⚡ Thor Breaks Math - Arithmetic Overflow & Underflow in Solidity#

Executive Summary#

Arithmetic overflow and underflow are classic vulnerabilities that plagued Solidity contracts before version 0.8.0.

• Pre-0.8.0: Arithmetic was unchecked by default. Overflows/underflows silently wrapped.
• Post-0.8.0: Arithmetic is checked by default. Overflows/underflows revert, unless explicitly wrapped in an unchecked {} block.

This case study illustrates both versions through an MCU analogy:

• Hulk 🟢 (Overflow): Unlimited rage that cannot be contained in finite bounds.
• Iron Man Suit 🤖 (Underflow): Energy drained below zero, causing catastrophic wraparound.

🎬 Story Time - The Battle#

Thor ⚡️ enters the battlefield. His mission: test the limits of Hulk’s rage and Iron Man’s power suit.

• Round 1: HulkRageToken (Overflow) Thor pushes Hulk’s rage meter past its limits. At first, Hulk gets angrier, but once his rage exceeds the storage limit (uint8 = 255), it wraps around to a calm number. Thor laughs - the strongest Avenger has been tricked by math.

• Round 2: IronManSuit (Underflow) Thor drains the Iron Man suit’s energy beyond zero. Instead of shutting down, the suit glitches, overflowing into maximum power (2²⁵⁶ − 1). The suit explodes into chaos, handing Thor unlimited energy.

Vulnerable Contracts (Pre-0.8.0)#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.7.6;
3

4
// Example:
5
//   If rage[msg.sender] = 250 (uint8) and user calls getAngry(10),
6
//   result = 260 → wraps back to 4.
7
// This breaks logic, since Hulk's rage "resets" unexpectedly.
8
//
9
// ⚠️ Important for Auditors:
10
// - Overflow in <0.8.0 is silent and must be mitigated using SafeMath (OpenZeppelin).
11
// - From Solidity 0.8.0 onwards, overflow/underflow reverts by default,
12
//   unless explicitly wrapped in an `unchecked` block.
13

14
contract HulkRageToken {
15
    mapping(address => uint8) public rage;
16

17
    function getAngry(uint8 _increaseAmount) public {
18
        // Vulnerable: Silent overflow in <0.8.0.
19
        rage[msg.sender] += _increaseAmount;
20
    }
21
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.7.6;
3

4
// Example:
5
//   If energy[msg.sender] = 0 and user calls drainEnergy(100),
6
//   result = 0 - 100 → wraps to (2^256 - 100).
7
// This means Iron Man’s suit suddenly shows *massive* energy instead of depleting.
8
//
9
// ⚠️ Important for Auditors:
10
// - Underflow in <0.8.0 is silent and must be mitigated using SafeMath (OpenZeppelin).
11
// - From Solidity 0.8.0 onwards, subtraction below zero reverts by default,
12
//   unless explicitly wrapped in an `unchecked` block.
13

14
contract IronManSuit {
15
    mapping(address => uint256) public energy;
16

17
    constructor() {
18
        energy[msg.sender] = 1000;
19
    }
20

21
    function drainEnergy(uint256 _drainAmount) public {
22
        // Vulnerable: Silent underflow in <0.8.0.
23
        energy[msg.sender] -= _drainAmount;
24
    }
25
}

Vulnerable Contracts (Post-0.8.0 with unchecked)#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
/*
5
 * Demonstrates an arithmetic **overflow** vulnerability.
6
 *
7
 * Example:
8
 *   rage[user] = 250
9
 *   user calls getAngry(10)
10
 *   250 + 10 = 260 → exceeds max(255)
11
 *   Wraparound: 260 - 256 = 4
12
 *   Final rage = 4 instead of reverting
13
 *
14
 * Why it’s bad:
15
 * - Any logic depending on `rage` (rewards, checks, thresholds)
16
 *   can be bypassed or broken.
17
 */
18
contract HulkRageToken {
19
    // Rage levels stored per address (uint8 = 0–255 max).
20
    mapping(address => uint8) public rage;
21

22
    /*
23
     * Increase caller’s rage.
24
     *
25
     * ⚠️ Vulnerability:
26
     * - `unchecked { ... }` disables overflow protection.
27
     * - If addition > 255, value wraps back to 0–255.
28
     */
29
    function getAngry(uint8 _increaseAmount) public {
30
        unchecked {
31
            rage[msg.sender] += _increaseAmount;
32
        }
33
    }
34
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3
/*
4
 * Demonstrates an arithmetic **underflow** vulnerability.
5
 *
6
 * Example:
7
 *   energy[user] = 0
8
 *   user calls drainEnergy(100)
9
 *   0 - 100 = -100 (invalid for uint256)
10
 *   Wraparound: uint256 max (2^256 - 1) - 99
11
 *   Final energy = 115792089237316195423570985008687907853269984665640564039457584007913129639935
12
 *
13
 * Why it’s bad:
14
 * - Attacker can convert a zero balance into an **enormous value**.
15
 * - Breaks tokenomics, supply constraints, or game mechanics.
16
 */
17
contract IronManSuit {
18
    // Each address has an energy balance (uint256 can hold huge numbers).
19
    mapping(address => uint256) public energy;
20

21
    constructor() {
22
        // Deployer starts with some energy.
23
        energy[msg.sender] = 1000;
24
    }
25

26
    /*
27
     * Drain caller’s energy.
28
     *
29
     * ⚠️ Vulnerability:
30
     * - No check if user has enough energy.
31
     * - Underflow causes wraparound to a massive value.
32
     */
33
    function drainEnergy(uint256 _drainAmount) public {
34
        unchecked {
35
            energy[msg.sender] -= _drainAmount;
36
        }
37
    }
38
}

Proof of Exploit#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
import {HulkRageToken} from "./Post/HulkRageToken.sol";
5
import {IronManSuit} from "./Post/IronManSuit.sol";
6

7
contract ThorBreaker {
8
    HulkRageToken public hulk;
9
    IronManSuit public ironMan;
10

11
    constructor(address _hulk, address _ironMan) {
12
        hulk = HulkRageToken(_hulk);
13
        ironMan = IronManSuit(_ironMan);
14
    }
15

16
    function breakHulk() external {
17
        // Step 1: Increase rage close to max (255)
18
        hulk.getAngry(250); // rage = 250
19

20
        // Step 2: Trigger overflow
21
        // 250 + 10 = 260 → wraps to 4
22
        hulk.getAngry(10);
23
    }
24

25
    function breakIronMan() external {
26
        // Step 1: Start with energy = 0
27
        // Step 2: Drain 100 → underflow to 2^256 - 100
28
        ironMan.drainEnergy(100);
29
    }
30
}

Foundry Test Example (ThorBreakerTest.t.sol)#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

5 collapsed lines
4
import {Test} from "forge-std/Test.sol";
5
import {HulkRageToken} from "../src/HulkRageToken.sol";
6
import {IronManSuit} from "../src/IronManSuit.sol";
7
import {ThorBreaker} from "../src/ThorBreaker.sol";
8

9
contract ThorBreakerTest is Test {
10
    HulkRageToken hulk;
11
    IronManSuit ironMan;
12
    ThorBreaker thor;
13

14
    function setUp() public {
15
        hulk = new HulkRageToken();
16
        ironMan = new IronManSuit();
17
        thor = new ThorBreaker(address(hulk), address(ironMan));
18
    }
19

20
    function test_Break_Hulk() public {
21
        thor.breakHulk();
22
        uint8 finalRage = hulk.rage(address(thor));
23
        assertEq(finalRage, 4, "Overflow exploit failed");
24
    }
25

26
    function test_Break_IronMan() public {
27
        thor.breakIronMan();
28
        uint256 finalEnergy = ironMan.energy(address(thor));
29
        assertEq(finalEnergy, type(uint256).max - 99, "Underflow exploit failed");
30
    }
31
}

1
forge test -vv

1
[PASS] test_Break_Hulk() (gas: xxxx)
2
[PASS] test_Break_Iron-Man() (gas: xxxx)

Fixed Contracts#

1
// SPDX-License-Identifier: MIT
2
 pragma solidity ^0.8.24; // updated version
3

4
contract HulkRageTokenFixed {
5
    mapping(address => uint8) public rage;
6

7
    function getAngry(uint8 _increaseAmount) public {
8
        rage[msg.sender] += _increaseAmount; //  Checked by default
9
    }
10
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24; // updated version
3

4
contract IronManSuitFixed {
5
    mapping(address => uint256) public energy;
6

7
    constructor() {
8
        energy[msg.sender] = 1000;
9
    }
10

11
    function drainEnergy(uint256 _drainAmount) public {
12
        require(energy[msg.sender] >= _drainAmount, "Not enough energy");
13
        energy[msg.sender] -= _drainAmount;
14
    }
15
}

Auditor’s Checklist#

• Using Solidity <0.8.0 (unchecked arithmetic by default)?
• Any explicit unchecked blocks in 0.8+ without proper validation?
• Missing require() checks on subtraction?
• Edge cases tested for 0 and max(uintX) values?

Severity & Impact#

• Overflow (HulkRageToken) Severity: High – can bypass logic checks.

• Underflow (IronManSuit) Severity: Critical – attacker can gain massive balances.

Business Risk: Broken tokenomics, infinite balances, game-breaking logic, financial loss.

Recommendations#

• Always use Solidity ≥0.8.0 where safe math is default.
• Avoid unchecked unless gas-optimized and justified.
• Validate inputs before subtraction.
• For legacy code (<0.8.0): use OpenZeppelin SafeMath.
• Test edge cases thoroughly.

Challenge: Break Thor’s Math! ⚡#

Challenge Name: Hulk vs. Iron Man’s Arithmetic Bug

• Description: Prove you can push Solidity’s limits like the God of Thunder! Exploit the arithmetic vulnerabilities in the Hulk and Iron Man contracts.

Quiz: Test Your Understanding#

1. What is the primary difference in arithmetic behavior between Solidity <0.8.0 and Solidity ≥0.8.0?

• a) In <0.8.0, division by zero reverts; in ≥0.8.0, it returns zero.

• b) In <0.8.0, overflow/underflow reverts; in ≥0.8.0, it silently wraps around.

• c) In <0.8.0, arithmetic silently wraps; in ≥0.8.0, it reverts by default.

• d) In <0.8.0, uint is 32-bit; in ≥0.8.0, uint is 256-bit.

  Show Answer

  Answer: c) In <0.8.0, arithmetic silently wraps; in ≥0.8.0, it reverts by default.

  Explanation: Prior to 0.8.0, arithmetic was unchecked (silent wrapping). In 0.8.0 and later, arithmetic is checked by default, causing a revert on overflow/underflow, unless inside an unchecked {} block.

2. How does the underflow exploit in IronManSuit.sol (0.8.0 with unchecked) allow the attacker to gain a massive energy balance?

• a) Subtraction below zero causes the transaction to revert, protecting funds.

• b) The balance wraps around from 0 to a number close to 2²⁵⁶.

• c) The unchecked block temporarily changes the variable from uint256 to int256.

• d) The low balance triggers a bonus reward function.

  Show Answer

  Answer: b) The balance wraps around from 0 to a number close to 2²⁵⁶.

  Explanation: When an unsigned integer (uint) is subtracted below zero, it underflows and wraps around to the largest possible value, giving the attacker an enormous balance.

3. Which of the following is the most effective fix to prevent the underflow vulnerability in the drainEnergy function?

• a) Removing the unchecked {} block and using Solidity ≥0.8.0.

• b) Changing the energy variable from uint256 to uint8.

• c) Using the transfer() method instead of call() for all transactions.

• d) Making the energy mapping private.

  Show Answer

  Answer: a) Removing the unchecked {} block and using Solidity ≥0.8.0.

  Explanation: In Solidity ≥0.8.0, removing the unchecked {} block restores the default behavior of checked arithmetic, which causes the transaction to revert if the result is negative, thus preventing the underflow.

References#

• MCU: Thor: Ragnarok (2017) – Thor battles Hulk’s uncontrollable rage, and Iron Man’s armor glitches under stress. Perfect metaphors for overflow and underflow.

• Historical Exploits:

  1. BatchOverflow (2018) – A famous ERC20 vulnerability where multiplication overflow allowed attackers to mint unlimited tokens.

     • Root cause: Missing SafeMath checks in token logic.
     • Impact: Billions of tokens created out of thin air.
     • PeckShield Postmortem

  2. Rubixi Ponzi (2016) – Early contracts failed to account for safe arithmetic, enabling logic bypasses and unstable payouts.

  3. Fomo3D-style Games – Relied on countdowns and counters that were exploitable via wraparound if unchecked.

• Modern Fixes:

  • Solidity ≥0.8.0: Arithmetic checked by default - no silent overflow/underflow.
  • unchecked {}: Still dangerous if used carelessly.
  • OpenZeppelin SafeMath (pre-0.8.0): Historical go-to for preventing arithmetic bugs.

NOTE

Like Hulk’s uncontrollable rage and Iron Man’s unstable suit, unchecked arithmetic is dangerous. Modern Solidity makes it safer, but auditors must stay vigilant for legacy contracts and unsafe use of unchecked.

Ready to Battle Bugs?#

Join the Defi CTF Challenge! Audit vulnerable contracts in our Defi CTF Challenges (Full credit to Hans Friese, co-founder of Cyfrin.), submit your report via GitHub Issues/Discussions, or tag @THE_SANDF on X. Let’s secure the Web3 multiverse together! 🏗️ Start the Challenge