A transaction context generation strategy construction method for smart contract fuzz testing

Abstract

This invention proposes a method for constructing transaction context generation strategies for smart contract fuzz testing. The method includes: modeling the transaction context of a smart contract function call as a triple containing the transaction sender, transaction amount, and function call parameters; abstracting the transaction context generation logic into an executable generation strategy; obtaining an initial set of generation strategies and using a large language model to perform code-level mutations on the initial generation strategies in the initial set to form candidate generation strategies; mutation types include code concatenation, code completion, and code rewriting; dynamically evaluating the coverage of the candidate generation strategies, and based on the coverage feedback generated by the triples generated by executing the candidate generation strategies in the smart contract execution environment, selecting high-value strategies for new coverage and deleting redundant strategies. This method improves deep path coverage capabilities while reducing the frequency of large language model calls and test execution overhead.

Description

Technical Field

[0001] This invention proposes a method for constructing a transaction context generation strategy for smart contract fuzz testing, belonging to the field of software testing technology. Background Technology

[0002] Smart contracts are executable programs deployed and running on a blockchain platform, capable of automatically executing logic such as asset transfer, access control, and state updates when preset conditions are met. Fuzzing is a technique that discovers vulnerabilities by automatically generating a large number of test inputs and observing the program's execution behavior. Compared to formal verification, symbolic execution, and static analysis, fuzzing offers advantages such as high automation, relatively convenient engineering implementation, and the ability to directly generate reproducible test cases, thus becoming an important technical approach in smart contract vulnerability detection.

[0003] Existing fuzzing methods for smart contracts still have shortcomings in transaction context generation. Many methods focus primarily on generating or mutating function parameters, while neglecting transaction environment information such as the transaction sender and transaction amount. Traditional software fuzzing typically uses byte inputs or function parameters as the main mutation targets, but smart contracts have distinct on-chain transaction semantics. Simply generating or mutating function parameters randomly often fails to satisfy the require conditions, permission checks, and amount verifications within the contract. This results in a large number of test cases being rejected early in function execution, leading to low test input effectiveness and slow improvement in path coverage. Therefore, current technology lacks a transaction context generation method that can balance contract semantic understanding, execution efficiency, and coverage feedback optimization capabilities. Summary of the Invention

[0004] This invention provides a method for constructing a transaction context generation strategy for smart contract fuzz testing, in order to solve the problems mentioned above: This invention proposes a method for constructing a transaction context generation strategy for smart contract fuzz testing, the method comprising: The transaction context of a smart contract function call is modeled as a triple containing the transaction sender, transaction amount, and function call parameters; The logic for generating the transaction context is abstracted into an executable generation strategy, which is used to generate at least one of the triples at runtime. An initial generation strategy set is obtained, and the initial generation strategies in the initial generation strategy set are mutated at the code level using a large language model to form candidate generation strategies; the mutation types include code concatenation, code completion, and code rewriting. The candidate generation strategies are dynamically evaluated for coverage. Based on the coverage feedback generated by the triples generated by the candidate generation strategies in the smart contract execution environment, high-value strategies with new coverage are selected and redundant strategies are deleted. For the selected high-value strategy set, a local search algorithm based on maximum coverage is used to select a subset of strategies with complementary coverage capabilities, and a transaction context generation strategy library for smart contract fuzz testing is constructed.

[0005] Furthermore, the code concatenation includes: taking partial code from multiple initial generation strategies as input, and having the large language model generate supplementary code at the code connection points; The code completion includes: retaining the header code of the initial generation strategy, and having the large language model complete the subsequent code based on the header code and the semantic information of the smart contract under test; The code rewriting includes: selecting a code segment to be replaced from the initial generation strategy, and having the large language model generate a new code segment to replace the code segment to be replaced based on the semantic information and prompt word requirements of the smart contract under test.

[0006] Furthermore, when using a large language model for code-level mutation, a unified prompt word is constructed and input to the large language model. The prompt word includes the task description, the code of the smart contract to be tested, and the code of the initial generation strategy. The task description is used to indicate the type of the current mutation, the code of the smart contract under test is used to provide the semantic context of the smart contract under test, and the code of the initial generation strategy serves as the direct editing object of the large language model.

[0007] Furthermore, after the candidate generation strategy is formed, the candidate generation strategy is subjected to syntax checking and pre-run verification. The syntax check is used to determine whether the candidate generation strategy code conforms to the syntax rules of the target programming language, and the pre-run verification is used to determine whether the candidate generation strategy has a unified input and output interface, whether it can return a valid triplet structure, and whether there are undefined variables or unexecutable code. Candidate generation strategies that fail the checks or validations are resubmitted to the large language model for repair.

[0008] Furthermore, the dynamic coverage evaluation of the candidate generation strategy includes: Run the candidate generation strategy within the preset execution budget to generate at least one triplet. Input the transaction sender, transaction amount and function call parameters in the triplet into the smart contract execution environment for execution. Record the coverage set corresponding to the candidate generation strategy. The coverage set is a set consisting of the covered program positions recorded in the coverage feedback. Maintain an overlay mapping, which is used to store the correspondence between the retained generation strategies and their overlay sets; For each candidate generation strategy, its coverage set is compared with the coverage set of existing strategies in the current coverage map: If the coverage set of a candidate generation strategy is completely contained within the coverage set of an existing strategy, then the candidate generation strategy is determined to be a redundant strategy and is deleted. If the coverage set of a candidate generation strategy contains the coverage set of an existing strategy and contains new coverage positions, then record the coverage dominance relationship from the existing strategy to the candidate generation strategy. If a candidate generation strategy is not covered by any existing strategy, then the candidate generation strategy is added to the strategy space and the coverage mapping is updated.

[0009] Furthermore, the local search algorithm based on maximum coverage is specifically as follows: Randomly select N policies from the policy space to form an initial policy subset E; Repeat the replacement operation, replacing a policy in the initial policy subset E with a policy that was not selected in the policy space. If the joint cover set of the new policy subset E' obtained after the replacement is greater than the joint cover set of the original policy subset E, then the replacement is accepted; the joint cover set is the size of the union of all policy cover sets in the policy subset. Perform T random restarts, each starting with a different initial subset of strategies for a local search. Select the subset of strategies with the largest joint coverage from all search results as the final trading context to generate the strategy library.

[0010] Furthermore, the initial generation strategy set is constructed based on the ABI information, function signature, parameter type, state variables, decorators, and conditional statements in the function body of the smart contract under test.

[0011] Furthermore, the large language model includes: a general-purpose code large language model, a large language model trained on smart contract code, a locally deployed large language model, and a cloud-based large language model invoked via an interface.

[0012] Furthermore, the code implementation languages ​​of the candidate generation strategy include Python, JavaScript, TypeScript, and Solidity.

[0013] Furthermore, the methods for collecting the coverage feedback include EVM instrumentation, bytecode basic block recording, Solidity source code mapping, test framework event callbacks, and execution trajectory analysis.

[0014] The beneficial effects of this invention are as follows: This invention does not simply use a large language model to generate a number of test inputs, but rather uses a large language model to obtain strategy code that can continuously generate transaction contexts, thereby improving the effectiveness, reusability, and execution efficiency of input generation in smart contract fuzzing; This invention can precipitate and reuse effective generation logic, so that subsequent fuzzing does not need to search or call the large language model again to generate inputs each time, thereby improving testing efficiency and strategy evolution capability; Since the output of the large language model is a reusable generation strategy, rather than a one-time test input, it can significantly reduce the time cost and instability caused by frequently calling the large language model in the main loop of fuzzing. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of a transaction context generation strategy construction method for smart contract fuzz testing as described in this invention. Detailed Implementation

[0016] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0017] Numerous specific details are set forth in the following description to provide a thorough understanding of the invention. The described embodiments are only a part of, and not all, of the embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0019] One embodiment of the present invention provides a method for constructing a transaction context generation strategy for smart contract fuzz testing, the method comprising: The transaction context of a smart contract function call is modeled as a triple containing the transaction sender, transaction amount, and function call parameters; The logic for generating the transaction context is abstracted into an executable generation strategy, which is used to generate at least one of the triples at runtime. An initial generation strategy set is obtained, and the initial generation strategies in the initial generation strategy set are mutated at the code level using a large language model to form candidate generation strategies; the mutation types include code concatenation, code completion, and code rewriting. The candidate generation strategies are dynamically evaluated for coverage. Based on the coverage feedback generated by the triples generated by the candidate generation strategies in the smart contract execution environment, high-value strategies with new coverage are selected and redundant strategies are deleted. For the selected high-value strategy set, a local search algorithm based on maximum coverage is used to select a subset of strategies with complementary coverage capabilities, and a transaction context generation strategy library for smart contract fuzz testing is constructed. The strategies in the strategy library can be used as inputs for the next round of large language model strategy mutation.

[0020] The working principle and effects of the above technical solution are as follows: First, the transaction inputs required for smart contract fuzzing are uniformly modeled as triples (sender, value, args), covering the transaction sender, transaction amount, and function parameters. Then, the logic for generating triples is abstracted into reusable generation strategies (i.e., executable code). After obtaining the initial strategy set, a large language model is used to perform code-level mutations (including concatenation, completion, and rewriting) on ​​existing strategies, generating candidate strategies with stronger semantic targeting. For each candidate strategy, its generated triples are run in the smart contract execution environment, coverage feedback is collected, and a coverage set is formed. High-value strategies that can bring new coverage are selected based on coverage dominance relationships, while redundant strategies are eliminated. Finally, a local search algorithm based on maximum coverage is used to select a subset of strategies with complementary coverage capabilities from the high-value strategies, constructing a strategy library for efficient use by the fuzzing engine. To improve the effectiveness of test inputs, transaction contexts are uniformly modeled as triples and targeted strategies are generated, making it easier for the generated transaction contexts to meet permission, amount, and parameter constraints, significantly reducing the proportion of invalid test cases rejected due to unmet preconditions. To enhance deep vulnerability discovery capabilities, high-value strategies are filtered based on coverage feedback, and a subset of complementary strategies is selected. This enables continuous exploration of complex paths and improves coverage of deep code branches that depend on specific transaction senders, amounts, or parameter combinations. To reduce the cost of calling the large language model, the large language model is used only for offline, phased strategy mutation and expansion, rather than being generated in real-time for each test input in the fuzzing main loop, significantly reducing call frequency, time overhead, and resource consumption. To improve strategy reusability and evolution capabilities, the generation logic is abstracted into strategy code, effectively accumulating reusable generation logic and supporting iterative mutation driven by coverage feedback to continuously evolve the strategy space, avoiding redundant searches. To reduce strategy redundancy and improve testing efficiency, redundant strategies are eliminated through coverage dominance relationships, and a subset of complementary strategies is selected based on maximum coverage, preventing the execution budget from being consumed by low-value or repetitive strategies and improving the overall efficiency of fuzzing.

[0021] In one embodiment of the present invention, the code concatenation includes: taking partial code from multiple initial generation strategies as input, and having the large language model generate supplementary code at the code connection points; The code completion includes: retaining the header code of the initial generation strategy, and having the large language model complete the subsequent code based on the header code and the semantic information of the smart contract under test; The code rewriting includes: selecting a code segment to be replaced from the initial generation strategy, and having the large language model generate a new code segment to replace the code segment to be replaced based on the semantic information and prompt word requirements of the smart contract under test.

[0022] In specific application scenarios, code concatenation refers to taking portions of the code from two or more existing generation strategies as input, and having a large language model generate supplementary code at the connection points, enabling the effective logic from different strategies to combine to form new candidate strategies. For example, one parent strategy might contain logic for selecting the transaction sender, while another parent strategy might contain logic for generating the transaction amount or function parameters. The large language model can generate necessary intermediate logic, variable transformation logic, or conditional judgment logic between the two, thereby forming a new complete strategy. Code completion refers to retaining the first half or header code of the parent strategy, and having the large language model complete the subsequent code based on the existing code and the semantics of the contract under test, enabling the strategy to generate a complete transaction context. Code rewriting refers to selecting a section of code to be replaced from the parent strategy, and having the large language model generate a new code fragment to replace that section based on the contract semantics and prompt requirements, thereby changing the generation logic of the original strategy. Through these three types of variation, this invention can introduce new semantic inference logic, boundary value generation logic, account selection logic, amount calculation logic, or parameter association logic while retaining the existing effective strategy structure, thus expanding the transaction context generation strategy space.

[0023] The header code refers to the prefix code from the start position to a preset truncation point. This preset truncation point is determined by specific comments in the code, incomplete statement structures, or the position before a function return statement. The large language model then completes the subsequent code based on the prefix code and the semantic information of the smart contract under test. In one embodiment of the present invention, when performing code-level mutation using a large language model, a unified prompt word is constructed and input to the large language model. The prompt word includes a task description, the code of the smart contract to be tested, and the code of the initial generation strategy. The task description is used to indicate the type of the current mutation, the code of the smart contract under test is used to provide the semantic context of the smart contract under test, and the code of the initial generation strategy serves as the direct editing object of the large language model.

[0024] The working principle and effect of the above technical solution are as follows: When using a large language model for code-level mutation, this solution first constructs a unified prompt word input to the large language model. This prompt word consists of three parts: a task description, the code of the smart contract to be tested, and the code of the initial generation strategy. The task description indicates the type of mutation to be performed (code concatenation, code completion, or code rewriting), enabling the large language model to understand the goal of this edit. The code of the smart contract to be tested provides semantic context, allowing the large language model to perceive the logic in the contract, such as permission judgments, monetary constraints, and parameter dependencies, thereby generating more targeted strategy code. The code of the initial generation strategy serves as the direct editing object for the large language model. Based on this code, the large language model makes local modifications according to the task description and outputs candidate generation strategies that conform to the interface agreement. Through the above prompt word structure, this solution transforms the large language model from a black-box tool that "directly generates test input" into a code mutation tool that "performs controlled editing on existing code." Improve the targeting and effectiveness of mutations: By incorporating the code of the smart contract under test into the prompt words, the large language model can understand the specific constraints in the contract (such as permission judgment and amount calculation relationship), and the generated candidate strategies are more in line with the semantic features of the target contract, avoiding the blind generation of logic that is irrelevant to the contract.

[0025] To ensure the stability of mutation operations, the mutation type is explicitly specified in the task description, and the initial policy code is used as the direct editing target. The output of the large language model is restricted to local modifications, avoiding problems such as unstable output format and chaotic code structure caused by the free generation of large language models. The output parsing cost is reduced because the mutation operation is a local editing based on the existing policy code. The output results naturally inherit the interface structure and programming specifications of the original code, and can directly enter the subsequent syntax checking and pre-run validation stages without additional parsing and adaptation. The efficiency of policy space exploration is improved. The unified prompt word framework enables the large language model to generate candidate policies in batches and stably, supporting the rapid expansion of the policy space and providing sufficient candidate input for subsequent coverage evaluation and policy selection.

[0026] In one embodiment of the present invention, after the candidate generation strategy is formed, the candidate generation strategy is subjected to syntax checking and pre-run verification. The syntax check is used to determine whether the candidate generation strategy code conforms to the syntax rules of the target programming language, and the pre-run verification is used to determine whether the candidate generation strategy has a unified input and output interface, whether it can return a valid triplet structure, and whether there are undefined variables or unexecutable code. Candidate generation strategies that fail the checks or validations are resubmitted to the large language model for repair.

[0027] This verification process can reduce the overhead caused by invalid policies entering the subsequent dynamic execution phase.

[0028] In one embodiment of the present invention, the dynamic coverage evaluation of the candidate generation strategy includes: Run the candidate generation strategy within the preset execution budget to generate at least one triplet. Input the transaction sender, transaction amount and function call parameters in the triplet into the smart contract execution environment for execution. Record the coverage set corresponding to the candidate generation strategy. The coverage set is a set consisting of the covered program positions recorded in the coverage feedback. Maintain an overlay mapping, which is used to store the correspondence between the retained generation strategies and their overlay sets; For each candidate generation strategy, its coverage set is compared with the coverage set of existing strategies in the current coverage map: If the coverage set of a candidate generation strategy is completely contained within the coverage set of an existing strategy, then the candidate generation strategy is determined to be a redundant strategy and is deleted. If the coverage set of a candidate generation strategy includes the coverage set of an existing strategy and contains new coverage positions, then the coverage dominance relationship from the existing strategy to the candidate generation strategy is recorded, and the priority of the dominated strategy can be deleted or reduced accordingly. If a candidate generation strategy is not covered by any existing strategy, then the candidate generation strategy is added to the strategy space and the coverage mapping is updated.

[0029] The above process can suppress the growth of redundant strategies while continuously introducing new strategies, thus maintaining a high quality of the strategy space.

[0030] After the coverage evaluation and screening phase, the strategy space may still contain many effective strategies. While each of these strategies has a certain coverage capability, in actual fuzzing, retaining and executing all of them could lead to fragmented execution budgets, increased scheduling costs, and duplicate strategy calls. Therefore, this invention further implements a diversity strategy selection phase, selecting a fixed number or a preset proportion of strategies from the current strategy space as the final transaction context generation strategy library for fuzzing. The goal of this phase is not to select a single strategy with the largest coverage, but rather to select a set of complementary strategies with complementary coverage capabilities, maximizing the joint coverage of the set. A local search algorithm based on maximum coverage is used for strategy selection. One embodiment of the present invention, the local search algorithm based on maximum coverage, specifically includes: Randomly select N policies from the policy space to form an initial policy subset E; Repeat the replacement operation, replacing a policy in the initial policy subset E with a policy that was not selected in the policy space. If the joint cover set of the new policy subset E' obtained after the replacement is greater than the joint cover set of the original policy subset E, then the replacement is accepted; the joint cover set is the size of the union of all policy cover sets in the policy subset. Perform T random restarts, each starting with a different initial subset of strategies for a local search. Select the subset of strategies with the largest joint coverage from all search results as the final trading context to generate the strategy library.

[0031] By selecting strategies based on maximum coverage, this invention avoids the coverage duplication problem caused by greedy selection based solely on the coverage size of individual strategies. For example, some strategies may have large individual coverage areas but highly overlap with each other; while other strategies, although having smaller individual coverage areas, can cover special branches that the former cannot. If only the strategy with the largest coverage is selected, critical paths reached by the latter may be missed. This invention, by maximizing the joint coverage of the strategy set, makes the final strategy library more diverse and complementary, and more suitable as the basis for generating transaction contexts in smart contract fuzzing.

[0032] In one embodiment of the present invention, the initial generation strategy set is constructed based on the ABI information, function signature, parameter type, state variables, decorators, and conditional statements in the function body of the smart contract under test.

[0033] In one embodiment of the present invention, the large language model includes: a general-purpose code large language model, a large language model for training smart contract code, a locally deployed large language model, and a cloud-based large language model invoked via an interface.

[0034] In implementing this invention, various large language models can be used as policy mutation models, including but not limited to general-purpose code large language models, large language models trained on smart contract code, locally deployed large language models, or cloud-based large language models called via APIs. As long as the model can generate or modify code based on input prompts, it can be used in the policy mutation stage of this invention.

[0035] In one embodiment of the present invention, the code implementation language of the candidate generation strategy includes Python, JavaScript, TypeScript, and Solidity.

[0036] The implementation language of the selection strategy code is not limited to a specific language. It can be implemented using Python, JavaScript, TypeScript, Solidity test scripts, or other languages ​​that can be called by the fuzzing framework.

[0037] In one embodiment of the present invention, the acquisition method of the coverage feedback includes EVM instrumentation, bytecode basic block recording, Solidity source code mapping, test framework event callback, and execution trajectory analysis.

[0038] The key to this invention lies in elevating transaction context generation from "single input generation" to "generation strategy optimization," and using a large language model for offline and phased mutation of strategy code, rather than directly generating input for each execution during fuzzing. Through this design, the invention fully leverages the large language model's understanding of smart contract semantics, filters out invalid and redundant strategies through coverage feedback, and constructs a diverse strategy library through maximum coverage selection. Ultimately, this invention improves the accuracy and effectiveness of transaction context generation in smart contract fuzzing, enhances deep path coverage, and reduces the frequency of large language model calls and test execution overhead.

[0039] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0040] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0041] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0042] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0043] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for constructing a transaction context generation strategy for smart contract fuzz testing, characterized in that, The method includes: The transaction context of a smart contract function call is modeled as a triple containing the transaction sender, transaction amount, and function call parameters; The logic for generating the transaction context is abstracted into an executable generation strategy, which is used to generate at least one of the triples at runtime. An initial generation strategy set is obtained, and the initial generation strategies in the initial generation strategy set are mutated at the code level using a large language model to form candidate generation strategies; the mutation types include code concatenation, code completion, and code rewriting. The candidate generation strategies are dynamically evaluated for coverage. Based on the coverage feedback generated by the triples generated by the candidate generation strategies in the smart contract execution environment, high-value strategies with new coverage are selected and redundant strategies are deleted. For the selected high-value strategy set, a local search algorithm based on maximum coverage is used to select a subset of strategies with complementary coverage capabilities, and a transaction context generation strategy library for smart contract fuzz testing is constructed.

2. The method according to claim 1, characterized in that, The code concatenation includes: taking partial code from multiple initial generation strategies as input, and having the large language model generate supplementary code at the code connection points; The code completion includes: retaining the header code of the initial generation strategy, and having the large language model complete the subsequent code based on the header code and the semantic information of the smart contract under test; The code rewriting includes: selecting a code segment to be replaced from the initial generation strategy, and having the large language model generate a new code segment to replace the code segment to be replaced based on the semantic information and prompt word requirements of the smart contract under test.

3. The method according to claim 1, characterized in that, When performing code-level mutation using a large language model, a unified prompt word is constructed and input to the large language model. The prompt word includes the task description, the code of the smart contract to be tested, and the code of the initial generation strategy. The task description is used to indicate the type of the current mutation, the code of the smart contract under test is used to provide the semantic context of the smart contract under test, and the code of the initial generation strategy serves as the direct editing object of the large language model.

4. The method according to claim 1, characterized in that, After the candidate generation strategy is formed, the candidate generation strategy is subjected to syntax checking and pre-run verification. The syntax check is used to determine whether the candidate generation strategy code conforms to the syntax rules of the target programming language, and the pre-run verification is used to determine whether the candidate generation strategy has a unified input and output interface, whether it can return a valid triplet structure, and whether there are undefined variables or unexecutable code. Candidate generation strategies that fail the checks or validations are resubmitted to the large language model for repair.

5. The method according to claim 1, characterized in that... The dynamic coverage evaluation of the candidate generation strategy includes: Run the candidate generation strategy within the preset execution budget to generate at least one triplet. Input the transaction sender, transaction amount and function call parameters in the triplet into the smart contract execution environment for execution. Record the coverage set corresponding to the candidate generation strategy. The coverage set is a set consisting of the covered program positions recorded in the coverage feedback. Maintain an overlay mapping, which is used to store the correspondence between the retained generation strategies and their overlay sets; For each candidate generation strategy, its coverage set is compared with the coverage set of existing strategies in the current coverage map: If the coverage set of a candidate generation strategy is completely contained within the coverage set of an existing strategy, then the candidate generation strategy is determined to be a redundant strategy and is deleted. If the coverage set of a candidate generation strategy contains the coverage set of an existing strategy and contains new coverage positions, then record the coverage dominance relationship from the existing strategy to the candidate generation strategy. If a candidate generation strategy is not covered by any existing strategy, then the candidate generation strategy is added to the strategy space and the coverage mapping is updated.

6. The method according to claim 1, characterized in that, The local search algorithm based on maximum coverage is specifically as follows: Randomly select N policies from the policy space to form an initial policy subset E; Repeat the replacement operation, replacing a policy in the initial policy subset E with a policy that has not been selected in the policy space. If the joint cover set of the new policy subset E' obtained after the replacement is greater than the joint cover set of the original policy subset E, then the replacement is accepted. The joint cover set is the size of the union of all policy cover sets in the policy subset. Perform T random restarts, each starting with a different initial subset of strategies for a local search. Select the subset of strategies with the largest joint coverage from all search results as the final trading context to generate the strategy library.

7. The method according to claim 1, characterized in that, The initial generation strategy set is constructed based on the ABI information, function signature, parameter type, state variables, decorators, and conditional statements in the function body of the smart contract under test.

8. The method according to claim 1, characterized in that, The large language model includes: a general-purpose code large language model, a large language model for training smart contract code, a locally deployed large language model, and a cloud-based large language model called via an interface.

9. The method according to claim 1, characterized in that, The code implementation languages ​​for the candidate generation strategy include Python, JavaScript, TypeScript, and Solidity.

10. The method according to claim 1, characterized in that, The methods for collecting coverage feedback include EVM instrumentation, bytecode basic block recording, Solidity source code mapping, test framework event callbacks, and execution trajectory analysis.

Images