Integer Overflow

It is possible to cause add and sub to overflow (or underflow) on any type of integer in Solidity.

Attack Scenarios

• Attacker has 5 of some ERC20 token. They spend 6, but because the token doesn't check for underflows, they wind up with 2^256 tokens.

• A contract contains a dynamic array and an unsafe pop method. An attacker can underflow the length of the array and alter other variables in the contract.

Mitigations

• Use openZeppelin's safeMath library
• Validate all arithmetic

Examples

• In integer_overflow_1, we give both unsafe and safe version of the add operation.

• A submission to the Underhanded Solidity Coding Contest that explots the unsafe dynamic array bug outlined above