Λεπτομέρειες βιβλιογραφικής εγγραφής
| Τίτλος: |
ParityFuzz: Finding inconsistencies across solidity compilers via fine-grained mutation and differential analysis. |
| Συγγραφείς: |
Su, Bowei1 (AUTHOR) subw3@mail2.sysu.edu.cn, Ye, Mingxi1 (AUTHOR) yemx6@mail2.sysu.edu.cn, Nan, Yuhong1 (AUTHOR) nanyh@mail.sysu.edu.cn, Zheng, Peilin1 (AUTHOR) zhengplin@mail.sysu.edu.cn, Zheng, Zibin1 (AUTHOR) zhzibin@mail.sysu.edu.cn |
| Πηγή: |
Journal of Systems & Software. Nov2026, Vol. 241, pN.PAG-N.PAG. 1p. |
| Θεματικοί όροι: |
*Blockchains, *Defect tracking (Computer software development), Compilers (Computer programs), Computer software testing, Reinforcement learning |
| Περίληψη: |
The Solidity smart contract ecosystem has rapidly grown, leading to multiple compilers targeting different blockchain platforms or offering improved compilation efficiency. Although many compilers aim to be compatible with the primary Solidity compiler (Solc), significant inconsistencies in compilation and execution remain. These inconsistencies hinder contract migration, mislead developers during debugging, and may introduce exploitable vulnerabilities, causing potential financial losses. Existing testing techniques mainly focus on bugs within a single compiler or perform differential testing across compilers targeting the same environment. However, these approaches are inadequate for detecting inconsistencies across Solidity compilers, as they lack mechanisms to explore inconsistency-triggering conditions and do not support comparing bytecode generated for different environments. To address this gap, we propose ParityFuzz, a cross-compiler differential testing framework for Solidity. ParityFuzz operates in three stages. First, it generates a rich set of mutation rules (i.e., syntax-oriented and boundary-oriented mutation rules) by analyzing source code (i.e., compiler and execution environment). Second, it employs a reinforcement learning-based strategy to select the most promising rules for mutating test programs. Finally, it detects inconsistencies by compiling and executing these programs on multiple compilers, then normalizing and comparing their results. Our evaluation demonstrates that ParityFuzz is both efficient and effective. It improves test program generation, achieving up to an 18 × higher compilation success rate and 1.8 × greater code coverage compared to state-of-the-art fuzzers. In total, ParityFuzz has uncovered 64 previously unknown inconsistencies across six popular compilers. Notably, our findings have led to 11 fixes by developers and received a bounty from the Polkadot community. • ParityFuzz is the first framework for Solidity cross-compiler inconsistencies. • ParityFuzz derives mutation rules from source-code boundary conditions. • ParityFuzz uses an execution-based oracle to detect inconsistencies. • ParityFuzz outperforms existing fuzzers in success rate, coverage, and detected inconsistencies. • ParityFuzz identified 64 new inconsistencies across six Solidity compilers. [ABSTRACT FROM AUTHOR] |
|
Copyright of Journal of Systems & Software is the property of Elsevier B.V. and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) |
| Βάση Δεδομένων: |
Business Source Index |