INTRODUCTION
(A). BACKGROUND
Blockchain technology has revolutionized digital transactions, and Ethereum is now the most
popular platform for developing and executing smart contracts. In particular, Decentralised
Finance (DeFi) and Non-Fungible Tokens (NFTs) rely on smart contracts, which are self-
contained programs written in languages like Solidity and compiled into low-level Ethereum
Virtual Machine (EVM) bytecode. While the immutability of smart contracts guarantees that
their behavior can’t be changed after deployment, it also means that any hidden bug or
security oversight becomes a permanent part of the code. Once such an issue slips through, it
can quickly turn into heavy financial losses, something the DeFi space has seen more than
once in its major breach history. The 2016 DAO breach—where attackers siphoned off more
than 3.6 million ETH—stands as one of the clearest examples of why stronger security
measures are urgently needed.
When faced with the increasing complexity and rapid evolution of smart contracts and the
EVM environment, traditional security auditing techniques usually fail. As a result, more
advanced techniques are needed to identify minor but harmful vulnerabilities that
conventional tools might miss. Even in cases where the source code is absent or has been
modified due to compiler optimisations, reverse engineering offers an efficient way for
analysts to dissect produced EVM bytecode, rebuild the underlying logic, and identify
vulnerabilities. Additionally, by analysing opcode-level data from smart contract bytecode,
machine learning techniques—such as Random Forest algorithms—have demonstrated
success in identifying patterns associated with fraudulent or insecure activity in DeFi
protocols.
(B). PROBLEM STATEMENT
Even with the steady progress in smart-contract development and security auditing, uncovering the
more obscure and complex flaws buried in EVM bytecode is still a significant challenge—especially in
fast-moving areas like DeFi and NFT projects. The permanent nature of blockchain deployment
exacerbates the scenario; once a defect is discovered after launch, it is typically impossible to
rectify without significant community consensus, costly contract migrations, or other costly
measures.
The majority of static analysis tools currently in use work relatively well on straightforward
problems, but they often become confused by context-specific flaws, Resulting in either a
large number of false alarms or, worse, a complete lack of detection of sophisticated attack
patterns that exploit minor logical faults. Many categories of critical weaknesses remain
poorly understood and frequently evade detection by existing techniques. The DAO issue is a
classic illustration of how inadequate sharing of lessons learned from previous exploits has
frequently resulted in significant losses throughout history.
An automated, quick, and highly accurate method that can consistently identify these elusive
flaws in compiled EVM bytecode is therefore desperately needed by the ecosystem. By
addressing risks prior to contracts becoming live, such a system would enable developers and
auditors to lower the likelihood of expensive exploits drastically.
(C). RESEARCH OBJECTIVES
This study seeks to tackle the highlighted challenges through the following goals:
1. To create a structured and repeatable process for reverse engineering Ethereum EVM
bytecode, enabling the extraction of key structural and behavioural patterns that reveal
potential vulnerabilities—even in cases where the source code is unavailable or has been
heavily altered by compiler optimisations.
2. To explore and implement machine learning methods, with the Random Forest model, to
automatically recognise hidden patterns and indicators of complex security weaknesses
directly within compiled EVM bytecode.
3. To test and measure the performance of the proposed approach in identifying both known
and previously unseen vulnerabilities in real-world Ethereum smart contracts, especially
those used in DeFi and NFT platforms, while overcoming the shortcomings of current
detection tools.
4. To strengthen the overall security of the Ethereum ecosystem by delivering a fast, scalable,
and practical framework that supports early and proactive discovery of risks in smart
contracts before they are deployed.
(D). RESEARCH METHODOLOGY
To provide reliable vulnerability discovery, the suggested approach combines machine
learning and reverse engineering.
Using advanced methods like Ghidra, the Ethereum EVM bytecode is reverse-engineered to
start the process. In this step, the compiled code is broken down into a readable format, and
key components, such as opcode sequences, control flow graphs—which are especially
challenging to accurately reconstruct due to the stack-based architecture of the EVM—data
dependencies, and general structural properties, are extracted. Following their extraction,
these components are arranged into a structured dataset that may be used for machine
learning analysis.
The last step involves training a Random Forest classifier on this dataset using labelled
samples that provide a clear distinction between secure bytecode patterns and those that are
vulnerable. In related tasks, such as opcode-based analysis for detecting fraudulent behaviour
in DeFi protocols, Random Forest has demonstrated impressive performance in the past. The
trained model gains the ability to identify complex and challenging indicators of security
flaws that are frequently missed by manual assessments or traditional static analysis methods.
Lastly, a wide range of real-world smart contracts is utilised to assess the system's
effectiveness thoroughly. To find out the accuracy of the approach in identifying various
types of vulnerabilities commonly found in DeFi and NFT projects, key metrics, including
precision, recall, and F1-score, are calculated. This method guarantees that the approach is
dependable and feasible for actual implementation.
(E). SCOPE
This research focuses exclusively on Ethereum smart contracts which operate using the
Ethereum Virtual Machine (EVM).The subtle and often missed patterns that reveal
significant vulnerabilities in DeFi protocols and NFT initiatives will be the focus of the
vulnerability identification efforts. Reentrancy attacks, integer overflow and underflow
errors, ineffective access control systems, and other logic-related flaws are examples of these.
The Random Forest technique for machine learning-driven pattern detection and Ghidra for
reverse engineering generated bytecode will be the main tools utilised during the project. The
Ethereum network and its own EVM bytecode format will be the only ones used for actual
implementation, testing, and analyzation even if some of the fundamental ideas may apply to
other blockchain platforms.
(F). LIMITATIONS
This study acknowledges some potential limitations that could impact the whole model.
The performance of a machine-learning model depends heavily on the quality of its training data—
its size, diversity, and accuracy all play a major role. When the dataset contains gaps, built-in biases,
or too few examples of rare vulnerability types, the model’s reliability can drop noticeably . Random
Forest can occasionally behave like a "black box," making it difficult to pinpoint the precise
reason why particular bytecode portions are flagged as dangerous, despite its overall strength
and stability.
Because smart contract attacks are constantly changing, new exploit strategies are frequently
developed. To be successful against new threats, the model may therefore require regular
updates and retraining.
The method may struggle to identify runtime-dependent errors or vulnerabilities that are only
visible during specific transaction sequences, as it is primarily static and only operates on
compiled bytecode. For instance, it is particularly challenging to pinpoint problems related to
gas usage in the absence of real execution traces.
Lastly, only EVM bytecode patterns are included in the study. This approach may not be able
to discover defects that start in high-level languages like Solidity but disappear or become
unrecognisable after compilation.
(G). ORGANIZATION OF THE DISSERTATION
This dissertation is structured as follows:
Chapter 2: Related Work This chapter examines previous studies on smart contract
vulnerabilities, traditional static and dynamic analysis methods, and the growing use of
machine learning in blockchain and cybersecurity domains, with a focus on existing
vulnerability detection approaches.
Chapter 3: Background on Ethereum and Smart Contracts This chapter covers essential
concepts, including the Ethereum blockchain, the Ethereum Virtual Machine (EVM)
architecture, the Solidity programming language, and widely known attack patterns targeting
smart contracts.
Chapter 4: Methodology This chapter gives a detailed explanation of the proposed
framework, describing the reverse engineering workflow using Ghidra, the extraction of key
features such as opcode sequences and control flow graphs, the design and training of the
Random Forest classifier, and the complete experimental setup.
Chapter 5: Experimental Results and Analysis. This chapter presents the evaluation
outcomes, including performance metrics, comparisons with current detection tools, and real-
world case studies that highlight vulnerabilities identified by the system.
Chapter 6: Discussion This chapter interprets the results, explores their broader impact,
revisits the study's limitations, and suggests promising directions for future work.
Chapter 7: Conclusion This final chapter recaps the entire research, highlights the key
contributions, and provides closing remarks.