Erays: Reverse Engineering Ethereum's Opaque Smart Contracts
summary
Erays is a reverse-engineering pipeline that recovers CFGs, lifts EVM stack code into a register IR (uses 1024 registers to model the stack), applies constant/copy propagation and dead-code elimination, aggregates expressions and reconstructs if/while constructs. On a blockchain snapshot of ~1,000,000 contract addresses it finds ~34,000 unique binaries, matches 7,700 to compiled sources and reports ~77% opaque without source. Validation replays ~16,000 transactions via geth, with a 3% failure rate. Case studies include multi-sig wallets holding 590 million dollars, arbitrage gadget contracts using revert, and reverse-engineering CryptoKitties’ gene algorithm.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:44EVM Bytecode
- 3:09Ecosystem: Measuring Opacity
- 3:37Erays: System Design
- 4:05Control Flow Graph Recovery
- 4:58Lifting: Stack-based to Register-based
- 7:04Optimization: Removing Redundancy
- 7:51Aggregation: Condensing the Output
- 8:26Control Flow Structure Recovery
- 9:20Validation
- 10:37Use Case
- 10:49Erays: Function Fuzzy Hash
- 11:22Case Studies
- 11:34Case Study: High Value Contracts
- 12:12Time Dependency Hazard
- 12:57Case Study: Duplicate Contracts
- 14:46Case Study: EtherDelta Arbitrage Bots
- 16:21Case Study: CryptoKitties
- 18:23Conclusion
related talks
31mElipmoc: advanced decompilation of Ethereum smart contracts
01h 10mHow Context-Sensitive Static Analysis Led to the Best Smart Contract Decompiler
22mHow Decompilation Uncovers Smart Contract Vulnerabilities
10mHow to Understand a Smart Contract Hack
43mOutsmarting Smart Contracts
21mSurviving in Dark Forest: Towards Evading the Attacks from Front-Running Bots
15mSymbolic Value-Flow Static Analysis: Deep, Precise, Complete Modeling of Ethereum Smart Contracts
33mHacking in Darkness: Return-oriented Programming against Secure Enclaves