一句话：对以太坊 680 万份 Solidity 智能合约进行大规模实证研究，揭示内联汇编的使用率、演变与模式。
Solidity 是主流智能合约语言，其内联汇编允许嵌入低级代码，用于优化、扩展语言或使用区块链特有 opcode。但内联汇编难以理解，可能引入安全威胁、影响编译器优化，并限制源码级静态分析器。本文对以太坊上 680 万份智能合约进行大规模定量研究，并手工定性分析使用模式。结果发现，23% 的合约包含内联汇编，且使用随时间更普遍。这些发现可帮助实践者判断何时使用内联汇编，指导工具开发者优先支持相关特性，并为改进 Solidity 语言与编译器、研究非必要时替换内联汇编提供方向。
The Solidity programming language is the most widely used language for smart contract development. Improving smart contracts’ correctness, security, and performance has been the driving force for research in vulnerability detection, program analysis, and compiler techniques for Solidity. Similar to system-level languages such as C, Solidity enables the embedding of low-level code in programs, in the form of inline assembly code. Developers use inline assembly for low-level optimizations, extending the Solidity language through libraries, and using blockchain-specific opcodes only available through inline assembly. Nevertheless, inline assembly fragments are not well understood by an average developer and can introduce security threats as well as affect the optimizations that can be applied to programs by the compiler; it also significantly limits the effectiveness of source code static analyzers that operate on the Solidity level. A better understanding of how inline assembly is used in practice could in turn increase the performance, security, and support for inline assembly in Solidity. This paper presents a large-scale quantitative study of the use of inline assembly in 6.8M smart contracts deployed on the Ethereum blockchain. We find that 23% of the analyzed smart contracts contain inline assembly code, and that the use of inline assembly has become more widespread over time. We further performed a manual qualitative analysis for identifying usage patterns of inline assembly in Solidity smart contracts. Our findings are intended to help practitioners understand when they should use inline assembly and guide developers of Solidity tools in prioritizing which parts of inline assembly to implement first. Finally, the insights of this study could be used to enhance the Solidity language, improve the Solidity compiler, and to open up new research directions by driving future researchers to build appropriate methods and techniques for replacing inline assembly in Solidity programs when there is no real necessity to use it.
@article{paperbot1432,
title = {A study of inline assembly in solidity smart contracts},
author = {Stefanos Chaliasos and Arthur Gervais and Benjamin Livshits},
journal = {Proceedings of the ACM on Programming Languages},
volume = {6},
number = {OOPSLA2},
year = {2022},
doi = {10.1145/3563328}
}