How to recover funds from a scam contract

Smart Contracts
1

Hello, I would like to know if there is any possibility of recovering funds deposited in a scam contract. I will explain in detail below.

  • ETH locked in contract with invalid address generation bug (31 chars instead of 42)
  • Decompiled bytecode confirms no selfdestruct() or recovery functions
  • Offering 20% bounty for successful recovery (or proof of impossibility)
  • Full technical analysis included below

:magnifying_glass_tilted_left: The Problem

This contract appears to be a "MEV bot" but contains a critical bug that makes funds permanently inaccessible:

How the Scam Works:

  1. :white_check_mark: Contract accepts ETH deposits via receive() function
  2. :cross_mark: start() function attempts to send ETH to a dynamically generated address
  3. :cross_mark: Address generation function produces 31-character string instead of required 42
  4. :cross_mark: parseMempool() rejects the invalid address → transaction reverts
  5. :cross_mark: withdrawal() has the same bug → also reverts
  6. :locked: ETH is permanently locked with no recovery mechanism

The decompiled bytecode shows this function:

function 0x5ba() private { // callMempool
v0 = 0x5e8(0xb9f1a09); // offset: 194976265
v1 = 0x9c8(v0, 120); // concat with 'x'
v2 = 0x8d3(0x93fc1e); // sol: 9698334
v3 = 0x9c8(v2, v1);
v4 = 0x8d3(0xf676e9a32); // length: 66159811122
v5 = 0x8d3(0x5bbeab1); // size: 96201393
v6 = 0x9c8(v5, v4);
v7 = 0x9c8(v6, v3);
v8 = 0x9c8(v7, 48); // concat with '0'
return v8; // Returns: "0xb9f1a0993fc1ef676e9a325bbeab1" (31 chars)
}

function 0x669(bytes varg0) private { // parseMempool
require(42 == varg0.length, Error('Invalid address length'));
// ↑ ALWAYS REVERTS because input is 31 chars, not 42
// ... parsing logic never executes
}

3

Recovering funds from scam contracts is quite difficult unless with some third party recovery tools which most of them are already proven to be less reliable

It’d rather let go than risk more