[GH-ISSUE #2391] [Feature] Solidity: decode supplied ABI calldata, logs and revert payloads with explicit ambiguity #800

New issue

Open

opened 2026-10-15 18:28:35 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:35 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2391

Analyst question and current gap

REA currently infers dispatch selectors and argument/mutability strings from bytecode. Those candidates do not provide verified function names or an ABI-aware interpretation of caller-selected calldata, event logs and revert bytes.

Proposed outcome

Accept a caller-selected ABI plus a separately identified local payload and its role: calldata, return data, event log or revert data.
Compute canonical signatures/selectors/event identifiers using Ethereum Keccak and preserve all matching candidates. Distinguish caller-supplied ABI facts from bytecode inference.
Decode admitted tuples/arrays/dynamic types with lossless integer and byte values; retain raw payload and byte ranges.
Preserve unknown custom errors/selectors, malformed offsets, trailing bytes and ambiguous matches instead of selecting a guessed signature.
Keep indexed dynamic event values as hashes rather than claiming to recover their original contents. No signature database, RPC, wallet or transaction action is implied.

Acceptance and verification

Owned contract fixtures cover overloads, nested dynamic tuples/arrays, custom errors, Error/Panic payloads, anonymous events and indexed dynamic fields.
Synthetic malformed offsets/lengths and adversarial size expansion are rejected before allocation.
Conflicting ABI candidates remain distinct; every uint256/int256 stays lossless through JSON.
CLI/MCP provide equivalent decoded facts, raw evidence and unavailable facets.
Define one feature specification, one implementation plan and incremental tasks under docs/specs/solidity/abi-decoding/ before implementation.

Scope and relationships

Offline caller-selected artifact inspection. Existing EVM interface recovery (PR #1051), retained delivery (PR #2308) and roadmap #972 are the foundations; this feature is independently scoped and does not reopen the entire roadmap. Parent language tracker: #2383. Use self-owned compiler fixtures and preserve provider/version provenance. New provider choices, if needed, follow CONTRIBUTING.md before substantial integration work.

Primary references

Solidity ABI specification

Originally created by @matbrgz on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2391 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Blockchain RE](https://img.shields.io/badge/domain-blockchain_RE-orange.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Analyst question and current gap REA currently infers dispatch selectors and argument/mutability strings from bytecode. Those candidates do not provide verified function names or an ABI-aware interpretation of caller-selected calldata, event logs and revert bytes. ## Proposed outcome - Accept a caller-selected ABI plus a separately identified local payload and its role: calldata, return data, event log or revert data. - Compute canonical signatures/selectors/event identifiers using Ethereum Keccak and preserve all matching candidates. Distinguish caller-supplied ABI facts from bytecode inference. - Decode admitted tuples/arrays/dynamic types with lossless integer and byte values; retain raw payload and byte ranges. - Preserve unknown custom errors/selectors, malformed offsets, trailing bytes and ambiguous matches instead of selecting a guessed signature. - Keep indexed dynamic event values as hashes rather than claiming to recover their original contents. No signature database, RPC, wallet or transaction action is implied. ## Acceptance and verification - [ ] Owned contract fixtures cover overloads, nested dynamic tuples/arrays, custom errors, Error/Panic payloads, anonymous events and indexed dynamic fields. - [ ] Synthetic malformed offsets/lengths and adversarial size expansion are rejected before allocation. - [ ] Conflicting ABI candidates remain distinct; every uint256/int256 stays lossless through JSON. - [ ] CLI/MCP provide equivalent decoded facts, raw evidence and unavailable facets. - [ ] Define one feature specification, one implementation plan and incremental tasks under docs/specs/solidity/abi-decoding/ before implementation. ## Scope and relationships Offline caller-selected artifact inspection. Existing EVM interface recovery (PR #1051), retained delivery (PR #2308) and roadmap #972 are the foundations; this feature is independently scoped and does not reopen the entire roadmap. Parent language tracker: #2383. Use self-owned compiler fixtures and preserve provider/version provenance. New provider choices, if needed, follow CONTRIBUTING.md before substantial integration work. ## Primary references - [Solidity ABI specification](https://docs.soliditylang.org/en/latest/abi-spec.html)

bsakaguchi added the

area: domain

enhancement

P2: medium

labels

2026-10-15 18:28:35 +00:00

bsakaguchi commented

2026-10-15 18:28:36 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Triage & Architectural Review Notes

Objective (ELI5):
Decode ABI calldata, emitted event topics/data, and revert reasons into structured parameters while explicitly signaling ambiguities (e.g. 4-byte selector collisions).

Core Invariants:

Ambiguity Preservation: When a 4-byte function selector matches multiple ABI definitions, the tool must not guess. It must return all candidate matches marked with ambiguous: true and their respective parameter decodings.
Modern Error Support: Must natively decode standard Error(string) (0x08c379a0), Panic(uint256) (0x4e487b71), and arbitrary custom errors from the contract's ABI. Unknown error selectors should remain raw bytes with unmatched_custom_error diagnostics.

@matbrgz commented on GitHub (Oct 12, 2026): ### Triage & Architectural Review Notes **Objective (ELI5):** Decode ABI calldata, emitted event topics/data, and revert reasons into structured parameters while explicitly signaling ambiguities (e.g. 4-byte selector collisions). **Core Invariants:** 1. **Ambiguity Preservation:** When a 4-byte function selector matches multiple ABI definitions, the tool must not guess. It must return all candidate matches marked with `ambiguous: true` and their respective parameter decodings. 2. **Modern Error Support:** Must natively decode standard `Error(string)` (`0x08c379a0`), `Panic(uint256)` (`0x4e487b71`), and arbitrary custom errors from the contract's ABI. Unknown error selectors should remain raw bytes with `unmatched_custom_error` diagnostics.

bsakaguchi referenced this issue

2026-10-16 21:16:14 +00:00

[PR #800] [MERGED] fix(ghidra): select exact packaged bridge scripts #2248

bsakaguchi referenced this issue

2026-10-16 21:16:16 +00:00

[PR #801] [MERGED] feat(web): export captured scripts for JavaScript application analysis #2249

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:42 +00:00