--- name: evm-analysis-c0d05ab13cbe description: Deep EVM bytecode analysis and decompilation capabilities for smart contract security, gas optimization, and reverse engineering. Provides tools for analyzing opcodes, storage layouts, proxy patterns, and bytecode verification. allowed-tools: Read, Grep, Write, Bash, Edit, Glob, WebFetch graph: domains: [domain:security] specializations: [specialization:cryptography-blockchain] skillAreas: [skill-area:smart-contract-security, skill-area:smart-contract-development-testing, skill-area:vulnerability-scanning-remediation] roles: [role:security-engineer] --- # EVM/Bytecode Analysis Skill Expert-level EVM bytecode analysis and decompilation for smart contract security audits, gas optimization, and reverse engineering. ## Capabilities - **Bytecode Analysis**: Analyze EVM bytecode and opcodes - **Gas Cost Calculation**: Calculate gas costs per operation - **Storage Layout Identification**: Identify storage slot layouts and packing - **Decompilation**: Decompile bytecode to pseudo-Solidity - **Proxy Analysis**: Analyze proxy implementation slots (EIP-1967) - **Pattern Detection**: Detect bytecode patterns (CREATE2, selfdestruct) - **Bytecode Verification**: Verify contract bytecode against source ## MCP Server Integration This skill can leverage the following MCP servers: | Server | Purpose | Install | |--------|---------|---------| | **EVM MCP Tools** | Smart contract auditing, security analysis | [0xGval/evm-mcp-tools](https://github.com/0xGval/evm-mcp-tools) | | **Solidity Contract Analyzer** | Contract code analysis with metadata | [Skywork](https://skywork.ai/skypage/en/smart-contract-analysis-solidity) | ## Opcode Reference Common EVM opcodes and gas costs: | Category | Opcodes | Base Gas | |----------|---------|----------| | Arithmetic | ADD, SUB, MUL, DIV | 3-5 | | Comparison | LT, GT, EQ, ISZERO | 3 | | Bitwise | AND, OR, XOR, NOT, SHL, SHR | 3 | | Memory | MLOAD, MSTORE | 3 + memory expansion | | Storage | SLOAD | 100 (warm) / 2100 (cold) | | Storage | SSTORE | 100-20000 (varies) | | Control | JUMP, JUMPI | 8-10 | | Call | CALL, DELEGATECALL, STATICCALL | 100 + memory + value | ## Storage Layout Analysis ### Standard Slot Patterns ```solidity // Basic types (slot 0, 1, 2...) uint256 public a; // slot 0 uint256 public b; // slot 1 // Packed storage uint128 public c; // slot 2, bytes 0-15 uint128 public d; // slot 2, bytes 16-31 // Mappings: keccak256(key . slot) mapping(address => uint256) public balances; // slot 3 // balances[addr] at keccak256(addr . 3) // Dynamic arrays: length at slot, data at keccak256(slot) uint256[] public arr; // length at slot 4, arr[i] at keccak256(4) + i ``` ### EIP-1967 Proxy Slots ``` Implementation: 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc Admin: 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 Beacon: 0xa3f0ad74e5423aebfd80d3ef4346578335a9a72aeaee59ff6cb3582b35133d50 ``` ## Bytecode Patterns ### Contract Creation ``` PUSH1 0x80 // Free memory pointer PUSH1 0x40 MSTORE ... CODECOPY // Copy runtime code RETURN // Return runtime code ``` ### Selector Dispatch ``` PUSH4 // 4-byte function selector EQ // Compare with calldata[0:4] PUSH2 // Jump destination JUMPI // Jump if match ``` ### Common Vulnerability Patterns ``` // Reentrancy indicator: CALL before SSTORE CALL ... SSTORE // Unchecked return: CALL without ISZERO check CALL // Missing: ISZERO, JUMPI for error handling // Self-destruct (deprecated but detectable) SELFDESTRUCT ``` ## Workflow ### 1. Fetch Contract Bytecode ```bash # Using cast (Foundry) cast code
--rpc-url # Using curl curl -X POST \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"eth_getCode","params":["
","latest"],"id":1}' ``` ### 2. Analyze Opcodes ```bash # Disassemble with cast cast disassemble # Or use online tools # - evm.codes/playground # - ethervm.io/decompile ``` ### 3. Storage Slot Analysis ```bash # Read specific storage slot cast storage
--rpc-url # Read EIP-1967 implementation slot cast storage
0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url ``` ### 4. Bytecode Comparison ```bash # Get deployed bytecode cast code
--rpc-url > deployed.bin # Compile source and compare forge build diff deployed.bin out/Contract.sol/Contract.bin ``` ## Process Integration This skill integrates with the following processes: - `gas-optimization.js` - Identify gas-heavy opcodes - `smart-contract-security-audit.js` - Bytecode-level vulnerability detection - `smart-contract-upgrade.js` - Proxy slot verification - `formal-verification.js` - Bytecode correctness verification ## Tools Reference | Tool | Purpose | URL | |------|---------|-----| | **Foundry Cast** | CLI bytecode interaction | [foundry-rs/foundry](https://github.com/foundry-rs/foundry) | | **evm.codes** | Opcode reference | [evm.codes](https://www.evm.codes/) | | **Dedaub** | Decompiler | [dedaub.com](https://app.dedaub.com/decompile) | | **Heimdall** | Advanced decompiler | [heimdall-rs](https://github.com/Jon-Becker/heimdall-rs) | | **panoramix** | Python decompiler | [eveem.org](https://eveem.org/) | ## Example Analysis ```javascript // Analyze proxy contract const analysis = { type: 'proxy', pattern: 'EIP-1967 Transparent', implementation: '0x...', admin: '0x...', // Storage layout storageSlots: { 0: { name: '_initialized', type: 'uint8' }, 1: { name: '_initializing', type: 'bool' }, // ... }, // Function selectors selectors: { '0xa9059cbb': 'transfer(address,uint256)', '0x23b872dd': 'transferFrom(address,address,uint256)', // ... }, // Gas hotspots gasHotspots: [ { offset: 0x1a4, opcode: 'SSTORE', context: 'balance update' }, { offset: 0x2f0, opcode: 'CALL', context: 'external call' } ] }; ``` ## See Also - `skills/gas-optimization/SKILL.md` - Gas optimization techniques - `agents/solidity-auditor/AGENT.md` - Security audit agent - `references.md` - External resources --- Source attribution: a5c-ai Original project: https://github.com/a5c-ai/babysitter License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 Gabriel Moreira Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: a5c-ai Original project: https://github.com/a5c-ai/babysitter Attribution basis: Upstream repository explicitly recorded in package mirror path Fields of work: Data & Analytics, Development & Engineering, Product Management Roles: Backend Developer, Data Scientist, ML / AI Engineer, Product Manager, Security Engineer Specialties: API, Backend Tools: Skywork, 0Xgval/Evm Mcp Tools Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 7540795bfc7e2e69f58525f23dc1f01987dfe93513ff3de353bd32604ffdf6b9