A Study of Inline Assembly in Solidity Smart Contracts
summary
A large-scale code audit of 6.8M contracts finds 23% of 6.8M contracts contain inline assembly, typically with up to three fragments per contract and 9–10 instructions per fragment. Only about ~5k unique fragments appear repeatedly across many deployments. Common uses are low-level optimizations, access to opcodes missing from Solidity (e.g., contract existence checks), and library core code written in Yul after 2017. Static analyzers often ignore these fragments (Slither flags them), and many assembler uses are now redundant because the compiler gains equivalent optimizations.
AI-written summary · about
chapters (14)
- 0:00Inline assembly in Solidity
- 1:02Advantages of inline assembly
- 3:52Research motivation
- 5:38Data collection method
- 7:48Inline assembly usage findings
- 9:39Assembly in smart contracts
- 11:48Assembly adoption trends
- 12:53Inline assembly instructions
- 15:47Assembly patterns and uses
- 16:51Necessary vs unnecessary assembly
- 18:16Future research and security
- 19:03Q&A 1
- 21:31Q&A 2
- 24:42Q&A 3
related talks
01h 31mHow to find Solidity vulnerabilities
16mCodeExtract: Enhancing Binary Code Similarity Detection with Code Extraction Techniques
22mHow Decompilation Uncovers Smart Contract Vulnerabilities
20mSolidity's most common security pitfalls and its best safeguards
15mSymbolic Value-Flow Static Analysis: Deep, Precise, Complete Modeling of Ethereum Smart Contracts
38mStatic Code Analysis - A Behind-the-scenes Look
31mThe Now And The Future Of Malicious WebAssembly
26mAn Effective Approach to Software Obfuscation