Paper Presentation

CSE 6324 - Advance Topic in Software Engineering

University of Texas at Arlington (UTA)
Paper Title: Elipmoc: Advanced Decompilation of Ethereum Smart Contracts
(OOPSLA 2022)

1. Rushikesh Mahesh Bhagat 1001911486

2. Sai Likhith Palasala 1001980407

1
4. Title:

Fig 1: Elipmoc high-level architecture, where solid line depicts new elements in
addition to existing Gigahorse architecture. [1] ​

2
5.Function Reconstruction:
• Private functions in Ethereum smart contracts are not visible or
accessible, making it challenging to analyze a contract's behavior.

• Elipmoc tool uses private function reconstruction technique to

decompile and analyze private functions.

• Private function reconstruction involves identifying entry points and

reconstructing function body by analyzing the bytecode.

3
5.1 Private Function Reconstruction:
• Elipmoc's approach to private function reconstruction
involves:
• Identify Entry points
– Identify entry points to each private function in the bytecode.

• Symbolic Execution
– Monitor and record the values of symbolic variables that are utilized
within the Ethereum smart contract.

• Taint analysis
– Tracking the flow of data through the contract and identifying
potential sources .

4
5.2 Function Boundary and Argument Inference:
• Identify entry and exit points of functions. Find instructions that
push addresses and eventually jump back to same addresses.
This produces an over-approximation of possible call- and return-
site pairings. These are filtered for well-formedness.

• Normalize the control flow of functions by in-lining basic blocks in

all functions that can reach them to address block merging that
occurred during compilation.

• To deduce the types of function arguments, Elipmoc employed a

blend of stack-based and taint-based analysis techniques.

5
6. End to end impact:

• Elipmoc has been utilized as the foundation for an extensive

security inspection and analysis infrastructure.

• Many research tools have been developed on the basis of

Elipmoc. [2] [3] [4]

• It has become basis for many studies by Ethereum Foundation for

deployed smart contracts. [5]

6
7. Evaluation:

• There research questions were based upon three parameters,

Precision, Completeness and Scalability.

• Elipmoc was compared to other tools such as Gigahorse and

Panoramix with respect to the contract size and execution times.

7
7. Evaluation (cont.):
• Gigahorse:
Timeouts (%) Execution Time avg. (sec)
Elipmoc 4.94 % 2.74 s
Gigahorse 18.74 % 4.03 s
Table 1: Decompilation scalability metrics vs Gigiahorse

Bytecode Size [0,5KB) [5KB,10KB) [10KB,15KB) [15KB,20KB) [20KB,max)

Elipmoc 2547 (99.8 %) 1023 (96 %) 536 (82.6 %) 254 (86.1 %) 393 (89.5 %)
Gigahorse 2538 (99.5 %) 909 (85.3 %) 405 (62.4 %) 124 (42.0 %) 87 (19.8 %)
Total Contracts 2552 1065 649 295 439

Table 2: Scalability and size distribution of contracts vs Gigiahorse

8
7. Evaluation (cont.):
• Panoramix:
Unique Unique Events Timeouts (%) Execution
External calls Time avg. (sec)
Elipmoc 11816 11640 5% 2.75 s
Panoramix 7048 7128 17.94 % 15.6 s

Table 3: Decompilation completeness scalability metrics vs Panoramix

Bytecode Size [0,5KB) [5KB,10KB) [10KB,15KB) [15KB,20KB) [20KB,max)

Elipmoc 2547 (99.8 %) 1022 (96 %) 535 (82.4 %) 253 (85.8 %) 393 (89.5 %)
Panoramix 2483 (97.3 %) 925 (86.9 %) 455 (70.1 %) 160 (54.2 %) 80 (18.2 %)
Total Contracts 2552 1065 649 295 439

Table 4: Scalability and size distribution of contracts vs Panoramix

9
8. Related Work:

• Since industry prefers deploying low level Ethereum byte code, it

resulted in many decompilation tools like EtherSolve, SigRec,

• Binary disassembly and decompilation are closer to the EVM

decompilation problem, although control flow is still more
disciplined than in the EVM.

10
9. Conclusion:

• Authors described the enhancements made through Elipmoc

which they claim is better than its predecessors in terms of high-
precision algorithms and they perform better while compared
against parameters like scalability and completeness.

11
References:
[1] https://ieeexplore.ieee.org/document/8811905
[2] https://arxiv.org/abs/1809.03981
[3] https://dl.acm.org/doi/10.1145/3428258
[4] https://dl.acm.org/doi/10.1145/3485540
[5]
https://media.dedaub.com/yield-skimming-forcing-bad-swaps-on-yiel
d-farming-397361fd7c72

12
Thank you!

13