Integer Overflow

Integer Overflow Explained in Detail

An integer overflow happens when a calculation exceeds the maximum value of its type. Solidity 0.8.x reverts on overflow by default, but unchecked blocks and older Solidity versions can still wrap.

Auditors should also review downcasts, fixed-point math, rounding, and decimal conversions, especially in DeFi accounting and ERC-4626 vaults.

Smart contract example

pragma solidity ^0.8.20;

contract Counter {
    uint8 public count = 255;

    function inc() external {
        unchecked {
            count += 1; // wraps to 0
        }
    }
}

Integer Overflow in Auditing

Classic overflow bugs are less common in modern Solidity, but arithmetic edge cases still break DeFi accounting, token limits, reward math, share conversions, and loop counters.

Red flags in code

• Solidity version below 0.8.0.

• unchecked blocks around user-controlled math.

• Narrow types such as uint8, uint32, or uint128.

• Downcasts without range checks.

• Multiplication before division in fixed-point math.

• Token decimals, oracle decimals, and share decimals mixed together.

How to test or review it

• Fuzz 0, 1, max values, max minus one, and extreme token amounts.

• Test every unchecked block with boundary inputs.

• Review explicit casts separately from arithmetic checks.

• Check rounding direction for mint, redeem, borrow, repay, and liquidation math.

• Verify scaling factors and decimals across tokens and oracles.

• Add invariants for total supply, shares, reserves, and user balances.