigger the vulnerability and gain benefits, the vulnerability is judged to be exploitable and considered to have a real attack threat. 2) If all attacks in the verification script only trigger the vulnerability without any benefit or only gain without triggering the vulnerability, then the vulnerability is determined to be difficult to exploit in a real environment and is therefore deemed unexploitable.
[0065] 3) If no exploit verification script that meets the exploitation conditions appears before the set timeout period expires, it is determined that the vulnerability is difficult to be successfully exploited in a real environment.
[0066] This invention provides the first implementation of a vulnerability exploitability verification framework based on real execution feedback. Through customized virtual machine execution, vulnerability triggering rule matching, and multi-asset benefit analysis, it achieves triple verification of the success of attack script execution, vulnerability triggering, and attack profitability, and can accurately distinguish between two types of risks: "flawed" and "exploitable".
[0067] Furthermore, in this embodiment of the invention, it also includes: When the attack fails to execute the verification script, the complete bytecode sequence during the execution process is collected, and the semantic information that caused the execution failure is obtained. The execution path of the verification script used in the attack was determined based on the complete bytecode sequence; Locate the code and function that failed to execute based on the execution path and semantic information; Identify the core failure statements and their corresponding target functions at the code and function locations, and determine the cause of the failure; Obtain the execution context of the core statement that failed; The update script is obtained by updating the verification script based on the core statements of the failure, the reason for the failure, and the execution context.
[0068] In its implementation, when the exploit verification script fails to complete the vulnerability triggering process during the exploitability verification phase, a feedback-driven update of the exploit verification script can be performed. The system updates and repairs the exploit verification script based on bytecode semantic feedback to achieve automated, fine-grained optimization. The specific algorithm is shown in Table 1. The system first collects the complete bytecode sequence Lb throughout the execution process and extracts the semantic information msg_revert that caused the execution failure from the EVM output. Subsequently, the system analyzes the execution path by reverse tracing the bytecode, locating the source code segments loc and func related to the failure by comparing the mapping relationship between the bytecode and the compiled source code. The system focuses on the conditional statement Check and the critical state update statement StateUpdate, as these statements are often the main reasons for execution termination, such as insufficient balance leading to failed transfers or failed condition checks. Once the core statement and its associated function are identified, the system provides the failed statement, execution context, and failure reason to the large language model, guiding it to repair the script for the specific error, including supplementing missing preconditions, adjusting input parameters, and correcting the call order. The patched attack script PoC_update will be rewritten into the script corpus and enter the next round of verification, thus forming an automatic patching closed loop based on execution semantics, which significantly improves the script's ability to approximate the actual vulnerability triggering path.
[0069] Table 1
[0070] Furthermore, in this embodiment of the invention, it also includes: When an attack completes the execution of a verification script but fails to trigger a vulnerability or achieve its intended gain, the vulnerability type and the failure stage of the attack script are obtained. Obtain the vulnerability type and the primitive operations corresponding to the failure stage of the attack script, and use the primitive operations to enhance and optimize the attack exploit verification script to obtain the updated script.
[0071] In its implementation, when an attack successfully executes the verification script but fails to trigger the vulnerability or gain any exploit, the system selects appropriate primitive operations based on the vulnerability type and the failure stage of the attack script. This enhances the script's optimization, exploring more potential attack paths and improving its exploitability. The system predefines various primitive operations that can adjust the attack script from multiple dimensions, including state changes, caller identity, call order, block environment attributes, and parameter configuration. These include the following primitives: 1) By adding additional user actions to enhance contract state changes, the probability of triggering certain state-sensitive vulnerabilities can be increased; 2) Explore vulnerability paths that depend on invocation permissions by changing the identity of the invoker; 3) A vulnerability that triggers different behaviors due to different execution orders by rearranging the function call order; 4) Explore vulnerabilities that rely on randomness on the blockchain by modifying block numbers or block timestamps; 5) Different state conditions and profit margins can be triggered by adjusting function parameters or transfer amounts.
[0072] The system will automatically modify the Proof-of-Concept (PoC) by sequentially selecting these primitive operations according to applicable rules, and add all newly generated scripts back to the corpus for the next round of verification. Through this dual optimization mechanism based on trigger feedback and benefit feedback, this invention achieves continuous evolution and automatic strengthening of the attack script, gradually approaching the actual exploit conditions of the vulnerability during the iteration process, thereby significantly improving the success rate and coverage of vulnerability exploitability verification.
[0073] This invention proposes for the first time a feedback-driven script update method for vulnerability verification tasks. It locates the cause of failure through bytecode semantics, explores different states and paths by combining primitive operations, and automatically rewrites the Proof-of-Concept (PoC) using a large language model, thereby achieving continuous evolutionary optimization of the PoC and significantly improving the coverage and success rate of vulnerability exploitability verification.
[0074] For ease of understanding, the embodiments of the present invention will be described below through specific examples: like Figure 4 As shown, Figure 4 This is a flowchart illustrating the vulnerability exploitability verification method provided in this embodiment of the invention. Specifically, it includes three stages: vulnerability path-guided attack exploitation verification script generation, feedback-driven attack exploitation verification script update, and attack exploitation verification script effectiveness analysis based on triggerability and exploitability. In the vulnerability path-guided attack exploitation script generation stage, the smart contract, the function to be tested, and the vulnerability report are input into a large language model. The large language model performs contract initialization, vulnerability path analysis, and vulnerability feature analysis to obtain the attack exploitation verification script, which is then stored in a script corpus. In the attack exploitation script effectiveness analysis stage based on triggerability and exploitability, the attack exploitation verification script is executed through a virtual machine (EVM) to obtain the execution result. If the execution is successful, triggerability analysis and profitability analysis are performed, and exploitability analysis is conducted based on the triggering and profitability results. If the vulnerability is triggered and profitable, the vulnerability is determined to be exploitable.
[0075] In the feedback-driven exploit script update phase, if the exploit verification script fails to execute, the exploit verification script is updated through bytecode semantic analysis, and the updated script is stored in the script corpus. If the exploit verification script executes successfully but fails to trigger the vulnerability or gain any benefit, the exploit script is improved using primitives, and the improved script is stored in the script corpus.
[0076] This invention first uses static program analysis technology to identify vulnerability entry points and construct potential vulnerability execution paths. It then automatically generates customized attack exploitation verification scripts by combining vulnerability characteristics with contract deployment constraints. Subsequently, it constructs a vulnerability exploitability verification framework based on execution feedback to systematically evaluate the vulnerability triggering capability and actual attack impact of the attack exploitation verification scripts, thereby accurately determining whether the vulnerability can be exploited in a real environment.
[0077] Please see Figure 5 , Figure 5 This is a structural block diagram of a vulnerability exploitability verification device provided in an embodiment of the present invention.
[0078] This invention provides a vulnerability exploitability verification device, comprising: The vulnerability path acquisition module 501 is used to acquire the function under test and obtain the vulnerability paths that affect the execution state of the function under test from the preset smart contract; The attack exploit verification script generation module 502 is used to obtain the smart contract and the deployment parameters of the smart contract. The smart contract, deployment parameters and vulnerability path are input into the pre-trained large language model to generate the attack exploit verification script. The triggerability judgment module 503 is used to execute the attack exploit verification script and, based on the execution result, to judge the triggerability of the vulnerability corresponding to the vulnerability path and obtain the trigger result. The profit analysis module 504 is used to perform profit analysis on the attack exploit verification script to obtain the profit results. The exploitability assessment module 505 is used to determine whether a vulnerability can be exploited based on the triggering result and the profit result.
[0079] In this embodiment of the invention, the vulnerability path acquisition module 501 includes: The submodule for obtaining the state read set and state write set is used to obtain the function under test and to obtain the state read set and state write set of the function under test; The State Dependency Model Generation Submodule is used to generate a state dependency model based on the state read set and the state write set. The entry function set retrieval submodule is used to retrieve the set of entry functions that affect the execution state of the function under test based on the state dependency relationship model. The entry function set includes several entry functions. The permission control decorator judgment submodule is used to determine whether each entry function has a permission control decorator. The vulnerability path determination submodule is used to determine the entry function with an access control modifier as a restricted entry function if the condition is met, and remove the restricted entry function from the entry function set to obtain the vulnerability path that affects the execution state of the function under test.
[0080] In this embodiment of the invention, the triggerability determination module 503 includes: The system final instruction acquisition submodule is used to execute the attack exploit verification script to obtain the system final instruction. The validity verification submodule is used to verify the validity of the attack exploit verification script based on the system's final instructions; The recording submodule is used to record the attack call chain, execution stack state, and PC state changes if the verification passes. The trigger result acquisition submodule is used to detect whether the vulnerability corresponding to the preset trigger rule is triggered based on the attack call chain, execution stack state and PC state changes, and obtain the trigger result.
[0081] In this embodiment of the invention, the system final instruction acquisition submodule includes: The system final instruction acquisition unit is used to execute the attack exploit verification script in a preset virtual machine according to a preset execution process to obtain the system final instruction.
[0082] In this embodiment of the invention, the profit analysis module 504 includes: The asset change submodule is used to obtain the changes in assets before and after the attacker executes the attack exploit verification script, based on the execution results. The Profit Result Determination Submodule is used to determine the profit result based on changes in assets.
[0083] In this embodiment of the invention, the availability determination module 505 includes: The exploitability determination submodule is used to determine whether a vulnerability is exploitable when the trigger result is a vulnerability trigger and the profit result is gaining benefits. The first unexploitable determination submodule is used to determine that a vulnerability cannot be exploited when the trigger result is a vulnerability trigger and the profit result is no profit. When the second unexploitable determination submodule is used to determine that the vulnerability is not exploitable and the result of triggering is that the vulnerability is not triggered and the result of gaining benefits, the vulnerability is determined to be unexploitable. The third unexploitable determination submodule is used to determine that a vulnerability cannot be exploited if the trigger result is that the vulnerability is not triggered or the profit result is that there is no profit within a preset timeout period.
[0084] In this embodiment of the invention, it further includes: The collection module is used to collect the complete bytecode sequence during the execution process and obtain the semantic information that caused the execution failure when the attack fails to execute the verification script. The execution path determination module is used to determine the execution path of the attack exploit verification script based on the complete bytecode sequence; The code location and function location module is used to locate the code location and function location where execution failed, based on the execution path and semantic information. The module for determining the core failure statement, target function, and cause of failure is used to identify the core failure statement and the target function corresponding to the core failure statement at the code location and function location, and to determine the cause of failure. The execution context acquisition module is used to obtain the execution context of failed core statements; The first update module is used to update the attack exploit verification script based on the failed core statement, the reason for failure, and the execution context, and thus obtain the update script.
[0085] In this embodiment of the invention, it further includes: The vulnerability type and attack script failure stage acquisition module is used to acquire the vulnerability type and attack script failure stage when an attack fails to trigger the vulnerability or achieve attack profit after the verification script has been executed. The second update module is used to obtain the vulnerability type and the primitive operations corresponding to the failure stage of the attack script, and to use the primitive operations to enhance and optimize the attack exploit verification script to obtain the update script.
[0086] This invention also provides an electronic device, which includes a processor and a memory: The memory is used to store program code and transfer the program code to the processor; The processor is used to execute the vulnerability exploitability verification method of the present invention according to the instructions in the program code.
[0087] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0088] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0089] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0090] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0092] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0093] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.
[0094] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.
[0095] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.
[0096] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A vulnerability exploitability verification method, characterized in that, include: Obtain the function to be tested, and retrieve the vulnerability paths that affect the execution state of the function to be tested from the preset smart contract; Obtain the smart contract and its deployment parameters, input the smart contract, the deployment parameters, and the vulnerability path into a pre-trained large language model, and generate an attack exploit verification script; The attack exploit verification script is executed, and the triggerability of the vulnerability corresponding to the vulnerability path is determined based on the execution result to obtain the trigger result; The attack was analyzed using a verification script to determine the profit outcome. The vulnerability can be exploited based on the triggering result and the profit result.
2. The method according to claim 1, characterized in that, The step of obtaining the function to be tested and obtaining the vulnerability path affecting the execution state of the function to be tested from the preset smart contract includes: Obtain the function to be tested, and obtain the state read set and state write set of the function to be tested; A state dependency model is generated based on the state read set and the state write set; The set of entry functions that affect the execution state of the function under test is retrieved according to the state dependency model, and the set of entry functions includes several entry functions; Determine whether each of the aforementioned entry functions contains an access control modifier; If so, the entry function containing the access control modifier is identified as a restricted entry function, and the restricted entry function is removed from the set of entry functions to obtain the vulnerability path that affects the execution state of the function under test.
3. The method according to claim 1, characterized in that, The steps of executing the attack exploit verification script and determining the triggerability of the vulnerability corresponding to the vulnerability path based on the execution result to obtain the triggering result include: The attack utilizes a verification script to obtain the system's final instructions. The system's final instructions are used to validate the attack using a verification script. If the verification passes, record the attack call chain, execution stack state, and PC state changes; Based on the attack call chain, the execution stack state, and the PC state changes, it is detected whether the vulnerability corresponding to the preset triggering rule is triggered, and the triggering result is obtained.
4. The method according to claim 3, characterized in that, The step of executing the attack to obtain the final system instruction using the verification script includes: According to the preset execution process, the attack exploit verification script is executed in the preset virtual machine to obtain the final system instruction.
5. The method according to claim 1, characterized in that, The step of performing profit analysis on the attack using a verification script to obtain a profit result includes: Based on the execution results, obtain the changes in the attacker's assets before and after executing the attack exploit verification script; The profit result is determined based on the changes in the assets.
6. The method according to claim 1, characterized in that, The step of determining whether the vulnerability can be exploited based on the triggering result and the profit result includes: When the triggering result is triggering a vulnerability and the profit result is obtaining a benefit, the vulnerability is determined to be exploitable. If the triggering result is a vulnerability being triggered and the profit result is no profit, then the vulnerability is determined to be unexploitable. If the triggering result is that the vulnerability is not triggered and the profit result is that a profit is obtained, then the vulnerability is determined to be unexploitable. If the triggering result is that the vulnerability is not triggered and the profit result is that there is no profit within the preset timeout period, then the vulnerability is determined to be unexploitable.
7. The method according to claim 1, characterized in that, Also includes: When the attack fails to execute the verification script, the complete bytecode sequence during the execution process is collected, and the semantic information that caused the execution failure is obtained. The execution path of the verification script used in the attack is determined based on the complete bytecode sequence. Based on the execution path and the semantic information, locate the code location and function location where execution failed; Identify the core failure statement and the target function corresponding to the core failure statement at the code location and the function location, and determine the cause of failure; Obtain the execution context of the core statement that failed; The attack exploit verification script is updated based on the failed core statement, the reason for failure, and the execution context to obtain the updated script.
8. The method according to claim 1, characterized in that, Also includes: When the attack completes the execution of the verification script but fails to successfully trigger the vulnerability or achieve the attack's profit, the vulnerability type and the failure stage of the attack script are obtained. Obtain the primitive operations corresponding to the vulnerability type and the failure stage of the attack script, and use the primitive operations to enhance and optimize the attack exploit verification script to obtain an updated script.
9. A vulnerability exploitability verification device, characterized in that, include: The vulnerability path acquisition module is used to acquire the function under test and obtain the vulnerability paths that affect the execution state of the function under test from a preset smart contract; The attack utilizes a verification script generation module to obtain the smart contract and its deployment parameters. The smart contract, deployment parameters, and vulnerability path are then input into a pre-trained large language model to generate an attack exploit verification script. The triggerability determination module is used to execute the attack exploit verification script and determine the triggerability of the vulnerability corresponding to the vulnerability path based on the execution result, so as to obtain the triggering result; The profit analysis module is used to perform profit analysis on the attack using the verification script to obtain the profit result; The exploitability assessment module is used to determine whether the vulnerability can be exploited based on the triggering result and the profit result.
10. An electronic device, characterized in that, The device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute the vulnerability exploitability verification method according to any one of claims 1-8 according to the instructions in the program code.