disasm: Return values

Unfortunately selector hashes don’t include the return value, so none of the 4byte databases include return types.

Questions:

1. How do we detect whether a function has a return value at all?
2. If it does, can we do anything to guess the type or size?

What we have:

• Function selectors with instruction pointers
• Boundaries for selectors’ functions (they seem to be assembled contiguously based on a few anecdotal examinations).

Updated challenges:

• Old Solidity (e.g. WETH compiled with 0.4.x) assembles functions with simple return macros, so those are fairly easily detectable by looking back for RETURN from the end of each selector function’s boundary.
• Modern Solidity assembles returns through chains of helper branches that prepare the data. I can’t think of a way to resolve these in a ~single pass. Anyone have ideas?
  • One of the helper branches is a STOP branch, which shouldn’t be too hard to find in isolation (basically JUMPDEST STOP, sometimes there are multiples, not sure why). Could we just use the absence of a STOP or JUMP to a STOP offset as an indicator whether there is a return value of somekind?
• In either case, I’m having trouble finding a reliable pattern for extracting the size of the return values, even in the old-Solidity simple case.

[shazow]

Started a WIP PR in #14, here are the vibes so far (from PR):

Still in the research phase, trying to find a way to detect output sizes but that’s looking harder than I hoped.

It looks like modern solidity wraps most outputs through a chain of jumps that prepares the data. It’s going to be quite hard to do this with a single-pass static analysis.

Older solidity (e.g. WETH contract with v0.4.x) does a simpler return macro per function window, those aren’t hard to detect but extracting sizing reliably still seems hard.

Also I thought it’d be easier to detect address type outputs because they’re 20 bytes rather than the usual 32, but I forgot that things get padded so it still ends up being 32 bytes.

I probably need to sleep on this in case there’s other clever solutions but not looking great for single-pass static analysis right now. 😅

[shazow]

Updated the current state and challenges in the issue description, going to pass it around to some folks to see if anyone else has ideas. Feel free to re-share. 😃