VarLifter: Recovering Variables and Types from Bytecode of Solidity Smart Contracts
summary
VarLifter recovers typed state variables from Solidity bytecode by treating every accessed field as a candidate variable, pruning false positives, then refining types via operation-sequence patterns and a fuzzy type lattice over EVM stack/memory/storage behavior. Evaluated on 34,832 contracts it achieves 97.48% precision, 91.84% recall, analyzes 77% of contracts in ≈10 seconds per contract, and boosts two decompilers by 52.4% and 74.6% more correctly recovered typed variables.
AI-written summary · about
chapters (12)
- 0:00VarLifter introduction
- 0:43Solidity smart contracts
- 3:57Reverse engineering challenges
- 5:23Decompiler limitations
- 6:25LLMs for type recovery
- 7:30VarLifter improvements
- 8:12Malicious contract detection
- 10:23VarLifter variable recovery
- 13:17Type refinement process
- 15:48Evaluation results
- 16:30Fuzzing with type recovery
- 17:12Q&A
related talks
15mPrecise Static Modeling of Ethereum “Memory”
01h 10mHow Context-Sensitive Static Analysis Led to the Best Smart Contract Decompiler
21mSolType: Refinement Types for Arithmetic Overflow in Solidity
22mHow Decompilation Uncovers Smart Contract Vulnerabilities
33mSymbolic value-flow static analysis:deep,precise,complete modeling of Ethereum smartcontracts
53mSemantics-based program manipulation in the age of LLMs
15mSymbolic Value-Flow Static Analysis: Deep, Precise, Complete Modeling of Ethereum Smart Contracts
21mErays: Reverse Engineering Ethereum's Opaque Smart Contracts