Skip to content

feat: impl. azoth obfuscated bytecode analyzer #130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
g4titanx wants to merge 11 commits into
base: master
Choose a base branch
from
Open

feat: impl. azoth obfuscated bytecode analyzer #130

g4titanx wants to merge 11 commits into from

Conversation

@g4titanx
Copy link
Member

@g4titanx g4titanx commented Jan 12, 2026

basically how this works is: download dataset -> index -> analyze

Dataset discovery

  • The CLI uses the Ethereum contracts dataset manifest from Paradigm.
  • Default dataset root is ./.azoth/datasets/ethereum_contracts, unless AZOTH_DATASET_DIR or --dataset-root is set.
    Download
  • azoth dataset download fetches dataset_manifest.json and lists all files.
  • It downloads each parquet file and verifies MD5.
  • Already‑valid files are skipped.
    Index build (cache)
  • azoth dataset reindex scans all local parquet files.
  • For each contract row it reads:
    • code (runtime bytecode)
    • code_hash (keccak hash of runtime bytecode)
  • It aggregates:
    • opcode_freq: global opcode distribution
    • size_counts: bytecode size histogram
    • total_count: total contracts indexed
    • bloom: a Bloom filter for membership checks on code_hash
  • Writes the cached index to ./.azoth/datasets/ethereum_contracts/index.json.
    Analyze (comparison)
  • azoth analyze loads the cached index.
  • It computes for the input bytecode:
    • opcode frequency histogram
    • bytecode size
    • keccak hash of runtime bytecode
  • Then compares against the cached index:
    • size percentile (how many contracts are smaller)
    • opcode cosine similarity
    • top opcode deviations
    • exact‑match signal via Bloom filter
      Output
  • CLI prints the comparison summary and anomalies.
  • If the index is missing or stale, it warns and suggests reindexing.

@github-actions
Copy link
Contributor

github-actions bot commented Jan 12, 2026

Decompile Diff Analysis

Statistics (50 iterations)

  • Total: 48 hunks, -169 removed, +240 added
  • Items: 16 total, 15 with changes
  • Selectors: 19 remapped
Metric Min Avg Max
Hunks 12 44.2 49
Lines removed 145 166.3 263
Lines added 200 235.2 349
Lines unchanged 19 115.7 137
Full Diff Output 
─── Storage ───
@@ -1,14 +1,21 @@
-    uint256 public constant expectedAmount = 0;
-    uint256 public constant unresolved_8677ab23 = 0;
-    uint256 public constant unresolved_d4899a62 = 0;
-    
-    uint256 public unresolved_fe03a460;
-    uint256 public currentRewardAmount;
-    uint256 public unresolved_d415b3f9;
-    bool public unresolved_308657d7;
-    bool public is_bonded;
-    address public unresolved_1aa7c0ec;
-    uint256 public unresolved_8bd03d0a;
-    uint256 public bondAmount;
+    address store_d;
+    uint256 public unresolved_f8aa6630;
+    bytes32 store_p;
+    bytes32 store_m;
+    bytes32 store_g;
+    uint256 public unresolved_0e80c604;
+    bytes32 store_h;
+    uint256 public unresolved_846bb00c;
+    uint256 public unresolved_52449782;
+    bytes32 store_n;
+    bytes32 store_l;
+    uint256 public unresolved_a968e77f;
+    bytes32 store_r;
+    bytes32 store_a;
+    uint256 store_e;
+    bytes32 store_o;
+    bytes32 store_j;
+    bytes32 store_q;
     
+    error CustomError_00000000();
     

─── Function fund (0xa65e2cfd → 0xcd8aac0b) ───
@@ -1,48 +1,54 @@
-    /// @custom:selector    0xa65e2cfd
-    /// @custom:signature   fund(uint256 arg0, uint256 arg1) public payable
+    
+    /// @custom:selector    0xcd8aac0b
+    /// @custom:signature   Unresolved_cd8aac0b(uint256 arg0, uint256 arg1) public payable
     /// @param              arg0 ["uint256", "bytes32", "int256"]
     /// @param              arg1 ["uint256", "bytes32", "int256"]
-    function fund(uint256 arg0, uint256 arg1) public payable {
+    function Unresolved_cd8aac0b(uint256 arg0, uint256 arg1) public payable {
+        require(!store_j);
+        require(0 == 0x01);
         require(msg.value);
-        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0x40, "Only callable by the deployer");
-        require(!(msg.sender == 0), "Only callable by the deployer");
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0x40, CustomError_0());
+        require(!(msg.sender == 0), CustomError_0());
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x1d;
-        var_d = 0x4f6e6c792063616c6c61626c6520627920746865206465706c6f796572000000;
-        require(!(!bytes1(unresolved_308657d7 >> 0x08)), "Contract already funded");
+        var_d = this.code[12645:12645];
+        var_d = this.code[12677:12677];
+        uint256 var_e = uint256(var_f ^ ((0x579ffa69 ^ (0x04e3587d ^ (0x313d1d83 ^ (0xa5020455 ^ (var_f | (0x0416 ^ ((0x7a5b0eba - (0x96e75d9a - (0x77feb327 + (0x02 * (0xb80821d76ace49ffd9cb4dcbceefdb4b2197edccf9e8ecf4599579b48463c703 + var_g))))) ^ 0x061c))))))) + arg0));
+        require(!(!bytes1(store_a >> 0x08)), "Contract already funded");
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x17;
-        var_d = 0x436f6e747261637420616c72656164792066756e646564000000000000000000;
-        require(!arg0);
-        require(!arg1);
-        currentRewardAmount = arg0;
-        unresolved_d415b3f9 = arg0;
-        unresolved_8bd03d0a = arg1;
-        require(unresolved_d415b3f9 > (unresolved_d415b3f9 + unresolved_8bd03d0a));
-        var_e = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_f = 0x11;
+        var_h = 0x436f6e747261637420616c72656164792066756e646564000000000000000000;
+        require(!arg0, CustomError_4e487d1f());
+        require(!arg1, CustomError_4e487d1f());
+        unresolved_52449782 = arg0;
+        unresolved_0e80c604 = arg0;
+        unresolved_a968e77f = arg1;
+        require(unresolved_0e80c604 > (unresolved_0e80c604 + unresolved_a968e77f), CustomError_4e487d1f());
+        var_f = 0x4e487d1f00000000000000000000000000000000000000000000000000000000;
+        var_i = 0x11;
         var_a = 0x23b872dd00000000000000000000000000000000000000000000000000000000;
         address var_b = msg.sender;
         address var_c = address(this);
-        uint256 var_d = unresolved_d415b3f9 + unresolved_8bd03d0a;
+        uint256 var_h = unresolved_0e80c604 + unresolved_a968e77f;
         (bool success, bytes memory ret0) = address(0).Unresolved_23b872dd(var_b); // call
-        unresolved_308657d7 = (uint248(unresolved_308657d7)) | 0x0100;
-        require(0x20 > ret0.length);
-        require(((var_g + 0x20) > 0xffffffffffffffff) | ((var_g + 0x20) < var_g));
-        var_e = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_f = 0x41;
+        store_a = (uint248(store_a)) | 0x0100;
+        require(0x20 > ret0.length, CustomError_4e487bd1());
+        require(((var_g + 0x20) > 0xffffffffffffffff) | ((var_g + 0x20) < var_g), CustomError_4e487bd1());
+        uint256 var_f = (0x92621603 ^ (0xeda160ca ^ (0x318b0db8 ^ (var_g + 0x20)))) << 0xe0;
+        var_i = 0x41;
         uint256 var_g = var_g + 0x20;
         require(((var_g + 0x20) - var_g) < 0x20);
         require(var_g.length - var_g.length);
-        unresolved_308657d7 = (uint248(unresolved_308657d7)) | 0x0100;
+        store_a = (uint248(store_a)) | 0x0100;
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x1f;
-        var_d = 0x5061796d656e7420616d6f756e74206d757374206265206e6f6e2d7a65726f00;
+        var_h = 0x5061796d656e7420616d6f756e74206d757374206265206e6f6e2d7a65726f00;
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x1e;
-        var_d = 0x52657761726420616d6f756e74206d757374206265206e6f6e2d7a65726f0000;
+        var_d = this.code[12901:12901];
+        uint256 var_j = (0xa7e2b5dd ^ (0xb88f4cb0 ^ (0xb8476789 ^ (uint248(var_f ^ 0x5b7f77e97a7e6e676d7f756f75246f7d7376e07a6f21fe7feebffa77d547c1f8))))) ^ var_g;
     }

─── Function requestCancellation (0x81972d00 → 0xaec45da5) ───
@@ -1,13 +1,9 @@
     
-    /// @custom:selector    0x81972d00
-    /// @custom:signature   requestCancellation() public payable
-    function requestCancellation() public payable {
+    /// @custom:selector    0xaec45da5
+    /// @custom:signature   Unresolved_aec45da5() public view
+    function Unresolved_aec45da5() public view {
+        require(!store_r);
+        require(0 == 0x01);
         require(msg.value);
         require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
-        require(!(0 == msg.sender), "Only callable by the deployer");
-        var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
-        var_b = 0x20;
-        var_c = 0x1d;
-        var_d = 0x4f6e6c792063616c6c61626c6520627920746865206465706c6f796572000000;
-        unresolved_308657d7 = 0x01 | (uint248(unresolved_308657d7));
     }

─── Function resume (0x046f7da2 → 0x474cc187) ───
@@ -1,13 +1,9 @@
     
-    /// @custom:selector    0x046f7da2
-    /// @custom:signature   resume() public payable
-    function resume() public payable {
+    /// @custom:selector    0x474cc187
+    /// @custom:signature   Unresolved_474cc187() public view
+    function Unresolved_474cc187() public view {
+        require(!store_o);
+        require(0 == 0x01);
         require(msg.value);
         require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
-        require(!(0 == msg.sender), "Only callable by the deployer");
-        var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
-        var_b = 0x20;
-        var_c = 0x1d;
-        var_d = 0x4f6e6c792063616c6c61626c6520627920746865206465706c6f796572000000;
-        unresolved_308657d7 = uint248(unresolved_308657d7);
     }

─── Function Unresolved_ede7f6a3 (0xede7f6a3 → 0xc6042445) ───
@@ -1,62 +1,52 @@
     
-    /// @custom:selector    0xede7f6a3
-    /// @custom:signature   Unresolved_ede7f6a3(uint256 arg0, uint256 arg1) public view
+    /// @custom:selector    0xc6042445
+    /// @custom:signature   Unresolved_c6042445(uint256 arg0, uint256 arg1) public view
     /// @param              arg0 ["uint256", "bytes32", "int256"]
     /// @param              arg1 ["uint256", "bytes32", "int256"]
-    function Unresolved_ede7f6a3(uint256 arg0, uint256 arg1) public view {
+    function Unresolved_c6042445(uint256 arg0, uint256 arg1) public view {
+        require(!store_l);
+        require(0 == 0x01);
         require(msg.value);
         require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0x40);
         require(arg0 > 0xffffffffffffffff);
-        require(((msg.data.length - arg0) + 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc) < 0xa0, "Only bonded executor can collect");
-        require(!(bytes1(unresolved_308657d7 >> 0x08)), "Only bonded executor can collect");
-        require(address(unresolved_1aa7c0ec) == msg.sender, "Only bonded executor can collect");
-        require(!(address(unresolved_1aa7c0ec) == msg.sender), "Only bonded executor can collect");
+        require(((msg.data.length - arg0) + 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc) < 0xa0, CustomError_0());
+        require(!(bytes1(store_a >> 0x08)), CustomError_0());
+        require(address(store_d) == msg.sender, CustomError_0());
+        require(!(address(store_d) == msg.sender), CustomError_0());
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x20;
-        var_d = 0x4f6e6c7920626f6e646564206578656375746f722063616e20636f6c6c656374;
+        uint248 var_d = 0x5731 ^ (0xef1c ^ (uint248(0x6f6fef7931fe6f7e64657d28f578756375756f72e063696e28676f7c6c7ddf7b ^ var_e)));
         require(!(!arg1 > block.number), "Target block is in the future");
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x1d;
-        var_d = 0x54617267657420626c6f636b20697320696e2074686520667574757265000000;
-        require((block.number - arg1) > block.number);
-        var_e = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_f = 0x11;
+        var_f = 0x54617267657420626c6f636b20697320696e2074686520667574757265000000;
+        require((block.number - arg1) > block.number, CustomError_4e48736d());
+        var_g = 0x4e48736d00000000000000000000000000000000000000000000000000000000;
+        var_h = 0x11;
         require(0 < (block.number - arg1));
         require(!blockhash(arg1));
         require(arg0 + (arg0) > 0xffffffffffffffff);
-        require(arg0 + (arg0) > 0xffffffffffffffff, "Block header hash mismatch");
-        var_e = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_f = 0x41;
-        require(((var_g + (uint248((0x20 + (0x1f + (arg0 + (arg0)))) + 0x1f))) > 0xffffffffffffffff) | ((var_g + (uint248((0x20 + (0x1f + (arg0 + (arg0)))) + 0x1f))) < var_g), "Block header hash mismatch");
-        var_e = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_f = 0x41;
-        uint256 var_g = var_g + (uint248((0x20 + (0x1f + (arg0 + (arg0)))) + 0x1f));
-        uint256 var_a = (arg0 + (arg0));
-        var_h = msg.data[36:36];
-        uint256 var_i = 0;
-        require(!(keccak256(var_h) == blockhash(arg1)), "Block header hash mismatch");
-        var_i = 0x08c379a000000000000000000000000000000000000000000000000000000000;
-        var_c = 0x20;
-        var_d = 0x1a;
-        var_j = 0x426c6f636b206865616465722068617368206d69736d61746368000000000000;
+        require(arg0 + (arg0) > 0xffffffffffffffff);
+        uint256 var_g = (0x92621603 ^ (0xeda160ca ^ (0x318b0db8 ^ (arg0 + (arg0))))) << 0xe0;
+        var_h = 0x41;
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x1d;
-        var_d = 0x556e61626c6520746f20726574726965766520626c6f636b2068617368000000;
+        uint256 var_i = (0x9f6f ^ (0xf47b ^ ((var_e - 0xa8b9d6a8ce20c3aebdec8050168c9b4e8047c63d661c42b41ee5d2ac5cc6bfd4) - 0xac6966925914fb6863d29ae5008e91e692edf8fdc104f675a0496a6c2d3d8e40))) / 0x02;
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x14;
-        var_d = 0x54617267657420626c6f636b20746f6f206f6c64000000000000000000000000;
-        require(is_bonded, "Only bonded executor can collect");
-        require(!(!block.timestamp > is_bonded), "Only bonded executor can collect");
+        var_f = 0x54617267657420626c6f636b20746f6f206f6c64000000000000000000000000;
+        require(unresolved_846bb00c, CustomError_0());
+        require(!(!block.timestamp > unresolved_846bb00c), CustomError_0());
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x20;
-        var_d = 0x4f6e6c7920626f6e646564206578656375746f722063616e20636f6c6c656374;
+        var_d = 0x5731 ^ (0xef1c ^ (uint248(0x6f6fef7931fe6f7e64657d28f578756375756f72e063696e28676f7c6c7ddf7b ^ var_e)));
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x13;
-        var_d = 0x436f6e7472616374206e6f742066756e64656400000000000000000000000000;
+        bytes32 var_j = (0x10dbdc5d9f5b5cdd301c1c2171e19d9b9d1ea1 ^ var_e) << 0x6a;
     }

─── Function withdraw (0x3ccfd60b → 0xf38ad6cc) ───
@@ -1,55 +1,30 @@
     
-    /// @custom:selector    0x3ccfd60b
-    /// @custom:signature   withdraw() public payable
-    function withdraw() public payable {
+    /// @custom:selector    0xf38ad6cc
+    /// @custom:signature   Unresolved_f38ad6cc(uint256 arg0) public view
+    /// @param              arg0 ["uint256", "bytes32", "int256"]
+    function Unresolved_f38ad6cc(uint256 arg0) public view {
+        require(0xd6 == msg.data[0]);
+        require(0 == 0x01);
         require(msg.value);
         require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
-        require(!(bytes1(unresolved_308657d7 >> 0x08)), "Only callable by the deployer");
-        require(!(msg.sender == 0), "Only callable by the deployer");
+        require(!(bytes1(store_a >> 0x08)), CustomError_0());
+        require(!(msg.sender == 0), CustomError_0());
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x1d;
-        var_d = 0x4f6e6c792063616c6c61626c6520627920746865206465706c6f796572000000;
-        require(!((bytes1(unresolved_308657d7 >> 0x08)) == 0x01), "Cannot reset while bond is active");
-        require(is_bonded, "Cannot reset while bond is active");
-        require(!(block.timestamp > is_bonded), "Cannot reset while bond is active");
-        var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
-        var_b = 0x20;
-        var_c = 0x21;
-        var_d = 0x43616e6e6f74207265736574207768696c6520626f6e64206973206163746976;
-        var_e = 0x6500000000000000000000000000000000000000000000000000000000000000;
-        unresolved_1aa7c0ec = uint96(unresolved_1aa7c0ec);
-        bondAmount = 0;
-        is_bonded = 0;
-        require(unresolved_8bd03d0a > (unresolved_8bd03d0a + unresolved_d415b3f9));
-        var_f = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_g = 0x11;
-        unresolved_308657d7 = uint248(unresolved_308657d7);
-        unresolved_8bd03d0a = 0;
-        currentRewardAmount = 0;
-        require(!unresolved_8bd03d0a + unresolved_d415b3f9);
-        var_a = 0xa9059cbb00000000000000000000000000000000000000000000000000000000;
-        address var_b = msg.sender;
-        uint256 var_c = unresolved_8bd03d0a + unresolved_d415b3f9;
-        (bool success, bytes memory ret0) = address(0).Unresolved_a9059cbb(var_b); // call
-        require(0x20 > ret0.length);
-        require(((var_h + 0x20) > 0xffffffffffffffff) | ((var_h + 0x20) < var_h));
-        var_f = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_g = 0x41;
-        uint256 var_h = var_h + 0x20;
-        require(((var_h + 0x20) - var_h) < 0x20);
-        require(var_h.length - var_h.length);
-        var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
-        var_b = 0x20;
-        var_c = 0x15;
-        var_d = 0x4e6f20776974686472617761626c652066756e64730000000000000000000000;
+        var_d = this.code[12645:12645];
+        var_d = this.code[12677:12677];
+        uint256 var_e = uint256(var_f ^ ((0x579ffa69 ^ (0x04e3587d ^ (0x313d1d83 ^ (0xa5020455 ^ (var_f | (0x0416 ^ ((0x7a5b0eba - (0x96e75d9a - (0x77feb327 + (0x02 * (0xb80821d76ace49ffd9cb4dcbceefdb4b2197edccf9e8ecf4599579b48463c703 + var_g))))) ^ 0x0299))))))) + (bytes1(store_a >> 0x08))));
+        require(!((bytes1(store_a >> 0x08)) == 0x01), CustomError_61732062());
+        require(unresolved_846bb00c, CustomError_61732062());
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x37;
-        var_d = 0x54686520636f6e747261637420776173206e6f742066756e646564206f722068;
-        var_e = 0x6173206265656e20647261696e656420616c7265616479000000000000000000;
+        var_d = this.code[12709:12709];
+        uint248 var_h = uint248(0x05 * (0x02a1 - (0xc71a8c70f1833a16 + (0x14f3ec9b24141116 + (0x7897e347dffd83a8 - (0x2ac9a8f06de6c7561ebcfa0a7d84d51823c71b387858feb9f2792b8c56d75993 ^ ((0x3c53349872cc4ff7 - (0x28a4ee096dbfdede - (0xfd1778c01b0d7803 + (0x1865c73116c45674 + var_f)))) ^ var_g)))))));
+        var_i = 0x6173206265656e20647261696e656420616c7265616479000000000000000000;
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x13;
-        var_d = 0x436f6e7472616374206e6f742066756e64656400000000000000000000000000;
+        bytes32 var_j = (0x10dbdc5d9f5b5cdd301c1c2171e19d9b9d1ea1 ^ var_g) << 0x6a;
     }

─── Function bond (0x9940686e → 0x99090b5b) ───
@@ -1,60 +1,63 @@
     
-    /// @custom:selector    0x9940686e
-    /// @custom:signature   bond(uint256 arg0) public payable
+    /// @custom:selector    0x99090b5b
+    /// @custom:signature   Unresolved_99090b5b(uint256 arg0) public payable
     /// @param              arg0 ["uint256", "bytes32", "int256"]
-    function bond(uint256 arg0) public payable {
+    function Unresolved_99090b5b(uint256 arg0) public payable {
+        require(0x99 == msg.data[0]);
+        require(0 == 0x01);
         require(msg.value);
-        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0x20, "Cancellation requested");
-        require(!(bytes1(unresolved_308657d7 >> 0x08)), "Cancellation requested");
-        require(!(!bytes1(unresolved_308657d7)), "Cancellation requested");
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0x20, CustomError_0());
+        require(!(bytes1(store_a >> 0x08)), CustomError_0());
+        require(!(!bytes1(store_a)), CustomError_0());
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x16;
-        var_d = 0x43616e63656c6c6174696f6e2072657175657374656400000000000000000000;
-        require(!(!arg0 < (currentRewardAmount >> 0x01)), "Bond must be at least half of reward amount");
+        var_d = this.code[12869:12869];
+        uint256 var_e = ((((0x6ebd05a3 ^ (0xb4898e69 ^ (0xe24cf42e ^ (0xba693dbc ^ (0x1350e7134302164150661880200a02c14099040106102380110268c8a0100108 | (0x2027 ^ (0x121b292e021554631822048e128ba31cd442eca026c514a1cea1f576f3d7dcdb + var_f))))))) + 0x04a7) - 0x135bef3f4317566358660bb5d6f2ca82b9c38f86caf9af8598560c7099491bb9) - var_g) << 0x52;
+        require(!(!arg0 < (unresolved_52449782 >> 0x01)), CustomError_0());
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x2b;
-        var_d = 0x426f6e64206d757374206265206174206c656173742068616c66206f66207265;
-        var_e = 0x7761726420616d6f756e74000000000000000000000000000000000000000000;
-        require(is_bonded, "Another executor is already bonded");
-        require(block.timestamp > is_bonded, "Another executor is already bonded");
-        require(is_bonded, "Another executor is already bonded");
-        require(!(block.timestamp > is_bonded), "Another executor is already bonded");
+        var_e = 0x04be - (0xf3405025a65f7800007996f0960959a7 + (0x2b134f4a7a4589fbe105312e7689adfc + (0x4896d44c82bb4382b5eddf63e2ef33dd + (0x282496a59913af0a1a2fb32a3ace35f4 + (0xbd90919bdf928a8c8bdf9d9adf9e8bdf048b942a4f6ba3180af884a3a5f6b3ed + var_f)))));
+        uint256 var_h = (0x52341c542c6ef4a2c90147 + (0xd01b2f1ba91a9300141a88 + (0x8502392ee572185fd738ad + (0x7686d7fa4d1cbb59290721 + unresolved_52449782)))) << 0xaa;
+        require(unresolved_846bb00c, "Another executor is already bonded");
+        require(block.timestamp > unresolved_846bb00c, "Another executor is already bonded");
+        require(unresolved_846bb00c, "Another executor is already bonded");
+        require(!(block.timestamp > unresolved_846bb00c), "Another executor is already bonded");
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x22;
-        var_d = 0x416e6f74686572206578656375746f7220697320616c726561647920626f6e64;
-        var_e = 0x6564000000000000000000000000000000000000000000000000000000000000;
+        var_i = 0x416e6f74686572206578656375746f7220697320616c726561647920626f6e64;
+        var_j = 0x6564000000000000000000000000000000000000000000000000000000000000;
         var_a = 0x23b872dd00000000000000000000000000000000000000000000000000000000;
         address var_b = msg.sender;
         address var_c = address(this);
-        uint256 var_d = arg0;
+        uint256 var_i = arg0;
         (bool success, bytes memory ret0) = address(0).Unresolved_23b872dd(var_b); // call
-        unresolved_1aa7c0ec = var_b | (uint96(unresolved_1aa7c0ec));
-        require(block.timestamp > (block.timestamp + 0x012c));
-        var_f = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_g = 0x11;
-        is_bonded = block.timestamp + 0x012c;
-        bondAmount = arg0;
-        require(0x20 > ret0.length);
-        require(((var_h + 0x20) > 0xffffffffffffffff) | ((var_h + 0x20) < var_h));
-        var_f = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-        var_g = 0x41;
-        uint256 var_h = var_h + 0x20;
-        require(((var_h + 0x20) - var_h) < 0x20);
-        require(var_h.length - var_h.length);
-        if (currentRewardAmount > (currentRewardAmount + bondAmount)) {
-            var_f = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-            var_g = 0x11;
-            currentRewardAmount = currentRewardAmount + bondAmount;
-            require(currentRewardAmount > (currentRewardAmount + bondAmount), "Contract not funded");
-            var_f = 0x4e487b7100000000000000000000000000000000000000000000000000000000;
-            var_g = 0x11;
-            require(unresolved_fe03a460 > (unresolved_fe03a460 + bondAmount), "Contract not funded");
+        store_d = var_b | (uint96(store_d));
+        require(block.timestamp > (block.timestamp + 0x012c), CustomError_4e487e19());
+        var_g = 0x4e487e1900000000000000000000000000000000000000000000000000000000;
+        var_k = 0x11;
+        unresolved_846bb00c = block.timestamp + 0x012c;
+        store_e = arg0;
+        require(0x20 > ret0.length, CustomError_4e487bd1());
+        require(((var_f + 0x20) > 0xffffffffffffffff) | ((var_f + 0x20) < var_f), CustomError_4e487bd1());
+        uint256 var_g = (0x92621603 ^ (0xeda160ca ^ (0x318b0db8 ^ (var_f + 0x20)))) << 0xe0;
+        var_k = 0x41;
+        uint256 var_f = var_f + 0x20;
+        require(((var_f + 0x20) - var_f) < 0x20);
+        require(var_f.length - var_f.length);
+        require(unresolved_52449782 > (unresolved_52449782 + store_e), CustomError_4e487eea());
+        var_g = 0x4e487eea00000000000000000000000000000000000000000000000000000000;
+        var_k = 0x11;
+        unresolved_52449782 = unresolved_52449782 + store_e;
+        require(unresolved_f8aa6630 > (unresolved_f8aa6630 + store_e), CustomError_4e487edf());
+        var_g = 0x4e487edf00000000000000000000000000000000000000000000000000000000;
+        var_k = 0x11;
+        if (unresolved_846bb00c) {
         }
         var_a = 0x08c379a000000000000000000000000000000000000000000000000000000000;
         var_b = 0x20;
         var_c = 0x13;
-        var_d = 0x436f6e7472616374206e6f742066756e64656400000000000000000000000000;
+        uint256 var_l = (0x10dbdc5d9f5b5cdd301c1c2171e19d9b9d1ea1 ^ var_f) << 0x6a;
     }

─── Added: Unresolved_36c204c8 (0x36c204c8) ───
@@ -1,0 +1,12 @@
+    
+    /// @custom:selector    0x36c204c8
+    /// @custom:signature   Unresolved_36c204c8(uint256 arg0) public view returns (bool)
+    /// @param              arg0 ["uint256", "bytes32", "int256"]
+    function Unresolved_36c204c8(uint256 arg0) public view returns (bool) {
+        require(0x04 == msg.data[0]);
+        require(0 == 0x01);
+        require(msg.value);
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
+        bytes1 var_a = !(!bytes1(store_a >> 0x08));
+        return !(!bytes1(store_a >> 0x08));
+    }

─── Added: Unresolved_9acb6ae5 (0x9acb6ae5) ───
@@ -1,0 +1,16 @@
+    
+    /// @custom:selector    0x9acb6ae5
+    /// @custom:signature   Unresolved_9acb6ae5(uint256 arg0) public view returns (bool)
+    /// @param              arg0 ["uint256", "bytes32", "int256"]
+    function Unresolved_9acb6ae5(uint256 arg0) public view returns (bool) {
+        require(0x6a == msg.data[0]);
+        require(0 == 0x01);
+        require(msg.value);
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
+        if (unresolved_846bb00c) {
+            uint256 var_a = !(block.timestamp > unresolved_846bb00c);
+            return !(block.timestamp > unresolved_846bb00c);
+            var_a = unresolved_846bb00c;
+            return unresolved_846bb00c;
+        }
+    }

─── Added: Unresolved_80004471 (0x80004471) ───
@@ -1,0 +1,12 @@
+    
+    /// @custom:selector    0x80004471
+    /// @custom:signature   Unresolved_80004471(uint256 arg0) public view returns (uint256)
+    /// @param              arg0 ["uint256", "bytes32", "int256"]
+    function Unresolved_80004471(uint256 arg0) public view returns (uint256) {
+        require(0x80 == msg.data[0]);
+        require(0 == 0x01);
+        require(msg.value);
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
+        var_a = store_e;
+        return store_e;
+    }

─── Added: Unresolved_f4e9c0dd (0xf4e9c0dd) ───
@@ -1,0 +1,12 @@
+    
+    /// @custom:selector    0xf4e9c0dd
+    /// @custom:signature   Unresolved_f4e9c0dd(uint256 arg0) public view returns (address)
+    /// @param              arg0 ["uint256", "bytes32", "int256"]
+    function Unresolved_f4e9c0dd(uint256 arg0) public view returns (address) {
+        require(0xc0 == msg.data[0]);
+        require(0 == 0x01);
+        require(msg.value);
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
+        address var_a = address(store_d);
+        return address(store_d);
+    }

─── Added: Unresolved_6516ab75 (0x6516ab75) ───
@@ -1,0 +1,12 @@
+    
+    /// @custom:selector    0x6516ab75
+    /// @custom:signature   Unresolved_6516ab75(uint256 arg0) public pure returns (uint256)
+    /// @param              arg0 ["uint256", "bytes32", "int256"]
+    function Unresolved_6516ab75(uint256 arg0) public pure returns (uint256) {
+        require(0xab == msg.data[0]);
+        require(0 == 0x01);
+        require(msg.value);
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
+        uint256 var_a = 0;
+        return 0;
+    }

─── Added: Unresolved_300a2cb6 (0x300a2cb6) ───
@@ -1,0 +1,12 @@
+    
+    /// @custom:selector    0x300a2cb6
+    /// @custom:signature   Unresolved_300a2cb6(uint256 arg0) public view returns (bool)
+    /// @param              arg0 ["uint256", "bytes32", "int256"]
+    function Unresolved_300a2cb6(uint256 arg0) public view returns (bool) {
+        require(0x30 == msg.data[0]);
+        require(0 == 0x01);
+        require(msg.value);
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
+        bytes1 var_a = !(!bytes1(store_a));
+        return !(!bytes1(store_a));
+    }

─── Added: Unresolved_ca14edff (0xca14edff) ───
@@ -1,0 +1,11 @@
+    
+    /// @custom:selector    0xca14edff
+    /// @custom:signature   Unresolved_ca14edff() public view returns (uint256)
+    function Unresolved_ca14edff() public view returns (uint256) {
+        require(!store_g);
+        require(0 == 0x01);
+        require(msg.value);
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
+        uint256 var_a = 0;
+        return 0;
+    }

─── Added: Unresolved_d4cfd0d2 (0xd4cfd0d2) ───
@@ -1,0 +1,11 @@
+    /// @custom:selector    0xd4cfd0d2
+    /// @custom:signature   Unresolved_d4cfd0d2(uint256 arg0) public pure returns (uint256)
+    /// @param              arg0 ["uint256", "bytes32", "int256"]
+    function Unresolved_d4cfd0d2(uint256 arg0) public pure returns (uint256) {
+        require(0xd4 == msg.data[0]);
+        require(0 == 0x01);
+        require(msg.value);
+        require((0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc + msg.data.length) < 0);
+        uint256 var_a = 0;
+        return 0;
+    }

Commit 3b3a839

@g4titanx
Copy link
Member Author

g4titanx commented Jan 12, 2026 

============================================================
DATASET COMPARISON
============================================================
Bytecode size:            11028 bytes
Size percentile:          99.29%
Opcode similarity:        0.841
Exact match:              no

Top opcode anomalies:
  PUSH0 (0x5f): +7394.43%
  MSTORE8 (0x53): +3512.33%
  BYTE (0x1a): +2419.90%
  SLT (0x12): +723.10%
  DUP11 (0x8a): +666.73
============================================================

meaning:

Bytecode size: 11028 bytes - That’s the runtime size of the escrow contract I analyzed.

Size percentile: 99.29% - This bytecode is larger than ~99.29% of contracts in the dataset. It’s unusually large compared to typical deployed contracts.

Opcode similarity: 0.841 - Cosine similarity of opcode frequency vs. the dataset baseline. 0.841 is fairly close, but not “typical.” It suggests the distribution is somewhat similar to average contracts, but with noticeable deviations.

Exact match: no - The keccak hash of the bytecode isn’t present in the dataset Bloom filter, so there’s no exact match (or it’s a false negative, which Bloom filters don’t produce).

Top opcode anomalies (relative to dataset baseline, higher means overrepresented):

  • 0x5f = PUSH0 -> Very high suggests many zero pushes vs. average.
  • 0x53 = MSTORE8 (store single byte in memory).
  • 0x1a = BYTE (extract a byte from a word).
  • 0x12 = SLT (signed less-than).
  • 0x8a = DUP11.

these anomalies are relative increases (e.g., +7394% means ~75× more frequent than the dataset baseline). but it doesn’t mean they’re wrong, just that the escrow contract’s opcode mix is unusual compared to the global dataset.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@g4titanx