Debug an Unverified Contract

Case objective

Without verified source code, locate the instruction that transfers ETH unwrapped from WETH and confirm its target and amount.

Example transaction and context

0xbdec39a74e620fc624f90483aff067b17044f81138e6c30038daf7f873159db4

Open the transaction in Skylens

The target executor is 0x64dc84faa300b5f27c7ebae8d867d039337e5999. After unwrapping WETH, it makes two native ETH calls to a fee recipient and the transaction sender.

Questions to answer

1. Which trace contains the target ETH transfer?
2. Which opcode and stack parameters should be inspected in Bytecode Debugger?
3. How can the target and amount be cross-checked without source code?

Investigation steps

1. In Execution Trace, search the executor and WETH addresses to narrow the scope to calls after WETH.withdraw.
2. Record the caller, target, value, and return status shown for the relevant trace.
3. Enter Bytecode Debugger from that trace and locate the CALL in Instructions. Record its PC as a stable bytecode position.
4. Immediately before CALL, inspect the seven stack arguments: gas, to, value, inOffset, inSize, outOffset, and outSize.
5. Check Memory for calldata, then verify the call result against subsequent balance changes.

Key evidence

The Skylens documentation fixture places a CALL at PC 122 to demonstrate the Instructions, Stack, and Memory workflow. It is not a substitute for the full onchain stack. Use the runtime values from trace 619, then confirm them again immediately before CALL in the real debug session:

to    = 0x269ff4d056252a30cad249a4cd75cb9bcfb1f46c
value = 679568466516036487 wei

The amounts also conserve: the outputs in traces 618 and 619 add up to the input in trace 616.

Conclusion

Execution Trace narrows the investigation to two CALLs after WETH is unwrapped. Trace 619 transfers 0.679568466516036487 ETH to the sender, while trace 618 pays a 0.001 ETH fee. Opcode context, stack arguments, runtime trace data, and amount conservation provide a verifiable result without source code.

Caveats

• A PC identifies a position in one bytecode version; locate it again after an upgrade or redeployment.
• Stack values are 32-byte words. Addresses occupy the low 20 bytes, and call value is denominated in wei.
• A successful CALL only confirms the EVM return status; verify balances and subsequent logic as well.
• Documentation fixtures demonstrate the workflow. Investigation reports must cite runtime data from the real transaction.

Related documentation

• Execution Trace
• Bytecode Debugger
• Balance Changes
• State Changes