Smart Contract Risk Assessment via AST Flattening

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Manual review of smart contract source code for security risks and bugs is time-intensive and impractical, especially with the rapid deployment of new tokens on blockchains like Ethereum, where over 350,000 ERC-20 token contracts exist, making it infeasible for human analysts to individually analyze each for inherent security risks.

Innovation Solution

An automated risk assessment engine analyzes smart contract source code by generating an abstract syntax tree (AST), flattening it to remove non-differentiating elements, hashing it, and comparing it to a database of known functions to identify features and associated risk levels, generating a risk assessment report.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If manual review of smart contract source code is performed to ensure security and detect risks, then detection precision is improved, but productivity deteriorates due to time-intensive analysis taking days to weeks

Engineering Contradiction:

Improvedetection precisionVSAvoidproductivity

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent introduces an automated analysis system that acts as an intermediary between the smart contract source code and the security assessment process. This system uses abstract syntax tree generation, flattening, hashing, and pattern matching against a database of known vulnerabilities to automatically detect security risks, thereby maintaining high detection precision while dramatically improving productivity by processing contracts in minutes rather than days or weeks

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical manual review process with an automated computational system. Instead of human analysts manually examining source code, the system automatically generates abstract syntax trees, flattens them, creates hashes, and compares them against a database of known vulnerability patterns, substituting human effort with algorithmic processing to achieve both high precision and high productivity

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If manual review processes are used to analyze smart contracts for security risks, then reliability is improved through thorough examination, but loss of time increases significantly

Engineering Contradiction:

ImprovereliabilityVSAvoidloss of time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by pre-processing the smart contract source code into an abstract syntax tree and then flattening it before analysis. This preliminary transformation standardizes the code representation, making subsequent vulnerability detection more efficient and reliable while reducing the time required for the actual security assessment

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent creates a simplified copy of the original source code through abstract syntax tree generation and flattening. This copied representation retains the essential structural information needed for security analysis while removing unnecessary complexity, enabling rapid and reliable vulnerability detection without requiring time-consuming analysis of the full original codebase

Inventive Principle:

Principle #26Copying

3Object-generated harmful factors

If comprehensive manual security auditing is performed on each smart contract, then object-generated harmful factors are reduced through thorough risk detection, but productivity deteriorates making it infeasible to review large numbers of contracts

Engineering Contradiction:

Improvesecurity risksVSAvoidproductivity

Core Design Contradiction:

Object-generated harmful factorsVSProductivity

Solution Approach 1:

The patent extracts the essential structural information from smart contract source code by generating abstract syntax trees and flattening them. This extraction process isolates the critical elements needed for security analysis while discarding unnecessary code complexity, enabling the system to efficiently detect harmful patterns and vulnerabilities across large numbers of contracts without being overwhelmed by the full source code volume

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS11544045B2Automatic smart contract analysis

Publication Date: 2023.01.03 COINBASE INC

AI summary

One or more aspects described herein provide automatic smart contract feature analysis and risk assessment based on unique source code signatures and/or fingerprints within the smart contract. A risk assessment engine may automatically analyze a smart contract by first retrieving smart contract source code from a contract address on a blockchain where the smart contract is accessible. The risk assessment engine may generate an abstract syntax tree (AST) of the smart contract using a compiler for the smart contract source code, and then flatten the AST by removing non-differentiating elements from the AST. The flattened AST may be divided by function calls within the smart contract, and then each division may be fingerprinted, e.g., hashed using a one-way hash. The fingerprint is compared to a database of known functions to automatically identify one or more features of the smart contract with associated risk levels.