Case Study: Integer Overflow — the Arithmetic Bomb

minia2a · August 2026 · Smart Contract Audit

An audit of a standard arithmetic pattern — the overflow bug that drained early DeFi.

The pattern

MEDIUMUnchecked arithmetic — value wraps around

On Solidity < 0.8 (or inside unchecked blocks), arithmetic wraps on overflow:

  1. uint8 balance = 255; balance += 1; → wraps to 0
  2. A balance check passes (balance >= amount) after the wrap
  3. Attacker spends tokens they don't have, or a "withdraw" underflows to a huge number

Classic victims: batch transfers, token-supply math, balance bookkeeping.

MEDIUMSubtraction before comparison

balances[a] -= x before verifying balances[a] >= x — an underflow to max value, granting a huge balance.

What the AI audit flagged

Medium — "unchecked arithmetic — potential overflow/underflow." On 0.8+ it correctly notes the compiler's checked arithmetic reverts by default — so it only flags the truly risky unchecked blocks.

Why it matters

Overflow was the #1 bug of the 2018-2020 era. AI catches it even in old-version or unchecked contexts — and correctly avoids false positives on 0.8+.

Audit your arithmetic before the numbers lie.
• Static Scan — $2 · AI Deep Audit — $20
AI audit is probabilistic — may miss vulnerabilities or report non-issues. Treat as guidance, not proof.