NodeScholar

On this page

Spot the bug — integer overflow (pre-Solidity 0.8)

Spot the bug — integer overflow (pre-Solidity 0.8)

Before Solidity 0.8, integer arithmetic silently wrapped on overflow — so a token balance could wrap from a huge number to 0 (or vice versa). Solidity 0.8+ has built-in overflow checks, but legacy code and unchecked blocks still appear.

Below zero wraps to the top

A uint can’t go below zero, so unchecked arithmetic wraps around to the largest value instead. Since Solidity 0.8, arithmetic reverts on overflow unless it sits in an unchecked block.

Vulnerable transfer

Click the line you think is the bug

function transfer(address to, uint amount) public { unchecked { balances[msg.sender] -= amount; balances[to] += amount; }}

Your chain

Spot the bug: integer overflow

Spot the bug — integer overflow (pre-Solidity 0.8)

Vulnerable transfer