一句话：提出有界穷举随机程序生成方法并实现 Erwin，在 Solidity 编译器中检出 26 个缺陷。
Solidity 编译器管理着巨额资产，其正确性至关重要，但编译器缺陷频发，已有研究显示 Solidity 程序中限定符（qualifier）的组合是编译器崩溃的首要原因，占历史崩溃的 40.5%。通用随机程序生成器在无界的程序空间中探索，难以集中覆盖这类易出错限定符的组合。本文提出有界穷举随机程序生成：基于经验证据动态界定搜索空间，先生成抽象出使用易出错限定符的有效程序模板，再以模板为基础对合适的限定符进行穷举枚举来测试编译器，并设计了相应机制以解决有效性与效率方面的技术挑战。作者实现工具 Erwin，在 solc、solang 两个 Solidity 编译器和静态分析器 slither 上发现并报告 26 个缺陷，其中 23 个此前未知、18 个已确认、10 个已修复。评估还表明 Erwin 在缺陷检测上优于当前最优的 Solidity fuzzer，并覆盖了 solc 单元测试遗漏的 4599 条边与 14824 行代码。
By July 2025, smart contracts collectively manage roughly $120 billion in assets. With Solidity remaining the dominant language for smart contract development, the correctness of Solidity compilers has become critically important. However, Solidity compilers are prone to bugs, with a recent study revealing that combinations of qualifiers in Solidity programs are the primary cause of compiler crashes, accounting for \(40.5\%\) of all historical crashes. While random program generators are widely used for compiler testing, they may be less effective at finding Solidity compiler bugs because they explore the unbounded space of possible programs rather than concentrating on the specific subspace related to bug-prone qualifiers. A promising idea for finding qualifier-related bugs is to bound the search space based on empirical evidence of where such bugs are likely to occur, specifically focusing test generation to target subspaces with rich combinations of qualifiers. To address this, we propose bounded exhaustive random program generation, a novel approach that dynamically bounds the search space, enhancing the likelihood of uncovering Solidity compiler bugs. Specifically, our method bounds the search space by generating valid program templates that abstract programs that use bug-prone qualifiers, and then uses these templates as a basis for compiler testing through exhaustive enumeration of suitable qualifiers. Mechanisms are devised to address technical challenges regarding validity and efficiency. We have implemented our novel generation approach in a new tool, Erwin. We have used Erwin to find and report 26 bugs across two Solidity compilers, solc and solang, and one Solidity static analyzer, slither. Among these, 23 were previously unknown, 18 have been confirmed, and 10 have been fixed. Evaluation results demonstrate that Erwin outperforms state-of-the-art Solidity fuzzers in bug detection and complements developer-written test suites by covering 4,599 edges and 14,824 lines of the solc compiler that were missed by solc’s unit tests.
@inproceedings{paperbot11878,
title = {Bounded Exhaustive Random Program Generation for Testing Solidity Compilers},
author = {Haoyang Ma and Alastair F. Donaldson and Qingchao Shen and Yongqiang Tian and Junjie Chen and Shing-Chi Cheung},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773237}
}