Building Reuse-Sensitive Control Flow Graphs (CFGs) for EVM Bytecode

2025-05-20

AI Summary

To address semantic ambiguity and redundant dependencies in EVM bytecode static analysis caused by compiler-level code reuse, this paper proposes the first reuse-sensitive control-flow graph (CFG) construction method. Our approach dynamically reconstructs context-aware CFGs by leveraging dynamic taint analysis to automatically identify code reuse contexts, followed by multi-context basic block comparison and on-demand code duplication. This overcomes the limitations of conventional reuse-agnostic modeling and enables synergistic static-dynamic analysis. Evaluated on 10,000 mainstream smart contracts, our method achieves a 99.94% execution trace coverage rate, a 97.02% F1-score for reuse identification, and F1-scores of 99.97% (for tx.origin vulnerabilities) and 99.67% (for reentrancy vulnerabilities), with an average analysis time of only 1.06 seconds.

Technology Category

• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty
• Planning, Routing, and Scheduling: Replanning and Plan Repair

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Security and Privacy: Cryptocurrency and smart contracts
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

The emergence of smart contracts brings security risks, exposing users to the threat of losing valuable cryptocurrencies, underscoring the urgency of meticulous scrutiny. Nevertheless, the static analysis of smart contracts in EVM bytecode faces obstacles due to flawed primitives resulting from code reuse introduced by compilers. Code reuse, a phenomenon where identical code executes in diverse contexts, engenders semantic ambiguities and redundant control-flow dependencies within reuse-insensitive CFGs. This work delves into the exploration of code reuse within EVM bytecode, outlining prevalent reuse patterns, and introducing Esuer, a tool that dynamically identifies code reuse when constructing CFGs. Leveraging taint analysis to dynamically identify reuse contexts, Esuer identifies code reuse by comparing multiple contexts for a basic block and replicates reused code for a reuse-sensitive CFG. Evaluation involving 10,000 prevalent smart contracts, compared with six leading tools, demonstrates Esuer's ability to notably refine CFG precision. It achieves an execution trace coverage of 99.94% and an F1-score of 97.02% for accurate identification of reused code. Furthermore, Esuer attains a success rate of 99.25%, with an average execution time of 1.06 seconds, outpacing tools generating reuse-insensitive CFGs. Esuer's efficacy in assisting identifying vulnerabilities such as tx.origin and reentrancy vulnerabilities, achieving F1-scores of 99.97% and 99.67%, respectively.

Problem

• Addresses semantic ambiguities in EVM bytecode due to code reuse
• Improves CFG precision by dynamically identifying code reuse contexts
• Enhances vulnerability detection in smart contracts via reuse-sensitive CFGs

Innovation

• Dynamic code reuse identification via taint analysis
• Reuse-sensitive CFG construction by replicating code
• High precision with 99.94% trace coverage