Being the most popular programming language for developing Ethereum smart contracts, Solidity allows using inline assembly to gain fine-grained control. Although many empirical studies on smart contracts have been conducted, to the best of our knowledge, none has examined inline assembly in smart contracts. To fill the gap, in this paper, we conduct the first large-scale empirical study of inline assembly on more than 7.6 million open-source Ethereum smart contracts from three aspects, namely, source code, bytecode, and transactions after designing new approaches to tackle several technical challenges. Through a thorough quantitative and qualitative analysis of the collected data, we obtain many new observations and insights. Moreover, by conducting a questionnaire survey on using inline assembly in smart contracts, we draw new insights from the valuable feedback. This work sheds light on the development of smart contracts as well as the evolution of Solidity and its compilers.

The development of blockchain has promoted the prosperity of the cryptocurrency ecosystem. The majority of cryptocurrencies are ERC20 tokens implemented based on Ethereum contracts. The major role of ERC20 tokens is to carry out various trades and loans in decentralized applications (DApps). To participate in DApps, users must grant the DApps permission to spend tokens on user behalf. However, if the authorization logic of token contract is flawed implementation, the holder of token will suffer tremendous financial losses. In this work, we detect the authentication implementation of the flaws in ERC20 token, which has not been done before. We find the authentication process of the token is implemented by operating the authentication data structure of the token. Therefore, we capture the operations of the authentication data structure in token contract to infer authentication behaviors and detect authentication defects. However, it’s not a simple task as most smart contracts are not open source and the bytecode of token contract lacks type information. To tackle these problems, we utilize symbolic execution on the token bytecode, then identify the authentication data structure and capture the operations by parsing the symbolic expressions, and finally detect authentication defects through the inferred authentication behavior. To best our knowledge, this is the first work to detect the flaws in the implementation of authentication in ERC20 Token. To automate the analysis, we implement our approach in a new tool named TokenCat and use it to inspect 245,822 tokens. As a result, the TokenCat found 491 ERC20 token authentication implementation flaws with 94% precision.

Using the echo energy difference of symmetric beams and the background three-dimensional (3-D) wind field observed by Wuhan mesosphere–stratosphere–troposphere (MST) radar, this letter analyzes the tilted condition of the atmosphere, studies the disturbance factors of tilted atmosphere based on the Lomb–Scargle method, and analyzes the relation between the atmospheric disturbances and 3-D wind field. The results indicate that: 1) the MST radar is capable of observing the tilting of the scattering layers by using the symmetric radar beams; 2) the main source induced the tilting of the scattering layer is the atmospheric waves with various scales in the troposphere, tidal waves in the lower stratosphere and mesosphere, but the main source in the lower stratosphere is semidiurnal tide, the main source in the mesosphere is diurnal tide; and 3) the wave periods detected by the echo power difference really exist in the atmospheric wind data, so we can use the echo power difference to analyze atmospheric waves based on the MST radar for all the ranges.