Integer Overflow
& Underflow Guide

Q: What is integer overflow in Solidity smart contracts?

Integer overflow occurs when an arithmetic operation produces a value larger than the maximum the variable type can hold, causing it to wrap around to zero (or minimum). In Solidity < 0.8.0, `uint8` overflowing 255 wraps to 0. Attackers exploit this to mint unlimited tokens or bypass balance checks.

Q: Does Solidity 0.8 prevent integer overflow automatically?

Yes — Solidity 0.8.0 introduced built-in overflow checks that revert the transaction on overflow or underflow. However, contracts using `unchecked {}` blocks, assembly, or third-party libraries compiled under older versions remain vulnerable. Always verify which Solidity version your contract uses.

Q: What is the difference between overflow and underflow in Solidity?

Overflow is when a value exceeds the maximum (e.g., uint256 max + 1 = 0). Underflow is when a value goes below the minimum (e.g., uint256(0) - 1 = 2^256-1). Both were exploited before Solidity 0.8. The Beauty Chain (BEC) token lost $900M in value to an overflow that minted billions of tokens.

Q: Has integer overflow caused real DeFi exploits?

Yes. Before Solidity 0.8, overflow bugs were common. The BEC token hack (2018) used a multiplication overflow to mint 2^255 tokens. The SMT token, PoWH Coin, and multiple ERC-20 tokens had similar issues. Even post-0.8, unchecked blocks and assembly still create exposure.

Q: How can I check my smart contract for integer overflow?

SmartContractAuditor.ai scans your contract for arithmetic operations in unchecked blocks, assembly sections, and older Solidity pragma declarations that disable automatic overflow protection. It flags operations where overflow or underflow could occur and recommends SafeMath usage or migration to Solidity 0.8+.

Integer overflow and underflow vulnerabilities occur when arithmetic operations exceed variable limits. Learn how they work and how to prevent them in your smart contracts.

Historical Impact: Integer overflow vulnerabilities have caused millions in losses, including the infamous BeautyChain (BEC) token incident where tokens were created from nothing.

What are Integer Overflow & Underflow?

Integer overflow occurs when an arithmetic operation results in a value larger than the maximum value that can be stored in the variable. The value "wraps around" to the minimum value. Underflow is the opposite - when a value becomes smaller than the minimum and wraps to the maximum.

How Integer Overflow Works

Overflow Example (uint256)

Maximum value: 2²⁵⁶ - 1 = 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,935
Maximum + 1 = 0 (wraps around)

Underflow Example (uint256)

Minimum value: 0
0 - 1 = 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,935 (wraps around)

Common Attack Scenarios

Token Balance Manipulation

• Underflow in transfer functions
• Creating tokens from nothing
• Balance corruption
• Supply manipulation

Financial Calculations

• Price calculation errors
• Interest rate overflows
• Fee calculation issues
• Reward distribution bugs

BeautyChain Attack: In April 2018, attackers exploited an integer overflow in the BeautyChain token contract to generate billions of tokens, crashing the token price to near zero.

Solidity Version Differences

Solidity < 0.8.0

• No built-in overflow protection
• Silent overflow/underflow
• Requires SafeMath library
• Manual checks needed

Solidity ≥ 0.8.0

• Built-in overflow protection
• Automatic revert on overflow
• SafeMath no longer needed
• Unchecked blocks available

Frequently Asked Questions

What is integer overflow in Solidity smart contracts?+

Integer overflow occurs when an arithmetic operation produces a value larger than the maximum the variable type can hold, causing it to wrap around to zero (or minimum). In Solidity < 0.8.0, `uint8` overflowing 255 wraps to 0. Attackers exploit this to mint unlimited tokens or bypass balance checks.

Does Solidity 0.8 prevent integer overflow automatically?+

Yes — Solidity 0.8.0 introduced built-in overflow checks that revert the transaction on overflow or underflow. However, contracts using `unchecked {}` blocks, assembly, or third-party libraries compiled under older versions remain vulnerable. Always verify which Solidity version your contract uses.

What is the difference between overflow and underflow in Solidity?+

Overflow is when a value exceeds the maximum (e.g., uint256 max + 1 = 0). Underflow is when a value goes below the minimum (e.g., uint256(0) - 1 = 2^256-1). Both were exploited before Solidity 0.8. The Beauty Chain (BEC) token lost $900M in value to an overflow that minted billions of tokens.

Has integer overflow caused real DeFi exploits?+

Yes. Before Solidity 0.8, overflow bugs were common. The BEC token hack (2018) used a multiplication overflow to mint 2^255 tokens. The SMT token, PoWH Coin, and multiple ERC-20 tokens had similar issues. Even post-0.8, unchecked blocks and assembly still create exposure.

How can I check my smart contract for integer overflow?+

SmartContractAuditor.ai scans your contract for arithmetic operations in unchecked blocks, assembly sections, and older Solidity pragma declarations that disable automatic overflow protection. It flags operations where overflow or underflow could occur and recommends SafeMath usage or migration to Solidity 0.8+.