EVM Charts 2024: What's hot? What's not?

Hello everyone, good morning. Welcome to this presentation. We're gonna see some statistics about EVM, especially we're gonna see some statistics about the firm EVM especially we're gonna compare some data and we collected data from 100,000 blocks before last DEF CON and 100,000 blocks before this DEF CON and we're gonna see what changed. I'm Dominic Britsch one of the lead auditors and co-founders at Chain Security. So, let's dive right in.

But first, I have a question to you. What do you think is the most popular opcode used in the EVM? It's push1. It's mainly used to push small constants onto the stack. Next is push true and it's for larger constants and this one is especially used to push jump targets onto the stack.

Third in row is jump test this marks jump test in EVM code and you might wonder why we don't see the jump instruction itself being used heavily and this is due to in the EVM code and you might wonder why we don't see the jump instruction itself being used heavily and this is due to in the EVM we have two instructions to jump jump and jump by for conditional jump and both together roughly add up to the same number as jump test overall between the data sets of DEF CON before the DEF CON Bogota and before this DEF CON, we see no change in the most popular opcodes. Moving on to the least popular opcodes. Least popular opcode is call code. This is basically a less helpful variant of delegate call, and it's used really few times only. Log0 just emits log events with zero topics and invalid opcodes they both basically simply consume all the gas of the current context when they are called.

Now prior to DEF CON 7 this changed slightly. Create made it onto the list. It became less popular. Invalid is still on the list. This one is slightly interesting as this is one of the opcodes that is dominated by one single contract.

The invalid opcodes are almost exclusively used by the USDT contract. They have an assert in the cipher math library they use which produces an invalid opcode if triggered. Now especially for the least popular opcode it may be interesting to discuss some opcodes that do not appear on the list, particularly self destruct. Since the Cancun hard fork this opcode has basically become obsolete and Let's ignore some special corner cases here. It now simply transfers all the ETH of the account onwards.

Investigating this, we were surprised that the opcode is still used for some cases. And yeah, even more interestingly, we saw that there are still gas tokens deploying new contracts. We don't know why this is still done. We think it's due to legacy code still being triggered by some contracts. Let's have a quick look at the new opcodes introduced since last DEF CON.

Keep in mind that all contracts deployed before these opccode were introduced won't use them. So all execution you see here must be from recently deployed contracts. Push0 is already used for 0.7 of all opcode we've seen. So this new opcode is already used more than, for example, call data load or MUL.

You might wonder why T-Store is used more than T-Load because in a typical re-entrancy pattern, you have T-Store, T-Load, T-Store. Now, what about pre-compiles? Prior to DEF CON 6, EC-Recall was by far the most heavily used pre-compile. It was mainly used by OpenSees C-Port contract for signature verification. Keep in mind that we only have 11 million EVM transactions in our data set, so 2 million users is quite a lot.

For SHA-2-256 the heaviest user was the EF2 deposit contract and identity which is mainly used in Viper for memory operations. Now before DEFCON 7 we see way less easy recover operation. The far heaviest users now are permit 2 and wormhole contract. For SHA-2-256 the heaviest users are the if-to-deposit contract and eigenlayer. And we saw that Vipers popularity rose and we see this reflected in the identity opcode.

The least popular opcode, interesting here, it's one single contract that was all the blank two calls. Transaction complexity, the number of calls per transaction went down while the memory consumption decreased. So super quick summary, PUS0 is super hot, easy recover is useless and there are more calls per transaction. We've prepared a blog post which is not fully ready yet but will be published soon. It will have a full description of the data more plots more results thank you thank you thank you Dominic for the short presentation insightful one of course do you have Mari saya cuba.

Ya, menarik untuk melihat bagaimana Create adalah salah satu kode op. Adakah anda mempunyai sebab atau keadaan mengenai mengapa itu berlaku? Saya cukup pasti kerana Create 2 menjadi lebih biasa dan kemudian statistik itu berpisah, betul? Betul, ya. Okey.

Terima kasih. I'm pretty sure because create two became more common and then the statistics are split, right? Right, yeah. Okay. Thanks.

Next question? Okay. What can we do with all these new findings? I think it's important for the core devs and the people discussing the EIP stuff, especially for the opcodes. It's really good for them to see, right, that Push 2, a new edition, the recently introduced, is really used heavily and has an impact, and they can take a look at the statistic and see what isn't used so heavily.

But of course it's hard to deprecate something right because we still have contracts relying on them. Thank you. Last question.