The Incredible Shrinking Context... in a decompiler near you

2024-09-17

arXiv.org

AI Summary

This paper addresses the critical challenge of recovering high-level control flow from highly optimized continuation-passing style (CPS) bytecode in Ethereum EVM smart contract decompilation. We propose a novel static-analysis-based decompilation method centered on “contracted context-sensitivity” analysis—a technique that dynamically prunes control-flow history to preserve precision while overcoming the computational complexity bottlenecks inherent in conventional context-sensitive analyses. Our approach integrates EVM semantic modeling, context-sensitive data-flow analysis, and control-flow graph reconstruction. Evaluated on standard benchmarks, the method achieves 99.5% contract coverage (+4.5 percentage points), increases decodable code volume by 67%, and improves key control-flow recovery accuracy by over 65%.

Technology Category

• Search and Optimization: Evolutionary Computation
• Constraint Satisfaction and Optimization: Distributed CSP/Optimization
• Machine Learning: Evaluation and Analysis

Application Category

• Security and Privacy: Cryptocurrency and smart contracts
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

Decompilation of binary code has arisen as a highly-important application in the space of Ethereum VM (EVM) smart contracts. Major new decompilers appear nearly every year and attain popularity, for a multitude of reverse-engineering or tool-building purposes. Technically, the problem is fundamental: it consists of recovering high-level control flow from a highly-optimized continuation-passing-style (CPS) representation. Architecturally, decompilers can be built using either static analysis or symbolic execution techniques. We present Shrknr, a static-analysis-based decompiler succeeding the state-of-the-art Elipmoc decompiler. Shrknr manages to achieve drastic improvements relative to the state of the art, in all significant dimensions: scalability, completeness, precision. Chief among the techniques employed is a new variant of static analysis context: shrinking context sensitivity. Shrinking context sensitivity performs deep cuts in the static analysis context, eagerly"forgetting"control-flow history, in order to leave room for further precise reasoning. We compare Shrnkr to state-of-the-art decompilers, both static-analysis- and symbolic-execution-based. In a standard benchmark set, Shrnkr scales to over 99.5% of contracts (compared to ~95%), covers (i.e., reaches and manages to decompile) 67% more code, and reduces key imprecision metrics by over 65%.

Problem

• Recovering high-level control flow from optimized EVM bytecode
• Improving decompiler scalability, completeness, and precision
• Introducing shrinking context sensitivity for better static analysis

Innovation

• Static-analysis-based decompiler Shrknr
• Shrinking context sensitivity technique
• Improves scalability, completeness, precision