Finding and Understanding Miscompilation Bugs in the Solidity Compiler

Smart contract compilers are critical to ensuring the correctness of public blockchains whose defining characteristics are open-source and immutable code. We created SolSmith, a semantics-aware differential fuzz testing tool, to improve the quality of the Solidity compiler -- the most popular compiler for the Ethereum blockchain -- and spent over three years finding compiler defects that produce incorrect code. We call these defects miscompilation bugs. During this time period, we have discovered 25 miscompilation bugs that went unnoticed, some for multiple years. Our first contribution is to make compiler testing more rigorous. SolSmith achieves this goal by generating valid test programs that are likely to stress test code generation and optimization components. This helps SolSmith find bugs missed during routine testing that could potentially have serious implications for smart contracts and their users. Our second contribution is a qualitative and quantitative analysis of miscompilation bugs that we found in the Solidity compiler. We classify miscompilation bugs found by SolSmith based on their nature, root-causes, and impact on end-users. This sheds light on some pitfalls of optimizing compilers.

Paper

References (11)

04“Fuzzing for javascript correctness.”2007 · squarefree.com/
05“Solidity documentation.”docs.soliditylang.org/en/latest/
06If the selected production has dependencies
07The maximum number of test files per test case is user-controlled
08It chooses one of the contract’s functions uniquely at random and invokes it with typed ar-guements to that function which have also been generated randomly
09Should the chosen term be an inline assembly block, SolSmith starts iterating on a top-level inline assembly terms
10Since Solidity enforces types rather strictlySection
11The output and status code of the function invocation, and the state of the blockchain are pre-served for comparison later on

Similar papers

© 2026 NYSGPT2525 LLC