SPLASH 2026
Sun 4 - Fri 9 October 2026 Oakland, California, United States
co-located with SPLASH/ISSTA 2026
Tue 6 Oct 2026 15:48 - 16:06 at Junior Ballroom 3&4 - Smart Contracts and Blockchain Chair(s): Chandrakana Nandi

The Ethereum ecosystem, which secures over $381 billion in assets, fundamentally relies on client APIs as the sole interface between users and the blockchain. However, these critical APIs suffer from widespread implementation inconsistencies, which can lead to financial discrepancies, degraded user experiences, and threats to network reliability. Despite this criticality, existing testing approaches remain manual and incomplete: they require extensive domain expertise, struggle to keep pace with Ethereum's rapid evolution, and fail to distinguish genuine bugs from acceptable implementation variations. We present APIDiffer, the first specification-guided differential testing framework designed to automatically detect API inconsistencies across Ethereum's diverse client ecosystem. APIDiffer transforms API specifications into comprehensive test suites through two key innovations: (1) specification-guided test input generation that creates both syntactically valid and invalid requests enriched with real-time blockchain data, and (2) specification-aware false positive filtering that leverages large language models to distinguish genuine bugs from acceptable variations. Our evaluation across all 11 major Ethereum clients reveals the pervasiveness of API bugs in production systems. APIDiffer uncovered 72 bugs, with 90.28% already confirmed or fixed by developers, including one critical error in the official specifications themselves. Beyond these raw numbers, APIDiffer achieves up to 89.67% higher code coverage than existing tools and reduces false positive rates by 37.38%. The Ethereum community's response validates our impact: developers have integrated our test cases, expressed interest in adopting our methodology, and escalated one bug to the official Ethereum Project Management meeting. By making APIDiffer open-source, we enable continuous validation of Ethereum client API implementations, thereby strengthening the foundational integrity of the entire Ethereum ecosystem.

Tue 6 Oct

Displayed time zone: Pacific Time (US & Canada) change

15:30 - 17:00
Smart Contracts and BlockchainOOPSLA at Junior Ballroom 3&4
Chair(s): Chandrakana Nandi Certora; University of Washington
15:30
18m
Talk
SymGPT: Auditing Smart Contracts via Combining Symbolic Execution with Large Language Models
OOPSLA
Shihao Xia Pennsylvania State University, Mengting He Pennsylvania State University, Shuai Shao University of Connecticut, Tingting Yu University of Connecticut, Yiying Zhang University of California at San Diego, Nobuko Yoshida University of Oxford, Linhai Song Institute of Computing Technology at Chinese Academy of Sciences
DOI
15:48
18m
Talk
When Specifications Meet Reality: Uncovering API Inconsistencies in Ethereum Infrastructure
OOPSLA
Jie Ma Beihang University; Zhongguancun Laboratory, Ningyu He Hong Kong Polytechnic University, Jinwen Xi Zhongguancun Laboratory, Mingzhe Xing Zhongguancun Laboratory, Liangxin Liu Beihang University, luojiushenzi Beijing Institute of Technology; Zhongguancun Laboratory, Xiaopeng Fu Beijing Institute of Technology; Zhongguancun Laboratory, Chiachih Wu Amber Group, Haoyu Wang Huazhong University of Science and Technology, Ying Gao Beihang University; Zhongguancun Laboratory, Yinliang Yue Zhongguancun Laboratory
DOI
16:06
18m
Talk
Verifying Economic Security of Smart Contracts via Unintended Return
OOPSLA
Yi Rong Columbia University, Xupeng Li CertiK, Ronghui Gu Columbia University
DOI
16:24
18m
Talk
Beacon: Detecting Broken Access Control Vulnerabilities in DBMSs via System Catalog Consistency Validation
OOPSLA
Zongrui Peng Tsinghua University, Jingzhou Fu Tsinghua University, Zhiyong Wu Tsinghua University, Jie Liang Beihang University, Xiangdong Huang Tsinghua University, Dalong Shi Aviation Industry Corporation of China, Yu Jiang Tsinghua University
DOI