Locate Vulnerabilities Of Ethereum Smart Contracts

Locate Vulnerabilities Of Ethereum Smart Contracts

Speakers: Boik Su, Senior Security Researcher, CyCraft

Conference: HITB Phuket

YouTube: https://www.youtube.com/watch?v=_6Lvxm7poyo

Overview

In this insightful talk from HITB Phuket, Boik Su, a Senior Security Researcher at CyCraft, delves into the critical and rapidly evolving domain of Ethereum smart contract security. With the Web3 ecosystem experiencing exponential growth, accompanied by staggering financial losses due to vulnerabilities—totaling approximately $3.8 billion in 2022 alone—the need for robust security analysis tools and methodologies has never been more pressing. Su highlights a significant challenge: while the blockchain paradigm emphasizes transparency, the source code for many proprietary smart contracts remains inaccessible, forcing security researchers to confront raw bytecode.

The presentation meticulously unpacks the intricacies of reverse engineering Ethereum smart contracts, offering a systematic approach to uncover hidden logic and potential vulnerabilities. Su demonstrates how traditional reverse engineering techniques, adapted for the Ethereum Virtual Machine (EVM), can be leveraged to understand complex contracts even without their original source code. This capability is paramount for blackbox security auditing, enabling defenders and researchers to analyze and secure the decentralized applications (dApps) that form the backbone of Web3.

Su's talk provides a comprehensive technical deep dive, introducing concepts like Control Flow Graphs (CFG), Intermediate Language (IL) based analysis, Value Set Analysis (VSA), and EVM simulation. He culminates the discussion by showcasing a custom tool built upon Binary Ninja's API, capable of transforming opaque EVM bytecode into human-readable pseudo-C code. This talk is essential for anyone involved in blockchain development, security research, or simply seeking a deeper understanding of the challenges and solutions in safeguarding the decentralized future.

Background

▶ Watch: Introduction to blockchain, web3, and smart contracts (0:00)

The advent of Web3 marks a paradigm shift from the centralized architectures of Web2, leveraging blockchain technology to foster decentralization, transparency, and immutability. At its core, blockchain, first popularized by Bitcoin in 2008, introduced concepts like peer-to-peer (P2P) networks and consensus algorithms (e.g., Nakamoto Consensus, Proof of Work, Proof of Stake). These innovations ensure data integrity and availability across distributed ledger technologies (DLTs), mitigating single points of failure inherent in Web2's centralized data storage. For instance, a 51% attack, while theoretically possible on smaller chains, is practically impossible on robust networks like Bitcoin, preventing malicious actors from reversing transactions and executing double-spending attacks.

Ethereum, representing the "second generation" of blockchain, significantly expanded capabilities by introducing smart contracts. These self-executing contracts, with rules encoded directly into their logic, enable the creation of decentralized applications (dApps) and decentralized finance (DeFi) protocols. Unlike Bitcoin, which primarily functions as a payment system (processing ~7 transactions per second compared to credit cards' ~24,000 tps), Ethereum provides a programmable platform where developers can define complex logic. Smart contracts execute within the Ethereum Virtual Machine (EVM), a stack-based machine that processes EVM opcodes—a set of 142 distinct instructions, each incurring a gas fee representing computational cost.

Despite their revolutionary potential, Web3 applications share significant security parallels with their Web2 predecessors. Boik Su highlights several real-world examples:

• Cross-Site Scripting (XSS) attacks on NFT marketplaces, allowing attackers to inject malicious JavaScript to steal keys or deface pages.
• DNS cache spoofing attacks, as seen with Curve Finance (though attributed to an infrastructure provider), where altered DNS records redirected users to malicious sites.
• UI spoofing attacks, where malicious actors create functions with benign-sounding names (e.g., claimRewards) that perform nefarious actions under the hood. MetaMask, a popular crypto wallet, attempts to recover original function signatures, but attackers can exploit this by crafting misleading signatures. This underscores the critical need for users to verify contract interactions, especially if the source code is available.

However, the most significant security challenge in Web3 lies within the smart contracts themselves. The sheer volume of funds locked in these contracts makes them prime targets, with billions lost annually to hacks. While some developers open-source their contracts for transparency and trust, many proprietary projects opt to keep their source code private to protect intellectual property. This creates a "blackbox" scenario for security researchers, who are left with only the compiled bytecode on the blockchain. The problem exists because even though "everything on the blockchain is transparent," this transparency often extends only to the bytecode, not necessarily the human-readable source code. This necessitates advanced reverse engineering techniques to understand, audit, and secure these critical backend components.

Key Findings

▶ Watch: Ethereum's revolutionary smart contracts and DApps (12:00)

The central finding of Boik Su's talk is the development and demonstration of a robust methodology and tool for reverse engineering Ethereum smart contracts from their compiled bytecode. This addresses the critical gap faced by security researchers and auditors when confronted with proprietary or unaudited contracts lacking public source code. The core contribution lies in adapting traditional binary reverse engineering principles to the unique environment of the EVM, thereby enabling comprehensive blackbox security analysis.

Key findings and contributions include:

1. Necessity of Blackbox Analysis: Acknowledging that not all smart contracts are open-source, the talk establishes that relying solely on whitebox (source code available) testing is insufficient. Blockchain transparency means bytecode is always accessible, making blackbox reverse engineering a mandatory skill set for comprehensive security.
2. Adaptation of Control Flow Graphs (CFG) for EVM: Su demonstrates how disassembling EVM bytecode into a Control Flow Graph (CFG) is fundamental. A CFG visually represents the execution paths of a program, crucial for understanding complex conditional logic, identifying loops, and deriving correct execution semantics, which is a significant challenge in the unstructured nature of raw bytecode.
3. Leveraging Intermediate Language (IL) based Analysis: The talk advocates for IL-based analysis as a powerful abstraction layer. By converting EVM opcodes into a higher-level, architecture-agnostic intermediate representation, the complexity of the underlying machine code is significantly reduced. This allows for more effective static analysis, loop elimination, and transformation into Static Single Assignment (SSA) form, paving the way for higher-level program understanding.
4. Integration of Value Set Analysis (VSA) for Branch Resolution: A common challenge in reverse engineering is accurately determining the targets of indirect jumps. Su highlights the use of Value Set Analysis (VSA), which approximates the possible values a variable or memory location can hold at any given program point. This is crucial for inferring branch information and constructing an accurate CFG in the dynamic EVM environment.
5. EVM Simulation for Contextual Data: To overcome the limitations of static analysis, the methodology incorporates dynamic EVM simulation. By executing the bytecode with a defined gas limit, the tool can capture runtime values, memory states, and function call targets. This dynamic context provides essential data (e.g., jump table targets, storage slot values) that greatly enhances the accuracy of the static analysis and CFG generation.
6. A Practical Tool for Smart Contract Decompilation: The culmination of these findings is a custom plugin built using Binary Ninja's API. This tool effectively automates the process, taking EVM bytecode, simulating its execution, and then feeding the collected data back into Binary Ninja to generate increasingly abstract views: raw disassembly, low-level IL, high-level IL, and ultimately, human-readable pseudo-C code. This transformation dramatically reduces the intellectual effort required to understand complex contract logic.

These findings collectively provide a robust framework for understanding and analyzing the security posture of Ethereum smart contracts without access to their original source code, offering a critical asset for the Web3 security community.

Technical Deep Dive

▶ Watch: Reversing smart contracts: Disassembly to CFG (28:00)

The core of Boik Su's talk revolves around a sophisticated methodology for reverse engineering Ethereum smart contracts, specifically focusing on transforming raw EVM bytecode into an understandable, high-level representation. This process is crucial for blackbox security auditing, where the original source code is unavailable.

Su first contrasts whitebox testing, where source code is available (e.g., using tools like Slither, MythX), with blackbox testing. He illustrates a common whitebox vulnerability with an NFT collection example: a mint function with a require statement checking price < msg.value but failing to update the price based on quantity. This allows a user to mint multiple NFTs while paying for only one, a critical flaw highlighting the importance of thorough code review. For blackbox scenarios, however, the approach must differ.

The fundamental step in reverse engineering any compiled binary, including EVM bytecode, is disassembly. EVM opcodes, each typically one byte long, are translated into their mnemonic representations. For instance, 60 E0 translates to PUSH1 0xE0. This raw assembly is then used to construct a Control Flow Graph (CFG).

Why CFG is essential:

• Correct Execution Logic: A CFG accurately models the program's execution paths, including branches and jumps. Without it, understanding the true flow of control, especially with conditional logic, is impossible. Su provides an example where a linear read of code would lead to incorrect assumptions about register states, whereas a CFG reveals all possible paths.
• Loop Elimination: CFGs aid in identifying and abstracting loops, transforming the graph into a more structured, tree-like representation, which simplifies subsequent analysis.
• Static Single Assignment (SSA) Form: CFGs are a prerequisite for converting code into SSA form, an intermediate representation where each variable is assigned only once. This simplifies data flow analysis and enables more powerful optimizations and transformations to higher-level abstractions.

Directly building an accurate CFG from EVM bytecode is challenging due to dynamic jump targets. To simplify this, Su advocates for Intermediate Language (IL) based analysis. Instead of directly working with machine code, the bytecode is first translated into an intermediate representation. Tools like Binary Ninja, Ghidra (P-Code), and IDA Pro (Microcode) provide such ILs. Su specifically chose Binary Ninja due to its well-documented API, which is critical for custom tool development.

The process of constructing the CFG within Binary Ninja involves several technical steps:

1. Initial Disassembly and IL Generation: Binary Ninja's API is used to load the EVM bytecode and generate its initial disassembly and low-level IL representation.
2. Inferring Branch Information via Value Set Analysis (VSA): A key challenge in EVM is that jump targets (e.g., for JUMP or JUMPI opcodes) are often computed dynamically and pushed onto the stack. Value Set Analysis (VSA) is employed to approximate the possible values that can be on the stack at any given program point. This allows the tool to determine potential jump destinations, even for indirect jumps, enabling the accurate construction of the CFG. VSA might "over-approximate" (report more possibilities than actually exist) but crucially "never under-approximate," ensuring no valid paths are missed.
3. EVM Simulation for Runtime Context: To obtain highly accurate values for stack, memory, and storage at various program points, the methodology incorporates EVM simulation. Su utilizes ethereumjs-monorepo, a full JavaScript implementation of the EVM. By setting a reasonable gas limit (as all EVM computations are gas-bounded), the tool can simulate every execution step. During this simulation, critical data is recorded:

• Jump Tables: The actual targets of JUMP and JUMPI instructions are captured. For example, a JUMP at 0x24 might reveal a target address of 0x169.
• Memory Operations: Values written to memory via MSTORE and return data via RETURNDATACOPY are logged.
• Built-in Function Calls: Interactions with precompiled contracts or special EVM functions are tracked.

This dynamic information provides concrete values that VSA might only approximate, significantly boosting the accuracy of the CFG and subsequent analysis. The tool can even "alter state to arbitrary values" during simulation for semi-automatic analysis, allowing researchers to observe behavioral changes.

1. Feeding Data to Binary Ninja API: The collected branch information and runtime values from the EVM simulation are then fed back into Binary Ninja's APIs. This allows Binary Ninja to refine its internal representation, constructing a precise CFG and progressively lifting the abstraction level of the code.

By combining static IL analysis with dynamic EVM simulation and VSA, the developed tool overcomes significant hurdles in EVM reverse engineering. It effectively translates the low-level, stack-based operations of the EVM into a structured, high-level representation, making complex smart contract logic accessible for security analysis without source code.

Demo / Proof of Concept

▶ Watch: Functional EVM reversing tool demonstrated (39:30)

Boik Su demonstrated the practical application of his reverse engineering tool using a case study from the DEF CON 2018 CTF Qualification challenge, "SEC." This challenge involved a smart contract designed as a gambling game, presenting a realistic scenario for blackbox analysis.

The "SEC" challenge provided a proxy contract, SECProxy, which delegates calls to a separate, private implementation contract. The goal was twofold: first, to understand the gambling logic within the private contract by invoking SECProxy.gamble to win; and second, to request an encrypted flag via SECProxy.requestPrice after winning. Crucially, the source code for the private contract was not provided, making it a perfect candidate for the blackbox reverse engineering tool.

The demonstration proceeded as follows:

1. Obtaining Bytecode: As "everything on the blockchain is transparent," the bytecode for the private contract could be easily retrieved.
2. Loading into the Tool: The retrieved bytecode was loaded into the custom Binary Ninja plugin.
3. Initial Views: Upon loading, the tool displayed a list of function selectors on the left-hand side and the raw disassembled bytecode on the right. Clicking on a specific function selector initially showed a highly complex and convoluted CFG in the disassembly view, which was "very hard to understand" due to its intricate structure and numerous blocks and edges.
4. Abstraction Levels: The power of the IL-based analysis was then showcased by progressively escalating the abstraction view:

• Low-Level IL (LLIL): The view was switched to LLIL, providing a more "intuitive view" of the logic. While still complex with many blocks, it was a significant improvement over raw disassembly.
• High-Level IL (HLIL): Further abstraction led to HLIL, where "old blocks are being reducted to a decent amount of number." This view was much cleaner, abstracting away many low-level EVM stack operations.
• Pseudo-C View: The final and most impactful transformation was to the pseudo-C view. This view presented the contract's logic in a familiar, C-like syntax, revealing clear programming constructs. For the "SEC" challenge, this view immediately exposed "two while loops there doing some kinds of operations, you know, to randomize the inputs of user's address or something like that."

This demonstration vividly illustrated how the tool transforms opaque EVM bytecode into a comprehensible, high-level representation. By reducing the complexity from raw opcodes to pseudo-C code, the tool enables security researchers to quickly grasp the underlying logic of a smart contract, identify critical functions like the gambling mechanism, and subsequently devise strategies to exploit or defend against vulnerabilities. The case study effectively validated the potency of the Intermediate Language-based analysis combined with EVM simulation for practical smart contract security challenges.

Defensive Implications

▶ Watch: Future enhancements for smart contract analysis tools (44:40)

The insights and tools presented by Boik Su have profound implications for enhancing security in the Web3 ecosystem, offering actionable strategies for both developers and defenders.

For Smart Contract Developers, the talk underscores the critical importance of prioritizing security from the outset, rather than treating it as an afterthought in the pursuit of a Minimum Viable Product (MVP).

• Secure Coding Practices: The NFT minting vulnerability example (paying for one, getting many) highlights that even seemingly simple logic can harbor severe flaws. Developers must adopt rigorous secure coding practices, conducting thorough internal reviews and employing static analysis tools (like Slither or MythX) when source code is available.
• Gas Efficiency: Su emphasizes the developer's responsibility to ensure gas efficiency within contracts. While primarily a cost concern for users, inefficient gas usage can also expose contracts to denial-of-service vectors or make certain operations economically unfeasible, indirectly affecting security and usability.
• Transparency vs. Proprietary Code: While open-sourcing contracts fosters trust and allows for community audits, developers choosing to keep their code proprietary must invest even more heavily in internal security audits and formal verification. For proprietary contracts, tools like the one demonstrated become indispensable for any third-party blackbox audit.

For Defenders, Auditors, and Security Researchers, the methodology provides crucial capabilities for analyzing unverified or proprietary smart contracts:

• Blackbox Auditing: The ability to reverse engineer EVM bytecode into pseudo-C code empowers security professionals to conduct comprehensive blackbox audits. This is vital for assessing the security of deployed contracts where source code is unavailable, identifying vulnerabilities that might otherwise remain hidden.
• Incident Response: In the aftermath of a smart contract hack, the tool can be used to quickly understand the exploit vector by analyzing the malicious transaction's interaction with the bytecode, even if the original source code is withheld or compromised.
• Threat Intelligence: Researchers can use this approach to analyze known malicious contracts or novel attack techniques directly from the blockchain, generating valuable threat intelligence for the wider community.
• User Protection: The discussion on UI spoofing (e.g., misleading function names) serves as a potent warning. Defenders can educate users to always verify the actual operations a smart contract is about to perform, not just rely on human-readable names presented by wallets or dApps. Tools that can show the decompiled logic directly to users (even in a simplified form) could be a future defensive layer.

Looking forward, Su suggests improvements for reverse engineering tools, such as producing more Solidity-like output (rather than generic C), integrating features akin to IDA Pro's FLIRT technology for identifying imported libraries, and leveraging APIs (or even AI like GPT) for decoding function signatures. These advancements would further streamline the defensive process, making smart contract analysis more accessible and efficient for the security community, ultimately contributing to a safer Web3 landscape.

Key Takeaways

• Smart contract security is paramount in Web3, with billions of dollars lost annually due to vulnerabilities, necessitating robust analysis techniques.
• Reverse engineering EVM bytecode is essential for blackbox auditing of proprietary or unverified smart contracts where source code is not publicly available.
• Intermediate Language (IL) based analysis (e.g., using Binary Ninja) significantly simplifies complex EVM bytecode by transforming it into a higher-level, more manageable representation.
• Combining static analysis (CFG, VSA) with dynamic EVM simulation provides the most accurate and comprehensive understanding of smart contract logic and execution flow.
• The demonstrated tool effectively transforms opaque EVM bytecode into human-readable pseudo-C code, making intricate contract logic accessible for security researchers.
• Defenders and developers must prioritize security, adopt secure coding practices, and educate users about frontend vulnerabilities like UI spoofing, which can complement backend smart contract exploits.

About the Speaker(s)

Boik Su is a Senior Security Researcher at CyCraft, a cybersecurity company. He is also an active member of CHROOTS, a local hacker group in Taiwan known for organizing annual hackathon events. With a primary expertise spanning web security and IoT security, Boik has recently dedicated his focus to mastering blockchain security. Over the years, he has been a prolific speaker at various security conferences globally, including notable events such as OWASP Global, Black Hat Asia, R00tCon, and HITB, sharing his insights and research with the wider cybersecurity community.