[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84202-en":3,"doc-seo-84202-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},84202,962075114765,"Quinn","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","Finding and Understanding Miscompilation Bugs in the Solidity Compiler","Smart contract compilers underpin correctness for public, open-source blockchains where deployed code is immutable. The work introduces SolSmith, a semantics-aware differential fuzz testing tool for the Solidity compiler, and reports results from over three years of bug hunting. It uncovers 25 miscompilation bugs unnoticed for as long as multiple years. The approach generates semantically valid programs to stress optimization and code generation, and analyzes bug types, root causes, and end-user impact to reveal optimization pitfalls.","Finding and Understanding Miscompilation Bugs in the Solidity  \nCompiler  \nBhargava Shastry 1  \n1 Ethereum Foundation, [bhargava.shastry@ethereum.org](bhargava.shastry@ethereum.org)  \narXiv :2607 .072 17v 1 [ cs . SE] 8 Jul 2026  \nAbstract  \nSmart contract compilers are critical to ensuring the correctness of public blockchains whose defining characteristics are open-source and immutable code. We created SolSmith, a semantics-aware differential fuzz testing tool, to improve the quality of the Solidity compiler—the most popular compiler for the Ethereum blockchain—and spent over three years finding compiler defects that produce incorrect code. We call these defects miscompilation bugs. During this time period, we have discovered 25 miscompilation bugs that went unnoticed, some for multiple years.  \nOur first contribution is to make compiler testing more rigorous. SolSmith achieves this goal by generating valid test programs that are likely to stress test code generation and optimization components. This helps SolSmith find bugs missed during routine testing that could potentially have serious implications for smart contracts and their users. Our second contribution is a qualitative and quantitative analysis of miscompilation bugs that we found in the Solidity compiler. We classify miscompilation bugs found by SolSmith based on their nature, root-causes, and impact on end-users. This sheds light on some pitfalls of optimizing compilers.  \n1 Introduction  \nSmart contracts are programs that codify the terms of an agreement between contracting parties. They are written in domain-specific program-  \nming languages like Solidity and are executed on the Ethereum blockchain. The compiler is responsible for translating the high-level smart contract code written in Solidity into bytecode that can be executed on the Ethereum Virtual Machine (EVM) . It is no surprise that compilers for smart contracts, like any complex software system, contain bugs. In this paper, we look specifically at miscompilation bugs: compiler defects that result in incorrect code generation.  \nMiscompilations are dangerous in general because they may go unnoticed unless the compiled code has been thoroughly tested. Miscompilations of smart contracts deployed on the Ethereum blockchain are particularly problematic because (1) deployed code is immutable (bugs persist); (2) they may alter the blockchain’s persistent state (side effects of bugs persist); and (3) side-effects routinely include financial transactions (sending/receiving Ether or other ERC20 tokens) .  \nIn our experience, miscompilations occur due to two main reasons: incorrect optimization and incorrect translation. Miscompilations due to incorrect optimizations occur for the following reasons. First, if optimization correctness checks are either inadequate or not thoroughly tested such that in most cases the optimization produces the desired output with the exception of corner cases. Second, if a formally verified optimization rule is correct in theory but incorrect in practice (e.g., function side-effects are not taken into account leading to more aggressive optimization than permissible) . Third, if wrong assumptions are made on the code to be optimized (e.g., may conditions are assumed to be must) . Mis-  \ncompilations due to incorrect translation occur either due to implementation flaws or inconsistent cleanup of typed data.  \nVerifying the correctness of the compiler is challenging, and traditional testing methods, such as writing unit and end-to-end tests, have limited effectiveness because they do not fully tease out compiler output for diverse programs. Blackbox fuzz testing—simply generating random input—is of little value when it comes to compiler testing if the goal is to find miscompilation bugs. This is because the test input needs to trigger code generation to be able to test for correct compilation and this is highly unlikely to occur when the input to the compiler is a random sequence of ","cbCaiqBJFLaX5gFM","https://ap.wps.com/l/cbCaiqBJFLaX5gFM","pdf",333447,1,16,"English","en",105,"# Abstract\n# Introduction\n## Miscompilation risks in smart contracts\n## Causes of miscompilation\n## Limitations of traditional and blackbox fuzz testing\n## SolSmith approach and differential testing setup","[{\"question\":\"What problem does the document address regarding the Solidity compiler?\",\"answer\":\"It targets miscompilation bugs—compiler defects that produce incorrect code generation for Solidity smart contracts on Ethereum.\"},{\"question\":\"How does SolSmith detect miscompilation bugs?\",\"answer\":\"SolSmith generates semantically correct Solidity programs and runs the compiler twice in control and experiment configurations, then compares execution traces on the EVM.\"},{\"question\":\"Why are miscompilation bugs especially dangerous on Ethereum?\",\"answer\":\"Deployed code is immutable, bugs can persist in blockchain state, and side effects can include financial transactions involving Ether or ERC20 tokens.\"}]",1784193910,40,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"finding-and-understanding-miscompilation-bugs-in-the-solidity-compiler","",{"@graph":35,"@context":84},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/finding-and-understanding-miscompilation-bugs-in-the-solidity-compiler/84202/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"What problem does the document address regarding the Solidity compiler?","Question",{"text":74,"@type":75},"It targets miscompilation bugs—compiler defects that produce incorrect code generation for Solidity smart contracts on Ethereum.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"How does SolSmith detect miscompilation bugs?",{"text":79,"@type":75},"SolSmith generates semantically correct Solidity programs and runs the compiler twice in control and experiment configurations, then compares execution traces on the EVM.",{"name":81,"@type":72,"acceptedAnswer":82},"Why are miscompilation bugs especially dangerous on Ethereum?",{"text":83,"@type":75},"Deployed code is immutable, bugs can persist in blockchain state, and side effects can include financial transactions involving Ether or ERC20 tokens.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,114,118,121,126,129,133],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},6,"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":28,"slug":117},7,"Healthcare","healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":119,"slug":120},30,"research-report",{"id":122,"doc_module":4,"doc_module_name":45,"category_name":123,"show_sort_weight":124,"slug":125},9,"Religion & Spirituality",20,"religion-spirituality",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":127,"show_sort_weight":124,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":45,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":45,"category_name":135,"show_sort_weight":105,"slug":136},19,"General","general"]