scispace - formally typeset
Proceedings ArticleDOI

Gigahorse: thorough, declarative decompilation of smart contracts

Reads0
Chats0
TLDR
Gigahorse offers a full-featured toolchain for further analyses (and a ``batteries included'' approach, with multiple clients already implemented), together with the highest performance and scalability, and uses a declarative, logic-based specification, which allows high-level insights to inform low-level decompilation.
Abstract
The rise of smart contractsThe rise of smart contracts–autonomous applications running on blockchains–has led to a growing number of threats, necessitating sophisticated program analysis. However, smart contracts, which transact valuable tokens and cryptocurrencies, are compiled to very low-level bytecode. This bytecode is the ultimate semantics and means of enforcement of the contract. We present the Gigahorse toolchain. At its core is a reverse compiler (i.e., a decompiler) that decompiles smart contracts from Ethereum Virtual Machine (EVM) bytecode into a highlevel 3-address code representation. The new intermediate representation of smart contracts makes implicit data- and controlflow dependencies of the EVM bytecode explicit. Decompilation obviates the need for a contract’s source and allows the analysis of both new and deployed contracts. Gigahorse advances the state of the art on several fronts. It gives the highest analysis precision and completeness among decompilers for Ethereum smart contracts–e.g., Gigahorse can decompile over 99.98% of deployed contracts, compared to 88% for the recently-published Vandal decompiler and under 50% for the state-of-the-practice Porosity decompiler. Importantly, Gigahorse offers a full-featured toolchain for further analyses (and a "batteries included" approach, with multiple clients already implemented), together with the highest performance and scalability. Key to these improvements is Gigahorse’s use of a declarative, logic-based specification, which allows high-level insights to inform low-level decompilation.autonomous applications running on blockchains---has led to a growing number of threats, necessitating sophisticated program analysis. However, smart contracts, which transact valuable tokens and cryptocurrencies, are compiled to very low-level bytecode. This bytecode is the ultimate semantics and means of enforcement of the contract. We present the Gigahorse toolchain. At its core is a reverse compiler (i.e., a decompiler) that decompiles smart contracts from Ethereum Virtual Machine (EVM) bytecode into a high-level 3-address code representation. The new intermediate representation of smart contracts makes implicit data- and control-flow dependencies of the EVM bytecode explicit. Decompilation obviates the need for a contract's source and allows the analysis of both new and deployed contracts. Gigahorse advances the state of the art on several fronts. It gives the highest analysis precision and completeness among decompilers for Ethereum smart contracts---e.g., Gigahorse can decompile over 99.98\% of deployed contracts, compared to 88\% for the recently-published Vandal decompiler and under 50\% for the state-of-the-practice Porosity decompiler. Importantly, Gigahorse offers a full-featured toolchain for further analyses (and a ``batteries included'' approach, with multiple clients already implemented), together with the highest performance and scalability. Key to these improvements is Gigahorse's use of a declarative, logic-based specification, which allows high-level insights to inform low-level decompilation.

read more

Citations
More filters
Book ChapterDOI

A Semantic Framework for the Security Analysis of Ethereum Smart Contracts

TL;DR: The first complete small-step semantics of EVM bytecode is presented, which is formalized in the F* proof assistant, obtaining executable code that is successfully validate against the official Ethereum test suite.
Journal Article

Code Quest : Scalable Source Code Queries with Datalog

TL;DR: This paper describes a source code querying tool, named codeQuest, which combines two previous proposals, namely the use of logic programming and database systems, and uses safe Datalog, which was originally introduced in the theory of databases.
Journal ArticleDOI

Smart Contract: Attacks and Protections

TL;DR: It is revealed that even adopting the 10 most widely used tools to detect smart contract vulnerabilities, these still contain known vulnerabilities, providing a dangerously false sense of security.
Journal ArticleDOI

An exploratory study of smart contracts in the Ethereum blockchain platform

TL;DR: An exploratory study of smart contracts, which elucidates how frequently used the contracts are, what they do, and how complex they are and proposes an open research agenda to drive and foster future studies in the area.
Journal ArticleDOI

Ethereum smart contract security research: survey and future research opportunities

TL;DR: How smart contracts can be maliciously exploited and targeted is focused on, such as security issues of contract program model, vulnerabilities in the program and safety consideration introduced by program execution environment.
References
More filters
Book

The Java Virtual Machine Specification

Tim Lindholm, +1 more
TL;DR: In this article, the authors present a detailed overview of the Java Virtual Machine, including the internal structure of the class file format, the internal form of Fully Qualified Class and Interface names, and the implementation of new class instances.
Journal ArticleDOI

Efficiently computing static single assignment form and the control dependence graph

TL;DR: In this article, the authors present new algorithms that efficiently compute static single assignment forms and control dependence graphs for arbitrary control flow graphs using the concept of {\em dominance frontiers} and give analytical and experimental evidence that these data structures are usually linear in the size of the original program.
Proceedings ArticleDOI

Making Smart Contracts Smarter

TL;DR: This paper investigates the security of running smart contracts based on Ethereum in an open distributed network like those of cryptocurrencies, and proposes ways to enhance the operational semantics of Ethereum to make contracts less vulnerable.
Posted Content

Making Smart Contracts Smarter.

TL;DR: Oyente as discussed by the authors is a symbolic execution tool to find potential security bugs in the execution of smart contracts based on Ethereum in an open distributed network like those of Bitcoin and Ethereum.
Proceedings ArticleDOI

Formal Verification of Smart Contracts: Short Paper

TL;DR: This paper outlines a framework to analyze and verify both the runtime safety and the functional correctness of Ethereum contracts by translation to F*, a functional programming language aimed at program verification.
Related Papers (5)