sBugChecker: A Systematic Framework for Detecting Solidity Compiler-Introduced Bugs

IF 8 1区计算机科学 Q1 COMPUTER SCIENCE, THEORY & METHODS

IEEE Transactions on Information Forensics and Security Pub Date : 2025-09-10 DOI:10.1109/TIFS.2025.3608660

Fei Tong;Zihao Li;Guang Cheng;Yujian Zhang;Heng Li

{"title":"sBugChecker: A Systematic Framework for Detecting Solidity Compiler-Introduced Bugs","authors":"Fei Tong;Zihao Li;Guang Cheng;Yujian Zhang;Heng Li","doi":"10.1109/TIFS.2025.3608660","DOIUrl":null,"url":null,"abstract":"A compiler converts smart contract source code into bytecode, ensuring behavior consistency between them. However, as compiler is also a program, it may contain bugs that disrupt this consistency, known as Compiler-Introduced Bugs (CIBs). Of the latest 4,857 verified smart contracts coded in Solidity, approximately 58% still use compilers that contain at least one CIB. These CIBs can be exploited by attackers to bypass security checks or inject malicious data, leading to significant security issues, which becomes even more serious for smart contracts in blockchain as they cannot be modified after being deployed. To this end, this paper proposes sBugChecker, to the best of our knowledge, the first systematic framework designed to automatically and effectively detect CIBs for smart contracts coded in Solidity. sBugChecker can be readily extended with the rule customization suite we propose based on domain specific language. Additionally, it employs two static analytical methods, i.e., pattern matching, and symbolic execution, to identify CIBs’ triggering conditions and confirm their impacts, broadening its detection scope and improving its detection efficiency. To evaluate sBugChecker’s performance, we construct a CIB mutated smart contract dataset, which is the first publicly-available one for this study. According to the evaluation based on this dataset, sBugChecker performs exceptionally well, with detection precision, recall, and F-measure on average achieving 96.6%, 95.5% and 96.0%, respectively. Moreover, sBugChecker has been applied to successfully discover real-world deployed smart contracts capable of triggering CIBs.","PeriodicalId":13492,"journal":{"name":"IEEE Transactions on Information Forensics and Security","volume":"20 ","pages":"9760-9775"},"PeriodicalIF":8.0000,"publicationDate":"2025-09-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"IEEE Transactions on Information Forensics and Security","FirstCategoryId":"94","ListUrlMain":"https://ieeexplore.ieee.org/document/11159069/","RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q1","JCRName":"COMPUTER SCIENCE, THEORY & METHODS","Score":null,"Total":0}

引用次数: 0

Abstract

A compiler converts smart contract source code into bytecode, ensuring behavior consistency between them. However, as compiler is also a program, it may contain bugs that disrupt this consistency, known as Compiler-Introduced Bugs (CIBs). Of the latest 4,857 verified smart contracts coded in Solidity, approximately 58% still use compilers that contain at least one CIB. These CIBs can be exploited by attackers to bypass security checks or inject malicious data, leading to significant security issues, which becomes even more serious for smart contracts in blockchain as they cannot be modified after being deployed. To this end, this paper proposes sBugChecker, to the best of our knowledge, the first systematic framework designed to automatically and effectively detect CIBs for smart contracts coded in Solidity. sBugChecker can be readily extended with the rule customization suite we propose based on domain specific language. Additionally, it employs two static analytical methods, i.e., pattern matching, and symbolic execution, to identify CIBs’ triggering conditions and confirm their impacts, broadening its detection scope and improving its detection efficiency. To evaluate sBugChecker’s performance, we construct a CIB mutated smart contract dataset, which is the first publicly-available one for this study. According to the evaluation based on this dataset, sBugChecker performs exceptionally well, with detection precision, recall, and F-measure on average achieving 96.6%, 95.5% and 96.0%, respectively. Moreover, sBugChecker has been applied to successfully discover real-world deployed smart contracts capable of triggering CIBs.

查看原文本刊更多论文

sBugChecker：一个用于检测稳定性编译器引入的bug的系统框架

编译器将智能合约源代码转换为字节码，确保它们之间的行为一致性。然而，由于编译器也是一个程序，它可能包含破坏这种一致性的错误，称为编译器引入的错误（cib）。在Solidity最新的4857个经过验证的智能合约中，大约58%仍然使用包含至少一个CIB的编译器，这些CIB可以被攻击者利用来绕过安全检查或注入恶意数据，导致严重的安全问题，对于区块链中的智能合约来说，这变得更加严重，因为它们在部署后无法修改。为此，本文提出了sBugChecker，据我们所知，这是第一个系统框架，旨在自动有效地检测用Solidity编码的智能合约的cib。sBugChecker可以很容易地使用我们提出的基于领域特定语言的规则定制套件进行扩展。采用模式匹配和符号执行两种静态分析方法，识别cib的触发条件并确认其影响，扩大了cib的检测范围，提高了检测效率。为了评估sBugChecker的性能，我们构建了一个CIB突变的智能合约数据集，这是本研究中第一个公开可用的数据集。根据基于该数据集的评估，sBugChecker表现异常出色，检测精度、召回率和F-measure平均分别达到96.6%、95.5%和96.0%。此外，sBugChecker已被应用于成功发现能够触发cib的现实世界部署的智能合约。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

IEEE Transactions on Information Forensics and Security 工程技术-工程：电子与电气

CiteScore

14.40

自引率

7.40%

发文量

234

审稿时长

6.5 months

期刊介绍： The IEEE Transactions on Information Forensics and Security covers the sciences, technologies, and applications relating to information forensics, information security, biometrics, surveillance and systems applications that incorporate these features