一句话：提出静态分析技术，从 EVM 字节码中精确识别链上存储变量及其深层数据结构，精度和召回率均超 94%。
智能合约在 EVM 上运行，并以区块链状态作为持久存储。仅凭已部署字节码识别其 storage 中的数据结构十分困难：mapping 与 array 的位置由代码执行动态导出，现有最佳工具几乎无法恢复复杂结构，且只能扩展到约 50% 的合约。本文提出精细的静态分析技术，用于高保真、高完备地识别链上数据结构。该方法可近乎普遍地扩展，并能恢复深层嵌套结构。实验表明，其识别数据结构精确类型的 precision 达 95.70%、recall 至少 94.96%，显著优于当前最佳工具的 83.30% 与 55.65%；甚至常常比编译器借助完整源码生成的存储描述更完整。
Smart contracts are small programs that run autonomously on the blockchain, using it as their persistent memory. The predominant platform for smart contracts is the Ethereum VM (EVM). In EVM smart contracts, a problem with significant applications is to identify data structures (in blockchain state, a.k.a. “storage”), given only the deployed smart contract code. The problem has been highly challenging and has often been considered nearly impossible to address satisfactorily. (For reference, the latest state-of-the-art research tool fails to recover nearly all complex data structures and scales to 50% of contracts.) Much of the complication is that the main on-chain data structures (mappings and arrays) have their locations derived dynamically through code execution. We propose sophisticated static analysis techniques to solve the identification of on-chain data structures with extremely high fidelity and completeness. Our analysis scales nearly universally and recovers deep data structures. Our techniques are able to identify the exact types of data structures with 95.70% precision and at least 94.96% recall, compared to a state-of-the-art tool managing 83.30% and 55.65% respectively. Strikingly, the analysis is often more complete than the storage description that the compiler itself produces, with full access to the source code.
@inproceedings{abs-2503-20690,
title = {Precise Static Identification of Ethereum Storage Variables},
author = {Sifis Lagouvardos and Yannis Bollanos and Michael Debono and Neville Grech and Yannis Smaragdakis},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773121}
}