Clipper Decompiler (720p 2024)

The EVM is stack-based and untyped. A uint256 looks exactly the same as an address or a bytes32 to the machine. Clipper employs heuristic taint analysis to guess types. If a value is used in CALL (the opcode for sending ETH), Clipper flags it as an address payable . If a variable is used in EXP , it is likely a power. This recovery turns var1 + var2 into userBalance + withdrawalAmount .

A researcher pastes the bytecode into Clipper. Within seconds, the tool returns a structured output: clipper decompiler

Solidity’s move toward the intermediate representation (IR) broke almost every legacy decompiler. Clipper was built post-IR. It understands the optimizations the Solidity compiler makes when using via-ir , meaning it can decompile the most modern, gas-optimized contracts without vomiting errors. Use Case: The $50 Million Heist Consider a recent hypothetical exploit: A flash loan attack on a lending pool. The attacker’s transaction is on-chain forever. The team has the bytecode of the attacking contract, but the source code is private. The EVM is stack-based and untyped