g00dv1n/evm-hound-rs

A Minimalistic Rust library to extract all potential function selectors from EVM bytecode without source code.

EVM Hound

A Minimalistic Rust library to extract all potential function selectors from EVM bytecode without source code.

Installation

$ cargo add evm_hound

Usage

// examples/basic.rs
use ethers::{
    providers::{Http, Middleware, Provider},
    types::Address,
};
use eyre::Result;

use evm_hound::{selectors_from_bytecode, string_selectors_from_bytecode};

// To Try:
// cargo run --example basic

#[tokio::main]
async fn main() -> Result<()> {
    let provider = Provider::<Http>::try_from("https://rpc.flashbots.net/fast")?;
    let token_addr: Address = "0xdac17f958d2ee523a2206206994597c13d831ec7".parse()?;

    let code = provider.get_code(token_addr, None).await?;

    let raw_selectors = selectors_from_bytecode(&code);
    let string_selectors = string_selectors_from_bytecode(&code);

    println!("found {} selectors", raw_selectors.len());
    println!("{raw_selectors:?}");
    println!("{string_selectors:?}");

    Ok(())
}

Also, EVM Hound can detect basic contract types using extracted selectors:

pub enum ContractType {
    /// ERC20 - Typical token contract
    ERC20,
    /// ERC721 - Typical NFT contract
    ERC721,
    /// Any other contract
    ANY,
}

Check out example at examples/contract_type.rs.

Credits

Made for Hackers.tools Trading Simulator to search/bruteforce for potential methods that start trading.

evm-hound-rs's Issues

Accuracy and speed results from EVMole benchmark

Hi,
I've added your project to the accuracy and speed benchmark of cdump/evmole

I think you may be interested in that results, to examine errors of evm-hound-rs you can run:

$ sudo apt install git-lfs
$ git clone https://github.com/cdump/evmole 
$ cd evmole/

# you need GNU Make, https://formulae.brew.sh/formula/make - if you are using macos

$ PROVIDERS="etherscan evm-hound-rs" make -C benchmark
$ poetry run python3 benchmark/compare.py --providers etherscan evm-hound-rs --web-listen 0.0.0.0:8080 

# skip PROVIDERS/--providers to compare with other tools, like whatsabi & evmole

Open http://127.0.0.1:8080 after that and you'll see the results:

P.S. I'm not a Rust developer and using your tool in benchmark is literally my first written rust code, if you believe I am using your project incorrectly, please feel free to submit a pull request with fixes.