Arithmetic Overflow & Underflow In Solidity#

📖 Definition#

• Overflow: Happens when a number exceeds the maximum value of its type and wraps back to zero (or the minimum value).
• Underflow: Happens when a number goes below zero and wraps around to the maximum possible value of its type.

Example with uint8#

1
uint8 x = 255;
2
x = x + 1;
3
// Overflow → wraps to 0

1
uint8 y = 0;
2
y = y - 1;
3
// Underflow → wraps to 255

Solidity Version Behavior#

• Before Solidity 0.8.0

  • Arithmetic operations do not revert.
  • Overflow/underflow wraps silently.
  • Developers used SafeMath library (OpenZeppelin) to catch errors.

• Solidity 0.8.0 and above

  • Arithmetic operations revert automatically on overflow/underflow.
  • You can still use unchecked { ... } to deliberately allow wraparound (usually for gas optimization).

Vulnerable Code (<0.8.0)#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.7.6;
3

4
contract OverflowUnderflowExample {
5
    uint8 public value;
6

7
    function add(uint8 _amount) public {
8
        // Vulnerable: silent overflow possible
9
        value += _amount;
10
    }
11

12
    function subtract(uint8 _amount) public {
13
        // Vulnerable: silent underflow possible
14
        value -= _amount;
15
    }
16
}

Safe Code (>=0.8.0)#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
contract SafeArithmetic {
5
    uint8 public value;
6

7
    function add(uint8 _amount) public {
8
        value += _amount; // reverts on overflow
9
    }
10

11
    function subtract(uint8 _amount) public {
12
        value -= _amount; // reverts on underflow
13
    }
14
}

Security Impact#

• Incorrect balances or counters.
• Ability for attackers to bypass logic.
• Potential infinite minting or balance inflation.

Recommendations#

• Always use Solidity >=0.8.0.
• For legacy contracts, use SafeMath.
• Review any unchecked { ... } usage carefully.

Key Notes#

• Overflow = “Too high → wraps to low.”
• Underflow = “Too low → wraps to high.”
• Modern Solidity handles checks automatically, but auditors must still confirm.