Finding and Understanding Miscompilation Bugs in the Solidity Compiler

• URL: http://arxiv.org/abs/2607.07217v1
• Date: Wed, 08 Jul 2026 09:59:46 GMT
• Title: Finding and Understanding Miscompilation Bugs in the Solidity Compiler
• Abstract summary: We created SolSmith to improve the quality of the Solidity compiler.<n>We have discovered 25 miscompilation bugs that went unnoticed, some for multiple years.<n>We classify miscompilation bugs found by SolSmith based on their nature, root-causes, and impact on end-users.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Smart contract compilers are critical to ensuring the correctness of public blockchains whose defining characteristics are open-source and immutable code. We created SolSmith, a semantics-aware differential fuzz testing tool, to improve the quality of the Solidity compiler -- the most popular compiler for the Ethereum blockchain -- and spent over three years finding compiler defects that produce incorrect code. We call these defects miscompilation bugs. During this time period, we have discovered 25 miscompilation bugs that went unnoticed, some for multiple years. Our first contribution is to make compiler testing more rigorous. SolSmith achieves this goal by generating valid test programs that are likely to stress test code generation and optimization components. This helps SolSmith find bugs missed during routine testing that could potentially have serious implications for smart contracts and their users. Our second contribution is a qualitative and quantitative analysis of miscompilation bugs that we found in the Solidity compiler. We classify miscompilation bugs found by SolSmith based on their nature, root-causes, and impact on end-users. This sheds light on some pitfalls of optimizing compilers.

Related papers

• Anchored Self-Play for Code Repair [68.0728003844994]
  Code repair is an important capability for language models (LMs)<n>We propose __generator--fixer self-play__, in which a single model is trained with reinforcement learning to generate bugs and fix them.<n>On BugSourceBench, we find that self-play drifts toward difficult but unrealistic bugs.<n>We propose Anchored Self-Play (ASP), which anchors self-play with a small reference set by adding a code-embedding similarity reward for generation and mixing reference bugs into fixer training.
  arXiv  Detail & Related papers  (2026-07-03T17:51:52Z)
• ParityFuzz: Finding Inconsistencies across Solidity Compilers via Fine-Grained Mutation and Differential Analysis [37.31248744457945]
  ParityFuzz is a cross-compiler differential testing framework for Solidity.<n>It derives mutation rules, including syntax- and boundary-oriented rules, by analyzing compilers and execution environments.<n>It compiles and executes programs across multiple compilers, then normalizes and compares results to detect inconsistencies.
  arXiv  Detail & Related papers  (2026-05-09T16:53:45Z)
• Understanding Typing-Related Bugs in Solidity Compiler [20.643091052140118]
  This paper presents the first systematic empirical study on typing-related bugs in the Solidity compiler.<n>For each bug, we conducted an in-depth analysis and classification from four dimensions: symptoms, root causes, exposure conditions, and fix strategies.
  arXiv  Detail & Related papers  (2025-12-20T02:37:10Z)
• BugPilot: Complex Bug Generation for Efficient Learning of SWE Skills [59.003563837981886]
  High quality bugs are key to training the next generation of language model based software engineering (SWE) agents.<n>We introduce a novel method for synthetic generation of difficult and diverse bugs.
  arXiv  Detail & Related papers  (2025-10-22T17:58:56Z)
• Solsmith: Solidity Random Program Generator for Compiler Testing [8.14179966625145]
  This paper designs and implements Solsmith, a test program generator aimed at uncovering defects in Solidity compilers.<n>It tests the compiler correctness by generating valid and diverse Solidity programs.<n>Preliminary results show that Solsmith can generate the expected test programs and uncover four confirmed defects in Solidity compilers.
  arXiv  Detail & Related papers  (2025-06-04T13:04:17Z)
• CrashFixer: A crash resolution agent for the Linux kernel [58.152358195983155]
  This work builds upon kGym, which shares a benchmark for system-level Linux kernel bugs and a platform to run experiments on the Linux kernel.<n>This paper introduces CrashFixer, the first LLM-based software repair agent that is applicable to Linux kernel bugs.
  arXiv  Detail & Related papers  (2025-04-29T04:18:51Z)
• SolBench: A Dataset and Benchmark for Evaluating Functional Correctness in Solidity Code Completion and Repair [51.0686873716938]
  We introduce SolBench, a benchmark for evaluating the functional correctness of Solidity smart contracts generated by code completion models.<n>We propose a Retrieval-Augmented Code Repair framework to verify functional correctness of smart contracts.<n>Results show that code repair and retrieval techniques effectively enhance the correctness of smart contract completion while reducing computational costs.
  arXiv  Detail & Related papers  (2025-03-03T01:55:20Z)
• Finding Missed Code Size Optimizations in Compilers using LLMs [1.90019787465083]
  We develop a novel testing approach which combines large language models with a series of differential testing strategies.<n>Our approach requires fewer than 150 lines of code to implement.<n>To date we have reported 24 confirmed bugs in production compilers.
  arXiv  Detail & Related papers  (2024-12-31T21:47:46Z)
• Towards Understanding the Bugs in Solidity Compiler [11.193701473232851]
  This paper presents the first systematic study on 533 Solidity compiler bugs. We examine their characteristics (including symptoms, root causes, and distribution) and their triggering test cases. To study the limitations of Solidity compiler fuzzers, we evaluate three Solidity compiler fuzzers.
  arXiv  Detail & Related papers  (2024-07-08T14:22:50Z)
• DebugBench: Evaluating Debugging Capability of Large Language Models [80.73121177868357]
  DebugBench is a benchmark for Large Language Models (LLMs) It covers four major bug categories and 18 minor types in C++, Java, and Python. We evaluate two commercial and four open-source models in a zero-shot scenario.
  arXiv  Detail & Related papers  (2024-01-09T15:46:38Z)
• Using Developer Discussions to Guide Fixing Bugs in Software [51.00904399653609]
  We propose using bug report discussions, which are available before the task is performed and are also naturally occurring, avoiding the need for additional information from developers. We demonstrate that various forms of natural language context derived from such discussions can aid bug-fixing, even leading to improved performance over using commit messages corresponding to the oracle bug-fixing commits.
  arXiv  Detail & Related papers  (2022-11-11T16:37:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.