## 5 Detection of Smart Contract Vulnerabilities Based on Opcodes
### Analyzing the Smart Contract Opcode Flowchart  
The approach of analyzing smart contract opcodes is an effective way to detect vulnerabilities in smart contracts, especially for those that are not open source. To perform opcode analysis, a control flow diagram is constructed using a directed graph consisting of base blocks and edges connecting the base blocks. Figure 1: General framework of smart contract vulnerability detection for opcode analysis. A base block contains only sequentially executed instructions, with only one input and one output. In the event of an unconditional jump command (JUMP), the current base block is terminated, and a new base block is formed with the JUMPDEST instruction as the first instruction of the new base block. In the event of a conditional jump command (JUMPI), the current base block is also terminated and split into two new base blocks. One of the new base blocks still uses the JUMPDEST command, while the other takes the command immediately following the conditional jump command as the first command. By analyzing the control flow diagram and opcode, the smart contract vulnerabilities can be detected automatically. This approach is more efficient than analyzing the source code directly, especially for large contracts with complex logic. Improving the Mythril approach, the opcode analysis method provides a more effective and efficient way to detect vulnerabilities in smart contracts. The following figure shows the improved Ponzi scheme smart contract as an example for comparison. Analyze the accuracy, efficiency, and streamlining of the Mythril method before and after the improvement. The analysis of the Rubixi scheme smart contract opcode using the improved Mythril method is shown in Figure 2 and presented in flowchart form using HTML language. Each instruction in the basic block represents a state of the program (GlobalState), consisting of world state, machine state, and execution environment, and each field is represented by a symbolic value and a concrete value and also gives constraints on the path to be satisfied to reach the next basic block from one basic block. All opcodes have corresponding hexadecimal values, for example, the opcode 0 PUSH1 0 \(\times\) 80 in the first block diagram copies the 1-byte value 0 \(\times\) 80 to the ninth stack item, the hexadecimal value of \"PUSH 1\" is exactly \"0 \(\times\) 60\". By removing the non-mandatory \"0\(\times\)\", the logic can be written in byte code form as \"6080\", but note that 0 \(\times\) 40.0 \(\times\) 80 cannot be interpreted as real numbers 40 or 80. So 40 is actually equal to 64 in decimal (16 \(\times\) 4) and 80 is equal to (16 \(\times\) 8) in decimal. In short what \"PUSH1 0 \(\times\) 80 PUSH1 0 \(\times\) 40 MSTORE\" is doing is allocating 128 bytes of memory and moving the pointer to the beginning of the 64 th byte. In the EVM virtual machine, there are three places where data can be stored. First, in the stack, where the \"PUSH\" opcode was just used to store the data as in the example above. Second, in the memory (RAM) where the \"MSTORE\" opcode is used. And finally, in the disk storage, where the data is stored using the \"SSTORE\" opcode. Storing data in disk storage requires the most expensive gas, while storing data in stacked gas is the cheapest. Figure 2: Fragment of opcode of smart contract for Mythril analysis before improvement. Smart contract vulnerability detection can be achieved by using Mythril to analyze opcodes and specifically analyze the type of vulnerability and its location. Although analyzing smart contract source code into opcodes is somewhat tedious and requires fetching stack information step by step, it is more intuitive to see which part of the process is faulty by the automatically generated flowchart. When the Rubixi scheme smart contract is analyzed using the pre- and post-improvement Mythril methods separately, it can be concluded that the improved Mythril runs at a faster rate.