2025 · Journal article
DiSCo: Towards Decompiling EVM Bytecode to Source Code using Large Language Models
DiSCo lifts Ethereum contract creation bytecode to Solidity source by prompting a frozen LLM, instead of emitting decompiler pseudocode. It abstracts control-flow paths into logic-invariant semantic units, recovers constructor logic by simulating creation bytecode captured from block execution, and infers stripped names with signature databases and a type-aware graph model. These units become natural-language descriptions plus coding specifications in the prompt. GPT-4 is the primary model; Llama 3 is also tested.
Scope and limitations
Ground truth comes from Etherscan source files: 200 highest-balance contracts for all baselines and 1,000 for automated tests; separate studies add 50 Vyper, 50 newly deployed and 149 closed-source attack contracts. Compilability (about 75% with best-of-five sampling, 46% for a single run), differential-fuzzing pass rates and embedding similarity do not establish equivalence to deployed source. Nearly half of the imitation-learning fuzzer’s transactions revert, and manual review judged about 28.5% of generated contracts semantically consistent, and 12% for Vyper inputs. The authors report timeouts or unsound analysis on contracts with many paths, and name inference remains weak. Baselines give the same LLM output from Panoramix, Ethervm and Elipmoc, mostly taken from their websites or decompiled manually; this is not a comparison of standalone decompilers. Results depend on a GPT-4 preview snapshot. Attack reproduction covers ten January 2025 incidents, four of which were reproduced.
Why it fits this collection
Extends LLM-assisted decompilation to EVM smart-contract bytecode, recovering constructor logic and identifiers and checking results by compilation and differential execution.
Publication and review details
- Venue
- Proceedings of the ACM on Software Engineering (FSE 2025)
- Status
- Journal article
- Publication / posting date
- June 19, 2025
- Date source
- The ACM article page and publisher-deposited Crossref metadata agree on publication on 2025-06-19. The PDF footer’s July 2025 issue date and the FSE conference dates are not substituted for this publication date.
- DOI
- 10.1145/3729373
The six-author order follows the ACM PDF and Crossref. ACM lists article FSE103 in volume 2, issue FSE, pages 2311–2334, and licenses the paper under CC BY 4.0. No arXiv version was found. The Data Availability section points to github.com/suxnju/disco, which now redirects to b1ue3ky/disco. At the reviewed 2025-04-13 commit, that MIT-licensed repository holds dataset CSVs of contract addresses, evaluation results and user-study material, but no DiSCo implementation, so it is recorded as a project link rather than code. Contract sources and on-chain data keep their own terms. The primary model is given as GPT-4-0315-Preview. No code, prompts or experiments were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://dl.acm.org/doi/10.1145/3729373
- https://dl.acm.org/doi/pdf/10.1145/3729373
- https://api.crossref.org/works/10.1145/3729373
- https://github.com/b1ue3ky/disco/tree/ee04ae812c2239a42fef8046f3c2486c36d7d296
- README.md GitHub · b1ue3ky/disco · Revision ee04ae8
- LICENSE GitHub · b1ue3ky/disco · Revision ee04ae8
- disco_artifacts/datasets/d_small.csv GitHub · b1ue3ky/disco · Revision ee04ae8