ReFun: Reconstructing Function Boundaries in EVM Bytecode

Recovering the structure of a Solidity smart contract from its deployed bytecode is a prerequisite for various downstream analyses, such as control-flow graph construction, decompilation, and clone detection. A central step in this task is identifying private functions. However, since all source-level function boundaries are completely lost after compilation, the major challenge of this task lies in how to differentiate function calls from intra-procedural control transfers, because both are implemented via the JUMP/JUMPI instructions. We observe that although jump-based control transfers are superficially uniform, their context information is different. Some contexts provide definitive evidence of an intra-procedural control transfer or a function call, which inspires us to address this problem through progressive refinement rather than naive binary classification. Specifically, we first construct an over-approximated set of potential function call sites based on EVM execution semantics, and then narrow them down using rule-based reasoning. The remaining uncertain cases are finally resolved through probabilistic inference over suggestive contexts. For each identified function, we further analyze the instructions before each jump to determine its target and reassemble scattered code fragments into a continuous instruction sequence. We implement our approach as an open-source tool, dubbed ReFun, and evaluate it on 8,696 real-world Solidity smart contracts across multiple Solidity compiler versions and optimization settings. The experimental results demonstrate that ReFun achieves 94.3% precision and 95.5% recall in function recovery, and it is also efficient, completing function identification and separation for 82% of contracts within eight seconds per contract. Finally, we show how ReFun is applied to the downstream tasks, including contract decompilation and clone detection.