| Abstract: | The creative introduction of the smart contracts in Ethereum, which are Turing-complete programs, boosted blockchain to the second generation. Meantime, the specifically designed young and fast-evolving programming languages, such as Solidity, become the key factors behind smart contracts being the breeding ground of ubiquitous defects. As many contract defects occur within certain compiler versions, knowing the specific compiler version used to generate the contract's bytecode, facilitates the design of more targeted defect detection approaches, and provides ways to estimate the risks faced of invoking it. To this end, we propose VSmart (compiler Version identification for Smart contract), which takes in the bytecode of the smart contract to be analyzed and outputs the major compiler version used to produce it. The basic idea is to leverage deep neural networks to grasp version-indicative features from contracts' normalized opcode sequences, and train classifiers on a data set consisting of 131,546 smart contracts with ground-truth labels we collected from Etherscan. The performance evaluation conducted shows that VSmart achieves nearly 98% accuracy in identifying major Solidity compiler versions. Further, on the basis of VSmart, we perform an empirical study on the distribution of the Solidity compiler versions on a wild data set consisting of 15,326,672 nontrivial smart contracts actually deployed on the Ethereum blockchain. The landscape estimation results show that the Solidity version distribution is rather imbalanced, with Solidity 0.4 being the most popular one; and the developers' Solidity usage practices conflict with the official's suggestion of always using the latest version, while they tend to gradually switch to newer versions. |
