  Millions of smart contracts have been deployed onto Ethereum for providing
various services, whose functions can be invoked. For this purpose, the caller
needs to know the function signature of a callee, which includes its function
id and parameter types. Such signatures are critical to many applications
focusing on smart contracts, e.g., reverse engineering, fuzzing, attack
detection, and profiling. Unfortunately, it is challenging to recover the
function signatures from contract bytecode, since neither debug information nor
type information is present in the bytecode. To address this issue, prior
approaches rely on source code, or a collection of known signatures from
incomplete databases or incomplete heuristic rules, which, however, are far
from adequate and cannot cope with the rapid growth of new contracts. In this
paper, we propose a novel solution that leverages how functions are handled by
Ethereum virtual machine (EVM) to automatically recover function signatures. In
particular, we exploit how smart contracts determine the functions to be
invoked to locate and extract function ids, and propose a new approach named
type-aware symbolic execution (TASE) that utilizes the semantics of EVM
operations on parameters to identify the number and the types of parameters.
Moreover, we develop SigRec, a new tool for recovering function signatures from
contract bytecode without the need of source code and function signature
databases. The extensive experimental results show that SigRec outperforms all
existing tools, achieving an unprecedented 98.7 percent accuracy within 0.074
seconds. We further demonstrate that the recovered function signatures are
useful in attack detection, fuzzing and reverse engineering of EVM bytecode.
