一句话：提出 VarLifter，从 Solidity 字节码精确恢复带类型的变量，提升反编译、审计与 fuzzing 效果。
许多 Solidity 智能合约仅公开字节码而无源码，且字节码丢失了变量与类型信息，仅保留栈操作和无类型内存/存储访问，导致现有反编译器常漏识别变量并错误推断类型。VarLifter 将数据区域每次读写字段视为潜在变量，剔除误报后，根据变量操作序列逐步精化其类型。作者在 34,832 个真实合约上评估，带类型变量恢复精确率达 97.48%、召回率达 91.84%，77% 的合约约 10 秒完成分析；替换两个先进反编译器的变量恢复模块后，分别多正确恢复 52.4% 和 74.6% 的带类型变量。应用于反编译、合约审计和字节码 fuzzing 表明恢复的变量信息能改进多项任务。
Since funds or tokens in smart contracts are maintained through specific state variables, contract audit, an effective means for security assurance, particularly focuses on these variables and their related operations. However, the absence of publicly accessible source code for numerous contracts, with only bytecode exposed, hinders audit efforts. Recovering variables and their types from Solidity bytecode is thus a critical task in smart contract analysis and audit, yet this is a challenging task because the bytecode loses variable and type information, only with low-level data operated by stack manipulations and untyped memory/storage accesses. The state-of-the-art smart contract decompilers miss identifying many variables and incorrectly infer the types for many identified variables. To this end, we propose VarLifter , a lifter dedicated to the precise and efficient recovery of typed variables. VarLifter interprets every read or written field of a data region as at least one potential variable, and after discarding falsely identified variables, it progressively refines the variable types based on the variable behaviors in the form of operation sequences. We evaluate VarLifter on 34,832 real-world Solidity smart contracts. VarLifter attains a precision of 97.48% and a recall of 91.84% for typed variable recovery. Moreover, VarLifter finishes analyzing 77% of smart contracts in around 10 seconds per contract. If VarLifter is used to replace the variable recovery modules of the two state-of-the-art Solidity bytecode decompilers, 52.4%, and 74.6% more typed variables will be correctly recovered, respectively. The applications of VarLifter to contract decompilation, contract audit, and contract bytecode fuzzing illustrate that the recovered variable information improves many contract analysis tasks.
@article{00050024,
title = {VarLifter: Recovering Variables and Types from Bytecode of Solidity Smart Contracts},
author = {Yichuan Li and Wei Song and Jeff Huang},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {OOPSLA2},
year = {2024},
doi = {10.1145/3689711}
}