An Empirical Study of Impact of Solidity Compiler Updates on Vulnerabilities

Vulnerabilities are an important issue in Ethereum smart contracts. Although various vulnerability analysis tools have been developed, the effectiveness of compilers themselves in eliminating vulnerable code has not been investigated to the best of the author's knowledge. In this paper, we investigate how many vulnerable contracts are created in Ethereum smart contracts for each compiler version. In particular, we collected 503,572 contracts whose Solidity source codes are publicly available in the Ethereum blockchain and then analyzed the vulnerabilities of these contracts. Focused on three vulnerabilities with high severity, i.e., Locked Money, Using tx.origin, and Unchecked Call, we confirm that the appearance rates of these vulnerabilities are decreased by major updates of the Solidity compiler. We then found the following insights. First, the appearance rate for Locked Money is decreased after version v0.6, and second, that of Using tx.origin is quite limited independently of the compiler update. Third, the appearance rate for Unchecked Call is decreased by v0.8, but it is still high due to several factors, such as code cloning. Thus, countermeasures are needed for Unchecked Call.