一句话：通过渐进式精化从 EVM 字节码中恢复私有函数边界，精度 94.3%、召回 95.5%。
从已部署字节码恢复 Solidity 智能合约的结构是控制流图构建、反编译与克隆检测等下游分析的前提，其核心难点在于识别私有函数：编译后源码级函数边界完全丢失，而函数调用与过程内跳转都由 JUMP/JUMPI 实现，难以区分。作者观察到基于跳转的控制转移虽表面相似，但其上下文信息不同，部分上下文能确定性地指示过程内跳转或函数调用，因此提出渐进式精化而非简单的二分类：先依据 EVM 执行语义构造潜在函数调用点的过近似集合，再用基于规则的推理缩小范围，剩余不确定情形通过带暗示性上下文的概率推断解决。对每个识别出的函数，进一步分析跳转前的指令以确定目标，并将分散的代码片段重组为连续指令序列。作者实现开源工具 ReFun，在 8,696 个真实 Solidity 合约上跨多个编译器版本与优化设置进行评估，函数恢复达到 94.3% 精度与 95.5% 召回，82% 的合约可在 8 秒内完成函数识别与分离，并展示了其在合约反编译与克隆检测中的应用。
Recovering the structure of a Solidity smart contract from its deployed bytecode is a prerequisite for various downstream analyses, such as control-flow graph construction, decompilation, and clone detection. A central step in this task is identifying private functions. However, since all source-level function boundaries are completely lost after compilation, the major challenge of this task lies in how to differentiate function calls from intra-procedural control transfers, because both are implemented via the JUMP/JUMPI instructions. We observe that although jump-based control transfers are superficially uniform, their context information is different. Some contexts provide definitive evidence of an intra-procedural control transfer or a function call, which inspires us to address this problem through progressive refinement rather than naive binary classification. Specifically, we first construct an over-approximated set of potential function call sites based on EVM execution semantics, and then narrow them down using rule-based reasoning. The remaining uncertain cases are finally resolved through probabilistic inference over suggestive contexts. For each identified function, we further analyze the instructions before each jump to determine its target and reassemble scattered code fragments into a continuous instruction sequence. We implement our approach as an open-source tool, dubbed ReFun, and evaluate it on 8,696 real-world Solidity smart contracts across multiple Solidity compiler versions and optimization settings. The experimental results demonstrate that ReFun achieves 94.3% precision and 95.5% recall in function recovery, and it is also efficient, completing function identification and separation for 82% of contracts within eight seconds per contract. Finally, we show how ReFun is applied to the downstream tasks, including contract decompilation and clone detection.
@article{paperbot12104,
title = {ReFun: Reconstructing Function Boundaries in EVM Bytecode},
author = {Yichuan Li and Wei Song and Jeff Huang and Hans-Arno Jacobsen},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA2},
year = {2026},
doi = {10.1145/3839515}
}