Being the most popular programming language for developing Ethereum smart contracts, Solidity allows using inline assembly to gain fine-grained control. Although many empirical studies on smart contracts have been conducted, to the best of our knowledge, none has examined inline assembly in smart contracts. To fill the gap, in this paper, we conduct the first large-scale empirical study of inline assembly on >7.6 million open-source Ethereum smart contracts from three aspects, namely, source code, bytecode, and transactions after designing new approaches to tackle several technical challenges. Through a thorough quantitative and qualitative analysis of the collected data, we obtain many new observations and insights. Moreover, by conducting a questionnaire survey on using inline assembly in smart contracts, we draw new insights from the valuable feedback. This work sheds light on the development of smart contracts as well as the evolution of Solidity and its compilers.

Xiao Peng

China EverBright Bank

Shuwei Song

University of Electronic Science and Technology of China

Xiapu Luo

Hong Kong Polytechnic University

China

Ting Chen

University of Electronic Science and Technology of China

China

Jiachi Chen

Sun Yat-Sen University

Tao Zhang

Macau University of Science and Technology (MUST)

China

Xiaosong Zhang

University of Electronic Science and Technology of China

A key threat to the usage of third-party dependencies has been the threat of security vulnerabilities, which risks unwanted access to a user application. As part of an ecosystem of dependencies, users of a library are prone to both the direct and transitive dependencies adopted into their application. Recent work involves tool supports for vulnerable dependency updates, rarely showing the complexity of the transitive updates. In this paper, we introduce our solution to support vulnerability updating. V-Achilles is a prototype that shows a visualization (i.e., using dependency graphs) affected by vulnerability attacks. In addition to the tool overview, we highlight three use cases to demonstrate usefulness, and an application of our prototype with real-world npm packages. The prototype is available at https://github.com/MUICT-SERU/V-Achilles, with an accompanying video demonstration at https://www.youtube.com/watch?v=tspiZfhMNcs.

Vipawan Jarukitpipat

Mahidol University

Xiao Peng

China EverBright Bank

Chaiyong Ragkhitwetsagul

Mahidol University, Thailand

Thailand

Morakot Choetkiertikul

Mahidol University, Thailand

Thailand

Thanwadee Sunetnanta

Mahidol University

Raula Gaikovina Kula

Nara Institute of Science and Technology

Japan

Bodin Chinthanet

Nara Institute of Science and Technology

Japan

Takashi Ishio

Nara Institute of Science and Technology

Japan

Kenichi Matsumoto

Nara Institute of Science and Technology