Insecurity Through Obscurity: Veiled Vulnerabilities in Closed-Source Contracts
Sen Yang, Kaihua Qin, Aviv Yaish,Fan Zhang.
In submission. Posted on 18 Apr 2025.
Abstract
Most blockchains cannot hide the binary code of programs (i.e., smart contracts) running on them. To conceal proprietary business logic and to potentially deter attacks, many smart contracts are closed-source and employ layers of obfuscation. However, we demonstrate that such obfuscation can obscure critical vulnerabilities rather than enhance security, a phenomenon we term insecurity through obscurity. To systematically analyze these risks on a large scale, we present SKANF, a novel EVM bytecode analysis tool tailored for closed-source and obfuscated contracts. SKANF combines control-flow deobfuscation, symbolic execution, and concolic execution based on historical transactions to identify and exploit asset management vulnerabilities. Our evaluation on real-world Maximal Extractable Value (MEV) bots reveals that SKANF detects vulnerabilities in 1,028 contracts and successfully generates exploits for 373 of them, with potential losses exceeding $9.0M. Additionally, we uncover 40 real-world MEV bot attacks that collectively resulted in $900K in losses.
Links