Smart Contract Security and Zero-Knowledge Assurance

Duration: NaN:NaN:NaN

Speaker: Subhra Mazumdar

Type: CLS - Workshop (Academic track)

Expertise: Some familiarity with the topic

Event: Devcon

Date: Nov 2026

Around 2% of roughly 60 million deployed Ethereum contracts have verified source. The detectors students are taught — Slither above all — need that source, and most academic evaluations are built on source-level corpora. Bytecode analysis does exist (Mythril, Gigahorse, Dedaub), but recovery is lossy and nobody has measured how lossy in detection terms. We ran SmartBugs over annotated vulnerable contracts, then re-ran it after source-level obfuscation, measuring how far detection degrades under transformations that cost an attacker almost nothing. We then test LLM-assisted decompilation as a route back, and report where it works, where it fabricates a plausible-but-wrong contract, and why that is worse for an auditor than no output. The question worth asking is whether safety can be certified without disclosing source.