The correctness of the Solidity compiler is crucial for ensuring the security of smart contracts. However, the implementation complexity of its type system often introduces elusive defects. This paper presents the first systematic empirical study on typing-related bugs in the Solidity compiler. To systematically analyze these bugs, we collected 146 officially confirmed and fixed typing-related bugs from the official GitHub repository of Solidity compiler. For each bug, we conducted an in-depth analysis and classification from four dimensions: symptoms, root causes, exposure conditions, and fix strategies. Through this study, we reveal unique distribution patterns and key characteristics of such bugs, and summarize 12 core findings. We additionally give the implications of our findings, and these implications not only deepen the understanding of inherent weaknesses in the Solidity compiler but also provide new insights for detecting and fixing typing-related bugs in the Solidity compiler.
翻译:Solidity编译器的正确性对于确保智能合约的安全性至关重要。然而,其类型系统的实现复杂性常常引入难以捉摸的缺陷。本文首次对Solidity编译器中的类型相关缺陷进行了系统性实证研究。为系统分析这些缺陷,我们从Solidity编译器的官方GitHub仓库中收集了146个已官方确认并修复的类型相关缺陷。针对每个缺陷,我们从四个维度进行了深入分析和分类:症状、根本原因、暴露条件和修复策略。通过本研究,我们揭示了此类缺陷独特的分布模式和关键特征,并总结了12项核心发现。我们进一步阐述了这些发现的启示,这些启示不仅深化了对Solidity编译器固有弱点的理解,也为检测和修复Solidity编译器中的类型相关缺陷提供了新的见解。