CALL signature not obvious

[MatthiasEgli-chainsecurity]

The signature of CALL is not obvious. As an example, this is the one from the withdrawEther function of the binance (0xB8c77482e45F1F44dE1745F52C74426C631bDD52) token:

[
  "CALL",
  [
    "MUL",
    2300,
    [
      "ISZERO",
      [
        "cd",
        4
      ]
    ]
  ],
  [
    "MASK_SHL",
    160,
    0,
    0,
    [
      "STORAGE",
      160,
      0,
      4
    ]
  ],
  [
    "cd",
    4
  ],
  96,
  0,
  96,
  0,
  0,
  0
]

The operands on the EVM level are gas, to, value, in offset, in size, out offset, out size, but those don't match the numbers here.

[kolinko]

The order is almost identical in Eveem, but with two extra parameters at the end:

('CALL', gas, addr, wei, arg_start, arg_len, ret_start, ret_len, fname, fparams)

fname is the name/4-byte descriptor of the function being called (if possible to figure this out), and fparams are the function call parameters (if possible to figure out).

They may be zero in two cases - when in_size = 0, or when in_size > 0, but the decompiler couldn't figure out what exactly the memory contains (happens very rarely).

In the case you specified:

gas == 2300 * !param0
to == addr(storage4) (== ownerAddress in case of Binance)
value == param0 (== _amount)
in_offset = out_offset = 96
in_size = out_size = 0

Does it sound right?

And yeah, it needs docs :)

[Hotspot00]

The order is almost identical in Eveem, but with two extra parameters at the end:

('CALL', gas, addr, wei, arg_start, arg_len, ret_start, ret_len, fname, fparams)

fname is the name/4-byte descriptor of the function being called (if possible to figure this out), and fparams are the function call parameters (if possible to figure out).

They may be zero in two cases - when in_size = 0, or when in_size > 0, but the decompiler couldn't figure out what exactly the memory contains (happens very rarely).

In the case you specified:

gas == 2300 * !param0

to == addr(storage4) (== ownerAddress in case of Binance)

value == param0 (== _amount)

in_offset = out_offset = 96

in_size = out_size = 0

Does it sound right?

And yeah, it needs docs :)