Added 10 inteeger overflow vulnerability type smart contracts #110
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
|
|
||
| contract AuctusTokenSale { | ||
|
|
||
| function finish() public { | ||
| uint256 freeEthers = address(this).balance * 40; | ||
| uint256 vestedEthers = address(this).balance - freeEthers; | ||
|
There was a problem hiding this comment. Critical: Integer underflow leads to massive vestedEthers value Since This is the core integer overflow vulnerability - the calculation is mathematically impossible without underflow. |
||
| assert(address(this).call.value(vestedEthers)()); | ||
|
There was a problem hiding this comment. Critical: Self-transfer with underflowed value will fail The contract attempts to send Additionally:
🤖 Prompt for AI Agents |
||
| } | ||
|
Comment on lines
+4
to
+8
There was a problem hiding this comment. Critical: Integer overflow vulnerability in balance calculation The multiplication Example overflow scenario:
function finish() public {
- uint256 freeEthers = address(this).balance * 40;
- uint256 vestedEthers = address(this).balance - freeEthers;
+ // Use SafeMath or Solidity 0.8+ with automatic overflow checks
+ uint256 balance = address(this).balance;
+ require(balance <= type(uint256).max / 40, "Overflow protection");
+ uint256 freeEthers = balance * 40;
+ require(freeEthers <= balance, "Invalid calculation");
+ uint256 vestedEthers = balance - freeEthers;
assert(address(this).call.value(vestedEthers)());
}
🤖 Prompt for AI Agents |
||
| } | ||
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,13 @@ | ||||||||||||
|
|
||||||||||||
|
There was a problem hiding this comment. 🧩 Analysis chainAdd SPDX and an explicit pragma (<0.8) to preserve the overflow behavior. Without a pragma, builds can be non‑deterministic. Also, if compiled on 0.8+, arithmetic underflow will revert and the intended “integer overflow” test case won’t manifest. Apply: +// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.4.24;
contract SIMPLE_PIGGY_BANK {🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "---- file: audit_engine/smart_contracts/integer_overflow/io52.sol ----"
sed -n '1,240p' audit_engine/smart_contracts/integer_overflow/io52.sol || true
echo "---- end ----"Length of output: 374 Add SPDX header and explicit pre-0.8 pragma to preserve overflow behavior Add to the top of audit_engine/smart_contracts/integer_overflow/io52.sol so builds are deterministic and arithmetic overflow behavior remains pre-0.8: +// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.4.24;
contract SIMPLE_PIGGY_BANK {📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||
| contract SIMPLE_PIGGY_BANK { | ||||||||||||
|
|
||||||||||||
| mapping (address => uint) public Bal; | ||||||||||||
| uint public MinSum = 1 ether; | ||||||||||||
|
|
||||||||||||
| function Collect(uint _am) public payable { | ||||||||||||
| if(Bal[msg.sender] >= MinSum) { | ||||||||||||
| msg.sender.call.value(_am); | ||||||||||||
|
There was a problem hiding this comment. Low‑level call syntax is invalid (missing invocation). This won’t compile. In <=0.4.x you must invoke the call with trailing parentheses. Apply: - msg.sender.call.value(_am);
+ msg.sender.call.value(_am)();📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||
| Bal[msg.sender] -= _am; | ||||||||||||
| } | ||||||||||||
| } | ||||||||||||
| } | ||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,13 @@ | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
|
There was a problem hiding this comment. Missing pragma directive Like io51.sol, this contract lacks a Solidity version pragma. +pragma solidity ^0.8.0; // Or specify the intended vulnerable version
+
contract TokenBank {📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||
| contract TokenBank { | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| mapping (address => uint) public Holders; | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| function WithdrawToHolder(address _addr, uint _wei) public payable { | ||||||||||||||||||||||||||||||||
| if(Holders[_addr] > 0) { | ||||||||||||||||||||||||||||||||
| if(_addr.call.value(_wei)()) { | ||||||||||||||||||||||||||||||||
|
There was a problem hiding this comment. Critical: Reentrancy vulnerability via external call The pattern of calling an external address before updating state ( Apply the checks-effects-interactions pattern: function WithdrawToHolder(address _addr, uint _wei) public payable {
if(Holders[_addr] > 0) {
+ require(Holders[_addr] >= _wei, "Insufficient balance");
+ Holders[_addr] -= _wei; // Update state before external call
if(_addr.call.value(_wei)()) {
- Holders[_addr] -= _wei;
+ // Success
+ } else {
+ Holders[_addr] += _wei; // Revert state on failure
}
}
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||
| Holders[_addr] -= _wei; | ||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||
|
Comment on lines
+8
to
+10
There was a problem hiding this comment. Use of deprecated patterns and missing error handling The use of For Solidity 0.8+: -if(_addr.call.value(_wei)()) {
+(bool success,) = _addr.call{value: _wei}("");
+require(success, "Transfer failed");
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||
|
Comment on lines
+6
to
+12
There was a problem hiding this comment. Major: Missing access control and fund source validation The function lacks several critical security checks:
🤖 Prompt for AI AgentsCritical: Integer underflow vulnerability in balance update The subtraction function WithdrawToHolder(address _addr, uint _wei) public payable {
if(Holders[_addr] > 0) {
+ require(Holders[_addr] >= _wei, "Insufficient balance");
if(_addr.call.value(_wei)()) {
Holders[_addr] -= _wei;
}
}
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,10 @@ | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| contract SimpleEthBank { | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
|
Comment on lines
+1
to
+3
There was a problem hiding this comment. 🧩 Analysis chainAdd SPDX license identifier and pin the compiler version. Missing SPDX and pragma. Pinning the version ensures deterministic builds and prevents accidental behavior changes (e.g., arithmetic checks, call syntax). For a modern, secure build (recommended): +// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.24;
contract SimpleEthBank {For a legacy “intentionally vulnerable” build: +// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.4.26;
contract SimpleEthBank {Note: With 0.4.x you must use 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== show file (first 120 lines) ==="
sed -n '1,120p' audit_engine/smart_contracts/integer_overflow/io54.sol || true
echo
echo "=== search for SPDX and pragma in file ==="
rg -n --no-ignore -S "SPDX|pragma" audit_engine/smart_contracts/integer_overflow/io54.sol || true
echo
echo "=== ls file ==="
ls -l audit_engine/smart_contracts/integer_overflow/io54.sol || trueLength of output: 412 Add SPDX license identifier and pin the Solidity compiler version audit_engine/smart_contracts/integer_overflow/io54.sol is missing SPDX and pragma — pin the compiler to avoid accidental behavior changes (overflow semantics, call syntax). For a modern, secure build: +// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.24;
contract SimpleEthBank {For a legacy “intentionally vulnerable” build: +// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.4.26;
contract SimpleEthBank {Note: With 0.4.x use 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||
| mapping (address => uint) accountBalances; | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| function withdraw(uint amount) public { | ||||||||||||||||||||||
| accountBalances[msg.sender] -= amount; | ||||||||||||||||||||||
| msg.sender.call.value(amount); | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
|
Comment on lines
+6
to
+9
There was a problem hiding this comment. ❓ Verification inconclusiveFix invalid Ether send and unchecked subtraction (will not compile/work as written).
Apply this secure fix (Solidity ≥0.6/0.8 syntax) that compiles and checks failures: - function withdraw(uint amount) public {
- accountBalances[msg.sender] -= amount;
- msg.sender.call.value(amount);
- }
+ function withdraw(uint256 amount) public {
+ require(accountBalances[msg.sender] >= amount, "insufficient");
+ accountBalances[msg.sender] -= amount; // effects before interaction
+ (bool ok, ) = msg.sender.call{value: amount}("");
+ require(ok, "ETH send failed");
+ }If you intentionally need this to remain an integer overflow/underflow sample on Solidity 0.8.x (for testing the audit engine), keep it compilable but vulnerable like so: - function withdraw(uint amount) public {
- accountBalances[msg.sender] -= amount;
- msg.sender.call.value(amount);
- }
+ function withdraw(uint256 amount) public {
+ unchecked { accountBalances[msg.sender] -= amount; } // intentional underflow
+ (bool ok, ) = msg.sender.call{value: amount}("");
+ require(ok, "ETH send failed");
+ }Is the vulnerability intentional for test corpora? If yes, use the “intentional” variant; otherwise, use the secure fix. Fix unchecked subtraction and invalid Ether send (critical) File: audit_engine/smart_contracts/integer_overflow/io54.sol Lines: 6-9
Apply secure fix (Solidity ≥0.6/0.8): - function withdraw(uint amount) public {
- accountBalances[msg.sender] -= amount;
- msg.sender.call.value(amount);
- }
+ function withdraw(uint256 amount) public {
+ require(accountBalances[msg.sender] >= amount, "insufficient");
+ accountBalances[msg.sender] -= amount; // effects before interaction
+ (bool ok, ) = msg.sender.call{value: amount}("");
+ require(ok, "ETH send failed");
+ }If this is intentionally vulnerable for test corpora, use the intentional variant: - function withdraw(uint amount) public {
- accountBalances[msg.sender] -= amount;
- msg.sender.call.value(amount);
- }
+ function withdraw(uint256 amount) public {
+ unchecked { accountBalances[msg.sender] -= amount; } // intentional underflow
+ (bool ok, ) = msg.sender.call{value: amount}("");
+ require(ok, "ETH send failed");
+ }Is the vulnerability intentional for test corpora? If yes, keep the intentional variant; otherwise apply the secure fix. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||
| } | ||||||||||||||||||||||
|
Comment on lines
+1
to
+10
There was a problem hiding this comment. 🧩 Analysis chainConfirm compiler target and legacy patterns across the added contracts. To avoid mixed syntaxes and non-compilable files in the suite, verify all new contracts in this folder consistently specify 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "List all integer_overflow contracts:"
fd -t f -e sol 'audit_engine/smart_contracts/integer_overflow'
echo
echo "Show pragma lines (missing ones will not show):"
rg -nP '^\s*pragma\s+solidity\b' -C0 audit_engine/smart_contracts/integer_overflow || true
echo
echo "Check for legacy call.value usage:"
rg -nP 'call\.value\s*\(' -C2 audit_engine/smart_contracts/integer_overflow || true
echo
echo "Check for modern call{value: ...} usage:"
rg -nP 'call\s*\{\s*value\s*:' -C2 audit_engine/smart_contracts/integer_overflow || trueLength of output: 522 🏁 Script executed: #!/bin/bash
set -euo pipefail
dir='audit_engine/smart_contracts/integer_overflow'
if [ ! -d "$dir" ]; then
echo "DIR_NOT_FOUND:$dir"
exit 0
fi
echo "SOL_FILES:"
find "$dir" -type f -name '*.sol' -print || true
echo
echo "PRAGMA LINES (file:line):"
rg -nP '^\s*pragma\s+solidity\b' -g "$dir/**" -S || true
echo
echo "LEGACY call.value occurrences (with context):"
rg -nP 'call\.value\s*\(' -g "$dir/**" -n -C2 || true
echo
echo "MODERN call{value: ...} occurrences (with context):"
rg -nP 'call\s*\{\s*value\s*:' -g "$dir/**" -n -C2 || true
echo
echo "transfer()/send() occurrences (with context):"
rg -nP '\.(transfer|send)\s*\(' -g "$dir/**" -n -C2 || true
echo
echo "HEADS of .sol files (first 20 lines each):"
while IFS= read -r file; do
echo "=== $file ==="
sed -n '1,20p' "$file" || true
echo
done < <(find "$dir" -type f -name '*.sol')Length of output: 10610 Add a consistent pragma and modernize Ether-transfer calls in audit_engine/smart_contracts/integer_overflow No pragma lines were found and multiple files use legacy call.value/.call.value (io25, io28, io29, io43, io45, io48, io49, io51, io52, io53, io54, io55, io56, io59, io60). These patterns will break with Solidity >=0.6 and are unsafe.
🤖 Prompt for AI Agents |
||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,12 @@ | ||||||||||||||||||
|
|
||||||||||||||||||
| contract LZLCoin { | ||||||||||||||||||
|
There was a problem hiding this comment. 🧩 Analysis chainMissing compiler pragma and SPDX; code may fail on modern compilers Without a pinned pragma, this can compile under 0.8.x where call.value syntax is invalid and arithmetic is checked, changing behavior. Pin an old compiler if the goal is demonstrating overflow. Add at the top of the file (outside the shown range): // SPDX-License-Identifier: UNLICENSED
pragma solidity 0.4.24;Verify your toolchain compiles with 0.4.x for all contracts in this directory. 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Showing file: audit_engine/smart_contracts/integer_overflow/io55.sol ==="
sed -n '1,200p' audit_engine/smart_contracts/integer_overflow/io55.sol || true
echo
echo "=== Search for pragma solidity in audit_engine ==="
rg -n --hidden "pragma solidity" audit_engine || true
echo
echo "=== Search for SPDX in audit_engine ==="
rg -n --hidden "SPDX" audit_engine || true
echo
echo "=== Search for call.value in audit_engine ==="
rg -n --hidden "call.value" audit_engine || trueLength of output: 8329 Add SPDX header and pin Solidity pragma to 0.4.24 audit_engine/smart_contracts/integer_overflow/io55.sol is missing an SPDX header and a pinned pragma; it uses legacy call.value and unchecked arithmetic which behave differently on modern (>=0.8.x) compilers. Add at the top of the file (outside the shown range): // SPDX-License-Identifier: UNLICENSED Verify your CI/toolchain compiles all contracts in audit_engine/smart_contracts with Solidity 0.4.x. 🤖 Prompt for AI Agents |
||||||||||||||||||
|
|
||||||||||||||||||
| mapping (address => uint) balances; | ||||||||||||||||||
|
|
||||||||||||||||||
| function eT(address _pd, uint _tkA) returns (bool) { | ||||||||||||||||||
| balances[msg.sender] = balances[msg.sender] - _tkA; | ||||||||||||||||||
| balances[_pd] = balances[_pd] + _tkA; | ||||||||||||||||||
|
Comment on lines
+6
to
+8
There was a problem hiding this comment. Integer underflow/overflow and missing balance checks Subtracting without a floor check and adding without overflow checks on uint enables classic wraparound bugs (Solidity <0.8). Add explicit balance/addr checks and explicit visibility. - function eT(address _pd, uint _tkA) returns (bool) {
- balances[msg.sender] = balances[msg.sender] - _tkA;
- balances[_pd] = balances[_pd] + _tkA;
+ function eT(address _pd, uint _tkA) public returns (bool) {
+ require(_pd != address(0), "recipient zero");
+ require(balances[msg.sender] >= _tkA, "insufficient balance");
+ balances[msg.sender] -= _tkA;
+ balances[_pd] += _tkA;📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||
| if (!msg.sender.call.value(_tkA)()) revert(); | ||||||||||||||||||
|
There was a problem hiding this comment. Unsafe low-level value transfer → reentrancy and gas-surface risk msg.sender.call.value(...) forwards all gas and is reentrancy-prone. Prefer pull-payments or, minimally for 0.4.x, transfer (reverts on failure). - if (!msg.sender.call.value(_tkA)()) revert();
+ msg.sender.transfer(_tkA);If this must stay intentionally vulnerable, ensure it’s isolated from production builds. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||
| return true; | ||||||||||||||||||
| } | ||||||||||||||||||
|
Comment on lines
+6
to
+11
There was a problem hiding this comment. Contract can’t hold Ether; send likely reverts There’s no payable function/fallback to fund the contract, so value transfers will revert unless Ether is force-sent. Add a payable funding path if you want this to execute. Example (for 0.4.x, outside this range): function () public payable {}🤖 Prompt for AI Agents |
||||||||||||||||||
| } | ||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,11 @@ | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| contract PrivateBank { | ||||||||||||||||||||||
|
Comment on lines
+1
to
+2
There was a problem hiding this comment. 🛠️ Refactor suggestion Pin compiler version and add SPDX. Current syntax targets 0.4.x; without pragma it may compile on 0.8.x, changing overflow behavior and/or failing to compile. +// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.4.26;
contract PrivateBank {📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||
|
|
||||||||||||||||||||||
| mapping (address => uint) public balances; | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| function CashOut(uint _am) { | ||||||||||||||||||||||
| if(msg.sender.call.value(_am)()){ | ||||||||||||||||||||||
| balances[msg.sender] -= _am; | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
|
Comment on lines
+6
to
+9
There was a problem hiding this comment. Fix reentrancy and integer underflow in CashOut (checks-effects-interactions).
Apply: - function CashOut(uint _am) {
- if(msg.sender.call.value(_am)()){
- balances[msg.sender] -= _am;
- }
- }
+ function CashOut(uint _am) public {
+ require(_am > 0, "amount=0");
+ require(balances[msg.sender] >= _am, "insufficient");
+ balances[msg.sender] -= _am; // effects first
+ msg.sender.transfer(_am); // interaction; reverts on failure
+ }📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||
| } | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,8 @@ | ||||||||||||
| contract BasicToken { | ||||||||||||
|
There was a problem hiding this comment. 🧩 Analysis chainAdd SPDX identifier and explicit compiler pragma to control overflow semantics Without a pragma, solc 0.8+ will insert checked math and this sample won’t be vulnerable; pre‑0.8 will allow wraparound. Pin the intent. Two options—pick one consistently across all 10 samples: Option A (pre‑0.8 wraparound, no unchecked needed): +// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.5.17;
+
contract BasicToken {Option B (0.8+ with unchecked to re‑enable wraparound): +// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.24;
+
contract BasicToken {
@@
- function transfer(uint256 _value) public returns (bool) {
- balances[msg.sender] = balances[msg.sender] - _value;
+ function transfer(uint256 _value) public returns (bool) {
+ unchecked {
+ balances[msg.sender] = balances[msg.sender] - _value;
+ }
return true;
}If these contracts are intentionally vulnerable, also add a header comment stating so. 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE="audit_engine/smart_contracts/integer_overflow/io57.sol"
echo "Checking file existence:"
if [ -f "$FILE" ]; then
echo "FOUND: $FILE"
else
echo "MISSING: $FILE"
exit 0
fi
echo
echo "---- head (1-200) ----"
sed -n '1,200p' "$FILE" || true
echo "---- grep for SPDX/pragma/unchecked/wraparound ----"
rg -n --hidden --no-ignore --line-number "(SPDX-License-Identifier|pragma solidity|unchecked|wraparound)" "$FILE" || true
echo
echo "---- repo-wide pragma summary (first match per file) ----"
rg -n --hidden --no-ignore --line-number "pragma solidity" -S | sed -n '1,50p' || trueLength of output: 533 Add SPDX identifier and explicit compiler pragma — pick one option consistently across samples audit_engine/smart_contracts/integer_overflow/io57.sol has no SPDX or pragma; subtraction semantics are ambiguous across compiler versions. Apply one of the options below. Option A (pre-0.8 wraparound): +// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.5.17;
+
contract BasicToken {Option B (0.8+ with unchecked to re-enable wraparound): +// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.24;
+
contract BasicToken {
@@
- function transfer(uint256 _value) public returns (bool) {
- balances[msg.sender] = balances[msg.sender] - _value;
+ function transfer(uint256 _value) public returns (bool) {
+ unchecked {
+ balances[msg.sender] = balances[msg.sender] - _value;
+ }
return true;
}Location: audit_engine/smart_contracts/integer_overflow/io57.sol — add SPDX/pragma at file top; for Option B wrap the subtraction in transfer() as shown. If the sample is intentionally vulnerable, add a header comment stating that. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||
| mapping(address => uint256) public balances; | ||||||||||||
|
|
||||||||||||
| function transfer(uint256 _value) public returns (bool) { | ||||||||||||
| balances[msg.sender] = balances[msg.sender] - _value; | ||||||||||||
| return true; | ||||||||||||
| } | ||||||||||||
| } | ||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,9 @@ | ||||||||||
| contract OysterPearl { | ||||||||||
|
There was a problem hiding this comment. 🛠️ Refactor suggestion Pin compiler version (<0.8) or use unchecked in >=0.8; add SPDX. For deterministic behavior and to actually exhibit the arithmetic underflow, pin to a pre-0.8 compiler. Also add an SPDX identifier to silence compiler warnings. Apply this (Option A: pre‑0.8, wrapping math): +// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.6.12;
contract OysterPearl {If you must target >=0.8, keep pragma at >=0.8 and wrap the subtraction in an unchecked block (see another comment). 📝 Committable suggestion
Suggested change
|
||||||||||
| uint256 public claimAmount; | ||||||||||
| mapping (address => uint256) public balanceOf; | ||||||||||
|
|
||||||||||
| function claim() public { | ||||||||||
| require(block.timestamp >= 60); | ||||||||||
| balanceOf[msg.sender] -= claimAmount; | ||||||||||
| } | ||||||||||
| } | ||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,10 @@ | ||||||||||||
|
|
||||||||||||
| contract TokenLab { | ||||||||||||
|
Comment on lines
+1
to
+2
There was a problem hiding this comment. Pin Solidity version to preserve intended vulnerability semantics Without a pragma, compiling on 0.8.x will make arithmetic checked (under/overflow revert) and this code won’t compile due to legacy constructs (e.g., +pragma solidity ^0.4.25;
contract TokenLab {📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||
|
|
||||||||||||
| mapping (address => mapping (address => uint)) public tokens; | ||||||||||||
|
|
||||||||||||
| function withdraw(uint amount) { | ||||||||||||
| tokens[0][msg.sender] = tokens[0][msg.sender] - amount; | ||||||||||||
| require(msg.sender.call.value(amount)()); | ||||||||||||
| } | ||||||||||||
|
Comment on lines
+6
to
+9
There was a problem hiding this comment. Integer underflow on balance subtraction (allows draining)
Apply checks and use -function withdraw(uint amount) {
- tokens[0][msg.sender] = tokens[0][msg.sender] - amount;
- require(msg.sender.call.value(amount)());
-}
+function withdraw(uint amount) public {
+ require(amount > 0);
+ uint balance = tokens[address(0)][msg.sender];
+ require(balance >= amount);
+ tokens[address(0)][msg.sender] = balance - amount;
+ msg.sender.transfer(amount);
+}Note: If this contract is intentionally vulnerable for test fixtures, keep the underflow as-is but consider the comments below to avoid confounding with other vuln types.
🤖 Prompt for AI Agents |
||||||||||||
| } | ||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,15 @@ | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| contract MoldCoin { | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
|
Comment on lines
+1
to
+3
There was a problem hiding this comment. 🧩 Analysis chainPin Solidity version to preserve intended semantics and avoid build breaks Without a pragma, toolchains may compile with 0.8+, breaking Apply: +pragma solidity 0.4.26;
contract MoldCoin {🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Showing top of file if it exists:"
if [ -f "audit_engine/smart_contracts/integer_overflow/io60.sol" ]; then
sed -n '1,120p' audit_engine/smart_contracts/integer_overflow/io60.sol || true
else
echo "File not found: audit_engine/smart_contracts/integer_overflow/io60.sol"
rg -n "io60.sol" || true
fiLength of output: 494 Add explicit Solidity pragma to pin compiler to 0.4.26 File lacks a pragma; without one modern compilers (0.8+) change overflow semantics and break old call.value usage — pin to 0.4.26. +pragma solidity 0.4.26;
contract MoldCoin {📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||
| address public founder; | ||||||||||||||||||||||||||
| uint public coinAllocation = 20 * 10**8 * 10**2; | ||||||||||||||||||||||||||
| uint public amountRaised = 0; | ||||||||||||||||||||||||||
| mapping(address => uint) balances; | ||||||||||||||||||||||||||
|
Comment on lines
+4
to
+7
There was a problem hiding this comment. Founder is never initialized — ETH will be forwarded to address(0) Forwarding to the zero address effectively burns funds. Apply: contract MoldCoin {
address public founder;
uint public coinAllocation = 20 * 10**8 * 10**2;
uint public amountRaised = 0;
mapping(address => uint) balances;
+ constructor() public {
+ founder = msg.sender;
+ }📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| function buyRecipient(address recipient) payable { | ||||||||||||||||||||||||||
| uint tokens = msg.value * block.timestamp; | ||||||||||||||||||||||||||
| balances[recipient] = balances[recipient] + tokens; | ||||||||||||||||||||||||||
| amountRaised = amountRaised + msg.value; | ||||||||||||||||||||||||||
| if (!founder.call.value(msg.value)()) revert(); | ||||||||||||||||||||||||||
|
There was a problem hiding this comment. Avoid low-level call.value; use transfer in 0.4.x to reduce reentrancy/gas pitfalls
- if (!founder.call.value(msg.value)()) revert();
+ founder.transfer(msg.value);If upgrading to 0.8.x later, use: 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
Comment on lines
+1
to
+15
There was a problem hiding this comment. 🧩 Analysis chainQuick repo check: ensure all new overflow fixtures compile under the intended compiler Verify all newly added contracts in this folder declare a 0.4.x pragma (or, if using 0.8.x intentionally, update syntax and wrap arithmetic in unchecked). 🏁 Script executed: #!/bin/bash
# Verify solidity pragmas and deprecated patterns across the new fixtures.
echo "Files without a pragma:"
rg -nP --type=sol '^\s*pragma\s+solidity' -C0 | sed 's/:.*//' | sort -u > /tmp/has_pragma.txt
fd -e sol audit_engine/smart_contracts/integer_overflow | sort -u | comm -23 - /tmp/has_pragma.txt || true
echo -e "\nOccurrences of deprecated call.value syntax (0.6+ incompatible):"
rg -nP --type=sol '\.call\.value\s*\(' -C2 audit_engine/smart_contracts/integer_overflow
echo -e "\nSolidity versions used:"
rg -nP --type=sol '^\s*pragma\s+solidity' -C0 audit_engine/smart_contracts/integer_overflow | sort -uLength of output: 684 🏁 Script executed: #!/bin/bash
set -euo pipefail
SOLDIR='audit_engine/smart_contracts/integer_overflow'
echo "Searching for .sol files under $SOLDIR"
files=$(find "$SOLDIR" -type f -name '*.sol' || true)
if [ -z "$files" ]; then
echo "No .sol files found"
exit 0
fi
for f in $files; do
echo "---- $f ----"
echo "Pragma lines:"
grep -nE '^\s*pragma\s+solidity' "$f" || echo " NONE"
echo "Deprecated .call.value occurrences:"
grep -n '\.call\.value' "$f" || echo " NONE"
echo "First 15 lines:"
sed -n '1,15p' "$f" || true
echo
doneLength of output: 27592 Quick repo check: add Solidity pragmas and fix deprecated .call.value usages in integer_overflow fixtures
|
||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Missing pragma directive and compiler version
The contract lacks a Solidity version pragma, making it vulnerable to compilation with different compiler versions that may have different overflow behaviors.
📝 Committable suggestion
🤖 Prompt for AI Agents