《罗斯玛丽的婴儿》与恶意合约：恶魔契约作为智能合约漏洞

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract MaliciousContractDetector {
    struct ContractAnalysis {
        address contractAddress;
        bool hasSelfDestruct;
        bool hasUncheckedCall;
        bool hasReentrancy;
        bool hasUnlimitedAllowance;
        uint256 riskScore;
        string[] warnings;
    }

    mapping(address => ContractAnalysis) public analyses;

    function analyzeContract(address contractAddress) external returns (ContractAnalysis memory) {
        // In production, this would analyze bytecode
        ContractAnalysis memory analysis = ContractAnalysis({
            contractAddress: contractAddress,
            hasSelfDestruct: false,
            hasUncheckedCall: false,
            hasReentrancy: false,
            hasUnlimitedAllowance: false,
            riskScore: 0,
            warnings: new string[](0)
        });

        // Simulated analysis
        if (analysis.hasSelfDestruct) {
            analysis.warnings.push("Contract can self-destruct, risking fund loss");
            analysis.riskScore += 30;
        }
        if (analysis.hasUncheckedCall) {
            analysis.warnings.push("Unchecked external call detected");
            analysis.riskScore += 25;
        }

        analyses[contractAddress] = analysis;
        return analysis;
    }
}

import json
from typing import Dict, List

class ContractAuditor:
    def analyze_bytecode(self, bytecode: str) -> Dict:
        risk_indicators = {
            'selfdestruct': bytecode.count('selfdestruct') > 0,
            'delegatecall': bytecode.count('delegatecall') > 0,
            'unchecked_send': bytecode.count('send(') > 0 and bytecode.count('require') == 0,
            'tx_origin': bytecode.count('tx.origin') > 0
        }
        risk_score = sum(25 for v in risk_indicators.values() if v)
        return {
            'risk_indicators': risk_indicators,
            'risk_score': risk_score,
            'is_dangerous': risk_score > 50
        }


auditor = ContractAuditor()
sample = "function withdraw() { selfdestruct(msg.sender); }"
result = auditor.analyze_bytecode(sample)
print(json.dumps(result, indent=2))

const express = require('express');
const { ethers } = require('ethers');
const app = express();
app.use(express.json());

const DETECTOR_ABI = [
    "function analyzeContract(address contractAddress) external returns (tuple)",
    "function analyses(address) external view returns (tuple)"
];

class ContractSafety {
    constructor(providerUrl, detectorAddress) {
        this.provider = new ethers.providers.JsonRpcProvider(providerUrl);
        this.detector = new ethers.Contract(detectorAddress, DETECTOR_ABI, this.provider);
    }

    async analyze(contractAddress) {
        const tx = await this.detector.analyzeContract(contractAddress);
        const receipt = await tx.wait();
        const analysis = await this.detector.analyses(contractAddress);
        return {
            riskScore: analysis.riskScore.toNumber(),
            warnings: analysis.warnings
        };
    }
}

app.post('/api/contract/analyze', async (req, res) => {
    const { address } = req.body;
    const safety = new ContractSafety(process.env.RPC_URL, process.env.DETECTOR_ADDRESS);
    const result = await safety.analyze(address);
    res.json(result);
});

app.listen(3018, () => {
    console.log('Contract Safety API running on port 3018');
});