A smart contract bytecode security auditing method and system based on multi-agent cooperation

Abstract

The application discloses a kind of smart contract bytecode security audit method and system based on multi-agent cooperation, and wherein method includes: the underlying machine instruction of binary bytecode is converted into high-level behavior operator, for building micro function level control flow graph and macro contract level call correlation graph;Microscopic feature vector is injected into the node feature updating process of macro contract level call correlation graph, generates contract multidimensional topology fingerprint;High-level behavior operator sequence feature is input into sequential flow channel, and contract multidimensional topology fingerprint is input into structure flow channel;After aligning the feature space of double channel, micro function level defect and operator position are diagnosed;After encapsulating contract multidimensional topology fingerprint and micro function level defect and operator position, logical deduction is carried out through high-level large language model;The deduction conclusion is checked for graph reachability, and structured security audit report is generated.The application can effectively improve function level vulnerability positioning accuracy, and reduce the misjudgment problem of large language model.

Description

Technical Field

[0001] This invention relates to the field of blockchain security and automated software auditing technology, and more specifically to a method and system for security auditing of smart contract bytecode based on multi-agent collaboration. Background Technology

[0002] With the rapid development of blockchain technology, smart contracts carry massive amounts of digital assets, and their security has become a core pain point in the decentralized ecosystem. Currently, the security auditing of smart contracts is facing a multi-level technical bottleneck caused by the purely closed-source environment.

[0003] Since the vast majority of smart contracts on the blockchain do not have publicly available source code, security audits must be conducted at the pure bytecode level. However, high-level control flow and data structure features are severely de-semantized during compilation, making it extremely difficult for existing models to handle instruction variations caused by compilation optimizations or obfuscation techniques, and thus unable to accurately capture the underlying topology of the program. This lack of features in the pure bytecode de-semanticization scenario further limits the ability of deep learning models to mine the massive amounts of unlabeled contract data on the blockchain, causing existing vulnerability analysis techniques to remain mostly at the coarse-grained retrieval stage at the contract level, making it difficult to achieve precise defect location and attribution at the function level.

[0004] To address these bottlenecks, recent research has attempted to incorporate large language models, which excel in understanding complex macro-level business logic, into security auditing. However, because large language models lack the aforementioned factual support of objective program analysis and quantitative defect characteristics when independently performing code audits, they are highly susceptible to serious logical misjudgments and "illusions" when faced with intricate economic models and contract calls. While existing low-level static or dynamic detection tools can output objective evidence, they completely lack the ability to extrapolate high-level business flows.

[0005] Therefore, how to break through the semantic representation bottleneck in the pure bytecode environment, achieve automatic self-supervised alignment of fine-grained function-level defects in massive unlabeled data, and establish a collaborative mechanism that can inject the characteristics of underlying objective facts into high-level large language models without loss to completely suppress illusions are the technical problems that urgently need to be solved in the field of automated auditing of smart contracts. Summary of the Invention

[0006] In view of the above problems, the present invention proposes a method and system for security auditing of smart contract bytecode based on multi-agent collaboration, which aims to overcome or at least partially solve the above problems.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] In a first aspect, the present invention provides a method for security auditing of smart contract bytecode based on multi-agent collaboration, comprising: Obtain the binary bytecode of the smart contract to be audited, and convert the underlying machine instructions of the binary bytecode into high-level behavioral operators; Based on the high-level behavioral operators, a micro-function-level control flow graph and a macro-contract-level call association graph are constructed; the micro-feature vectors of the micro-function-level control flow graph are injected into the node feature update process of the macro-contract-level call association graph using a hierarchical residual topology network to generate a multi-dimensional topological fingerprint of the contract. A dual-channel network comprising a sequential flow channel and a structured flow channel is constructed; the sequence features of the high-level behavioral operators are input into the sequential flow channel, and the multidimensional topological fingerprint of the contract is input into the structured flow channel; the feature space of the dual-channel network is aligned through a cross-modal self-supervised contrastive learning mechanism, and micro-function-level defects and operator positions are diagnosed based on the gradient saliency attribution mechanism; After the central scheduling agent encapsulates the multidimensional topological fingerprint of the contract and the micro-function level defects and operator positions, it injects them into the high-level large language model for logical deduction. The topology verification agent then performs graph reachability verification on the deduction conclusions and generates a structured security audit report.

[0009] Furthermore, the step of converting the low-level machine instructions of the binary bytecode into high-level behavioral operators specifically includes: The combined semantic patterns in the underlying machine instructions are identified using a sliding window detection algorithm; When a PUSHx instruction is detected followed immediately by a JUMP or JUMPI instruction, the instruction pair is identified as a control flow jumper program entry mode, abstracted into a control operator, and the symbolic representation of the jump target address is marked. When a PUSH32 instruction is detected followed immediately by an SSTORE or SLOAD instruction, the instruction sequence is identified as a persistent storage access pattern, abstracted as a data operator, and associated with a symbolic representation of the storage slot index. When the PUSH32 instruction is detected followed immediately by the LOG0 to LOG4 instructions, this instruction sequence is identified as an event topic hash pattern and abstracted as a transmission operator. When a combination of a PUSH4 instruction followed by an EQ instruction and a JUMPI instruction is detected in the scheduler code block, this instruction set is identified as a function selector routing pattern, abstracted as a control operator, and the mapping relationship between the function signature hash value and the corresponding jump target address is marked.

[0010] Furthermore, the construction of the micro-function-level control flow graph and the macro-contract-level call association graph based on the high-level behavioral operators specifically includes: Using each independent function within the smart contract to be audited as an analysis unit, the boundary range and entry address of each independent function are automatically identified by statically parsing the function selector and jump table in the binary bytecode, and a corresponding micro-function-level control flow graph is constructed for each independent function. Each micro-function-level control flow graph is abstracted into a macro-topology node, and a macro-contract-level call association graph is constructed based on the call relationships and data transfer relationships between independent functions.

[0011] Furthermore, the node feature update process of the macro-contract-level call association graph is represented as follows:

[0012] in, This represents the first macro-contract level call association diagram. The macroscopic topology node at the ... The node feature vectors in the graph convolutional layer, and , Indicates the first The micro-feature vector of the micro-function-level control flow graph corresponding to each macro-topological node; Represents a non-linear activation function; This indicates the relationship between the macro-contract level call association diagram and the first... The set of neighboring function nodes connected to a macroscopic topological node; Indicates the first When the convolutional layer is in the figure, the first The first macroscopic topology node and the first Graph attention coefficients between macroscopic topological nodes; Indicates the first The weight transformation matrix of the convolutional layer; Indicates the first The macroscopic topology node at the ... Node feature vectors in graph convolutional layers; Indicates the residual control factor; This represents the linear alignment matrix of microscopic features.

[0013] Furthermore, the alignment of the feature space of the dual-channel network through the cross-modal self-supervised contrastive learning mechanism specifically includes: Project the sequential flow feature vector output by the sequential flow channel and the structural flow feature vector output by the structural flow channel onto a high-dimensional common semantic space to obtain the corresponding sequential flow feature projection vector and structural flow feature projection vector. Within a training batch, the sequential flow feature projection vector and the structural flow feature projection vector of the same smart contract are constructed as homologous positive sample pairs, and the structural flow feature projection vectors of other different smart contracts within the same training batch are constructed as non-homologous negative samples with the sequential flow feature projection vector of the current smart contract. Self-supervised training is performed using the InfoNCE contrastive loss function to achieve feature space alignment between the two channels.

[0014] Furthermore, the method for diagnosing microscopic function-level defects and operator locations based on the learned dual-channel network using a gradient significance attribution mechanism specifically includes: The learned dual-channel network is used to reason about the smart contract to obtain the overall contract vulnerability risk probability; when the overall contract vulnerability risk probability exceeds a preset threshold, the gradient saliency attribution mechanism is activated. The gradient significance attribution mechanism includes function-level localization and operator-level localization; The function-level localization includes: calculating the first-order partial derivative of the overall contract vulnerability risk probability with respect to the micro-feature vector components of each micro-function-level control flow graph, and calculating the significance sensitivity score of each independent function based on the norm of the partial derivative, and identifying the independent function with the highest score as the vulnerability-suspect function. The operator-level localization includes: after locking the vulnerability-probable function, calculating the gradient vector of the overall contract vulnerability risk probability with respect to the operator feature vector of each line within the vulnerability-probable function; determining the contribution magnitude of each line operator to the risk based on the norm of the gradient vector, and identifying the operator node with the largest contribution magnitude as the defective instruction location.

[0015] Furthermore, the overall contract vulnerability risk probability is expressed as:

[0016] in, Indicates the overall probability of contract vulnerability risk; Indicates the activation function; Represents the classification weight matrix; Represents the sequential flow feature projection vector output by the sequential flow channel; This represents the structure flow feature projection vector output by the structure flow channel; This represents the joint feature vector obtained by concatenating the sequential flow feature projection vector and the structured flow feature projection vector.

[0017] Furthermore, the encapsulation of the multidimensional topological fingerprint of the contract and the microscopic function-level defects and operator positions by the centrally scheduled intelligent agent specifically includes: The central scheduling agent converts the contract multidimensional topological fingerprint and the micro-function level defects and operator positions into a formatted fact context data packet through the system's built-in standardized fact injection interface. The fact context data packet is concatenated and encapsulated with the preset security audit guidance instructions to form a context-related window input that is injected into the high-level large language model; The fact context data packet remains immutable throughout the reasoning process to strongly constrain the inference range of the high-level large language model.

[0018] Furthermore, the graph reachability verification of the deduction conclusion by the topology verification agent specifically includes: the topology verification agent extracts the relevant attack path claims from the deduction conclusion output by the high-level big language model; and performs graph reachability verification in the micro-function level control flow graph and the macro-contract level call association graph; if the attack path claim is unreachable in the physical topology, it is marked as logically inconsistent and the high-level big language model is triggered to re-deduct.

[0019] Secondly, the present invention provides a smart contract bytecode security auditing system based on multi-agent collaboration, which uses the above-mentioned smart contract bytecode security auditing method based on multi-agent collaboration, including: The semantic abstraction module is used to obtain the binary bytecode of the smart contract to be audited and to convert the underlying machine instructions of the binary bytecode into high-level behavioral operators. The topological fingerprint construction module is used to construct a micro-function-level control flow graph and a macro-contract-level call association graph based on the high-level behavioral operators; and to inject the micro-feature vector of the micro-function-level control flow graph into the node feature update process of the macro-contract-level call association graph using a hierarchical residual topological network to generate a multi-dimensional topological fingerprint of the contract. A cross-modal contrastive learning module is used to construct a dual-channel network containing a sequential flow channel and a structured flow channel; the high-level behavioral operator sequence features are input into the sequential flow channel, and the contract multidimensional topological fingerprint is input into the structured flow channel; the feature space of the dual-channel network is aligned through a cross-modal self-supervised contrastive learning mechanism, and micro-function-level defects and operator positions are diagnosed based on the gradient saliency attribution mechanism; The multi-agent collaborative reasoning module is used to encapsulate the multi-dimensional topological fingerprint of the contract and the micro-function level defects and operator positions through a centrally scheduled agent, inject them into a high-level large language model for logical deduction, and perform graph reachability verification on the deduction conclusions through a topology verification agent to generate a structured security audit report.

[0020] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a method and system for security auditing of smart contract bytecode based on multi-agent collaboration, which has the following beneficial effects: This invention transforms the binary bytecode of the smart contract to be audited into high-level behavioral operators and constructs a micro-level function-level control flow graph and a macro-level contract-level call association graph. Through a hierarchical residual fusion mechanism, it achieves cross-level feature injection, so that the final output contract multi-dimensional topological fingerprint has both micro-level instruction details and macro-level business flow semantics, and has strong anti-interference ability. Even in the face of differences in instructions and syntax caused by compilation optimization or obfuscation, it can still accurately extract the functional skeleton, which greatly improves the accuracy of same-source identification and security warning in closed-source scenarios.

[0021] This invention fundamentally reduces data annotation costs by projecting dual-channel features into a common semantic space and achieving cross-modal self-supervised alignment. Furthermore, through a gradient-based saliency attribution mechanism, it achieves two levels of precise diagnosis, from contract-level risk probability to "specific suspicious functions and internal specific behavioral operators," significantly saving time and costs associated with manual auditing and vulnerability investigation.

[0022] This application encapsulates the topological fingerprints and attribution data of underlying diagnoses into immutable fact data packets through a standardized fact injection interface, and performs strong constraint injection based on a context splicing matrix. This architecture forces the large language model to base its deductions on solid underlying evidence when reasoning about complex business logic. This is further supplemented by a topology verification agent that performs reverse graph reachability verification of attack paths, fundamentally eliminating random illusions and fabrications in the model. This ensures that the final security audit report output possesses both objective diagnostic facts at the underlying level and logical coherence at the higher level. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the smart contract bytecode security auditing method based on multi-agent collaboration provided in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the principle of the hierarchical residual topology network and the extraction of multidimensional topological fingerprints of contracts provided in this embodiment of the invention. Figure 3 This is a schematic diagram of the training process for cross-modal dual-channel self-supervised contrastive learning and feature space alignment provided in an embodiment of the present invention; Figure 4This is a schematic diagram of the multi-agent collaborative reasoning and fact injection process based on the dynamic context encapsulation protocol provided in this embodiment of the invention; Detailed Implementation The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Example 1: Implementation of security auditing based on blockchain smart contract bytecode.

[0026] This embodiment takes the security audit of closed-source smart contract binary bytecode in the Ethereum Virtual Machine (EVM) environment as an example to explain in detail the smart contract bytecode security audit method based on multi-agent collaboration provided by the present invention.

[0027] Step S1: Multidimensional semantic abstraction and reconstruction of pure bytecode based on hierarchical residual topology network: Obtain the binary bytecode of the smart contract to be audited, and transform the low-level machine instructions of the binary bytecode into high-level behavioral operators; construct a micro-function level control flow graph and a macro-contract level call association graph based on the high-level behavioral operators; use the hierarchical residual topology network to inject the micro-feature vector of the micro-function level control flow graph into the node feature update process of the macro-contract level call association graph to generate a multidimensional topological fingerprint of the contract; Comparison Figure 1 The overall process and Figure 2 The layered topology network architecture, this step aims to address the semantic removal bottleneck in pure bytecode scenarios. The auditing system first receives the binary bytecode of the smart contract to be audited, and directly performs three-dimensional topology modeling of the underlying low-level machine instruction flow of the target smart contract without relying on the source code. Specifically: S101: Semantic operator abstraction.

[0028] The system has a built-in static parsing module that, after receiving the binary bytecode of the smart contract to be audited, disassembles the input binary bytecode into a sequence of assembly instructions. The system then calls a pre-defined semantic mapping matrix. It transforms the low-level hard-coded machine instructions into general high-level behavioral operators, eliminating literal variations caused by compiler optimization.

[0029] Specifically, semantic mapping matrix The system employs a context-aware compound lexical abstraction strategy, using a sliding window probing algorithm to identify combined semantic patterns in the opcode sequences corresponding to underlying machine instructions; and performs joint determination based on temporal dependencies between instructions and the influence of stack state. The system's preset compound lexical abstraction rules include, but are not limited to: When a PUSHx instruction is detected followed immediately by a JUMP or JUMPI instruction, the instruction pair is identified as a control flow jumper program entry mode, abstracted into a control operator, and the symbolic representation of the jump target address is marked. When a PUSH32 instruction is detected followed immediately by an SSTORE or SLOAD instruction, the instruction sequence is identified as a persistent storage access pattern, abstracted as a data operator, and associated with a symbolic representation of the storage slot index. When the PUSH32 instruction is detected followed immediately by the LOG0 to LOG4 instructions, this instruction sequence is identified as an event topic hash pattern and abstracted as a transmission operator. When a combination of a PUSH4 instruction followed by an EQ instruction and a JUMPI instruction is detected in the scheduler code block, this instruction set is identified as a function selector routing pattern, abstracted as a control operator, and the mapping relationship between the function signature hash value and the corresponding jump target address is marked.

[0030] Through the above abstraction strategy, the underlying opcode sequence is reconstructed into a high-level operator stream with clear behavioral semantics, eliminating the interference of instruction literal variants caused by compiler version differences or code obfuscation on subsequent feature extraction.

[0031] Furthermore, embodiments of the present invention construct a hierarchical residual topology network comprising both microscopic and macroscopic levels. For example... Figure 2 As shown, the micro-level is based on high-level behavioral operators, using each independent function as a unit, with basic blocks as nodes and control flow transfers as edges, to construct a function-level control flow graph. This accurately depicts the execution path of basic blocks within a function, effectively preventing vulnerability features from being diluted by the large amount of benign code in the entire contract. The macro-level uses all independent functions in the entire contract as nodes, with function call relationships and data transfers as edges, to construct a contract-level call relationship graph, depicting the overall business execution flow of the contract. See subsequent steps S102-S103 for details.

[0032] S102: Construction of microscopic function-level control flow graph.

[0033] This invention uses independent functions within a contract as the basic unit to analyze the local jumps and dependencies between operators. It's important to note that this application uses independent functions of the smart contract as the smallest unit of analysis, unlike existing technologies that use the entire contract as the granularity. Smart contract vulnerabilities typically exhibit strong locality; if the entire contract is used as the granularity, the proportion of vulnerability-related code is extremely low, and model feature extraction is easily diluted by a large amount of benign code. Therefore, in this embodiment, independent functions within the contract are used as the basic unit. By statically parsing the function selectors and jump tables in the binary bytecode, the boundary range and entry address of each independent function are automatically identified. A corresponding micro-function-level control flow graph is constructed for each independent function, ensuring that subsequent feature extraction and vulnerability localization always focus on the function-level granularity.

[0034] For any independent function in a smart contract The corresponding microscopic function-level control flow graph is represented as follows:

[0035] in, Indicates for independent functions The constructed microscopic function-level control flow graph; Representing independent functions The internal set of behavioral operator nodes; Representing independent functions The set of control flow topology edges between internal behavioral operators.

[0036] S103: Construction of macro-contract-level call association graph.

[0037] Control flow graphs at the level of each individual microfunction Abstracted as a macro-level topology node, a macro-contract-level call relationship graph is constructed based on the call relationships and data transfer relationships between independent functions. This macro-level contract-level call relationship diagram is used to depict the overall business execution process and state transmission relationships of the contract. Represented as:

[0038]

[0039]

[0040] in, This represents the macroscopic topology node set of a smart contract. Represents the set of macroscopic topological nodes The first in One macroscopic topological node; This represents the call dependencies and state transit edge sets between independent functions; Representing independent functions The corresponding microscopic function-level control flow graph; Representing independent functions The corresponding microscopic function-level control flow graph; and independent functions and independent functions There is a calling relationship; Representing independent functions With independent functions The call weights between modules are used to characterize the frequency of cross-module control flow transfers and the reach of global state variables.

[0041] S104: Residual feature fusion.

[0042] By utilizing a hierarchical residual topology network, the micro-feature vectors of the micro-function-level control flow graph are injected into the node feature update process of the macro-contract-level call association graph. Specifically, this includes: Microscopic feature vectors of the control flow graph at each microscopic function level are extracted using a graph neural network. And the extracted micro-feature vectors As a residual perturbation term injected into the macro-contract-level call association graph during the node feature update process:

[0043] in, This represents the first macro-contract level call association diagram. The macroscopic topology node at the ... Node feature vectors in graph convolutional layers (GCN / GAT convolution), and when hour, , Indicates the first The micro-feature vector of the micro-function-level control flow graph corresponding to each macro-topological node; Represents a non-linear activation function; This indicates the relationship between the macro-contract level call association diagram and the first... The set of neighboring function nodes connected to a macroscopic topological node; Indicates the first When the convolutional layer is in the figure, the first The first macroscopic topology node and the first Graph attention coefficients between macroscopic topological nodes; Indicates the first Learnable weight transformation matrix of graph convolutional layer; Indicates the first The macroscopic topology node at the ... Node feature vectors in graph convolutional layers; This represents the residual control factor, and ; This represents the linear alignment matrix of microscopic features.

[0044] This approach enables macro-level node feature updates to simultaneously receive neighbor message passing and micro-level detail signals. After completing node feature updates through multi-layer graph convolution, the final feature vectors of each macro-level topological node in the macro-contract-level call association graph are aggregated to serve as the multi-dimensional topological fingerprint of the smart contract. Output. This multidimensional topological fingerprint. It simultaneously preserves the details of low-level instructions and the semantics of high-level business flows. Utilizing this multi-dimensional topological fingerprint of the contract, the system can effectively identify the reuse of homogeneous functions with completely different syntax and instructions, enabling security warnings across compilation variants.

[0045] Step S2: Fine-grained feature alignment based on cross-modal dual-channel self-supervised contrastive learning: Construct a dual-channel network containing sequential flow channels and structural flow channels; input the high-level behavioral operator sequence features into the sequential flow channel and the contract multidimensional topological fingerprint into the structural flow channel; align the feature space of the dual-channel network through a cross-modal self-supervised contrastive learning mechanism, and diagnose micro-function-level defects and operator positions based on the learned dual-channel network according to the gradient significance attribution mechanism; Construct a two-channel network containing sequential flow channels and structured flow channels, such as... Figure 3 As shown; addressing the shortcomings of coarse-grained analysis and its heavy reliance on manually labeled data, this step leverages the dual-channel network and an unsupervised learning mechanism to fully mine massive amounts of unlabeled contract data, enabling the diagnosis of function-level vulnerabilities. Specifically: S201: Construct a dual-channel feature extraction architecture.

[0046] High-level behavioral operator sequence features Input sequential stream channel to generate multidimensional topological fingerprint of contract Input structure flow channel as a multidimensional topological fingerprint feature of the contract .

[0047] S202: Multimodal feature space alignment.

[0048] System build order mapping function With structure mapping function The sequential flow feature vectors output by the sequential flow channel and the structure flow feature vectors output by the structure flow channel are projected onto a high-dimensional common semantic space to obtain the corresponding sequential flow feature projection vectors. and structural flow feature projection vector ; In self-supervised learning scenarios without manually labeled data, this application determines positive and negative samples through batch construction: within a training batch, given unlabeled samples of the same smart contract... Sequential flow feature projection vector With structural flow feature projection vector Construct homogeneous positive sample pairs; simultaneously, combine samples from different smart contracts within the same training batch. ( ) structural flow feature projection vector Construct non-homologous negative samples; Self-supervised training is performed using the InfoNCE contrastive loss function to achieve feature space alignment between the two channels; the InfoNCE contrastive loss function is expressed as:

[0049] in, This represents the self-supervised comparison loss value; Batch Size is the size of a single training session. Represents the sequential flow feature projection vector With structural flow feature projection vector Cosine similarity between them; Represents the sequential flow feature projection vector With structural flow feature projection vector Cosine similarity between them; This indicates the preset temperature hyperparameter, and .

[0050] This loss function narrows the vector distance between two channels of the same contract within a batch, while widening the vector distance between different contracts, thereby achieving self-supervised feature space alignment and mutual error correction in a zero-label state.

[0051] S203: Diagnosis of microscopic function-level defects.

[0052] The learned dual-channel network is used to reason about smart contracts to obtain the overall contract vulnerability risk probability; this overall contract vulnerability risk probability is expressed as:

[0053] in, This indicates the predicted overall probability of contract vulnerability risk; Indicates the activation function; Represents the learnable classification weight matrix; Represents the sequential flow feature projection vector output by the sequential flow channel; This represents the structure flow feature projection vector output by the structure flow channel; This represents the joint feature vector obtained by concatenating the sequential flow feature projection vector and the structured flow feature projection vector.

[0054] When the overall contract vulnerability risk probability When the preset threshold is exceeded, the gradient significance attribution mechanism is activated; this gradient significance attribution mechanism includes function-level localization and operator-level localization. Function-level location analysis includes: calculating the overall probability of contract vulnerability risk. Microscopic eigenvector components of the control flow graph at each microscopic function level The first-order partial derivatives are used, and the significance sensitivity scores of each independent function are calculated based on the norm of the partial derivatives; for the ... The saliency sensitivity score of the micro-function-level control flow graph corresponding to each macro-topological node. Represented as:

[0055] in, Overall contract vulnerability risk probability For the The gradient matrix of the characteristic matrix of each microfunction; This represents the Frobenius norm (the square root of the sum of the squares of all elements of a matrix). The system will use all functions... The values ​​are sorted in descending order, and the independent function with the highest score is identified as the function suspected of being a vulnerability. Operator-level localization includes: after identifying potentially vulnerable functions, calculating the overall contract vulnerability risk probability. For each line within the function indicating a vulnerability, the feature vectors of the operators are considered. gradient vector The contribution magnitude of each operator to risk is determined based on the norm of the gradient vector. Specifically, its... norm The operator's contribution to risk is represented by its magnitude; the operator node with the largest contribution magnitude is identified as the defect instruction location, and the system can highlight this location.

[0056] Through the above two-level attribution, macro risks are accurately mapped, located, and diagnosed to the specific micro functions and their internal operators that cause security flaws, achieving a granular leap from "the contract has risks" to "the specific instructions within the specific function have risks," thus enabling fine-grained function-level vulnerability localization.

[0057] Step S3: Multi-agent collaborative reasoning and fact injection based on dynamic context encapsulation protocol: After the contract multi-dimensional topological fingerprint, micro-function level defects and operator positions are encapsulated by the central scheduling agent, they are injected into the preset high-level large language model for logical deduction, and the deduction conclusion is verified by the topology verification agent to generate a structured security audit report. Reference Figure 4The multi-agent collaborative framework diagram addresses the shortcomings of large language models in independent auditing, such as lack of underlying support and susceptibility to auditing illusions. This step constructs a text-text collaboration mechanism through standardized data channels to eliminate the auditing illusion of large language models. Specifically: S301: Multi-agent network construction and physical evidence reception.

[0058] The system constructs a multi-agent collaborative network consisting of a central scheduling agent and several underlying expert tool interfaces. The central scheduling agent concurrently receives the aforementioned multi-dimensional topological fingerprint of the contract. By combining microscopic function-level defects and operator positions, the physical level of objective quantitative data is achieved.

[0059] S302: Fact Encapsulation and Strong Constraint Injection.

[0060] The centrally scheduled intelligent agent uses the system's built-in standardized fact injection interface to inject multi-dimensional topological fingerprints of contracts. The conversion of microscopic function-level defects and operator positions into formatted fact context data packets. ; Transfer fact context data packets With the preset security audit guidance instructions The components are concatenated and encapsulated to form a context-related window input that is injected into a high-level large language model:

[0061] in, The input is the complete context Prompt string for the large language model; For contract multidimensional topological fingerprint A formatted JSON / XML text segment derived from microscopic function-level defects and operator positions; The pre-defined system-level role settings and deduction rules text include restrictions that prevent the model from deviating from them. The hard rules of fact; The above fact context data packet For strong constraint injection, The topological fingerprints and operator localization data in the model remain immutable throughout the entire inference process, and the inference conclusions of the large language model must be based on... The system unfolds based on the confirmed underlying evidence and must not fabricate or modify underlying facts. Furthermore, the system is configured with an independent topology verification agent to extract attack path claims from the inference conclusions output by the high-level large language model; and performs graph reachability verification in the micro-function-level control flow graph and the macro-contract-level call association graph; if the attack path claim is unreachable in the physical topology, it is marked as logically inconsistent and triggers a re-inference by the high-level large language model.

[0062] S303: Collaborative simulation and report generation.

[0063] Under the dual constraints of fact injection and topology verification, the high-level big language model performs logical deduction, leveraging its reasoning advantages in high-level business logic and economic models. Ultimately, it outputs a structured and interpretable security audit report that integrates "lower-level diagnostic facts" and "high-level logical coherence explanations," ensuring that all audit conclusions are supported by underlying hard evidence.

[0064] Example 2: Security auditing implementation based on the binary target code of embedded firmware for industrial IoT devices.

[0065] This embodiment uses the security auditing of the firmware binary target code of an industrial-grade embedded network device as an example to verify the cross-platform universality of the present invention on traditional hardware closed-source control programs. The underlying algorithm architecture, multi-dimensional topology network reconstruction mechanism, dual-channel self-supervised alignment, and multi-agent collaborative process are completely consistent with Embodiment 1.

[0066] S401: Industrial Firmware Heterogeneous Operator Abstraction and Topological Fingerprint Construction.

[0067] The system receives a firmware binary image under a specific hardware architecture. The static parsing module introduces a register context and instruction set mapping table to convert the machine code into high-level behavioral operator flows. Subsequently, the micro-level function-level control flow graph is reconstructed. Correlation diagram with macro-contract level calls Based on the residual fusion mechanism, it outputs a cross-platform universal firmware contract multidimensional topology fingerprint. .

[0068] S402: Firmware cross-modal self-supervised training and high-risk defect diagnosis.

[0069] The system employs a dual-channel network comprising sequential flow and structured flow channels, and performs self-supervised iterative training in the projection space based on the InfoNCE contrastive loss function. Regarding network buffer overflow defects, when the overall contract vulnerability risk probability... When the limit is exceeded, a two-level saliency attribution mechanism is activated, and the location of the buffer overflow subroutine and the offset of the abnormal operator are accurately located based on the norm calculation of the above embodiment 1.

[0070] S403: Secure output of firmware fact encapsulation and structured audit report.

[0071] The centrally scheduled intelligent agent receives the contract multidimensional topological fingerprint of the firmware. Generate fact context data packets from defect attribution data. By concatenating strong constraints and injecting them into a large language model, and combining this with a topology verification agent to perform graph reachability verification, a structured and interpretable security audit report is finally output in a formatted manner, providing precise guidance to operations and maintenance personnel for firmware patch upgrades and vulnerability repairs.

[0072] Example 3: Based on the same inventive concept, embodiments of the present invention also provide a smart contract bytecode security auditing system based on multi-agent collaboration, comprising: The semantic abstraction module is used to obtain the binary bytecode of the smart contract to be audited and to transform the underlying machine instructions of the binary bytecode into high-level behavioral operators. The topological fingerprint construction module is used to construct micro-function-level control flow graphs and macro-contract-level call association graphs based on high-level behavioral operators; it uses a hierarchical residual topological network to inject the micro-feature vectors of the micro-function-level control flow graphs into the node feature update process of the macro-contract-level call association graphs to generate multi-dimensional topological fingerprints of contracts. The cross-modal contrastive learning module is used to construct a dual-channel network containing sequential flow channels and structured flow channels; the sequence features of high-level behavioral operators are input into the sequential flow channel, and the multi-dimensional topological fingerprint of the contract is input into the structured flow channel; the feature space of the dual-channel network is aligned through a cross-modal self-supervised contrastive learning mechanism, and micro-function-level defects and operator positions are diagnosed based on the gradient significance attribution mechanism; The multi-agent collaborative reasoning module is used to encapsulate the multi-dimensional topological fingerprint of the contract, micro-function level defects, and operator positions through a centrally scheduled agent, and then inject them into a high-level large language model for logical deduction. The topology verification agent performs graph reachability verification on the deduction conclusions and generates a structured security audit report.

[0073] Since the principle behind the problem solved by this system is similar to the aforementioned method for security auditing of smart contract bytecode based on multi-agent collaboration, the implementation of this system can refer to the implementation of the aforementioned method, and the repetitions will not be repeated.

[0074] In summary, the smart contract bytecode security auditing method and system based on multi-agent collaboration provided by this invention solves the technical problems of existing smart contract auditing technologies, such as semantic loss in pure bytecode scenarios, low utilization of massive unlabeled data leading to the inability to accurately locate function-level vulnerabilities, and the ease with which "illusions" and misjudgments occur when auditing large language models independently due to the lack of underlying factual support.

[0075] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0076] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for security auditing of smart contract bytecode based on multi-agent collaboration, characterized in that, include: Obtain the binary bytecode of the smart contract to be audited, and convert the underlying machine instructions of the binary bytecode into high-level behavioral operators; Based on the high-level behavioral operators, a micro-function-level control flow graph and a macro-contract-level call association graph are constructed; the micro-feature vectors of the micro-function-level control flow graph are injected into the node feature update process of the macro-contract-level call association graph using a hierarchical residual topology network to generate a multi-dimensional topological fingerprint of the contract. A dual-channel network comprising a sequential flow channel and a structured flow channel is constructed; the sequence features of high-level behavioral operators are input into the sequential flow channel, and the multidimensional topological fingerprint of the contract is input into the structured flow channel; the feature space of the dual-channel network is aligned through a cross-modal self-supervised contrastive learning mechanism, and micro-function-level defects and operator positions are diagnosed based on the gradient saliency attribution mechanism; After the central scheduling agent encapsulates the multidimensional topological fingerprint of the contract and the micro-function level defects and operator positions, it injects them into the high-level large language model for logical deduction. The topology verification agent then performs graph reachability verification on the deduction conclusions and generates a structured security audit report.

2. The smart contract bytecode security auditing method based on multi-agent collaboration as described in claim 1, characterized in that, The process of converting the low-level machine instructions of the binary bytecode into high-level behavioral operators specifically includes: The combined semantic patterns in the underlying machine instructions are identified using a sliding window detection algorithm; When a PUSHx instruction is detected followed immediately by a JUMP or JUMPI instruction, the instruction pair is identified as a control flow jumper program entry mode, abstracted into a control operator, and the symbolic representation of the jump target address is marked. When a PUSH32 instruction is detected followed immediately by an SSTORE or SLOAD instruction, the instruction sequence is identified as a persistent storage access pattern, abstracted as a data operator, and associated with a symbolic representation of the storage slot index. When the PUSH32 instruction is detected followed immediately by the LOG0 to LOG4 instructions, this instruction sequence is identified as an event topic hash pattern and abstracted as a transmission operator. When a combination of a PUSH4 instruction followed by an EQ instruction and a JUMPI instruction is detected in the scheduler code block, this instruction set is identified as a function selector routing pattern, abstracted as a control operator, and the mapping relationship between the function signature hash value and the corresponding jump target address is marked.

3. The smart contract bytecode security auditing method based on multi-agent collaboration as described in claim 1, characterized in that, The construction of the micro-function-level control flow graph and the macro-contract-level call association graph based on the high-level behavioral operators specifically includes: Using the independent functions within the smart contract to be audited as analysis units, the boundary range and entry address of each independent function are automatically identified by statically parsing the function selector and jump table in the binary bytecode, and a corresponding micro-function-level control flow graph is constructed for each independent function. Each micro-function-level control flow graph is abstracted into a macro-topology node, and a macro-contract-level call association graph is constructed based on the call relationships and data transfer relationships between independent functions.

4. The smart contract bytecode security auditing method based on multi-agent collaboration as described in claim 1, characterized in that, The node feature update process of the macro-contract-level call association graph is represented as follows: in, This represents the first macro-contract level call association diagram. The macroscopic topology node at the ... The node feature vectors in the graph convolutional layer, and , Indicates the first The micro-feature vector of the micro-function-level control flow graph corresponding to each macro-topological node; Represents a non-linear activation function; This indicates the relationship between the macro-contract level call association diagram and the first... The set of neighboring function nodes connected to a macroscopic topological node; Indicates the first When the convolutional layer is in the figure, the first The first macroscopic topology node and the first Graph attention coefficients between macroscopic topological nodes; Indicates the first The weight transformation matrix of the convolutional layer; Indicates the first The macroscopic topology node at the ... Node feature vectors in graph convolutional layers; Indicates the residual control factor; This represents the linear alignment matrix of microscopic features.

5. The smart contract bytecode security auditing method based on multi-agent collaboration as described in claim 1, characterized in that, The alignment of the feature space of the dual-channel network through a cross-modal self-supervised contrastive learning mechanism specifically includes: Project the sequential flow feature vector output by the sequential flow channel and the structural flow feature vector output by the structural flow channel onto a high-dimensional common semantic space to obtain the corresponding sequential flow feature projection vector and structural flow feature projection vector. Within a training batch, the sequential flow feature projection vector and the structural flow feature projection vector of the same smart contract are constructed as homologous positive sample pairs, and the structural flow feature projection vectors of other different smart contracts within the same training batch are constructed as non-homologous negative samples with the sequential flow feature projection vector of the current smart contract. Self-supervised training is performed using the InfoNCE contrastive loss function to achieve feature space alignment between the two channels.

6. The smart contract bytecode security auditing method based on multi-agent collaboration as described in claim 1, characterized in that, The learned dual-channel network diagnoses microscopic function-level defects and operator locations based on gradient significance attribution mechanisms, specifically including: The learned dual-channel network is used to reason about the smart contract to obtain the overall contract vulnerability risk probability; when the overall contract vulnerability risk probability exceeds a preset threshold, the gradient saliency attribution mechanism is activated. The gradient significance attribution mechanism includes function-level localization and operator-level localization; The function-level localization includes: calculating the first-order partial derivative of the overall contract vulnerability risk probability with respect to the micro-feature vector components of each micro-function-level control flow graph, and calculating the significance sensitivity score of each independent function based on the norm of the partial derivative, and identifying the independent function with the highest score as the vulnerability-prone function. The operator-level localization includes: after locking the vulnerability-probable function, calculating the gradient vector of the overall contract vulnerability risk probability with respect to the operator feature vector of each line within the vulnerability-probable function; determining the contribution magnitude of each line operator to the risk based on the norm of the gradient vector, and identifying the operator node with the largest contribution magnitude as the defective instruction location.

7. The smart contract bytecode security auditing method based on multi-agent collaboration as described in claim 6, characterized in that, The overall contract vulnerability risk probability is expressed as: in, Indicates the overall probability of contract vulnerability risk; Indicates the activation function; Represents the classification weight matrix; Represents the sequential flow feature projection vector output by the sequential flow channel; This represents the structure flow feature projection vector output by the structure flow channel; This represents the joint feature vector obtained by concatenating the sequential flow feature projection vector and the structured flow feature projection vector.

8. The smart contract bytecode security auditing method based on multi-agent collaboration as described in claim 1, characterized in that, The encapsulation of the multidimensional topological fingerprint of the contract and the microscopic function-level defects and operator positions by the central scheduling intelligent agent specifically includes: The central scheduling agent converts the contract multidimensional topological fingerprint and the micro-function level defects and operator positions into a formatted fact context data packet through the system's built-in standardized fact injection interface. The fact context data packet is concatenated and encapsulated with the preset security audit guidance instructions to form a context-related window input that is injected into the high-level large language model; The fact context data packet remains immutable throughout the reasoning process to strongly constrain the inference range of the high-level large language model.

9. The smart contract bytecode security auditing method based on multi-agent collaboration as described in claim 1, characterized in that, The graph reachability verification of the deduction conclusion by the topology verification agent specifically includes: the topology verification agent extracts the attack path claims involved from the deduction conclusion output by the high-level big language model; and performs graph reachability verification in the micro-function level control flow graph and the macro-contract level call association graph; if the attack path claim is unreachable in the physical topology, it is marked as logically inconsistent and the high-level big language model is triggered to re-deduct.

10. A smart contract bytecode security auditing system based on multi-agent collaboration, using the smart contract bytecode security auditing method based on multi-agent collaboration as described in any one of claims 1-9, characterized in that, include: The semantic abstraction module is used to obtain the binary bytecode of the smart contract to be audited and to convert the underlying machine instructions of the binary bytecode into high-level behavioral operators. The topological fingerprint construction module is used to construct a micro-function-level control flow graph and a macro-contract-level call association graph based on the high-level behavioral operators; and to inject the micro-feature vector of the micro-function-level control flow graph into the node feature update process of the macro-contract-level call association graph using a hierarchical residual topological network to generate a multi-dimensional topological fingerprint of the contract. A cross-modal contrastive learning module is used to construct a dual-channel network containing a sequential flow channel and a structured flow channel; the high-level behavioral operator sequence features are input into the sequential flow channel, and the contract multidimensional topological fingerprint is input into the structured flow channel; the feature space of the dual-channel network is aligned through a cross-modal self-supervised contrastive learning mechanism, and micro-function-level defects and operator positions are diagnosed based on the gradient saliency attribution mechanism; The multi-agent collaborative reasoning module is used to encapsulate the multi-dimensional topological fingerprint of the contract and the micro-function level defects and operator positions through a centrally scheduled agent, inject them into a high-level large language model for logical deduction, and perform graph reachability verification on the deduction conclusions through a topology verification agent to generate a structured security audit report.

Images