# Grantee Spotlight: Dedaub *The Dedaub decompiler helps researchers read the contracts without public source code* By [TheDAO Security Fund](https://paragraph.com/@thedao.fund) · 2026-10-14 --- Smart contracts do not need to publish their source code to move money. When a contract is unverified, a security researcher may have to work backwards from the bytecode deployed onchain to understand what it can do. That is the problem the [Dedaub Decompiler](https://app.dedaub.com/) addresses: it turns low-level EVM bytecode into a more readable view of a contract's logic. What made Dedaub a strong candidate for round one, was that it was an established service, freely accessible to registered users, with a record of being used in real security work. In its [Round 1 application](https://qf.giveth.io/project/dedaub-decompiler:-from-bytecode-to-solidity-like-code), Dedaub reported more than 12,000 registered users and coverage of eight EVM networks. Those are Dedaub's figures, but our research found public incident reports offering something more tangible: examples of researchers actually using its decompiled output. For a comprehensive breakdown of Dedaub's decompiler core, named "Gigahorse", you can watch Yannis' talk at Devconnect Argentina: What use in the field looks like -------------------------------- In 2021, Dedaub's team found a critical issue affecting Harvest Finance's upgradeable contracts. The three affected implementation contracts had no verified source code. As [Immunefi's bug-fix review](https://immunefi.com/blog/bug-fix-reviews/harvest-finance-uninitialized-proxies-bugfix-review-200k-bounty/) explains, Dedaub's automated analysis flagged the contracts, and examining the decompiled code exposed a delegatecall path that could let an attacker destroy an implementation and disable the proxies using it. The contracts in scope held **$6.4 million** at the time. Harvest patched the issue. Decompiling helped investigators understand the code and find the vulnerability before it was too late. A second example comes from outside Dedaub. After the 2022 exploit of the unverified **0xbaDc0dE MEV bot**, an Immunefi researcher used [Dedaub's online decompiler](https://immunefi.com/blog/bug-fix-reviews/hack-analysis-0xbadc0de-mev-bot-september-2022/) to infer storage layout, examine how the bot delegated to its implementation contract, and inspect caller permissions. The researcher also used Dedaub's transaction filtering to trace earlier calls while reconstructing the approximately **$1.46 million** exploit. Other tools and manual testing were needed too, showing both the decompiler's contribution and its limits. In a [2024 rug-pull investigation](https://www.techflowpost.com/en-US/article/16858), CertiK researchers linked to Dedaub's decompilation of an unverified tax contract to help explain how tokens were swapped into ETH. Taken together, these cases show why readable bytecode matters across vulnerability discovery, exploit analysis, and investigation of malicious contracts. It is widely used in the ecosystem every time there is a hack, a new bot, or some contracts interacting with public contracts appear. Even our own curator pcaversaccio uses it! [View post on X (2036481170960261515)](https://x.com/pcaversaccio/status/2036481170960261515) Dedaub's broader impact in the ecosystem ---------------------------------------- Dedaub also has a tremendous record in Ethereum security, beyond offering the decompiler. In [Primitive Finance's own postmortem](https://primitivefinance.medium.com/postmortem-on-the-primitive-finance-whitehack-of-february-21st-2021-17446c0f3122), the protocol credits Dedaub with confirming a critical vulnerability, developing the whitehat exploit, and providing a list of affected users and balances. Primitive and its war room reported saving **98% of the initially exposed funds**, including more than **$1 million** in user funds. [OpenZeppelin](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-post-mortem/14958) credits Dedaub and Tenderly with helping identify projects affected by a TimelockController vulnerability; OpenZeppelin's response examined **316 deployed instances** across five networks and found no critical instance with assets at risk. [Multichain](https://medium.com/multichainorg/multichain-contract-vulnerability-post-mortem-d37bfab237c8) credits Dedaub with reporting two critical vulnerabilities and assisting its response as attacks unfolded. OpenZeppelin also cites monitoring and analysis by Dedaub and Ironblocks during the [ERC-2771/Multicall incident](https://www.openzeppelin.com/news/arbitrary-address-spoofing-vulnerability-erc2771context-multicall-public-disclosure); the [JIMBO V2 postmortem](https://paragraph.com/@baseline-protocol/jimbo-v2-exploit-post-mortem) thanks Dedaub researchers for investigative support. These reports establish a broad security practice; they do not isolate the role of the decompiler in those particular responses. How TheDAO Fund's Round 1 supported Dedaub ------------------------------------------ Our first Ethereum Security round, operated by Giveth, invited the community to support security work. Dedaub passed the round's eligibility review, then attracted donations from **61 contributors**. With direct donations and matching combined, it received **8.722 ETH, valued at $14,377 when sent**. 2.64 ETH were from community donations and sponsorships, thanks to the sponsors of the round: Wintermute, Quantstamp, Sigma Prime, CertiK, Certora, OtterSec and Chainsecurity among others. See the full list of sponsors for the round [here](https://forum.giveth.io/t/ethereum-security-qf-round-results-april-23-may-14-2026/2201#p-7891-a-huge-thank-you-to-our-donors-flexed_biceps-2). The **fund matched with 6.0841 ETH**. Dedaub itself, also donated 500 USD or 1000 USD to each team member to donate to other projects like The Red Guild, Seal 911, Safe Multisig Transaction Hashes, Sourcify and ZachXBT. Dedaub allocated the funding to paying for newer commercial AI models in its reconstruction layer and a higher free daily allowance for AI-assisted reconstruction. Although it is not easy to quantify the reconstructions that the grant allowed relative to the previous time, Dedaub told us that they went from < 1000 (probably near 500) weekly AI reconstructions to a current average of 2653! Read [Dedaub's grant recap](https://dedaub.com/blog/decompile-bytecode-ai-reconstruction/) The Fund's work --------------- Dedaub is one of the 134 projects that participated in Round 1.  The fund publishes all its allocations in a dedicated transparency page. Here's a summary of the stats of the round: ![](https://storage.googleapis.com/papyrus_images/3227793be9769b8affa2993fe1c1c1164e7de6a22251bd02b6e2e81a46893e0a.jpg) And broadly, the fund has already distributed 1.9M for security on Ethereum in its first 8 months of existence: ![](https://storage.googleapis.com/papyrus_images/ec9c6e9d4a74ad645b92780c5e68bc5114a2ce2876884360f1cdf6d990bd32b4.jpg) If you want to help make Ethereum safer, **ETHSecurity Initiatives Round** is currently active. You can now propose an initiative or pledge support for one. Explore what people are working on, help back the initiatives you believe in, or bring a new idea to the table. [ **TheDAO Security Fund | Initiatives** Ecosystem-funded Ethereum security initiatives. Browse open initiatives, donate by wallet or from an exchange, back initiatives with pledges that pay on completion. https://initiatives.thedao.fund ![TheDAO Security Fund | Initiatives](https://storage.googleapis.com/papyrus_images/3300c512c3a33bfabc22b1be739b1f306314644a08897334eda5a110dde2352a.png)](https://initiatives.thedao.fund/) --- *Originally published on [TheDAO Security Fund](https://paragraph.com/@thedao.fund/grantee-spotlight-dedaub)*