










Abstract:Most blockchains cannot hide the binary code of programs (i.e., smart contracts) running on them. To conceal proprietary business logic and to potentially deter attacks, many smart contracts are closed-source and in many cases exhibit code obfuscation, either intentionally introduced to hide internal logic or unintentionally produced by optimizations. However, we demonstrate that such obfuscation can obscure critical vulnerabilities rather than enhance security, a phenomenon known as insecurity through obscurity. To systematically analyze these risks on a large scale, we present SKANF, a novel EVM bytecode analysis tool tailored for closed-source and obfuscated contracts. SKANF combines control-flow deobfuscation with symbolic execution based on historical transactions to identify and exploit asset management vulnerabilities. Our evaluation on real-world Maximal Extractable Value (MEV) bots reveals that SKANF detects vulnerabilities in 1,046 contracts and successfully generates exploits for 394 of them, with potential losses of $10.6M. Additionally, we uncover 104 real-world MEV bot attacks that collectively resulted in $2.76M in losses.
From: Sen Yang [view email]
[v1]
Fri, 18 Apr 2025 01:22:58 UTC (708 KB)
[v2]
Sun, 8 Jun 2025 23:23:25 UTC (522 KB)
[v3]
Sun, 7 Sep 2025 14:57:02 UTC (516 KB)
[v4]
Wed, 10 Jun 2026 17:59:28 UTC (727 KB)
[v5]
Tue, 4 Aug 2026 00:43:56 UTC (726 KB)
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。